@black-duty/sing-box-schema 1.13.0-rc.4 → 1.13.13

package/dist/index.cjs

@@ -62,10 +62,11 @@ const CertificateOptions = zod.z.object({
 	store: zod.z.enum([
 		"system",
 		"mozilla",
+		"chrome",
 		"none"
 	]).optional().meta({
-		description: "The default X509 trusted CA certificate list. Options: `system` (System trusted CA certificates), `mozilla` (Mozilla Included List with China CA certificates removed), `none` (Empty list).",
-		description_zh: "默认的 X509 受信任 CA 证书列表。可选项：`system`（系统受信任的 CA 证书）、`mozilla`（移除中国 CA 证书的 Mozilla 包含列表）、`none`（空列表）。"
+		description: "The default X509 trusted CA certificate list. Options: `system` (System trusted CA certificates), `mozilla` (Mozilla Included List with China CA certificates removed), `chrome` (Chrome Root Store with China CA certificates removed), `none` (Empty list).",
+		description_zh: "默认的 X509 受信任 CA 证书列表。可选项：`system`（系统受信任的 CA 证书）、`mozilla`（移除中国 CA 证书的 Mozilla 包含列表）、`chrome`（移除中国 CA 证书的 Chrome Root Store）、`none`（空列表）。"
 	}),
 	certificate: listableString.optional().meta({
 		description: "The certificate line array to trust, in PEM format.",
@@ -123,37 +124,6 @@ const HttpHeader = zod.z.record(zod.z.string(), zod.z.string()).meta({
 	description: "HTTP headers.",
 	description_zh: "HTTP 标头。"
 });
-const InboundOptions = zod.z.object({
-	sniff: zod.z.boolean().optional().meta({
-		description: "Enable sniffing. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "启用协议探测。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	sniff_override_destination: zod.z.boolean().optional().meta({
-		description: "Override the connection destination address with the sniffed domain. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "用探测出的域名覆盖连接目标地址。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	sniff_timeout: zod.z.string().optional().meta({
-		description: "Timeout for sniffing (default `300ms`). Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "探测超时时间（默认 `300ms`）。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	domain_strategy: DomainStrategy.optional().meta({
-		description: "If set, the requested domain name will be resolved to IP before routing. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "如果设置，请求的域名将在路由之前解析为 IP。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	udp_disable_domain_unmapping: zod.z.boolean().optional().meta({
-		description: "If enabled, for UDP proxy requests addressed to a domain, the original packet address will be sent in the response instead of the mapped domain. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "如果启用，对于地址为域的 UDP 代理请求，将在响应中发送原始包地址而不是映射的域。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	detour: zod.z.string().optional().meta({
-		description: "If set, connections will be forwarded to the specified inbound. Requires target inbound support.",
-		description_zh: "如果设置，连接将被转发到指定的入站。需要目标入站支持。"
-	})
-});
 const ListenOptions = zod.z.object({
 	listen: zod.z.string().optional().meta({
 		description: "Listen address.",
@@ -207,6 +177,10 @@ const ListenOptions = zod.z.object({
 		description: "UDP NAT expiration time. `5m` will be used by default.",
 		description_zh: "UDP NAT 过期时间。默认使用 `5m`。"
 	}),
+	detour: zod.z.string().optional().meta({
+		description: "If set, connections will be forwarded to the specified inbound. Requires target inbound support.",
+		description_zh: "如果设置，连接将被转发到指定的入站。需要目标入站支持。"
+	}),
 	proxy_protocol: zod.z.boolean().optional().meta({
 		description: "Accept proxy protocol.",
 		description_zh: "接受代理协议。",
@@ -216,8 +190,7 @@ const ListenOptions = zod.z.object({
 		description: "Accept connections without proxy protocol header.",
 		description_zh: "接受没有代理协议头的连接。",
 		deprecated: true
-	}),
-	...InboundOptions.shape
+	})
 }).meta({
 	id: "ListenOptions",
 	title: "Listen Options",
@@ -1056,11 +1029,11 @@ const DNSRouteAction = zod.z.object({
 		description: "Disable cache and save cache in this query.",
 		description_zh: "在此查询中禁用缓存。"
 	}),
-	rewrite_ttl: zod.z.number().int().optional().meta({
+	rewrite_ttl: zod.z.number().int().optional().nullable().meta({
 		description: "Rewrite TTL in DNS responses.",
 		description_zh: "重写 DNS 回应中的 TTL。"
 	}),
-	client_subnet: zod.z.string().optional().meta({
+	client_subnet: zod.z.string().optional().nullable().meta({
 		description: "Append a `edns0-subnet` OPT extra record with the specified IP prefix to every query by default. If the value is an IP address instead of a prefix, `/32` or `/128` will be appended automatically. Will override `dns.client_subnet`.",
 		description_zh: "默认情况下，将带有指定 IP 前缀的 `edns0-subnet` OPT 附加记录附加到每个查询。如果值是 IP 地址而不是前缀，则会自动附加 `/32` 或 `/128`。将覆盖 `dns.client_subnet`。"
 	})
@@ -1100,11 +1073,11 @@ const DNSRouteOptionsAction = zod.z.object({
 		description: "Disable cache and save cache in this query.",
 		description_zh: "在此查询中禁用缓存。"
 	}),
-	rewrite_ttl: zod.z.number().int().optional().meta({
+	rewrite_ttl: zod.z.number().int().optional().nullable().meta({
 		description: "Rewrite TTL in DNS responses.",
 		description_zh: "重写 DNS 回应中的 TTL。"
 	}),
-	client_subnet: zod.z.string().optional().meta({
+	client_subnet: zod.z.string().optional().nullable().meta({
 		description: "Append a `edns0-subnet` OPT extra record with the specified IP prefix to every query by default. If the value is an IP address instead of a prefix, `/32` or `/128` will be appended automatically. Will override `dns.client_subnet`.",
 		description_zh: "默认情况下，将带有指定 IP 前缀的 `edns0-subnet` OPT 附加记录附加到每个查询。如果值是 IP 地址而不是前缀，则会自动附加 `/32` 或 `/128`。将覆盖 `dns.client_subnet`。"
 	})
@@ -1319,6 +1292,11 @@ const BaseDNSRule = zod.z.object({
 		description: "Make `ip_cidr` rule items in rule-sets match the source IP.",
 		description_zh: "使规则集中的 `ip_cidr` 规则匹配源 IP。"
 	}),
+	rule_set_ipcidr_match_source: zod.z.boolean().optional().meta({
+		description: "Deprecated in sing-box 1.10.0. `rule_set_ipcidr_match_source` is renamed to `rule_set_ip_cidr_match_source` and will be remove in sing-box 1.11.0. Make `ip_cidr` rule items in rule-sets match the source IP.",
+		description_zh: "已在 sing-box 1.10.0 废弃。`rule_set_ipcidr_match_source` 已重命名为 `rule_set_ip_cidr_match_source` 且将在 sing-box 1.11.0 中被移除。使规则集中的 `ip_cidr` 规则匹配源 IP。",
+		deprecated: true
+	}),
 	rule_set_ip_cidr_accept_empty: zod.z.boolean().optional().meta({
 		description: "Make `ip_cidr` rules in rule-sets accept empty query response. Only takes effect for address requests (A/AAAA/HTTPS).",
 		description_zh: "使规则集中的 `ip_cidr` 规则接受空查询响应。仅对地址请求（A/AAAA/HTTPS）生效。"
@@ -1339,7 +1317,7 @@ const DefaultDNSRule = zod.z.union([
 	BaseDNSRule.extend(DNSRejectAction.shape),
 	BaseDNSRule.extend(DNSRouteActionPredefined.shape)
 ]);
-const LogicalDNSRule = zod.z.object({
+const BaseLogicalDNSRule = zod.z.object({
 	type: zod.z.literal("logical").meta({
 		description: "Rule type.",
 		description_zh: "规则类型。"
@@ -1358,7 +1336,13 @@ const LogicalDNSRule = zod.z.object({
 		description: "Invert match result.",
 		description_zh: "反选匹配结果。"
 	})
-}).meta({
+});
+const LogicalDNSRule = zod.z.union([
+	BaseLogicalDNSRule.extend(DNSRouteAction.shape),
+	BaseLogicalDNSRule.extend(DNSRouteOptionsAction.shape),
+	BaseLogicalDNSRule.extend(DNSRejectAction.shape),
+	BaseLogicalDNSRule.extend(DNSRouteActionPredefined.shape)
+]).meta({
 	id: "LogicalDNSRule",
 	title: "Logical DNS Rule",
 	title_zh: "逻辑 DNS 规则"
@@ -1443,6 +1427,10 @@ const LegacyDNSServerAddress = zod.z.union([
 	})
 ]);
 const LegacyDNSServerOptions = zod.z.object({
+	type: zod.z.literal("legacy").optional().meta({
+		description: "DNS server type.",
+		description_zh: "DNS 服务器类型。"
+	}),
 	tag: zod.z.string().meta({
 		description: "The tag of the dns server.",
 		description_zh: "DNS 服务器的标签。"
@@ -1637,6 +1625,10 @@ const HTTP3DNSServerOptions = zod.z.object({
 		description: "The path of the HTTP3 DNS server. `/dns-query` will be used by default.",
 		description_zh: "HTTP3 DNS 服务器的路径。默认使用 `/dns-query`。"
 	}),
+	method: zod.z.string().optional().meta({
+		description: "The HTTP method for DNS-over-HTTP/3 requests.",
+		description_zh: "DNS-over-HTTP/3 请求使用的 HTTP 方法。"
+	}),
 	headers: HttpHeader.optional().meta({
 		description: "Additional headers to be sent to the DNS server.",
 		description_zh: "要发送到 DNS 服务器的额外请求头。"
@@ -1712,7 +1704,7 @@ const ResolvedDNSServerOptions = zod.z.object({
 	title: "Resolved DNS Server",
 	title_zh: "Resolved DNS 服务器"
 });
-const DNSServer = zod.z.discriminatedUnion("type", [
+const DNSServer = zod.z.union([zod.z.lazy(() => LegacyDNSServerOptions), zod.z.lazy(() => zod.z.discriminatedUnion("type", [
 	LocalDNSServerOptions,
 	HostsDNSServerOptions,
 	TCPDNSServerOptions,
@@ -1724,9 +1716,8 @@ const DNSServer = zod.z.discriminatedUnion("type", [
 	DHCPDNSServerOptions,
 	FakeIPDNSServerOptions,
 	TailscaleDNSServerOptions,
-	ResolvedDNSServerOptions,
-	LegacyDNSServerOptions
-]).meta({
+	ResolvedDNSServerOptions
+]))]).meta({
 	id: "DNSServer",
 	title: "DNS Server",
 	title_zh: "DNS 服务器"
@@ -1851,6 +1842,10 @@ const TailscaleEndpointOptions = zod.z.object({
 		description: "Indicates whether the node should advertise itself as an exit node.",
 		description_zh: "指示节点是否应将自己通告为出口节点。"
 	}),
+	advertise_tags: listableString.optional().meta({
+		description: "ACL tags to request when registering the node. Tags must be pre-authorized in the Tailscale ACL policy. Example: `[\"tag:server\", \"tag:prod\"]`.",
+		description_zh: "注册节点时请求的 ACL 标签。标签必须在 Tailscale ACL 策略中预先授权。示例：`[\"tag:server\", \"tag:prod\"]`。"
+	}),
 	relay_server_port: zod.z.number().int().optional().meta({
 		description: "The port to listen on for incoming relay connections from other Tailscale nodes.",
 		description_zh: "监听来自其他 Tailscale 节点的中继连接的端口。"
@@ -1960,84 +1955,6 @@ const WireGuardEndpointOptions = zod.default.object({
 	title: "WireGuard Endpoint",
 	title_zh: "WireGuard 端点"
 });
-const LegacyWireGuardPeer = zod.default.object({
-	public_key: zod.default.string().optional().meta({
-		description: "WireGuard peer public key.",
-		description_zh: "WireGuard 对等公钥。"
-	}),
-	pre_shared_key: zod.default.string().optional().meta({
-		description: "WireGuard pre-shared key.",
-		description_zh: "WireGuard 预共享密钥。"
-	}),
-	allowed_ips: zod.default.union([zod.default.string(), zod.default.array(zod.default.string())]).optional().meta({
-		description: "WireGuard allowed IPs.",
-		description_zh: "WireGuard 允许 IP。"
-	}),
-	reserved: Reserved.optional().meta({
-		description: "WireGuard reserved field bytes.",
-		description_zh: "WireGuard 保留字段字节。"
-	}),
-	...ServerOptions.shape
-});
-const LegacyWireGuardOutboundOptions = zod.default.object({
-	type: zod.default.literal("wireguard"),
-	tag: zod.default.string().optional(),
-	system_interface: zod.default.boolean().optional().meta({
-		description: "Use system interface. Requires privilege and cannot conflict with existing system interfaces. Forced if gVisor is not included in the build.",
-		description_zh: "使用系统设备。需要特权且不能与已有系统接口冲突。如果未包含 gVisor 构建标签，则强制使用。"
-	}),
-	gso: zod.default.boolean().optional().meta({
-		description: "Try to enable generic segmentation offload. Deprecated in sing-box 1.11.0; GSO will be automatically enabled when available. Only supported on Linux.",
-		description_zh: "尝试启用通用分段卸载。已在 sing-box 1.11.0 废弃；可用时将自动启用 GSO。仅在 Linux 上支持。",
-		deprecated: true
-	}),
-	interface_name: zod.default.string().optional().meta({
-		description: "Custom interface name for system interface.",
-		description_zh: "为系统接口自定义设备名称。"
-	}),
-	local_address: zod.default.union([zod.default.string(), zod.default.array(zod.default.string())]).meta({
-		description: "List of IP (v4 or v6) address prefixes to be assigned to the interface. Required.",
-		description_zh: "接口的 IPv4/IPv6 地址或地址段的列表（必填）。"
-	}),
-	private_key: zod.default.string().meta({
-		description: "WireGuard requires base64-encoded public and private keys. These can be generated using wg(8) or `sing-box generate wg-keypair`. Required.",
-		description_zh: "WireGuard 需要 base64 编码的公钥和私钥。可以使用 wg(8) 或 `sing-box generate wg-keypair` 生成。必填。"
-	}),
-	peers: zod.default.array(LegacyWireGuardPeer).optional().meta({
-		description: "Multi-peer support. If enabled, `server`, `server_port`, `peer_public_key`, and `pre_shared_key` will be ignored.",
-		description_zh: "多对等支持。启用后将忽略 `server`、`server_port`、`peer_public_key` 和 `pre_shared_key`。"
-	}),
-	peer_public_key: zod.default.string().meta({
-		description: "WireGuard peer public key. Required if multi-peer is disabled.",
-		description_zh: "WireGuard 对等公钥（未启用多对等支持时必填）。"
-	}),
-	pre_shared_key: zod.default.string().optional().meta({
-		description: "WireGuard pre-shared key.",
-		description_zh: "WireGuard 预共享密钥。"
-	}),
-	reserved: Reserved.optional().meta({
-		description: "WireGuard reserved field bytes. `$outbound.reserved` will be used if empty.",
-		description_zh: "WireGuard 保留字段字节。置空时将使用 `$outbound.reserved`。"
-	}),
-	workers: zod.default.number().int().optional().meta({
-		description: "WireGuard worker count. CPU count is used by default.",
-		description_zh: "WireGuard worker 数量。默认使用 CPU 数量。"
-	}),
-	mtu: zod.default.number().int().optional().meta({
-		description: "WireGuard MTU. `1408` will be used if empty.",
-		description_zh: "WireGuard MTU。默认使用 1408。"
-	}),
-	network: Network.optional().meta({
-		description: "Enabled network. One of `tcp` `udp`. Both is enabled by default.",
-		description_zh: "启用的网络协议。`tcp` 或 `udp`。默认所有。"
-	}),
-	...ServerOptions.shape,
-	...DialerOptions.shape
-}).meta({
-	id: "LegacyWireGuardOutboundOptions",
-	title: "Legacy WireGuard Outbound",
-	title_zh: "旧版 WireGuard 出站"
-});
 
 //#endregion
 //#region src/schema/endpoint.ts
@@ -2084,8 +2001,9 @@ const DebugOptions = zod.z.object({
 		description_zh: "内存限制（字节），如 `128MiB`，参见 https://pkg.go.dev/runtime/debug#SetMemoryLimit。"
 	}),
 	oom_killer: zod.z.boolean().optional().meta({
-		description: "Enable OOM killer.",
-		description_zh: "启用 OOM killer。"
+		deprecated: true,
+		description: "**Removed in v1.13.0.** This field is no longer supported and will return an error if set. Use the `oom-killer` service instead.",
+		description_zh: "**已在 v1.13.0 中移除。** 此字段不再受支持，设置后将返回错误。请改用 `oom-killer` 服务。"
 	})
 }).meta({
 	id: "DebugOptions",
@@ -2170,6 +2088,31 @@ const ClashAPIOptions = zod.z.object({
 	access_control_allow_private_network: zod.z.boolean().optional().meta({
 		description: "Allow access from private network. To access the Clash API on a private network from a public website, `access_control_allow_private_network` must be enabled.",
 		description_zh: "允许从私有网络访问。要从公共网站访问私有网络上的 Clash API，必须启用 `access_control_allow_private_network`。"
+	}),
+	store_mode: zod.z.boolean().optional().meta({
+		description: "Store Clash mode in cache file. Deprecated in sing-box 1.8.0 and migrated to the global cache file.",
+		description_zh: "将 Clash 模式存储在缓存文件中。已在 sing-box 1.8.0 弃用并迁移到全局缓存文件。",
+		deprecated: true
+	}),
+	store_selected: zod.z.boolean().optional().meta({
+		description: "Store selected outbound for the Selector outbound in cache file. Deprecated in sing-box 1.8.0 and migrated to the global cache file.",
+		description_zh: "将 Selector 出站中选定的出站存储在缓存文件中。已在 sing-box 1.8.0 弃用并迁移到全局缓存文件。",
+		deprecated: true
+	}),
+	store_fakeip: zod.z.boolean().optional().meta({
+		description: "Store fakeip in cache file. Deprecated in sing-box 1.8.0 and migrated to `cache_file.store_fakeip`.",
+		description_zh: "将 fakeip 存储在缓存文件中。已在 sing-box 1.8.0 弃用并迁移到 `cache_file.store_fakeip`。",
+		deprecated: true
+	}),
+	cache_file: zod.z.string().optional().meta({
+		description: "Cache file path. Deprecated in sing-box 1.8.0 and migrated to `cache_file.enabled` and `cache_file.path`.",
+		description_zh: "缓存文件路径。已在 sing-box 1.8.0 弃用并迁移到 `cache_file.enabled` 和 `cache_file.path`。",
+		deprecated: true
+	}),
+	cache_id: zod.z.string().optional().meta({
+		description: "Identifier in cache file. Deprecated in sing-box 1.8.0 and migrated to `cache_file.cache_id`.",
+		description_zh: "缓存文件中的标识符。已在 sing-box 1.8.0 弃用并迁移到 `cache_file.cache_id`。",
+		deprecated: true
 	})
 }).meta({
 	id: "ClashAPIOptions",
@@ -2335,16 +2278,6 @@ const DirectInboundOptions = zod.z.object({
 const DirectOutboundOptions = zod.z.object({
 	type: zod.z.literal("direct"),
 	tag: zod.z.string().optional(),
-	override_address: zod.z.string().optional().meta({
-		description: "Override the connection destination address. Deprecated since sing-box 1.11.0 and will be removed in 1.13.0; see [Migration](/migration/#migrate-destination-override-fields-to-route-options).",
-		description_zh: "覆盖连接目标地址。自 sing-box 1.11.0 起已废弃，并将于 1.13.0 移除；请参阅 [迁移指南](/zh/migration/#migrate-destination-override-fields-to-route-options)。",
-		deprecated: true
-	}),
-	override_port: zod.z.number().int().optional().meta({
-		description: "Override the connection destination port. Deprecated since sing-box 1.11.0 and will be removed in 1.13.0; see [Migration](/migration/#migrate-destination-override-fields-to-route-options).",
-		description_zh: "覆盖连接目标端口。自 sing-box 1.11.0 起已废弃，并将于 1.13.0 移除；请参阅 [迁移指南](/zh/migration/#migrate-destination-override-fields-to-route-options)。",
-		deprecated: true
-	}),
 	...DialerOptions.shape
 }).meta({
 	id: "DirectOutboundOptions",
@@ -2744,6 +2677,10 @@ const NaiveInboundOptions = zod.z.object({
 		description: "Naive users. Required.",
 		description_zh: "Naive 用户。必填。"
 	}),
+	quic_congestion_control: zod.z.string().optional().meta({
+		description: "QUIC congestion control algorithm.",
+		description_zh: "QUIC 拥塞控制算法。"
+	}),
 	tls: InboundTLSOptions.optional().meta({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
@@ -2754,6 +2691,56 @@ const NaiveInboundOptions = zod.z.object({
 	title: "Naive Inbound",
 	title_zh: "Naive 入站"
 });
+const NaiveOutboundOptions = zod.z.object({
+	type: zod.z.literal("naive"),
+	tag: zod.z.string().optional(),
+	username: zod.z.string().optional().meta({
+		description: "Authentication username.",
+		description_zh: "认证用户名。"
+	}),
+	password: zod.z.string().optional().meta({
+		description: "Authentication password.",
+		description_zh: "认证密码。"
+	}),
+	insecure_concurrency: zod.z.number().int().optional().meta({
+		description: "Number of concurrent tunnel connections. Multiple connections make the tunneling easier to detect through traffic analysis.",
+		description_zh: "并发隧道连接数。多个连接会使隧道更容易通过流量分析被检测到。"
+	}),
+	extra_headers: HttpHeader.optional().meta({
+		description: "Extra headers to send in HTTP requests.",
+		description_zh: "HTTP 请求中发送的额外标头。"
+	}),
+	stream_receive_window: zod.z.string().optional().meta({
+		description: "Stream receive window size.",
+		description_zh: "流接收窗口大小。"
+	}),
+	udp_over_tcp: zod.z.union([zod.z.boolean(), UDPOverTCPOptions]).optional().meta({
+		description: "UDP over TCP protocol settings. See [UDP Over TCP](/configuration/shared/udp-over-tcp/) for details.",
+		description_zh: "UDP over TCP 协议设置。参阅 [UDP Over TCP](/zh/configuration/shared/udp-over-tcp/) 以获取详细信息。"
+	}),
+	quic: zod.z.boolean().optional().meta({
+		description: "Use QUIC instead of HTTP/2.",
+		description_zh: "使用 QUIC 而非 HTTP/2。"
+	}),
+	quic_congestion_control: zod.z.string().optional().meta({
+		description: "QUIC congestion control algorithm.",
+		description_zh: "QUIC 拥塞控制算法。"
+	}),
+	quic_session_receive_window: zod.z.string().optional().meta({
+		description: "QUIC session receive window size.",
+		description_zh: "QUIC 会话接收窗口大小。"
+	}),
+	tls: OutboundTLSOptions.meta({
+		description: "TLS configuration, see [TLS](/configuration/shared/tls/#outbound). Required.",
+		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#outbound)。必填。"
+	}),
+	...ServerOptions.shape,
+	...DialerOptions.shape
+}).meta({
+	id: "NaiveOutboundOptions",
+	title: "Naive Outbound",
+	title_zh: "Naive 出站"
+});
 
 //#endregion
 //#region src/schema/protocols/redirect.ts
@@ -3311,6 +3298,10 @@ const TunInboundOptions = zod.z.object({
 		description: "Exclude android packages in route. Android package rules are only supported on Android and require `auto_route`.",
 		description_zh: "排除路由的 Android 应用包名。Android 应用规则仅在 Android 下被支持，并且需要 `auto_route`。"
 	}),
+	udp_timeout: zod.z.union([zod.z.string(), zod.z.number()]).optional().meta({
+		description: "UDP NAT expiration time. `5m` will be used by default.",
+		description_zh: "UDP NAT 过期时间。默认使用 `5m`。"
+	}),
 	stack: zod.z.enum([
 		"system",
 		"gvisor",
@@ -3322,48 +3313,7 @@ const TunInboundOptions = zod.z.object({
 	platform: TunPlatformOptions.optional().meta({
 		description: "Platform-specific settings, provided by client applications.",
 		description_zh: "平台特定的设置，由客户端应用提供。"
-	}),
-	gso: zod.z.boolean().optional().meta({
-		description: "Enable generic segmentation offload.",
-		description_zh: "启用通用分段卸载。",
-		deprecated: true
-	}),
-	inet4_address: listableString.optional().meta({
-		description: "IPv4 prefix for the tun interface.",
-		description_zh: "tun 接口的 IPv4 前缀。",
-		deprecated: true
-	}),
-	inet6_address: listableString.optional().meta({
-		description: "IPv6 prefix for the tun interface.",
-		description_zh: "tun 接口的 IPv6 前缀。",
-		deprecated: true
-	}),
-	inet4_route_address: listableString.optional().meta({
-		description: "Use custom routes instead of default when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时使用自定义路由而不是默认路由。",
-		deprecated: true
-	}),
-	inet6_route_address: listableString.optional().meta({
-		description: "Use custom routes instead of default when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时使用自定义路由而不是默认路由。",
-		deprecated: true
-	}),
-	inet4_route_exclude_address: listableString.optional().meta({
-		description: "Exclude custom routes when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时排除自定义路由。",
-		deprecated: true
-	}),
-	inet6_route_exclude_address: listableString.optional().meta({
-		description: "Exclude custom routes when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时排除自定义路由。",
-		deprecated: true
-	}),
-	endpoint_independent_nat: zod.z.boolean().optional().meta({
-		description: "Enable endpoint-independent NAT. This item is only available on the gvisor stack; other stacks are endpoint-independent NAT by default. Performance may degrade slightly, so it is not recommended to enable when it is not needed.",
-		description_zh: "启用独立于端点的 NAT。此项仅在 gvisor 栈上可用，其他栈默认启用独立于端点的 NAT。性能可能略有下降，因此不建议在不需要时启用。",
-		deprecated: true
-	}),
-	...ListenOptions.shape
+	})
 }).meta({
 	id: "TunInboundOptions",
 	title: "Tun Inbound",
@@ -3680,24 +3630,16 @@ const URLTestOutbound = zod.z.object({
 });
 
 //#endregion
-//#region src/schema/protocols/shadowsocksr.ts
-const ShadowsocksROutboundOptions = zod.z.object({
-	type: zod.z.literal("shadowsocksr"),
-	tag: zod.z.string().optional(),
-	method: zod.z.string(),
-	password: zod.z.string(),
-	obfs: zod.z.string().optional(),
-	obfs_param: zod.z.string().optional(),
-	protocol: zod.z.string().optional(),
-	protocol_param: zod.z.string().optional(),
-	network: Network.optional(),
-	...ServerOptions.shape,
-	...DialerOptions.shape
+//#region src/schema/protocols/block.ts
+const BlockOutboundOptions = zod.z.object({
+	type: zod.z.literal("block"),
+	tag: zod.z.string().optional()
 }).meta({
-	id: "ShadowsocksROutboundOptions",
-	title: "ShadowsocksR Outbound",
-	title_zh: "ShadowsocksR 出站",
-	deprecated: true
+	id: "BlockOutboundOptions",
+	title: "Block Outbound",
+	title_zh: "Block 出站",
+	description: "Block outbound closes all incoming requests.",
+	description_zh: "Block 出站关闭所有传入请求。"
 });
 
 //#endregion
@@ -3782,14 +3724,14 @@ const Outbound = zod.z.discriminatedUnion("type", [
 	ShadowsocksOutboundOptions,
 	VMessOutboundOptions,
 	TrojanOutboundOptions,
-	LegacyWireGuardOutboundOptions,
+	BlockOutboundOptions,
 	HysteriaOutboundOptions,
 	ShadowTLSOutboundOptions,
 	AnyTLSOutboundOptions,
 	Hysteria2OutboundOptions,
 	TUICOutboundOptions,
 	VLESSOutboundOptions,
-	ShadowsocksROutboundOptions,
+	NaiveOutboundOptions,
 	SSHOutboundOptions,
 	TorOutboundOptions,
 	SelectorOutbound,
@@ -3822,14 +3764,6 @@ const RuleActionRouteOptions = zod.z.object({
 		description: "See Dial Fields (/configuration/shared/dial/#network_strategy) for details. Only take effect if outbound is direct without `outbound.bind_interface`, `outbound.inet4_bind_address` and `outbound.inet6_bind_address` set.",
 		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#network_strategy)。仅当出站为 direct 且 `outbound.bind_interface`、`outbound.inet4_bind_address` 与 `outbound.inet6_bind_address` 均未设置时生效。"
 	}),
-	network_type: listable(NetworkType).optional().meta({
-		description: "See Dial Fields (/configuration/shared/dial/#network_type) for details.",
-		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#network_type)。"
-	}),
-	fallback_network_type: listable(NetworkType).optional().meta({
-		description: "See Dial Fields (/configuration/shared/dial/#fallback_network_type) for details.",
-		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#fallback_network_type)。"
-	}),
 	fallback_delay: zod.z.string().optional().meta({
 		description: "See Dial Fields (/configuration/shared/dial/#fallback_delay) for details.",
 		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#fallback_delay)。"
@@ -3934,14 +3868,33 @@ const RuleActionRoute = zod.z.object({
 	title: "Rule Action Route",
 	title_zh: "规则动作路由"
 });
+const RuleActionBypass = zod.z.object({
+	action: zod.z.literal("bypass").meta({
+		description: "Action type.",
+		description_zh: "动作类型。"
+	}),
+	outbound: zod.z.string().optional().meta({
+		description: "Tag of target outbound.",
+		description_zh: "目标出站的标签。"
+	}),
+	...RuleActionRouteOptions.shape
+}).meta({
+	id: "RuleActionBypass",
+	title: "Rule Action Bypass",
+	title_zh: "规则动作绕过"
+});
 const RuleActionReject = zod.z.object({
 	action: zod.z.literal("reject").meta({
 		description: "Action type.",
 		description_zh: "动作类型。"
 	}),
-	method: zod.z.enum(["default", "drop"]).optional().meta({
-		description: "`default`: Reply with TCP RST for TCP connections, and ICMP port unreachable for UDP packets. `drop`: Drop packets.",
-		description_zh: "`default`: 对于 TCP 连接回复 RST，对于 UDP 包回复 ICMP 端口不可达。`drop`: 丢弃数据包。"
+	method: zod.z.enum([
+		"default",
+		"drop",
+		"reply"
+	]).optional().meta({
+		description: "`default`: Reply with TCP RST for TCP connections, ICMP port unreachable for UDP packets, and ICMP host unreachable for ICMP echo requests. `drop`: Drop packets. `reply`: Reply with ICMP echo reply for ICMP echo requests.",
+		description_zh: "`default`: 对 TCP 连接回复 RST，对 UDP 包回复 ICMP 端口不可达，并对 ICMP 回显请求回复 ICMP 主机不可达。`drop`: 丢弃数据包。`reply`: 对 ICMP 回显请求回复 ICMP 回显响应。"
 	}),
 	no_drop: zod.z.boolean().optional().meta({
 		description: "If not enabled, `method` will be temporarily overwritten to `drop` after 50 triggers in 30s.",
@@ -3952,12 +3905,13 @@ const RuleActionReject = zod.z.object({
 	title: "Rule Action Reject",
 	title_zh: "规则动作拒绝"
 });
+const DirectActionDialerOptions = DialerOptions.omit({ detour: true });
 const RuleActionDirect = zod.z.object({
 	action: zod.z.literal("direct").meta({
 		description: "Action type.",
 		description_zh: "动作类型。"
 	}),
-	...DialerOptions.shape
+	...DirectActionDialerOptions.shape
 }).meta({
 	id: "RuleActionDirect",
 	title: "Rule Action Direct",
@@ -4181,6 +4135,7 @@ const BaseRouteRule = zod.z.object({
 const DefaultRouteRule = zod.z.union([
 	BaseRouteRule.extend(RuleActionRouteByDefault.shape),
 	BaseRouteRule.extend(RuleActionRoute.shape),
+	BaseRouteRule.extend(RuleActionBypass.shape),
 	BaseRouteRule.extend(RuleActionReject.shape),
 	BaseRouteRule.extend(RuleActionHijackDNS.shape),
 	BaseRouteRule.extend(RuleActionRouteOptionsWithAction.shape),
@@ -4188,7 +4143,7 @@ const DefaultRouteRule = zod.z.union([
 	BaseRouteRule.extend(RuleActionResolve.shape),
 	BaseRouteRule.extend(RuleActionDirect.shape)
 ]);
-const LogicalRouteRule = zod.z.object({
+const BaseLogicalRouteRule = zod.z.object({
 	type: zod.z.literal("logical").meta({
 		description: "Rule type.",
 		description_zh: "规则类型。"
@@ -4207,7 +4162,18 @@ const LogicalRouteRule = zod.z.object({
 		description: "Invert match result.",
 		description_zh: "反选匹配结果。"
 	})
-}).meta({
+});
+const LogicalRouteRule = zod.z.union([
+	BaseLogicalRouteRule.extend(RuleActionRouteByDefault.shape),
+	BaseLogicalRouteRule.extend(RuleActionRoute.shape),
+	BaseLogicalRouteRule.extend(RuleActionBypass.shape),
+	BaseLogicalRouteRule.extend(RuleActionReject.shape),
+	BaseLogicalRouteRule.extend(RuleActionHijackDNS.shape),
+	BaseLogicalRouteRule.extend(RuleActionRouteOptionsWithAction.shape),
+	BaseLogicalRouteRule.extend(RuleActionSniff.shape),
+	BaseLogicalRouteRule.extend(RuleActionResolve.shape),
+	BaseLogicalRouteRule.extend(RuleActionDirect.shape)
+]).meta({
 	id: "LogicalRouteRule",
 	title: "Logical Route Rule",
 	title_zh: "逻辑路由规则"
@@ -4357,7 +4323,7 @@ const HeadlessRule = zod.z.union([DefaultHeadlessRule, LogicalHeadlessRule]).met
 	title_zh: "无头规则"
 });
 const InlineRuleSetOptions = zod.z.object({
-	type: zod.z.literal("inline").meta({
+	type: zod.z.literal("inline").optional().meta({
 		description: "Rule set type.",
 		description_zh: "规则集类型。"
 	}),
@@ -4426,7 +4392,7 @@ const RemoteRuleSetOptions = zod.z.object({
 	title: "Remote Rule Set Options",
 	title_zh: "远程规则集选项"
 });
-const RuleSet = zod.z.discriminatedUnion("type", [
+const RuleSet = zod.z.union([
 	InlineRuleSetOptions,
 	LocalRuleSetOptions,
 	RemoteRuleSetOptions
@@ -4579,7 +4545,11 @@ const CCMServiceOptions = zod.z.object({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
 	}),
-	...ListenOptions.shape
+	...ListenOptions.shape,
+	detour: zod.z.string().optional().meta({
+		description: "Outbound tag for connecting to the Claude API.",
+		description_zh: "用于连接到 Claude API 的出站标签。"
+	})
 }).meta({
 	id: "CCMServiceOptions",
 	title: "CCM",
@@ -4638,7 +4608,7 @@ const DERPServiceOptions = zod.z.object({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
 	}),
-	config_path: zod.z.string().meta({
+	config_path: zod.z.string().optional().meta({
 		description: "Derper configuration file path. Example: `derper.key`.",
 		description_zh: "Derper 配置文件路径。示例：`derper.key`。"
 	}),
@@ -4717,7 +4687,11 @@ const OCMServiceOptions = zod.z.object({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
 	}),
-	...ListenOptions.shape
+	...ListenOptions.shape,
+	detour: zod.z.string().optional().meta({
+		description: "Outbound tag for connecting to the OpenAI API.",
+		description_zh: "用于连接到 OpenAI API 的出站标签。"
+	})
 }).meta({
 	id: "OCMServiceOptions",
 	title: "OCM",
@@ -4726,6 +4700,42 @@ const OCMServiceOptions = zod.z.object({
 	description_zh: "OCM（OpenAI Codex 多路复用器）服务是一个多路复用服务，允许您通过自定义令牌远程访问本地的 OpenAI Codex 订阅。"
 });
 
+//#endregion
+//#region src/schema/services/oom-killer.ts
+/**
+* OOM Killer service options for sing-box.
+*/
+const OOMKillerServiceOptions = zod.z.object({
+	type: zod.z.literal("oom-killer"),
+	tag: zod.z.string().optional(),
+	memory_limit: zod.z.string().optional().meta({
+		description: "The memory limit that triggers OOM killing. Accepts human-readable byte sizes such as `128MiB` or `1GiB`. When memory usage exceeds this threshold, the OOM killer becomes active.",
+		description_zh: "触发 OOM 强杀的内存限制，支持可读的字节大小格式，如 `128MiB`、`1GiB`。当内存使用量超过该阈值时，OOM killer 将被激活。"
+	}),
+	safety_margin: zod.z.string().optional().meta({
+		description: "An additional memory buffer subtracted from the limit before enforcement. Accepts human-readable byte sizes such as `32MiB`. Provides headroom to avoid aggressive killing.",
+		description_zh: "在执行限制前额外减去的内存缓冲量，支持可读的字节大小格式，如 `32MiB`。提供一定余量以避免过于激进的强杀行为。"
+	}),
+	min_interval: zod.z.union([zod.z.string(), zod.z.number()]).optional().meta({
+		description: "The minimum interval between consecutive OOM kill checks. Accepts a duration string such as `1s`. Prevents excessive kill frequency.",
+		description_zh: "两次 OOM 检测之间的最小间隔，支持时间字符串格式如 `1s`。防止过于频繁的强杀操作。"
+	}),
+	max_interval: zod.z.union([zod.z.string(), zod.z.number()]).optional().meta({
+		description: "The maximum interval between consecutive OOM kill checks. Accepts a duration string such as `30s`. The interval is dynamically adjusted between `min_interval` and `max_interval`.",
+		description_zh: "两次 OOM 检测之间的最大间隔，支持时间字符串格式如 `30s`。检测间隔会在 `min_interval` 与 `max_interval` 之间动态调整。"
+	}),
+	checks_before_limit: zod.z.number().int().optional().meta({
+		description: "The number of consecutive checks that must exceed the memory limit before the OOM killer takes action. Reduces false positives from transient memory spikes.",
+		description_zh: "在 OOM killer 采取行动之前，内存需要连续超过限制的检测次数。用于减少因瞬时内存峰值引发的误杀。"
+	})
+}).meta({
+	id: "OOMKillerServiceOptions",
+	title: "OOM Killer Service",
+	title_zh: "OOM Killer 服务",
+	description: "The OOM Killer service monitors memory usage and terminates the process when it exceeds the configured limit, preventing system-level out-of-memory conditions.",
+	description_zh: "OOM Killer 服务监控内存使用情况，并在超过配置限制时终止进程，从而防止系统级内存耗尽情况的发生。"
+});
+
 //#endregion
 //#region src/schema/services/resolved.ts
 /**
@@ -4781,6 +4791,7 @@ const Service = zod.z.discriminatedUnion("type", [
 	CCMServiceOptions,
 	DERPServiceOptions,
 	OCMServiceOptions,
+	OOMKillerServiceOptions,
 	ResolvedServiceOptions,
 	SSMAPIServiceOptions
 ]).meta({
@@ -4807,17 +4818,18 @@ const Configuration = zod.z.object({
 	experimental: ExperimentalOptions.optional()
 }).meta({
 	id: "Configuration",
-	title: "Sing-box v1.13.0-rc.4 Configuration",
-	title_zh: "Sing-box v1.13.0-rc.4 配置文件",
-	description: "Sing-box v1.13.0-rc.4 configuration file schema. Sing-box uses JSON for configuration files with log, dns, ntp, certificate, endpoints, inbounds, outbounds, route, services, and experimental sections.",
-	description_zh: "Sing-box v1.13.0-rc.4 配置文件定义。sing-box 使用 JSON 作为配置文件格式，包含 log、dns、ntp、certificate、endpoints、inbounds、outbounds、route、services 与 experimental 字段。",
-	version: "1.13.0-rc.4"
+	title: "Sing-box v1.13.13 Configuration",
+	title_zh: "Sing-box v1.13.13 配置文件",
+	description: "Sing-box v1.13.13 configuration file schema. Sing-box uses JSON for configuration files with log, dns, ntp, certificate, endpoints, inbounds, outbounds, route, services, and experimental sections.",
+	description_zh: "Sing-box v1.13.13 配置文件定义。sing-box 使用 JSON 作为配置文件格式，包含 log、dns、ntp、certificate、endpoints、inbounds、outbounds、route、services 与 experimental 字段。",
+	version: "1.13.13"
 });
 
 //#endregion
 exports.AnyTLSInboundOptions = AnyTLSInboundOptions;
 exports.AnyTLSOutboundOptions = AnyTLSOutboundOptions;
 exports.AnyTLSUser = AnyTLSUser;
+exports.BlockOutboundOptions = BlockOutboundOptions;
 exports.CertificateOptions = CertificateOptions;
 exports.Configuration = Configuration;
 exports.DHCPDNSServerOptions = DHCPDNSServerOptions;
@@ -4855,19 +4867,17 @@ exports.HysteriaOutboundOptions = HysteriaOutboundOptions;
 exports.HysteriaUser = HysteriaUser;
 exports.Inbound = Inbound;
 exports.InboundMultiplexOptions = InboundMultiplexOptions;
-exports.InboundOptions = InboundOptions;
 exports.InboundTLSOptions = InboundTLSOptions;
 exports.IpVersion = IpVersion;
 exports.LegacyDNSFakeIPOptions = LegacyDNSFakeIPOptions;
 exports.LegacyDNSServerOptions = LegacyDNSServerOptions;
-exports.LegacyWireGuardOutboundOptions = LegacyWireGuardOutboundOptions;
-exports.LegacyWireGuardPeer = LegacyWireGuardPeer;
 exports.ListenOptions = ListenOptions;
 exports.LocalDNSServerOptions = LocalDNSServerOptions;
 exports.LogOptions = LogOptions;
 exports.MixedInboundOptions = MixedInboundOptions;
 exports.NTPOptions = NTPOptions;
 exports.NaiveInboundOptions = NaiveInboundOptions;
+exports.NaiveOutboundOptions = NaiveOutboundOptions;
 exports.Network = Network;
 exports.NetworkStrategy = NetworkStrategy;
 exports.NetworkType = NetworkType;
@@ -4889,7 +4899,6 @@ exports.ShadowTLSOutboundOptions = ShadowTLSOutboundOptions;
 exports.ShadowsocksDestination = ShadowsocksDestination;
 exports.ShadowsocksInboundOptions = ShadowsocksInboundOptions;
 exports.ShadowsocksOutboundOptions = ShadowsocksOutboundOptions;
-exports.ShadowsocksROutboundOptions = ShadowsocksROutboundOptions;
 exports.ShadowsocksUser = ShadowsocksUser;
 exports.SocksInboundOptions = SocksInboundOptions;
 exports.SocksOutboundOptions = SocksOutboundOptions;