@black-duty/sing-box-schema 1.13.0 → 1.13.13

package/dist/index.js

@@ -39,10 +39,11 @@ const CertificateOptions = z.object({
 	store: z.enum([
 		"system",
 		"mozilla",
+		"chrome",
 		"none"
 	]).optional().meta({
-		description: "The default X509 trusted CA certificate list. Options: `system` (System trusted CA certificates), `mozilla` (Mozilla Included List with China CA certificates removed), `none` (Empty list).",
-		description_zh: "默认的 X509 受信任 CA 证书列表。可选项：`system`（系统受信任的 CA 证书）、`mozilla`（移除中国 CA 证书的 Mozilla 包含列表）、`none`（空列表）。"
+		description: "The default X509 trusted CA certificate list. Options: `system` (System trusted CA certificates), `mozilla` (Mozilla Included List with China CA certificates removed), `chrome` (Chrome Root Store with China CA certificates removed), `none` (Empty list).",
+		description_zh: "默认的 X509 受信任 CA 证书列表。可选项：`system`（系统受信任的 CA 证书）、`mozilla`（移除中国 CA 证书的 Mozilla 包含列表）、`chrome`（移除中国 CA 证书的 Chrome Root Store）、`none`（空列表）。"
 	}),
 	certificate: listableString.optional().meta({
 		description: "The certificate line array to trust, in PEM format.",
@@ -100,37 +101,6 @@ const HttpHeader = z.record(z.string(), z.string()).meta({
 	description: "HTTP headers.",
 	description_zh: "HTTP 标头。"
 });
-const InboundOptions = z.object({
-	sniff: z.boolean().optional().meta({
-		description: "Enable sniffing. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "启用协议探测。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	sniff_override_destination: z.boolean().optional().meta({
-		description: "Override the connection destination address with the sniffed domain. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "用探测出的域名覆盖连接目标地址。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	sniff_timeout: z.string().optional().meta({
-		description: "Timeout for sniffing (default `300ms`). Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "探测超时时间（默认 `300ms`）。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	domain_strategy: DomainStrategy.optional().meta({
-		description: "If set, the requested domain name will be resolved to IP before routing. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "如果设置，请求的域名将在路由之前解析为 IP。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	udp_disable_domain_unmapping: z.boolean().optional().meta({
-		description: "If enabled, for UDP proxy requests addressed to a domain, the original packet address will be sent in the response instead of the mapped domain. Deprecated in sing-box 1.11.0 and removed in 1.13.0.",
-		description_zh: "如果启用，对于地址为域的 UDP 代理请求，将在响应中发送原始包地址而不是映射的域。已在 sing-box 1.11.0 弃用，并将在 1.13.0 移除。",
-		deprecated: true
-	}),
-	detour: z.string().optional().meta({
-		description: "If set, connections will be forwarded to the specified inbound. Requires target inbound support.",
-		description_zh: "如果设置，连接将被转发到指定的入站。需要目标入站支持。"
-	})
-});
 const ListenOptions = z.object({
 	listen: z.string().optional().meta({
 		description: "Listen address.",
@@ -184,6 +154,10 @@ const ListenOptions = z.object({
 		description: "UDP NAT expiration time. `5m` will be used by default.",
 		description_zh: "UDP NAT 过期时间。默认使用 `5m`。"
 	}),
+	detour: z.string().optional().meta({
+		description: "If set, connections will be forwarded to the specified inbound. Requires target inbound support.",
+		description_zh: "如果设置，连接将被转发到指定的入站。需要目标入站支持。"
+	}),
 	proxy_protocol: z.boolean().optional().meta({
 		description: "Accept proxy protocol.",
 		description_zh: "接受代理协议。",
@@ -193,8 +167,7 @@ const ListenOptions = z.object({
 		description: "Accept connections without proxy protocol header.",
 		description_zh: "接受没有代理协议头的连接。",
 		deprecated: true
-	}),
-	...InboundOptions.shape
+	})
 }).meta({
 	id: "ListenOptions",
 	title: "Listen Options",
@@ -1033,11 +1006,11 @@ const DNSRouteAction = z.object({
 		description: "Disable cache and save cache in this query.",
 		description_zh: "在此查询中禁用缓存。"
 	}),
-	rewrite_ttl: z.number().int().optional().meta({
+	rewrite_ttl: z.number().int().optional().nullable().meta({
 		description: "Rewrite TTL in DNS responses.",
 		description_zh: "重写 DNS 回应中的 TTL。"
 	}),
-	client_subnet: z.string().optional().meta({
+	client_subnet: z.string().optional().nullable().meta({
 		description: "Append a `edns0-subnet` OPT extra record with the specified IP prefix to every query by default. If the value is an IP address instead of a prefix, `/32` or `/128` will be appended automatically. Will override `dns.client_subnet`.",
 		description_zh: "默认情况下，将带有指定 IP 前缀的 `edns0-subnet` OPT 附加记录附加到每个查询。如果值是 IP 地址而不是前缀，则会自动附加 `/32` 或 `/128`。将覆盖 `dns.client_subnet`。"
 	})
@@ -1077,11 +1050,11 @@ const DNSRouteOptionsAction = z.object({
 		description: "Disable cache and save cache in this query.",
 		description_zh: "在此查询中禁用缓存。"
 	}),
-	rewrite_ttl: z.number().int().optional().meta({
+	rewrite_ttl: z.number().int().optional().nullable().meta({
 		description: "Rewrite TTL in DNS responses.",
 		description_zh: "重写 DNS 回应中的 TTL。"
 	}),
-	client_subnet: z.string().optional().meta({
+	client_subnet: z.string().optional().nullable().meta({
 		description: "Append a `edns0-subnet` OPT extra record with the specified IP prefix to every query by default. If the value is an IP address instead of a prefix, `/32` or `/128` will be appended automatically. Will override `dns.client_subnet`.",
 		description_zh: "默认情况下，将带有指定 IP 前缀的 `edns0-subnet` OPT 附加记录附加到每个查询。如果值是 IP 地址而不是前缀，则会自动附加 `/32` 或 `/128`。将覆盖 `dns.client_subnet`。"
 	})
@@ -1296,6 +1269,11 @@ const BaseDNSRule = z.object({
 		description: "Make `ip_cidr` rule items in rule-sets match the source IP.",
 		description_zh: "使规则集中的 `ip_cidr` 规则匹配源 IP。"
 	}),
+	rule_set_ipcidr_match_source: z.boolean().optional().meta({
+		description: "Deprecated in sing-box 1.10.0. `rule_set_ipcidr_match_source` is renamed to `rule_set_ip_cidr_match_source` and will be remove in sing-box 1.11.0. Make `ip_cidr` rule items in rule-sets match the source IP.",
+		description_zh: "已在 sing-box 1.10.0 废弃。`rule_set_ipcidr_match_source` 已重命名为 `rule_set_ip_cidr_match_source` 且将在 sing-box 1.11.0 中被移除。使规则集中的 `ip_cidr` 规则匹配源 IP。",
+		deprecated: true
+	}),
 	rule_set_ip_cidr_accept_empty: z.boolean().optional().meta({
 		description: "Make `ip_cidr` rules in rule-sets accept empty query response. Only takes effect for address requests (A/AAAA/HTTPS).",
 		description_zh: "使规则集中的 `ip_cidr` 规则接受空查询响应。仅对地址请求（A/AAAA/HTTPS）生效。"
@@ -1316,7 +1294,7 @@ const DefaultDNSRule = z.union([
 	BaseDNSRule.extend(DNSRejectAction.shape),
 	BaseDNSRule.extend(DNSRouteActionPredefined.shape)
 ]);
-const LogicalDNSRule = z.object({
+const BaseLogicalDNSRule = z.object({
 	type: z.literal("logical").meta({
 		description: "Rule type.",
 		description_zh: "规则类型。"
@@ -1335,7 +1313,13 @@ const LogicalDNSRule = z.object({
 		description: "Invert match result.",
 		description_zh: "反选匹配结果。"
 	})
-}).meta({
+});
+const LogicalDNSRule = z.union([
+	BaseLogicalDNSRule.extend(DNSRouteAction.shape),
+	BaseLogicalDNSRule.extend(DNSRouteOptionsAction.shape),
+	BaseLogicalDNSRule.extend(DNSRejectAction.shape),
+	BaseLogicalDNSRule.extend(DNSRouteActionPredefined.shape)
+]).meta({
 	id: "LogicalDNSRule",
 	title: "Logical DNS Rule",
 	title_zh: "逻辑 DNS 规则"
@@ -1420,6 +1404,10 @@ const LegacyDNSServerAddress = z.union([
 	})
 ]);
 const LegacyDNSServerOptions = z.object({
+	type: z.literal("legacy").optional().meta({
+		description: "DNS server type.",
+		description_zh: "DNS 服务器类型。"
+	}),
 	tag: z.string().meta({
 		description: "The tag of the dns server.",
 		description_zh: "DNS 服务器的标签。"
@@ -1614,6 +1602,10 @@ const HTTP3DNSServerOptions = z.object({
 		description: "The path of the HTTP3 DNS server. `/dns-query` will be used by default.",
 		description_zh: "HTTP3 DNS 服务器的路径。默认使用 `/dns-query`。"
 	}),
+	method: z.string().optional().meta({
+		description: "The HTTP method for DNS-over-HTTP/3 requests.",
+		description_zh: "DNS-over-HTTP/3 请求使用的 HTTP 方法。"
+	}),
 	headers: HttpHeader.optional().meta({
 		description: "Additional headers to be sent to the DNS server.",
 		description_zh: "要发送到 DNS 服务器的额外请求头。"
@@ -1689,7 +1681,7 @@ const ResolvedDNSServerOptions = z.object({
 	title: "Resolved DNS Server",
 	title_zh: "Resolved DNS 服务器"
 });
-const DNSServer = z.discriminatedUnion("type", [
+const DNSServer = z.union([z.lazy(() => LegacyDNSServerOptions), z.lazy(() => z.discriminatedUnion("type", [
 	LocalDNSServerOptions,
 	HostsDNSServerOptions,
 	TCPDNSServerOptions,
@@ -1701,9 +1693,8 @@ const DNSServer = z.discriminatedUnion("type", [
 	DHCPDNSServerOptions,
 	FakeIPDNSServerOptions,
 	TailscaleDNSServerOptions,
-	ResolvedDNSServerOptions,
-	LegacyDNSServerOptions
-]).meta({
+	ResolvedDNSServerOptions
+]))]).meta({
 	id: "DNSServer",
 	title: "DNS Server",
 	title_zh: "DNS 服务器"
@@ -1941,84 +1932,6 @@ const WireGuardEndpointOptions = z$1.object({
 	title: "WireGuard Endpoint",
 	title_zh: "WireGuard 端点"
 });
-const LegacyWireGuardPeer = z$1.object({
-	public_key: z$1.string().optional().meta({
-		description: "WireGuard peer public key.",
-		description_zh: "WireGuard 对等公钥。"
-	}),
-	pre_shared_key: z$1.string().optional().meta({
-		description: "WireGuard pre-shared key.",
-		description_zh: "WireGuard 预共享密钥。"
-	}),
-	allowed_ips: z$1.union([z$1.string(), z$1.array(z$1.string())]).optional().meta({
-		description: "WireGuard allowed IPs.",
-		description_zh: "WireGuard 允许 IP。"
-	}),
-	reserved: Reserved.optional().meta({
-		description: "WireGuard reserved field bytes.",
-		description_zh: "WireGuard 保留字段字节。"
-	}),
-	...ServerOptions.shape
-});
-const LegacyWireGuardOutboundOptions = z$1.object({
-	type: z$1.literal("wireguard"),
-	tag: z$1.string().optional(),
-	system_interface: z$1.boolean().optional().meta({
-		description: "Use system interface. Requires privilege and cannot conflict with existing system interfaces. Forced if gVisor is not included in the build.",
-		description_zh: "使用系统设备。需要特权且不能与已有系统接口冲突。如果未包含 gVisor 构建标签，则强制使用。"
-	}),
-	gso: z$1.boolean().optional().meta({
-		description: "Try to enable generic segmentation offload. Deprecated in sing-box 1.11.0; GSO will be automatically enabled when available. Only supported on Linux.",
-		description_zh: "尝试启用通用分段卸载。已在 sing-box 1.11.0 废弃；可用时将自动启用 GSO。仅在 Linux 上支持。",
-		deprecated: true
-	}),
-	interface_name: z$1.string().optional().meta({
-		description: "Custom interface name for system interface.",
-		description_zh: "为系统接口自定义设备名称。"
-	}),
-	local_address: z$1.union([z$1.string(), z$1.array(z$1.string())]).meta({
-		description: "List of IP (v4 or v6) address prefixes to be assigned to the interface. Required.",
-		description_zh: "接口的 IPv4/IPv6 地址或地址段的列表（必填）。"
-	}),
-	private_key: z$1.string().meta({
-		description: "WireGuard requires base64-encoded public and private keys. These can be generated using wg(8) or `sing-box generate wg-keypair`. Required.",
-		description_zh: "WireGuard 需要 base64 编码的公钥和私钥。可以使用 wg(8) 或 `sing-box generate wg-keypair` 生成。必填。"
-	}),
-	peers: z$1.array(LegacyWireGuardPeer).optional().meta({
-		description: "Multi-peer support. If enabled, `server`, `server_port`, `peer_public_key`, and `pre_shared_key` will be ignored.",
-		description_zh: "多对等支持。启用后将忽略 `server`、`server_port`、`peer_public_key` 和 `pre_shared_key`。"
-	}),
-	peer_public_key: z$1.string().meta({
-		description: "WireGuard peer public key. Required if multi-peer is disabled.",
-		description_zh: "WireGuard 对等公钥（未启用多对等支持时必填）。"
-	}),
-	pre_shared_key: z$1.string().optional().meta({
-		description: "WireGuard pre-shared key.",
-		description_zh: "WireGuard 预共享密钥。"
-	}),
-	reserved: Reserved.optional().meta({
-		description: "WireGuard reserved field bytes. `$outbound.reserved` will be used if empty.",
-		description_zh: "WireGuard 保留字段字节。置空时将使用 `$outbound.reserved`。"
-	}),
-	workers: z$1.number().int().optional().meta({
-		description: "WireGuard worker count. CPU count is used by default.",
-		description_zh: "WireGuard worker 数量。默认使用 CPU 数量。"
-	}),
-	mtu: z$1.number().int().optional().meta({
-		description: "WireGuard MTU. `1408` will be used if empty.",
-		description_zh: "WireGuard MTU。默认使用 1408。"
-	}),
-	network: Network.optional().meta({
-		description: "Enabled network. One of `tcp` `udp`. Both is enabled by default.",
-		description_zh: "启用的网络协议。`tcp` 或 `udp`。默认所有。"
-	}),
-	...ServerOptions.shape,
-	...DialerOptions.shape
-}).meta({
-	id: "LegacyWireGuardOutboundOptions",
-	title: "Legacy WireGuard Outbound",
-	title_zh: "旧版 WireGuard 出站"
-});
 
 //#endregion
 //#region src/schema/endpoint.ts
@@ -2152,6 +2065,31 @@ const ClashAPIOptions = z.object({
 	access_control_allow_private_network: z.boolean().optional().meta({
 		description: "Allow access from private network. To access the Clash API on a private network from a public website, `access_control_allow_private_network` must be enabled.",
 		description_zh: "允许从私有网络访问。要从公共网站访问私有网络上的 Clash API，必须启用 `access_control_allow_private_network`。"
+	}),
+	store_mode: z.boolean().optional().meta({
+		description: "Store Clash mode in cache file. Deprecated in sing-box 1.8.0 and migrated to the global cache file.",
+		description_zh: "将 Clash 模式存储在缓存文件中。已在 sing-box 1.8.0 弃用并迁移到全局缓存文件。",
+		deprecated: true
+	}),
+	store_selected: z.boolean().optional().meta({
+		description: "Store selected outbound for the Selector outbound in cache file. Deprecated in sing-box 1.8.0 and migrated to the global cache file.",
+		description_zh: "将 Selector 出站中选定的出站存储在缓存文件中。已在 sing-box 1.8.0 弃用并迁移到全局缓存文件。",
+		deprecated: true
+	}),
+	store_fakeip: z.boolean().optional().meta({
+		description: "Store fakeip in cache file. Deprecated in sing-box 1.8.0 and migrated to `cache_file.store_fakeip`.",
+		description_zh: "将 fakeip 存储在缓存文件中。已在 sing-box 1.8.0 弃用并迁移到 `cache_file.store_fakeip`。",
+		deprecated: true
+	}),
+	cache_file: z.string().optional().meta({
+		description: "Cache file path. Deprecated in sing-box 1.8.0 and migrated to `cache_file.enabled` and `cache_file.path`.",
+		description_zh: "缓存文件路径。已在 sing-box 1.8.0 弃用并迁移到 `cache_file.enabled` 和 `cache_file.path`。",
+		deprecated: true
+	}),
+	cache_id: z.string().optional().meta({
+		description: "Identifier in cache file. Deprecated in sing-box 1.8.0 and migrated to `cache_file.cache_id`.",
+		description_zh: "缓存文件中的标识符。已在 sing-box 1.8.0 弃用并迁移到 `cache_file.cache_id`。",
+		deprecated: true
 	})
 }).meta({
 	id: "ClashAPIOptions",
@@ -2317,16 +2255,6 @@ const DirectInboundOptions = z.object({
 const DirectOutboundOptions = z.object({
 	type: z.literal("direct"),
 	tag: z.string().optional(),
-	override_address: z.string().optional().meta({
-		description: "Override the connection destination address. Deprecated since sing-box 1.11.0 and will be removed in 1.13.0; see [Migration](/migration/#migrate-destination-override-fields-to-route-options).",
-		description_zh: "覆盖连接目标地址。自 sing-box 1.11.0 起已废弃，并将于 1.13.0 移除；请参阅 [迁移指南](/zh/migration/#migrate-destination-override-fields-to-route-options)。",
-		deprecated: true
-	}),
-	override_port: z.number().int().optional().meta({
-		description: "Override the connection destination port. Deprecated since sing-box 1.11.0 and will be removed in 1.13.0; see [Migration](/migration/#migrate-destination-override-fields-to-route-options).",
-		description_zh: "覆盖连接目标端口。自 sing-box 1.11.0 起已废弃，并将于 1.13.0 移除；请参阅 [迁移指南](/zh/migration/#migrate-destination-override-fields-to-route-options)。",
-		deprecated: true
-	}),
 	...DialerOptions.shape
 }).meta({
 	id: "DirectOutboundOptions",
@@ -2726,6 +2654,10 @@ const NaiveInboundOptions = z.object({
 		description: "Naive users. Required.",
 		description_zh: "Naive 用户。必填。"
 	}),
+	quic_congestion_control: z.string().optional().meta({
+		description: "QUIC congestion control algorithm.",
+		description_zh: "QUIC 拥塞控制算法。"
+	}),
 	tls: InboundTLSOptions.optional().meta({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
@@ -2736,6 +2668,56 @@ const NaiveInboundOptions = z.object({
 	title: "Naive Inbound",
 	title_zh: "Naive 入站"
 });
+const NaiveOutboundOptions = z.object({
+	type: z.literal("naive"),
+	tag: z.string().optional(),
+	username: z.string().optional().meta({
+		description: "Authentication username.",
+		description_zh: "认证用户名。"
+	}),
+	password: z.string().optional().meta({
+		description: "Authentication password.",
+		description_zh: "认证密码。"
+	}),
+	insecure_concurrency: z.number().int().optional().meta({
+		description: "Number of concurrent tunnel connections. Multiple connections make the tunneling easier to detect through traffic analysis.",
+		description_zh: "并发隧道连接数。多个连接会使隧道更容易通过流量分析被检测到。"
+	}),
+	extra_headers: HttpHeader.optional().meta({
+		description: "Extra headers to send in HTTP requests.",
+		description_zh: "HTTP 请求中发送的额外标头。"
+	}),
+	stream_receive_window: z.string().optional().meta({
+		description: "Stream receive window size.",
+		description_zh: "流接收窗口大小。"
+	}),
+	udp_over_tcp: z.union([z.boolean(), UDPOverTCPOptions]).optional().meta({
+		description: "UDP over TCP protocol settings. See [UDP Over TCP](/configuration/shared/udp-over-tcp/) for details.",
+		description_zh: "UDP over TCP 协议设置。参阅 [UDP Over TCP](/zh/configuration/shared/udp-over-tcp/) 以获取详细信息。"
+	}),
+	quic: z.boolean().optional().meta({
+		description: "Use QUIC instead of HTTP/2.",
+		description_zh: "使用 QUIC 而非 HTTP/2。"
+	}),
+	quic_congestion_control: z.string().optional().meta({
+		description: "QUIC congestion control algorithm.",
+		description_zh: "QUIC 拥塞控制算法。"
+	}),
+	quic_session_receive_window: z.string().optional().meta({
+		description: "QUIC session receive window size.",
+		description_zh: "QUIC 会话接收窗口大小。"
+	}),
+	tls: OutboundTLSOptions.meta({
+		description: "TLS configuration, see [TLS](/configuration/shared/tls/#outbound). Required.",
+		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#outbound)。必填。"
+	}),
+	...ServerOptions.shape,
+	...DialerOptions.shape
+}).meta({
+	id: "NaiveOutboundOptions",
+	title: "Naive Outbound",
+	title_zh: "Naive 出站"
+});
 
 //#endregion
 //#region src/schema/protocols/redirect.ts
@@ -3293,6 +3275,10 @@ const TunInboundOptions = z.object({
 		description: "Exclude android packages in route. Android package rules are only supported on Android and require `auto_route`.",
 		description_zh: "排除路由的 Android 应用包名。Android 应用规则仅在 Android 下被支持，并且需要 `auto_route`。"
 	}),
+	udp_timeout: z.union([z.string(), z.number()]).optional().meta({
+		description: "UDP NAT expiration time. `5m` will be used by default.",
+		description_zh: "UDP NAT 过期时间。默认使用 `5m`。"
+	}),
 	stack: z.enum([
 		"system",
 		"gvisor",
@@ -3304,48 +3290,7 @@ const TunInboundOptions = z.object({
 	platform: TunPlatformOptions.optional().meta({
 		description: "Platform-specific settings, provided by client applications.",
 		description_zh: "平台特定的设置，由客户端应用提供。"
-	}),
-	gso: z.boolean().optional().meta({
-		description: "Enable generic segmentation offload.",
-		description_zh: "启用通用分段卸载。",
-		deprecated: true
-	}),
-	inet4_address: listableString.optional().meta({
-		description: "IPv4 prefix for the tun interface.",
-		description_zh: "tun 接口的 IPv4 前缀。",
-		deprecated: true
-	}),
-	inet6_address: listableString.optional().meta({
-		description: "IPv6 prefix for the tun interface.",
-		description_zh: "tun 接口的 IPv6 前缀。",
-		deprecated: true
-	}),
-	inet4_route_address: listableString.optional().meta({
-		description: "Use custom routes instead of default when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时使用自定义路由而不是默认路由。",
-		deprecated: true
-	}),
-	inet6_route_address: listableString.optional().meta({
-		description: "Use custom routes instead of default when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时使用自定义路由而不是默认路由。",
-		deprecated: true
-	}),
-	inet4_route_exclude_address: listableString.optional().meta({
-		description: "Exclude custom routes when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时排除自定义路由。",
-		deprecated: true
-	}),
-	inet6_route_exclude_address: listableString.optional().meta({
-		description: "Exclude custom routes when `auto_route` is enabled.",
-		description_zh: "启用 `auto_route` 时排除自定义路由。",
-		deprecated: true
-	}),
-	endpoint_independent_nat: z.boolean().optional().meta({
-		description: "Enable endpoint-independent NAT. This item is only available on the gvisor stack; other stacks are endpoint-independent NAT by default. Performance may degrade slightly, so it is not recommended to enable when it is not needed.",
-		description_zh: "启用独立于端点的 NAT。此项仅在 gvisor 栈上可用，其他栈默认启用独立于端点的 NAT。性能可能略有下降，因此不建议在不需要时启用。",
-		deprecated: true
-	}),
-	...ListenOptions.shape
+	})
 }).meta({
 	id: "TunInboundOptions",
 	title: "Tun Inbound",
@@ -3662,24 +3607,16 @@ const URLTestOutbound = z.object({
 });
 
 //#endregion
-//#region src/schema/protocols/shadowsocksr.ts
-const ShadowsocksROutboundOptions = z.object({
-	type: z.literal("shadowsocksr"),
-	tag: z.string().optional(),
-	method: z.string(),
-	password: z.string(),
-	obfs: z.string().optional(),
-	obfs_param: z.string().optional(),
-	protocol: z.string().optional(),
-	protocol_param: z.string().optional(),
-	network: Network.optional(),
-	...ServerOptions.shape,
-	...DialerOptions.shape
+//#region src/schema/protocols/block.ts
+const BlockOutboundOptions = z.object({
+	type: z.literal("block"),
+	tag: z.string().optional()
 }).meta({
-	id: "ShadowsocksROutboundOptions",
-	title: "ShadowsocksR Outbound",
-	title_zh: "ShadowsocksR 出站",
-	deprecated: true
+	id: "BlockOutboundOptions",
+	title: "Block Outbound",
+	title_zh: "Block 出站",
+	description: "Block outbound closes all incoming requests.",
+	description_zh: "Block 出站关闭所有传入请求。"
 });
 
 //#endregion
@@ -3764,14 +3701,14 @@ const Outbound = z.discriminatedUnion("type", [
 	ShadowsocksOutboundOptions,
 	VMessOutboundOptions,
 	TrojanOutboundOptions,
-	LegacyWireGuardOutboundOptions,
+	BlockOutboundOptions,
 	HysteriaOutboundOptions,
 	ShadowTLSOutboundOptions,
 	AnyTLSOutboundOptions,
 	Hysteria2OutboundOptions,
 	TUICOutboundOptions,
 	VLESSOutboundOptions,
-	ShadowsocksROutboundOptions,
+	NaiveOutboundOptions,
 	SSHOutboundOptions,
 	TorOutboundOptions,
 	SelectorOutbound,
@@ -3804,14 +3741,6 @@ const RuleActionRouteOptions = z.object({
 		description: "See Dial Fields (/configuration/shared/dial/#network_strategy) for details. Only take effect if outbound is direct without `outbound.bind_interface`, `outbound.inet4_bind_address` and `outbound.inet6_bind_address` set.",
 		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#network_strategy)。仅当出站为 direct 且 `outbound.bind_interface`、`outbound.inet4_bind_address` 与 `outbound.inet6_bind_address` 均未设置时生效。"
 	}),
-	network_type: listable(NetworkType).optional().meta({
-		description: "See Dial Fields (/configuration/shared/dial/#network_type) for details.",
-		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#network_type)。"
-	}),
-	fallback_network_type: listable(NetworkType).optional().meta({
-		description: "See Dial Fields (/configuration/shared/dial/#fallback_network_type) for details.",
-		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#fallback_network_type)。"
-	}),
 	fallback_delay: z.string().optional().meta({
 		description: "See Dial Fields (/configuration/shared/dial/#fallback_delay) for details.",
 		description_zh: "详情参阅 [拨号字段](/configuration/shared/dial/#fallback_delay)。"
@@ -3916,14 +3845,33 @@ const RuleActionRoute = z.object({
 	title: "Rule Action Route",
 	title_zh: "规则动作路由"
 });
+const RuleActionBypass = z.object({
+	action: z.literal("bypass").meta({
+		description: "Action type.",
+		description_zh: "动作类型。"
+	}),
+	outbound: z.string().optional().meta({
+		description: "Tag of target outbound.",
+		description_zh: "目标出站的标签。"
+	}),
+	...RuleActionRouteOptions.shape
+}).meta({
+	id: "RuleActionBypass",
+	title: "Rule Action Bypass",
+	title_zh: "规则动作绕过"
+});
 const RuleActionReject = z.object({
 	action: z.literal("reject").meta({
 		description: "Action type.",
 		description_zh: "动作类型。"
 	}),
-	method: z.enum(["default", "drop"]).optional().meta({
-		description: "`default`: Reply with TCP RST for TCP connections, and ICMP port unreachable for UDP packets. `drop`: Drop packets.",
-		description_zh: "`default`: 对于 TCP 连接回复 RST，对于 UDP 包回复 ICMP 端口不可达。`drop`: 丢弃数据包。"
+	method: z.enum([
+		"default",
+		"drop",
+		"reply"
+	]).optional().meta({
+		description: "`default`: Reply with TCP RST for TCP connections, ICMP port unreachable for UDP packets, and ICMP host unreachable for ICMP echo requests. `drop`: Drop packets. `reply`: Reply with ICMP echo reply for ICMP echo requests.",
+		description_zh: "`default`: 对 TCP 连接回复 RST，对 UDP 包回复 ICMP 端口不可达，并对 ICMP 回显请求回复 ICMP 主机不可达。`drop`: 丢弃数据包。`reply`: 对 ICMP 回显请求回复 ICMP 回显响应。"
 	}),
 	no_drop: z.boolean().optional().meta({
 		description: "If not enabled, `method` will be temporarily overwritten to `drop` after 50 triggers in 30s.",
@@ -3934,12 +3882,13 @@ const RuleActionReject = z.object({
 	title: "Rule Action Reject",
 	title_zh: "规则动作拒绝"
 });
+const DirectActionDialerOptions = DialerOptions.omit({ detour: true });
 const RuleActionDirect = z.object({
 	action: z.literal("direct").meta({
 		description: "Action type.",
 		description_zh: "动作类型。"
 	}),
-	...DialerOptions.shape
+	...DirectActionDialerOptions.shape
 }).meta({
 	id: "RuleActionDirect",
 	title: "Rule Action Direct",
@@ -4163,6 +4112,7 @@ const BaseRouteRule = z.object({
 const DefaultRouteRule = z.union([
 	BaseRouteRule.extend(RuleActionRouteByDefault.shape),
 	BaseRouteRule.extend(RuleActionRoute.shape),
+	BaseRouteRule.extend(RuleActionBypass.shape),
 	BaseRouteRule.extend(RuleActionReject.shape),
 	BaseRouteRule.extend(RuleActionHijackDNS.shape),
 	BaseRouteRule.extend(RuleActionRouteOptionsWithAction.shape),
@@ -4170,7 +4120,7 @@ const DefaultRouteRule = z.union([
 	BaseRouteRule.extend(RuleActionResolve.shape),
 	BaseRouteRule.extend(RuleActionDirect.shape)
 ]);
-const LogicalRouteRule = z.object({
+const BaseLogicalRouteRule = z.object({
 	type: z.literal("logical").meta({
 		description: "Rule type.",
 		description_zh: "规则类型。"
@@ -4189,7 +4139,18 @@ const LogicalRouteRule = z.object({
 		description: "Invert match result.",
 		description_zh: "反选匹配结果。"
 	})
-}).meta({
+});
+const LogicalRouteRule = z.union([
+	BaseLogicalRouteRule.extend(RuleActionRouteByDefault.shape),
+	BaseLogicalRouteRule.extend(RuleActionRoute.shape),
+	BaseLogicalRouteRule.extend(RuleActionBypass.shape),
+	BaseLogicalRouteRule.extend(RuleActionReject.shape),
+	BaseLogicalRouteRule.extend(RuleActionHijackDNS.shape),
+	BaseLogicalRouteRule.extend(RuleActionRouteOptionsWithAction.shape),
+	BaseLogicalRouteRule.extend(RuleActionSniff.shape),
+	BaseLogicalRouteRule.extend(RuleActionResolve.shape),
+	BaseLogicalRouteRule.extend(RuleActionDirect.shape)
+]).meta({
 	id: "LogicalRouteRule",
 	title: "Logical Route Rule",
 	title_zh: "逻辑路由规则"
@@ -4339,7 +4300,7 @@ const HeadlessRule = z.union([DefaultHeadlessRule, LogicalHeadlessRule]).meta({
 	title_zh: "无头规则"
 });
 const InlineRuleSetOptions = z.object({
-	type: z.literal("inline").meta({
+	type: z.literal("inline").optional().meta({
 		description: "Rule set type.",
 		description_zh: "规则集类型。"
 	}),
@@ -4408,7 +4369,7 @@ const RemoteRuleSetOptions = z.object({
 	title: "Remote Rule Set Options",
 	title_zh: "远程规则集选项"
 });
-const RuleSet = z.discriminatedUnion("type", [
+const RuleSet = z.union([
 	InlineRuleSetOptions,
 	LocalRuleSetOptions,
 	RemoteRuleSetOptions
@@ -4561,7 +4522,11 @@ const CCMServiceOptions = z.object({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
 	}),
-	...ListenOptions.shape
+	...ListenOptions.shape,
+	detour: z.string().optional().meta({
+		description: "Outbound tag for connecting to the Claude API.",
+		description_zh: "用于连接到 Claude API 的出站标签。"
+	})
 }).meta({
 	id: "CCMServiceOptions",
 	title: "CCM",
@@ -4620,7 +4585,7 @@ const DERPServiceOptions = z.object({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
 	}),
-	config_path: z.string().meta({
+	config_path: z.string().optional().meta({
 		description: "Derper configuration file path. Example: `derper.key`.",
 		description_zh: "Derper 配置文件路径。示例：`derper.key`。"
 	}),
@@ -4699,7 +4664,11 @@ const OCMServiceOptions = z.object({
 		description: "TLS configuration, see [TLS](/configuration/shared/tls/#inbound).",
 		description_zh: "TLS 配置，参阅 [TLS](/zh/configuration/shared/tls/#inbound)。"
 	}),
-	...ListenOptions.shape
+	...ListenOptions.shape,
+	detour: z.string().optional().meta({
+		description: "Outbound tag for connecting to the OpenAI API.",
+		description_zh: "用于连接到 OpenAI API 的出站标签。"
+	})
 }).meta({
 	id: "OCMServiceOptions",
 	title: "OCM",
@@ -4826,12 +4795,12 @@ const Configuration = z.object({
 	experimental: ExperimentalOptions.optional()
 }).meta({
 	id: "Configuration",
-	title: "Sing-box v1.13.0 Configuration",
-	title_zh: "Sing-box v1.13.0 配置文件",
-	description: "Sing-box v1.13.0 configuration file schema. Sing-box uses JSON for configuration files with log, dns, ntp, certificate, endpoints, inbounds, outbounds, route, services, and experimental sections.",
-	description_zh: "Sing-box v1.13.0 配置文件定义。sing-box 使用 JSON 作为配置文件格式，包含 log、dns、ntp、certificate、endpoints、inbounds、outbounds、route、services 与 experimental 字段。",
-	version: "1.13.0"
+	title: "Sing-box v1.13.13 Configuration",
+	title_zh: "Sing-box v1.13.13 配置文件",
+	description: "Sing-box v1.13.13 configuration file schema. Sing-box uses JSON for configuration files with log, dns, ntp, certificate, endpoints, inbounds, outbounds, route, services, and experimental sections.",
+	description_zh: "Sing-box v1.13.13 配置文件定义。sing-box 使用 JSON 作为配置文件格式，包含 log、dns、ntp、certificate、endpoints、inbounds、outbounds、route、services 与 experimental 字段。",
+	version: "1.13.13"
 });
 
 //#endregion
-export { AnyTLSInboundOptions, AnyTLSOutboundOptions, AnyTLSUser, CertificateOptions, Configuration, DHCPDNSServerOptions, DNSClientOptions, DNSOptions, DNSRule, DNSServer, DebugOptions, DialerOptions, DirectInboundOptions, DirectOutboundOptions, DomainResolverOptions, DomainStrategy, Endpoint, ExperimentalOptions, FakeIPDNSServerOptions, FwMark, GeoIPOptions, GeositeOptions, HTTP3DNSServerOptions, HTTPInboundOptions, HTTPOutboundOptions, HTTPProxyOptions, HTTPSDNSServerOptions, HeadlessRule, HostsDNSServerOptions, HttpHeader, Hysteria2InboundOptions, Hysteria2Masquerade, Hysteria2Obfs, Hysteria2OutboundOptions, Hysteria2User, HysteriaInboundOptions, HysteriaOutboundOptions, HysteriaUser, Inbound, InboundMultiplexOptions, InboundOptions, InboundTLSOptions, IpVersion, LegacyDNSFakeIPOptions, LegacyDNSServerOptions, LegacyWireGuardOutboundOptions, LegacyWireGuardPeer, ListenOptions, LocalDNSServerOptions, LogOptions, MixedInboundOptions, NTPOptions, NaiveInboundOptions, Network, NetworkStrategy, NetworkType, Outbound, OutboundMultiplexOptions, OutboundTLSOptions, QUICDNSServerOptions, RedirectInboundOptions, ResolvedDNSServerOptions, RouteOptions, RouteRule, RuleSet, SSHOutboundOptions, SelectorOutbound, ServerOptions, Service, ShadowTLSInboundOptions, ShadowTLSOutboundOptions, ShadowsocksDestination, ShadowsocksInboundOptions, ShadowsocksOutboundOptions, ShadowsocksROutboundOptions, ShadowsocksUser, SocksInboundOptions, SocksOutboundOptions, TCPDNSServerOptions, TLSDNSServerOptions, TProxyInboundOptions, TUICInboundOptions, TUICOutboundOptions, TUICUser, Tag, TailscaleDNSServerOptions, TailscaleEndpointOptions, TorOutboundOptions, TrojanInboundOptions, TrojanOutboundOptions, TrojanUser, TunInboundOptions, TunPlatformOptions, UDPDNSServerOptions, UDPOverTCPOptions, URLTestOutbound, V2RayTransportOptions, VLESSInboundOptions, VLESSOutboundOptions, VLESSUser, VMessInboundOptions, VMessOutboundOptions, VMessUser, WireGuardEndpointOptions, WireGuardPeer };
+export { AnyTLSInboundOptions, AnyTLSOutboundOptions, AnyTLSUser, BlockOutboundOptions, CertificateOptions, Configuration, DHCPDNSServerOptions, DNSClientOptions, DNSOptions, DNSRule, DNSServer, DebugOptions, DialerOptions, DirectInboundOptions, DirectOutboundOptions, DomainResolverOptions, DomainStrategy, Endpoint, ExperimentalOptions, FakeIPDNSServerOptions, FwMark, GeoIPOptions, GeositeOptions, HTTP3DNSServerOptions, HTTPInboundOptions, HTTPOutboundOptions, HTTPProxyOptions, HTTPSDNSServerOptions, HeadlessRule, HostsDNSServerOptions, HttpHeader, Hysteria2InboundOptions, Hysteria2Masquerade, Hysteria2Obfs, Hysteria2OutboundOptions, Hysteria2User, HysteriaInboundOptions, HysteriaOutboundOptions, HysteriaUser, Inbound, InboundMultiplexOptions, InboundTLSOptions, IpVersion, LegacyDNSFakeIPOptions, LegacyDNSServerOptions, ListenOptions, LocalDNSServerOptions, LogOptions, MixedInboundOptions, NTPOptions, NaiveInboundOptions, NaiveOutboundOptions, Network, NetworkStrategy, NetworkType, Outbound, OutboundMultiplexOptions, OutboundTLSOptions, QUICDNSServerOptions, RedirectInboundOptions, ResolvedDNSServerOptions, RouteOptions, RouteRule, RuleSet, SSHOutboundOptions, SelectorOutbound, ServerOptions, Service, ShadowTLSInboundOptions, ShadowTLSOutboundOptions, ShadowsocksDestination, ShadowsocksInboundOptions, ShadowsocksOutboundOptions, ShadowsocksUser, SocksInboundOptions, SocksOutboundOptions, TCPDNSServerOptions, TLSDNSServerOptions, TProxyInboundOptions, TUICInboundOptions, TUICOutboundOptions, TUICUser, Tag, TailscaleDNSServerOptions, TailscaleEndpointOptions, TorOutboundOptions, TrojanInboundOptions, TrojanOutboundOptions, TrojanUser, TunInboundOptions, TunPlatformOptions, UDPDNSServerOptions, UDPOverTCPOptions, URLTestOutbound, V2RayTransportOptions, VLESSInboundOptions, VLESSOutboundOptions, VLESSUser, VMessInboundOptions, VMessOutboundOptions, VMessUser, WireGuardEndpointOptions, WireGuardPeer };