Aurel subscription service - excerpt of the live source (client-formats/formatter-server.mjs), 2026-10-26.
Code lines are unchanged; comments are shortened and lines naming internal hosts or ports are left out. The full module does not write request
paths, tokens, IP addresses or User-Agents to any log; its container log is capped at 2 x 1 MB and holds only
start-up and error lines.

------------------------------------------------------------------------------------------------------------------
/** Fixed-origin, policy-aware subscriptions. Never log paths, tokens or payloads. */

const PROTOCOL_LABELS=Object.freeze({vless:'VLESS REALITY',trojan:'Trojan',vmess:'VMess',shadowsocks:'Shadowsocks',hysteria2:'Hysteria2'});
const BASE_HEADERS=Object.freeze({'Cache-Control':'private, no-store, max-age=0',Pragma:'no-cache',Expires:'0','X-Content-Type-Options':'nosniff','Referrer-Policy':'no-referrer'});
// Clash-family cores (mihomo/Clash Meta, OpenClash on routers, Clash Verge, FlClash, Stash) cannot load a base64
// URI list as their main config. On the native paths they get the equivalent clash-meta YAML instead; an explicit
// non-v2ray native format is always honoured. The business validator's own User-Agent is not Clash-family.
const CLASH_UA=/clash|mihomo|stash/i,SINGBOX_UA=/sing-box|\bSF[AIMT]\//i;
// Shadowsocks and VMess are no longer served to anyone; VLESS REALITY + Hysteria2 is the default; Trojan (TLS) is
// added only where the client may lack REALITY.
const RETIRED=new Set(['shadowsocks','vmess']),RETIRED_FORMATS=Object.freeze({ss:'trojan',vmess:'trojan'});
const VALIDATOR_UA=/^Aurel-Subscription-Validation\//,LEGACY_CLASH_UA=/clash/i;
const MODERN_CLASH_UA=/meta|mihomo|verge|stash|flclash|nyanpasu|clash[ .-]?mi\b|clashmi/i;
const MODERN_LINK_UA=/shadowrocket|v2rayn|hiddify|nekobox|nekoray|streisand|v2box|foxray|karing|v2raytun|\bhapp\/|sing-box|\bSF[AIMT]\//i;

/** validator | legacy-clash | quantumult-x | surge | modern | unknown. The User-Agent is only read to pick a format. */
export function clientClass(userAgent){
 const ua=typeof userAgent==='string'?userAgent.slice(0,300):'';
 if(VALIDATOR_UA.test(ua))return'validator';
 if(LEGACY_CLASH_UA.test(ua)&&!MODERN_CLASH_UA.test(ua))return'legacy-clash';
 if(/quantumult/i.test(ua))return'quantumult-x';
 if(/surge/i.test(ua))return'surge';
 if(CLASH_UA.test(ua)||MODERN_LINK_UA.test(ua))return'modern';
 return'unknown';
}
export function trojanMode(format,userAgent){
 if(format==='quantumult-x')return'add';
 if(format!=='v2ray'&&format!=='clash-meta')return'none';
 const kind=clientClass(userAgent);
 if(kind==='legacy-clash')return format==='clash-meta'?'only':'add';
 return kind==='validator'||kind==='modern'?'none':'add';
}
export function nativeFormatFor(requested,userAgent){
 const ua=typeof userAgent==='string'?userAgent.slice(0,300):'';
 if(requested!==undefined&&requested!=='v2ray')return requested;
 if(CLASH_UA.test(ua))return'clash-meta';
 if(requested===undefined&&SINGBOX_UA.test(ua))return'sing-box';
 return'v2ray';
}
------------------------------------------------------------------------------------------------------------------