diff --git a/package-debian.sh b/package-debian.sh
index 32e9e620..e6aa31af 100644
--- a/package-debian.sh
+++ b/package-debian.sh
@@ -1,141 +1,167 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Require Debian base branch
-. /etc/os-release
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+ARCH_OVERRIDE=""
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
 
-case "${ID:-}" in
-  debian)
-    echo "Detected supported system: ${NAME:-$ID} ${VERSION_ID:-}"
-    ;;
-  *)
-    echo "Unsupported system: ${NAME:-unknown} (${ID:-unknown})."
-    echo "This script only supports: Debian."
-    exit 1
-    ;;
-esac
+MIN_KERNEL="6.12"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+OUTPUT_DIR="${HOME}/debbuild"
 
-# Kernel version
-MIN_KERNEL="6.11"
-CURRENT_KERNEL="$(uname -r)"
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
 
-lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$CURRENT_KERNEL" | sort -V | head -n1)"
+declare -a BUILT_DEBS=()
 
-if [[ "$lowest" != "$MIN_KERNEL" ]]; then
-    echo "Kernel $CURRENT_KERNEL is below $MIN_KERNEL"
-    exit 1
-fi
-
-echo "[OK] Kernel $CURRENT_KERNEL verified."
-
-# Config & Parse arguments
-VERSION_ARG="${1:-}"     # Pass version number like 7.13.8, or leave empty
-WITH_CORE="both"         # Default: bundle both xray+sing-box
-FORCE_NETCORE=0          # --netcore => skip archive bundle, use separate downloads
-ARCH_OVERRIDE=""         # --arch x64|arm64|all (optional compile target)
-BUILD_FROM=""            # --buildfrom 1|2|3 to select channel non-interactively
-
-# If the first argument starts with --, do not treat it as a version number
-if [[ "${VERSION_ARG:-}" == --* ]]; then
-  VERSION_ARG=""
-fi
-# Take the first non --* argument as version, discard it
-if [[ -n "${VERSION_ARG:-}" ]]; then shift || true; fi
-
-# Parse remaining optional arguments
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --with-core)     WITH_CORE="${2:-both}"; shift 2;;
-    --xray-ver)      XRAY_VER="${2:-}"; shift 2;;
-    --singbox-ver)   SING_VER="${2:-}"; shift 2;;
-    --netcore)       FORCE_NETCORE=1; shift;;
-    --arch)          ARCH_OVERRIDE="${2:-}"; shift 2;;
-    --buildfrom)     BUILD_FROM="${2:-}"; shift 2;;
-    *)
-      if [[ -z "${VERSION_ARG:-}" ]]; then VERSION_ARG="$1"; fi
-      shift;;
-  esac
-done
-
-# Conflict: version number AND --buildfrom cannot be used together
-if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
-  echo "You cannot specify both an explicit version and --buildfrom at the same time."
-  echo "        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+die() {
+  echo "$*" >&2
   exit 1
-fi
+}
 
-# Check and install dependencies
-host_arch="$(uname -m)"
-[[ "$host_arch" == "aarch64" || "$host_arch" == "x86_64" ]] || { echo "Only supports aarch64 / x86_64"; exit 1; }
+parse_args() {
+  local first_arg="${1:-}"
 
-install_ok=0
-
-if command -v apt-get >/dev/null 2>&1; then
-  sudo apt-get update
-  sudo apt-get -y install \
-    curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
-    desktop-file-utils xdg-utils wget
-
-  if [[ "$host_arch" == "aarch64" ]]; then
-    sudo dpkg --add-architecture amd64 || true
-    sudo apt-get update
-    sudo apt-get -y install \
-      libc6:amd64 libgcc-s1:amd64 libstdc++6:amd64 zlib1g:amd64 libfontconfig1:amd64
-  elif [[ "$host_arch" == "x86_64" ]]; then
-    sudo dpkg --add-architecture arm64 || true
-    sudo apt-get update
-    sudo apt-get -y install \
-      libc6:arm64 libgcc-s1:arm64 libstdc++6:arm64 zlib1g:arm64 libfontconfig1:arm64
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
   fi
 
-  # Install .NET SDK 8 via official script
-  wget -q https://dot.net/v1/dotnet-install.sh
-  chmod +x dotnet-install.sh
-  ./dotnet-install.sh --channel 8.0 --install-dir "$HOME/.dotnet"
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --arch)        ARCH_OVERRIDE="${2:-}"; shift 2 ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
 
-  export PATH="$HOME/.dotnet:$PATH"
-  export DOTNET_ROOT="$HOME/.dotnet"
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
 
-  dotnet --info >/dev/null 2>&1 && install_ok=1
-fi
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
 
-if [[ "$install_ok" -ne 1 ]]; then
-  echo "Could not auto-install dependencies for '$ID'. Make sure these are available:"
-  echo "dotnet-sdk 8.x, curl, unzip, tar, rsync, git, dpkg-deb, desktop-file-utils, xdg-utils"
-  exit 1
-fi
+  . /etc/os-release
 
-# Root directory
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-cd "$SCRIPT_DIR"
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
 
-# Git submodules (best effort)
-if [[ -f .gitmodules ]]; then
-  git submodule sync --recursive || true
-  git submodule update --init --recursive || true
-fi
+  case "$OS_ID" in
+    debian)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: Debian."
+      ;;
+  esac
 
-# Locate project
-PROJECT="v2rayN.Desktop/v2rayN.Desktop.csproj"
-if [[ ! -f "$PROJECT" ]]; then
-  PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
-fi
-[[ -f "$PROJECT" ]] || { echo "v2rayN.Desktop.csproj not found"; exit 1; }
+  case "$HOST_ARCH" in
+    x86_64|aarch64) ;;
+    *) die "Only supports aarch64 / x86_64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local foreign_arch=""
+
+  mkdir -p "$OUTPUT_DIR"
+
+  if command -v apt-get >/dev/null 2>&1; then
+    sudo apt-get update
+    sudo apt-get -y install \
+      curl unzip tar jq rsync ca-certificates git dpkg-dev fakeroot file \
+      desktop-file-utils xdg-utils wget
+
+    case "$HOST_ARCH" in
+      aarch64) foreign_arch="amd64" ;;
+      x86_64)  foreign_arch="arm64" ;;
+      *)       die "Only supports aarch64 / x86_64" ;;
+    esac
+
+    sudo dpkg --add-architecture "$foreign_arch" || true
+    sudo apt-get update
+    sudo apt-get -y install \
+      "libc6:${foreign_arch}" \
+      "libgcc-s1:${foreign_arch}" \
+      "libstdc++6:${foreign_arch}" \
+      "zlib1g:${foreign_arch}" \
+      "libfontconfig1:${foreign_arch}"
+
+    wget -q https://dot.net/v1/dotnet-install.sh
+    chmod +x dotnet-install.sh
+    ./dotnet-install.sh --channel 10.0.1xx --install-dir "$HOME/.dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    dotnet --info >/dev/null 2>&1 && install_ok=1
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-sdk 10.x, curl, unzip, tar, rsync, git, dpkg-deb, desktop-file-utils, xdg-utils"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
 
 choose_channel() {
-  # If --buildfrom provided, map it directly and skip interaction.
+  local ch="latest"
+  local sel=""
+
   if [[ -n "${BUILD_FROM:-}" ]]; then
     case "$BUILD_FROM" in
-      1) echo "latest"; return 0;;
-      2) echo "prerelease"; return 0;;
-      3) echo "keep"; return 0;;
-      *) echo "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." >&2; exit 1;;
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
     esac
   fi
 
-  # Print menu to stderr and read from /dev/tty so stdout only carries the token.
-  local ch="latest" sel=""
-
   if [[ -t 0 ]]; then
     echo "[?] Choose v2rayN release channel:" >&2
     echo "    1) Latest (stable)  [default]" >&2
@@ -166,28 +192,35 @@ get_latest_tag_prerelease() {
     | sed 's/^v//'
 }
 
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
 git_try_checkout() {
-  local want="$1" ref=""
+  local want="$1"
+  local ref=""
+
   if git rev-parse --git-dir >/dev/null 2>&1; then
     git fetch --tags --force --prune --depth=1 || true
-    if git rev-parse "refs/tags/${want}" >/dev/null 2>&1; then
-      ref="${want}"
-    fi
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
     if [[ -n "$ref" ]]; then
       echo "[OK] Found ref '${ref}', checking out..."
-      git checkout -f "${ref}"
-      if [[ -f .gitmodules ]]; then
-        git submodule sync --recursive || true
-        git submodule update --init --recursive || true
-      fi
+      git checkout -f "$ref"
+      sync_submodules
       return 0
     fi
   fi
+
   return 1
 }
 
 apply_channel_or_keep() {
-  local ch="$1" tag
+  local ch="$1"
+  local tag=""
 
   if [[ "$ch" == "keep" ]]; then
     echo "[*] Keep current repository state (no checkout)."
@@ -197,99 +230,154 @@ apply_channel_or_keep() {
   fi
 
   echo "[*] Resolving ${ch} tag from GitHub releases..."
-  if [[ "$ch" == "prerelease" ]]; then
-    tag="$(get_latest_tag_prerelease || true)"
-  else
-    tag="$(get_latest_tag_latest || true)"
-  fi
 
-  [[ -n "$tag" ]] || { echo "Failed to resolve latest tag for channel '${ch}'."; exit 1; }
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
   echo "[*] Latest tag for '${ch}': ${tag}"
-  git_try_checkout "$tag" || { echo "Failed to checkout '${tag}'."; exit 1; }
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
   VERSION="${tag#v}"
 }
 
-if git rev-parse --git-dir >/dev/null 2>&1; then
-  if [[ -n "${VERSION_ARG:-}" ]]; then
-    clean_ver="${VERSION_ARG#v}"
-    if git_try_checkout "$clean_ver"; then
-      VERSION="$clean_ver"
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
     else
-      echo "[WARN] Tag '${VERSION_ARG}' not found."
-      ch="$(choose_channel)"
-      apply_channel_or_keep "$ch"
+      apply_channel_or_keep "$(choose_channel)"
     fi
   else
-    ch="$(choose_channel)"
-    apply_channel_or_keep "$ch"
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
   fi
-else
-  echo "Current directory is not a git repo; proceeding on current tree."
-  VERSION="${VERSION_ARG:-0.0.0}"
-fi
 
-VERSION="${VERSION#v}"
-echo "[*] GUI version resolved as: ${VERSION}"
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-x64)   echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip" ;;
+    linux-arm64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip" ;;
+    *)           return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-x64)   echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz" ;;
+    linux-arm64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz" ;;
+    *)           return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-x64)   echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip" ;;
+    linux-arm64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip" ;;
+    *)           return 1 ;;
+  esac
+}
 
 download_xray() {
-  local outdir="$1" rid="$2" ver="${XRAY_VER:-}" url tmp zipname="xray.zip"
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
   mkdir -p "$outdir"
+
   if [[ -z "$ver" ]]; then
     ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
-        | grep -Eo '"tag_name":\s*"v[^"]+"' | sed -E 's/.*"v([^"]+)".*/\1/' | head -n1)" || true
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
   fi
+
   [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
-  if [[ "$rid" == "linux-arm64" ]]; then
-    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-arm64-v8a.zip"
-  else
-    url="https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-64.zip"
-  fi
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
   echo "[+] Download xray: $url"
+
   tmp="$(mktemp -d)"
-  curl -fL "$url" -o "$tmp/$zipname"
-  unzip -q "$tmp/$zipname" -d "$tmp"
-  install -m 755 "$tmp/xray" "$outdir/xray"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
   rm -rf "$tmp"
 }
 
 download_singbox() {
-  # Download sing-box
-  local outdir="$1" rid="$2" ver="${SING_VER:-}" url tmp tarname="singbox.tar.gz" bin cronet
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
   mkdir -p "$outdir"
+
   if [[ -z "$ver" ]]; then
     ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
       | grep -Eo '"tag_name":\s*"v[^"]+"' \
       | sed -E 's/.*"v([^"]+)".*/\1/' \
       | head -n1)" || true
   fi
+
   [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
-  if [[ "$rid" == "linux-arm64" ]]; then
-    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-arm64.tar.gz"
-  else
-    url="https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-amd64.tar.gz"
-  fi
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
   echo "[+] Download sing-box: $url"
+
   tmp="$(mktemp -d)"
-  curl -fL "$url" -o "$tmp/$tarname"
-  tar -C "$tmp" -xzf "$tmp/$tarname"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
   bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
   [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
-  install -m 755 "$bin" "$outdir/sing-box"
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
   cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
-  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
   rm -rf "$tmp"
 }
 
 unify_geo_layout() {
   local outroot="$1"
-  mkdir -p "$outroot/bin"
+  local n
   local names=(
-    "geosite.dat"
-    "geoip.dat"
-    "geoip-only-cn-private.dat"
-    "Country.mmdb"
-    "geoip.metadb"
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
   )
+
+  mkdir -p "$outroot/bin"
+
   for n in "${names[@]}"; do
     if [[ -f "$outroot/bin/xray/$n" ]]; then
       mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
@@ -301,52 +389,44 @@ download_geo_assets() {
   local outroot="$1"
   local bin_dir="$outroot/bin"
   local srss_dir="$bin_dir/srss"
+  local f=""
+
   mkdir -p "$bin_dir" "$srss_dir"
 
   echo "[+] Download Xray Geo to ${bin_dir}"
-  curl -fsSL -o "$bin_dir/geosite.dat" \
-    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
-  curl -fsSL -o "$bin_dir/geoip.dat" \
-    "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
-  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" \
-    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
-  curl -fsSL -o "$bin_dir/Country.mmdb" \
-    "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
 
   echo "[+] Download sing-box rule DB & rule-sets"
-  curl -fsSL -o "$bin_dir/geoip.metadb" \
-    "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" || true
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
 
-  for f in \
-    geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs \
-    geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
-    curl -fsSL -o "$srss_dir/$f" \
-      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geoip/$f" || true
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
   done
 
-  for f in \
-    geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs \
-    geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
-    curl -fsSL -o "$srss_dir/$f" \
-      "https://raw.githubusercontent.com/2dust/sing-box-rules/rule-set-geosite/$f" || true
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
   done
 
   unify_geo_layout "$outroot"
 }
 
-download_v2rayn_bundle() {
-  local outroot="$1" rid="$2"
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
   local url=""
-  if [[ "$rid" == "linux-arm64" ]]; then
-    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-arm64.zip"
-  else
-    url="https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-64.zip"
-  fi
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
   echo "[+] Try v2rayN bundle archive: $url"
-  local tmp zipname
-  tmp="$(mktemp -d)"; zipname="$tmp/v2rayn.zip"
-  curl -fL "$url" -o "$zipname" || { echo "[!] Bundle download failed"; return 1; }
-  unzip -q "$zipname" -d "$tmp" || { echo "[!] Bundle unzip failed"; return 1; }
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
 
   if [[ -d "$tmp/bin" ]]; then
     mkdir -p "$outroot/bin"
@@ -358,7 +438,6 @@ download_v2rayn_bundle() {
   rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
   find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
 
-  local nested_dir
   nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
   if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
     mkdir -p "$outroot/bin"
@@ -366,90 +445,71 @@ download_v2rayn_bundle() {
     rm -rf "$nested_dir"
   fi
 
-  # Unify to bin/
   unify_geo_layout "$outroot"
+  rm -rf "$tmp"
 
   echo "[+] Bundle extracted to $outroot"
 }
 
-BUILT_DEBS=()
-BUILT_ALL=0
-OUTPUT_DIR="$HOME/debbuild"
-mkdir -p "$OUTPUT_DIR"
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
 
-build_for_arch() {
-  local short="$1"
-  local rid deb_arch outdir_name
-  case "$short" in
-    x64)   rid="linux-x64";   deb_arch="amd64"; outdir_name="amd64" ;;
-    arm64) rid="linux-arm64"; deb_arch="arm64"; outdir_name="arm64" ;;
-    *) echo "Unknown arch '$short' (use x64|arm64)"; return 1 ;;
-  esac
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
 
-  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
 
-  dotnet clean "$PROJECT" -c Release
-  rm -rf "$(dirname "$PROJECT")/bin/Release/net8.0" || true
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
 
-  dotnet restore "$PROJECT"
-  dotnet publish "$PROJECT" \
-    -c Release -r "$rid" \
-    -p:PublishSingleFile=false \
-    -p:SelfContained=true
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
 
-  local RID_DIR="$rid"
-  local PUBDIR
-  PUBDIR="$(dirname "$PROJECT")/bin/Release/net8.0/${RID_DIR}/publish"
-  [[ -d "$PUBDIR" ]] || { echo "Publish directory not found: $PUBDIR"; return 1; }
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
 
-  local WORKDIR PKGROOT STAGE DEBIAN_DIR
-  WORKDIR="$(mktemp -d)"
-  PKGROOT="v2rayN-publish"
-  STAGE="$WORKDIR/${PKGROOT}_${VERSION}_${deb_arch}"
-  DEBIAN_DIR="$STAGE/DEBIAN"
-
-  mkdir -p "$STAGE/opt/v2rayN"
-  mkdir -p "$STAGE/usr/bin"
-  mkdir -p "$STAGE/usr/share/applications"
-  mkdir -p "$STAGE/usr/share/icons/hicolor/256x256/apps"
-  mkdir -p "$DEBIAN_DIR"
-
-  # Stage publish content from source build
-  cp -a "$PUBDIR/." "$STAGE/opt/v2rayN/"
-
-  local ICON_CANDIDATE
-  PROJECT_DIR="$(cd "$(dirname "$PROJECT")" && pwd)"
-  ICON_CANDIDATE="$PROJECT_DIR/v2rayN.png"
-  [[ -f "$ICON_CANDIDATE" ]] && cp "$ICON_CANDIDATE" "$STAGE/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
-
-  mkdir -p "$STAGE/opt/v2rayN/bin/xray" "$STAGE/opt/v2rayN/bin/sing_box"
-
-  fetch_separate_cores_and_rules() {
-    local outroot="$1"
-
-    if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
-      download_xray "$outroot/bin/xray" "$RID_DIR" || echo "[!] xray download failed (skipped)"
-    fi
-    if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
-      download_singbox "$outroot/bin/sing_box" "$RID_DIR" || echo "[!] sing-box download failed (skipped)"
-    fi
-    download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
-  }
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
 
   if [[ "$FORCE_NETCORE" -eq 0 ]]; then
-    if download_v2rayn_bundle "$STAGE/opt/v2rayN" "$RID_DIR"; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
       echo "[*] Using v2rayN bundle bin assets."
     else
       echo "[*] Bundle failed, fallback to separate core + rules."
-      fetch_separate_cores_and_rules "$STAGE/opt/v2rayN"
+      populate_assets_netcore_mode "$outroot" "$rid"
     fi
   else
     echo "[*] --netcore specified: use separate core + rules."
-    fetch_separate_cores_and_rules "$STAGE/opt/v2rayN"
+    populate_assets_netcore_mode "$outroot" "$rid"
   fi
+}
 
-  # Wrapper
-  install -m 755 /dev/stdin "$STAGE/usr/bin/v2rayn" <<'EOF'
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    x64)   printf '%s\n%s\n' "linux-x64" "amd64" ;;
+    arm64) printf '%s\n%s\n' "linux-arm64" "arm64" ;;
+    *)     echo "Unknown arch '$short' (use x64|arm64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_launcher_file() {
+  local stage="$1"
+
+  install -m 755 /dev/stdin "$stage/usr/bin/v2rayn" <<'EOF'
 #!/usr/bin/env bash
 set -euo pipefail
 DIR="/opt/v2rayN"
@@ -469,12 +529,90 @@ echo "v2rayN launcher: no executable found in $DIR" >&2
 ls -l "$DIR" >&2 || true
 exit 1
 EOF
+}
 
-  SHLIBS_DEPENDS=""
-  EXTRA_DEPENDS="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+write_desktop_file() {
+  local stage="$1"
 
-  mkdir -p "$WORKDIR/debian"
-  cat > "$WORKDIR/debian/control" <<EOF
+  install -m 644 /dev/stdin "$stage/usr/share/applications/v2rayn.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Debian GNU Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+}
+
+write_maintainer_scripts() {
+  local debian_dir="$1"
+
+  install -m 755 /dev/stdin "$debian_dir/postinst" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+
+  install -m 755 /dev/stdin "$debian_dir/postrm" <<'EOF'
+#!/bin/sh
+set -e
+update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
+fi
+exit 0
+EOF
+}
+
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local deb_arch="$3"
+  local pubdir=""
+  local workdir=""
+  local stage=""
+  local debian_dir=""
+  local project_dir=""
+  local icon_candidate=""
+  local shlibs_depends=""
+  local extra_depends=""
+  local final_depends=""
+  local multiarch=""
+  local sys_libdir=""
+  local sys_usrlibdir=""
+  local deb_out=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  stage="$workdir/${PKGROOT}_${VERSION}_${deb_arch}"
+  debian_dir="$stage/DEBIAN"
+
+  mkdir -p "$stage/opt/v2rayN" "$stage/usr/bin" "$stage/usr/share/applications" "$stage/usr/share/icons/hicolor/256x256/apps" "$debian_dir"
+  cp -a "$pubdir/." "$stage/opt/v2rayN/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] && cp "$icon_candidate" "$stage/usr/share/icons/hicolor/256x256/apps/v2rayn.png" || true
+
+  stage_runtime_assets "$stage/opt/v2rayN" "$rid"
+  write_launcher_file "$stage"
+  write_desktop_file "$stage"
+  write_maintainer_scripts "$debian_dir"
+
+  extra_depends="libc6 (>= 2.34), fontconfig (>= 2.13.1), desktop-file-utils (>= 0.26), xdg-utils (>= 1.1.3), coreutils (>= 8.32), bash (>= 5.1), libfreetype6 (>= 2.11)"
+
+  mkdir -p "$workdir/debian"
+  cat > "$workdir/debian/control" <<EOF
 Source: v2rayn
 Section: net
 Priority: optional
@@ -486,55 +624,41 @@ Architecture: ${deb_arch}
 Description: v2rayN
 EOF
 
-  local SYS_LIBDIR=""
-  local SYS_USRLIBDIR=""
   multiarch="$(dpkg-architecture -a"$deb_arch" -qDEB_HOST_MULTIARCH)"
+  sys_libdir="/lib/$multiarch"
+  sys_usrlibdir="/usr/lib/$multiarch"
 
-  SYS_LIBDIR="/lib/$multiarch"
-  SYS_USRLIBDIR="/usr/lib/$multiarch"
+  : > "$debian_dir/substvars"
 
-  : > "$DEBIAN_DIR/substvars"
   mapfile -t ELF_FILES < <(
-    find "$STAGE/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
+    find "$stage/opt/v2rayN" -type f \( -name "*.so*" -o -perm -111 \) ! -name 'libcoreclrtraceptprovider.so'
   )
+
   if [[ "${#ELF_FILES[@]}" -gt 0 ]]; then
     (
-      cd "$WORKDIR"
+      cd "$workdir"
       dpkg-shlibdeps \
-        -l"$STAGE/opt/v2rayN" \
-        -l"$SYS_LIBDIR" \
-        -l"$SYS_USRLIBDIR" \
-        -T"$DEBIAN_DIR/substvars" \
+        -l"$stage/opt/v2rayN" \
+        -l"$sys_libdir" \
+        -l"$sys_usrlibdir" \
+        -T"$debian_dir/substvars" \
         "${ELF_FILES[@]}"
     ) >/dev/null 2>&1 || true
   fi
 
-  SHLIBS_DEPENDS="$(sed -n 's/^shlibs:Depends=//p' "$DEBIAN_DIR/substvars" | head -n1 || true)"
+  shlibs_depends="$(sed -n 's/^shlibs:Depends=//p' "$debian_dir/substvars" | head -n1 || true)"
 
-  if [[ -n "$SHLIBS_DEPENDS" ]]; then
-    SHLIBS_DEPENDS="$(echo "$SHLIBS_DEPENDS" \
+  if [[ -n "$shlibs_depends" ]]; then
+    shlibs_depends="$(echo "$shlibs_depends" \
       | sed -E 's/ *\([^)]*\)//g' \
       | sed -E 's/ *, */, /g' \
       | sed -E 's/^, *//; s/, *$//')"
-    FINAL_DEPENDS="${SHLIBS_DEPENDS}, ${EXTRA_DEPENDS}"
+    final_depends="${shlibs_depends}, ${extra_depends}"
   else
-    FINAL_DEPENDS="${EXTRA_DEPENDS}"
+    final_depends="${extra_depends}"
   fi
 
-  # Desktop file
-  install -m 644 /dev/stdin "$STAGE/usr/share/applications/v2rayn.desktop" <<'EOF'
-[Desktop Entry]
-Type=Application
-Name=v2rayN
-Comment=v2rayN for Debian GNU Linux
-Exec=v2rayn
-Icon=v2rayn
-Terminal=false
-Categories=Network;
-EOF
-
-  # Control file
-  cat > "$DEBIAN_DIR/control" <<EOF
+  cat > "$debian_dir/control" <<EOF
 Package: v2rayn
 Version: ${VERSION}
 Architecture: ${deb_arch}
@@ -542,71 +666,91 @@ Maintainer: 2dust <noreply@github.com>
 Homepage: https://github.com/2dust/v2rayN
 Section: net
 Priority: optional
-Depends: ${FINAL_DEPENDS}
+Depends: ${final_depends}
 Description: v2rayN (Avalonia) GUI client for Linux
  Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 /
  Shadowsocks / tuic / WireGuard.
 EOF
 
-  # postinst
-  install -m 755 /dev/stdin "$DEBIAN_DIR/postinst" <<'EOF'
-#!/bin/sh
-set -e
-update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
-if command -v gtk-update-icon-cache >/dev/null 2>&1; then
-  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
-fi
-exit 0
-EOF
+  find "$stage/opt/v2rayN" -type d -exec chmod 0755 {} +
+  find "$stage/opt/v2rayN" -type f -exec chmod 0644 {} +
+  [[ -f "$stage/opt/v2rayN/v2rayN" ]] && chmod 0755 "$stage/opt/v2rayN/v2rayN" || true
 
-  # postrm
-  install -m 755 /dev/stdin "$DEBIAN_DIR/postrm" <<'EOF'
-#!/bin/sh
-set -e
-update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
-if command -v gtk-update-icon-cache >/dev/null 2>&1; then
-  gtk-update-icon-cache -f /usr/share/icons/hicolor >/dev/null 2>&1 || true
-fi
-exit 0
-EOF
-
-  # Normalize permissions
-  find "$STAGE/opt/v2rayN" -type d -exec chmod 0755 {} +
-  find "$STAGE/opt/v2rayN" -type f -exec chmod 0644 {} +
-  [[ -f "$STAGE/opt/v2rayN/v2rayN" ]] && chmod 0755 "$STAGE/opt/v2rayN/v2rayN" || true
-  
-  local deb_out
   deb_out="$OUTPUT_DIR/v2rayn_${VERSION}_${deb_arch}.deb"
-
-  dpkg-deb --root-owner-group --build "$STAGE" "$deb_out"
+  dpkg-deb --root-owner-group --build "$stage" "$deb_out"
 
   echo "Build done for $short. DEB at:"
   echo "  $deb_out"
   BUILT_DEBS+=("$deb_out")
-
-  rm -rf "$WORKDIR"
 }
 
-case "${ARCH_OVERRIDE:-}" in
-  all)           targets=(x64 arm64); BUILT_ALL=1 ;;
-  x64|amd64)     targets=(x64) ;;
-  arm64|aarch64) targets=(arm64) ;;
-  "")            targets=($([[ "$host_arch" == "aarch64" ]] && echo arm64 || echo x64)) ;;
-  *)             echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all."; exit 1 ;;
-esac
+select_targets() {
+  case "${ARCH_OVERRIDE:-}" in
+    all)           printf '%s\n' x64 arm64 ;;
+    x64|amd64)     printf '%s\n' x64 ;;
+    arm64|aarch64) printf '%s\n' arm64 ;;
+    "")
+      case "$HOST_ARCH" in
+        x86_64)  printf '%s\n' x64 ;;
+        aarch64) printf '%s\n' arm64 ;;
+        *)       return 1 ;;
+      esac
+      ;;
+    *)
+      echo "Unknown --arch '${ARCH_OVERRIDE}'. Use x64|arm64|all." >&2
+      return 1
+      ;;
+  esac
+}
 
-for arch in "${targets[@]}"; do
-  build_for_arch "$arch"
-done
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local deb_arch=""
 
-echo ""
-echo "================ Build Summary ================="
-if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
-  echo "Output directory: $OUTPUT_DIR"
-  for pkg in "${BUILT_DEBS[@]}"; do
-    echo "$pkg"
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  deb_arch="${meta[1]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, DEB arch=$deb_arch)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$deb_arch"
+}
+
+print_summary() {
+  local pkg=""
+
+  echo ""
+  echo "================ Build Summary ================="
+  if [[ "${#BUILT_DEBS[@]}" -gt 0 ]]; then
+    echo "Output directory: $OUTPUT_DIR"
+    for pkg in "${BUILT_DEBS[@]}"; do
+      echo "$pkg"
+    done
+  else
+    echo "No DEBs detected in summary (check build logs above)."
+  fi
+  echo "==============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
   done
-else
-  echo "No DEBs detected in summary (check build logs above)."
-fi
-echo "==============================================="
+
+  print_summary
+}
+
+main "$@"