Refactor XRayMOD into a Secure VPN Infrastructure Control Plane

[Pakrohk]

Summary

This PR introduces a major architectural refactor of XRayMOD, moving the project from a traditional VPN/proxy panel model toward a Secure VPN Infrastructure Control Plane.

The new architecture clearly separates the control plane from the data plane, introduces an Edge Provider abstraction, establishes a Node Agent model, makes the Wizard the canonical deployment/orchestration path, and adds stronger security, policy, deployment, and CI infrastructure.

This PR also synchronizes the project with upstream 1.9.12 while preserving XRayMOD-specific architecture and security decisions.

Type of change

• Refactor
• Security hardening
• New infrastructure
• CI / deployment improvements
• Documentation
• Dependency / upstream synchronization

Architectural Changes

Control Plane / Data Plane separation

XRayMOD now explicitly distinguishes between:

• Control Plane

  • Cloudflare Worker
  • D1
  • Admin panel
  • API routes
  • Policies
  • Subscriptions
  • Node management
  • Onboarding and orchestration

• Data Plane

  • Xray / sing-box
  • User nodes
  • Gateways
  • Proxy traffic

The Worker is no longer treated as the VPN runtime. Its role is limited to infrastructure control, policy, orchestration, and edge-facing services.

Edge Provider abstraction

A new Edge Provider abstraction decouples XRayMOD from Cloudflare-specific implementation details.

Cloudflare is currently the first provider implementation, allowing future providers or infrastructure integrations to be introduced without coupling the core architecture directly to Cloudflare APIs.

Node Agent

A new Node Agent contract provides a structured way for managed nodes to:

• Authenticate securely
• Send heartbeats
• Pull configuration
• Report health
• Integrate with the control plane

The architecture keeps actual proxy/data-plane execution outside the Worker.

Wizard as the canonical orchestrator

The installation and deployment Wizard is now the primary orchestration surface.

It provides:

• Stateful deployment flow
• Capability discovery
• OAuth/PKCE support
• Remote deployment
• Rolling artifact deployment
• Node onboarding
• Configuration management

Legacy shell installers remain available for compatibility but are no longer treated as the primary installation path.

Security Improvements

This refactor introduces a dedicated security policy layer and strengthens several infrastructure boundaries:

• Node authentication using xrm_node_ bearer credentials
• Explicit control/data-plane separation
• Security policy engine
• Improved admin policy APIs
• Honest edge endpoint and origin-protection terminology
• Removal of misleading "clean IP" / stealth-as-camouflage claims
• Preservation of disguise and panel-path protections
• Reduced exposure of internal implementation details

Deployment & Release Infrastructure

The deployment workflow has been redesigned around reproducible rolling artifacts.

Added:

• publish-rolling.sh
• ship-panel.sh
• Rolling worker.mjs artifacts
• assets.tar.gz deployment flow
• run_worker_first deployment handling
• Automated rolling bundle publishing through GitHub Actions

The preferred production path now preserves existing D1 state and supports controlled panel updates.

CI Improvements

CI now validates the actual project surfaces instead of silently ignoring failures.

The pipeline now runs:

npm run lint
npm run build:ui
npm test

A dedicated rolling-bundle workflow was also added for publishing deployable artifacts.

Product & Repository Cleanup

This PR also removes deprecated product surfaces that no longer fit the new architecture:

• Telegram Mini App / TWA
• Telegram commerce/store
• Telegram bot integration
• telegram-bot/

These removals are intentional architectural decisions rather than simple file cleanup.

Legacy installer and compatibility code remains where required and is not permanently removed without an explicit cleanup decision.

Versioning

The canonical product version is now maintained through:

worker/lib/version.ts

Target product version:

1.9.12

This avoids conflicting legacy version identities across the repository.

Testing

The refactor has been validated through the project's main build and test surfaces:

npm run lint
npm run build:ui
npm test

Additional deployment and installer paths were reviewed as part of the migration.

Notes

This PR is intentionally larger than a conventional feature PR because it establishes the architectural foundation for the next phase of XRayMOD development.

The goal is not to add another layer around the existing panel, but to establish a cleaner and more scalable infrastructure model that can support future providers, managed nodes, policy enforcement, automated deployment, and additional control-plane capabilities without coupling them to the VPN data plane.