devconfig-gen-singbox 2.0.0__tar.gz → 2.1.0__tar.gz

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devconfig_gen_singbox
-Version: 2.0.0
+Version: 2.1.0
 Summary: Provider-based developer configuration generation engine and CLI
 Author-email: henryliu443 <henryliu443@gmail.com>
 License-Expression: Apache-2.0
@@ -12,20 +12,23 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Provides-Extra: yaml
 Requires-Dist: PyYAML>=5.1; extra == "yaml"
+Provides-Extra: ops
+Requires-Dist: cryptography>=3.4; extra == "ops"
 Provides-Extra: dev
 Requires-Dist: build; extra == "dev"
 Requires-Dist: wheel; extra == "dev"
 Requires-Dist: PyYAML>=5.1; extra == "dev"
+Requires-Dist: cryptography>=3.4; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs-material<10,>=9.5; extra == "docs"
 Dynamic: license-file
 
-# DevConfig-Gen_SingBox
+# devconfig_gen_singbox
 
 > **A sing-box domain implementation built on top of DevConfig-Gen.**
 > **构建在 `DevConfig-Gen` 之上的 sing-box 领域实现（child / fork）。**
 
-[![Version](https://img.shields.io/badge/version-2.0.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.1.0-blue.svg)](CHANGELOG.md)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 ![Python 3.8+](https://img.shields.io/badge/python-3.8%2B-blue.svg)
 ![Tests](https://img.shields.io/badge/tests-136%20passing-brightgreen.svg)
@@ -43,7 +46,7 @@ DevConfig-Gen
   中立引擎 · Provider 契约 · 执行流水线
         │
         ▼
-DevConfig-Gen_SingBox
+devconfig_gen_singbox
   sing-box 领域 · 校验 · 转换 · server/client 变体
         │
         ▼
@@ -148,7 +151,7 @@ DevConfig-Gen                         (父仓库 · 主)
 │  Provider 契约
 │  执行流水线
 │
-└── DevConfig-Gen_SingBox             (子仓库 · 兵)
+└── devconfig_gen_singbox             (子仓库 · 兵)
        │  sing-box 领域知识
        │  领域校验
        │  协议转换
@@ -239,6 +242,37 @@ devconfig-gen schema   --provider singbox
 - **零副作用**：Provider 不读环境变量、不写 state、不调子进程；凭据与子域前缀
   全部显式输入。
 
+## 部署层 / Operations Layer（`singbox-ops`）
+
+生成与部署被刻意分开：`devconfig_gen` 只做纯函数配置生成；同仓库的
+`singbox_ops` 包负责所有副作用（DNS、证书、安装、systemd、防火墙、watchdog），
+并通过**库调用**使用引擎，绝不注册为 provider。
+
+```bash
+pip install -e ".[yaml,ops]"
+
+# 只组装 context（无副作用，方便审阅）
+singbox-ops context --plan examples/singbox-deploy.yaml > context.yaml
+
+# 干跑：打印将执行的每一步，不碰系统
+singbox-ops deploy --plan examples/singbox-deploy.yaml --dry-run
+
+# 真实部署 / 反向清理
+singbox-ops deploy  --plan examples/singbox-deploy.yaml
+singbox-ops destroy --plan examples/singbox-deploy.yaml
+```
+
+- **适配器**：`secrets`（sing-box 子进程 + 纯 Python 兜底）、`dns`（Cloudflare）、
+  `acme`（acme.sh + Cloudflare DNS-01）、`state`（可选 local JSON）、
+  `export`（本地文件）、`runtime`（packages / systemd / nftables-basic / warp）。
+- **可注入 runner**：所有副作用走 `CommandRunner`；`--dry-run` 使用记录器，
+  测试全部 mock，不需要真实 VPS。
+- **零污染**：`singbox_ops` 与 `devconfig_gen` 命名空间隔离，
+  引擎的零副作用契约保持不变。
+
+详见 [`ARCHITECTURE.md`](ARCHITECTURE.md#operations-layer-singbox_ops) 与
+[`examples/singbox-deploy.yaml`](examples/singbox-deploy.yaml)。
+
 ## 继承自 DevConfig-Gen 的引擎 / Inherited DevConfig-Gen Engine
 
 > 本仓库从 DevConfig-Gen 继承以下基础设施：
@@ -329,7 +363,7 @@ python3 scripts/smoke_rounds.py 8
 
 ## 仓库关系 / Repository Relationship
 
-- 本仓库是 **子仓库（child / fork）**：`DevConfig-Gen_SingBox`。
+- 本仓库是 **子仓库（child / fork）**：`devconfig_gen_singbox`。
 - **父仓库（parent / upstream）** 为
   [`DevConfig-Gen`](https://github.com/henryliu443/DevConfig-Gen)，拥有中立核心与
   [`PROVIDER_STANDARD.md`](PROVIDER_STANDARD.md)。

devconfig_gen_singbox-2.0.0/src/devconfig_gen_singbox.egg-info/PKG-INFO → devconfig_gen_singbox-2.1.0/README.md

@@ -1,31 +1,9 @@
-Metadata-Version: 2.4
-Name: devconfig_gen_singbox
-Version: 2.0.0
-Summary: Provider-based developer configuration generation engine and CLI
-Author-email: henryliu443 <henryliu443@gmail.com>
-License-Expression: Apache-2.0
-Keywords: configuration,json,yaml,code-generation,cli
-Classifier: Programming Language :: Python :: 3
-Classifier: Operating System :: OS Independent
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Provides-Extra: yaml
-Requires-Dist: PyYAML>=5.1; extra == "yaml"
-Provides-Extra: dev
-Requires-Dist: build; extra == "dev"
-Requires-Dist: wheel; extra == "dev"
-Requires-Dist: PyYAML>=5.1; extra == "dev"
-Provides-Extra: docs
-Requires-Dist: mkdocs-material<10,>=9.5; extra == "docs"
-Dynamic: license-file
-
-# DevConfig-Gen_SingBox
+# devconfig_gen_singbox
 
 > **A sing-box domain implementation built on top of DevConfig-Gen.**
 > **构建在 `DevConfig-Gen` 之上的 sing-box 领域实现（child / fork）。**
 
-[![Version](https://img.shields.io/badge/version-2.0.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.1.0-blue.svg)](CHANGELOG.md)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 ![Python 3.8+](https://img.shields.io/badge/python-3.8%2B-blue.svg)
 ![Tests](https://img.shields.io/badge/tests-136%20passing-brightgreen.svg)
@@ -43,7 +21,7 @@ DevConfig-Gen
   中立引擎 · Provider 契约 · 执行流水线
         │
         ▼
-DevConfig-Gen_SingBox
+devconfig_gen_singbox
   sing-box 领域 · 校验 · 转换 · server/client 变体
         │
         ▼
@@ -148,7 +126,7 @@ DevConfig-Gen                         (父仓库 · 主)
 │  Provider 契约
 │  执行流水线
 │
-└── DevConfig-Gen_SingBox             (子仓库 · 兵)
+└── devconfig_gen_singbox             (子仓库 · 兵)
        │  sing-box 领域知识
        │  领域校验
        │  协议转换
@@ -239,6 +217,37 @@ devconfig-gen schema   --provider singbox
 - **零副作用**：Provider 不读环境变量、不写 state、不调子进程；凭据与子域前缀
   全部显式输入。
 
+## 部署层 / Operations Layer（`singbox-ops`）
+
+生成与部署被刻意分开：`devconfig_gen` 只做纯函数配置生成；同仓库的
+`singbox_ops` 包负责所有副作用（DNS、证书、安装、systemd、防火墙、watchdog），
+并通过**库调用**使用引擎，绝不注册为 provider。
+
+```bash
+pip install -e ".[yaml,ops]"
+
+# 只组装 context（无副作用，方便审阅）
+singbox-ops context --plan examples/singbox-deploy.yaml > context.yaml
+
+# 干跑：打印将执行的每一步，不碰系统
+singbox-ops deploy --plan examples/singbox-deploy.yaml --dry-run
+
+# 真实部署 / 反向清理
+singbox-ops deploy  --plan examples/singbox-deploy.yaml
+singbox-ops destroy --plan examples/singbox-deploy.yaml
+```
+
+- **适配器**：`secrets`（sing-box 子进程 + 纯 Python 兜底）、`dns`（Cloudflare）、
+  `acme`（acme.sh + Cloudflare DNS-01）、`state`（可选 local JSON）、
+  `export`（本地文件）、`runtime`（packages / systemd / nftables-basic / warp）。
+- **可注入 runner**：所有副作用走 `CommandRunner`；`--dry-run` 使用记录器，
+  测试全部 mock，不需要真实 VPS。
+- **零污染**：`singbox_ops` 与 `devconfig_gen` 命名空间隔离，
+  引擎的零副作用契约保持不变。
+
+详见 [`ARCHITECTURE.md`](ARCHITECTURE.md#operations-layer-singbox_ops) 与
+[`examples/singbox-deploy.yaml`](examples/singbox-deploy.yaml)。
+
 ## 继承自 DevConfig-Gen 的引擎 / Inherited DevConfig-Gen Engine
 
 > 本仓库从 DevConfig-Gen 继承以下基础设施：
@@ -329,7 +338,7 @@ python3 scripts/smoke_rounds.py 8
 
 ## 仓库关系 / Repository Relationship
 
-- 本仓库是 **子仓库（child / fork）**：`DevConfig-Gen_SingBox`。
+- 本仓库是 **子仓库（child / fork）**：`devconfig_gen_singbox`。
 - **父仓库（parent / upstream）** 为
   [`DevConfig-Gen`](https://github.com/henryliu443/DevConfig-Gen)，拥有中立核心与
   [`PROVIDER_STANDARD.md`](PROVIDER_STANDARD.md)。

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devconfig_gen_singbox"
-version = "2.0.0"
+version = "2.1.0"
 authors = [
   { name = "henryliu443", email = "henryliu443@gmail.com" },
 ]
@@ -21,15 +21,18 @@ dependencies = []
 
 [project.optional-dependencies]
 yaml = ["PyYAML>=5.1"]
-dev = ["build", "wheel", "PyYAML>=5.1"]
+ops = ["cryptography>=3.4"]
+dev = ["build", "wheel", "PyYAML>=5.1", "cryptography>=3.4"]
 docs = ["mkdocs-material>=9.5,<10"]
 
 [project.scripts]
 devconfig-gen = "devconfig_gen.cli:main"
 devconfig_gen_singbox = "devconfig_gen.cli:main"
+singbox-ops = "singbox_ops.cli:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]
 
 [tool.setuptools.package-data]
 devconfig_gen = ["py.typed", "providers/singbox/data/*.json"]
+singbox_ops = ["templates/*.template"]

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/src/devconfig_gen/__init__.py

@@ -64,4 +64,4 @@ __all__ = [
     "loads",
     "validate_request",
 ]
-__version__ = "2.0.0"
+__version__ = "2.1.0"

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/src/devconfig_gen/providers/singbox/provider.py

@@ -37,6 +37,11 @@ TUN_EXCLUDED_ROUTES = [
     # Android VpnService already excludes loopback/link-local; excluding them
     # explicitly makes `configure tun interface: Bad address` (sing-box #2030).
     "10.0.0.0/8",
+    # Parallels Desktop Shared Network (host 10.211.55.1, DHCP/DNS/NAT for
+    # guest VMs). Listed explicitly so macOS strict_route does not capture
+    # VM NAT/DNS traffic into the sing-box TUN.
+    "10.211.55.0/24",
+    "10.211.55.1/32",
     "100.64.0.0/10",
     "172.16.0.0/12",
     "192.168.0.0/16",

devconfig_gen_singbox-2.0.0/README.md → devconfig_gen_singbox-2.1.0/src/devconfig_gen_singbox.egg-info/PKG-INFO

@@ -1,9 +1,34 @@
-# DevConfig-Gen_SingBox
+Metadata-Version: 2.4
+Name: devconfig_gen_singbox
+Version: 2.1.0
+Summary: Provider-based developer configuration generation engine and CLI
+Author-email: henryliu443 <henryliu443@gmail.com>
+License-Expression: Apache-2.0
+Keywords: configuration,json,yaml,code-generation,cli
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: yaml
+Requires-Dist: PyYAML>=5.1; extra == "yaml"
+Provides-Extra: ops
+Requires-Dist: cryptography>=3.4; extra == "ops"
+Provides-Extra: dev
+Requires-Dist: build; extra == "dev"
+Requires-Dist: wheel; extra == "dev"
+Requires-Dist: PyYAML>=5.1; extra == "dev"
+Requires-Dist: cryptography>=3.4; extra == "dev"
+Provides-Extra: docs
+Requires-Dist: mkdocs-material<10,>=9.5; extra == "docs"
+Dynamic: license-file
+
+# devconfig_gen_singbox
 
 > **A sing-box domain implementation built on top of DevConfig-Gen.**
 > **构建在 `DevConfig-Gen` 之上的 sing-box 领域实现（child / fork）。**
 
-[![Version](https://img.shields.io/badge/version-2.0.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.1.0-blue.svg)](CHANGELOG.md)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 ![Python 3.8+](https://img.shields.io/badge/python-3.8%2B-blue.svg)
 ![Tests](https://img.shields.io/badge/tests-136%20passing-brightgreen.svg)
@@ -21,7 +46,7 @@ DevConfig-Gen
   中立引擎 · Provider 契约 · 执行流水线
         │
         ▼
-DevConfig-Gen_SingBox
+devconfig_gen_singbox
   sing-box 领域 · 校验 · 转换 · server/client 变体
         │
         ▼
@@ -126,7 +151,7 @@ DevConfig-Gen                         (父仓库 · 主)
 │  Provider 契约
 │  执行流水线
 │
-└── DevConfig-Gen_SingBox             (子仓库 · 兵)
+└── devconfig_gen_singbox             (子仓库 · 兵)
        │  sing-box 领域知识
        │  领域校验
        │  协议转换
@@ -217,6 +242,37 @@ devconfig-gen schema   --provider singbox
 - **零副作用**：Provider 不读环境变量、不写 state、不调子进程；凭据与子域前缀
   全部显式输入。
 
+## 部署层 / Operations Layer（`singbox-ops`）
+
+生成与部署被刻意分开：`devconfig_gen` 只做纯函数配置生成；同仓库的
+`singbox_ops` 包负责所有副作用（DNS、证书、安装、systemd、防火墙、watchdog），
+并通过**库调用**使用引擎，绝不注册为 provider。
+
+```bash
+pip install -e ".[yaml,ops]"
+
+# 只组装 context（无副作用，方便审阅）
+singbox-ops context --plan examples/singbox-deploy.yaml > context.yaml
+
+# 干跑：打印将执行的每一步，不碰系统
+singbox-ops deploy --plan examples/singbox-deploy.yaml --dry-run
+
+# 真实部署 / 反向清理
+singbox-ops deploy  --plan examples/singbox-deploy.yaml
+singbox-ops destroy --plan examples/singbox-deploy.yaml
+```
+
+- **适配器**：`secrets`（sing-box 子进程 + 纯 Python 兜底）、`dns`（Cloudflare）、
+  `acme`（acme.sh + Cloudflare DNS-01）、`state`（可选 local JSON）、
+  `export`（本地文件）、`runtime`（packages / systemd / nftables-basic / warp）。
+- **可注入 runner**：所有副作用走 `CommandRunner`；`--dry-run` 使用记录器，
+  测试全部 mock，不需要真实 VPS。
+- **零污染**：`singbox_ops` 与 `devconfig_gen` 命名空间隔离，
+  引擎的零副作用契约保持不变。
+
+详见 [`ARCHITECTURE.md`](ARCHITECTURE.md#operations-layer-singbox_ops) 与
+[`examples/singbox-deploy.yaml`](examples/singbox-deploy.yaml)。
+
 ## 继承自 DevConfig-Gen 的引擎 / Inherited DevConfig-Gen Engine
 
 > 本仓库从 DevConfig-Gen 继承以下基础设施：
@@ -307,7 +363,7 @@ python3 scripts/smoke_rounds.py 8
 
 ## 仓库关系 / Repository Relationship
 
-- 本仓库是 **子仓库（child / fork）**：`DevConfig-Gen_SingBox`。
+- 本仓库是 **子仓库（child / fork）**：`devconfig_gen_singbox`。
 - **父仓库（parent / upstream）** 为
   [`DevConfig-Gen`](https://github.com/henryliu443/DevConfig-Gen)，拥有中立核心与
   [`PROVIDER_STANDARD.md`](PROVIDER_STANDARD.md)。

devconfig_gen_singbox-2.1.0/src/devconfig_gen_singbox.egg-info/SOURCES.txt

@@ -0,0 +1,86 @@
+LICENSE
+README.md
+pyproject.toml
+src/devconfig_gen/__init__.py
+src/devconfig_gen/cli.py
+src/devconfig_gen/engine.py
+src/devconfig_gen/formats.py
+src/devconfig_gen/models.py
+src/devconfig_gen/py.typed
+src/devconfig_gen/registry.py
+src/devconfig_gen/validation.py
+src/devconfig_gen/providers/__init__.py
+src/devconfig_gen/providers/custom.py
+src/devconfig_gen/providers/env_provider.py
+src/devconfig_gen/providers/json_provider.py
+src/devconfig_gen/providers/singbox/__init__.py
+src/devconfig_gen/providers/singbox/links.py
+src/devconfig_gen/providers/singbox/models.py
+src/devconfig_gen/providers/singbox/provider.py
+src/devconfig_gen/providers/singbox/route.py
+src/devconfig_gen/providers/singbox/schema.py
+src/devconfig_gen/providers/singbox/data/rules.json
+src/devconfig_gen/providers/singbox/plugins/__init__.py
+src/devconfig_gen/providers/singbox/plugins/anytls.py
+src/devconfig_gen/providers/singbox/plugins/base.py
+src/devconfig_gen/providers/singbox/plugins/hysteria2.py
+src/devconfig_gen/providers/singbox/plugins/tuic.py
+src/devconfig_gen_singbox.egg-info/PKG-INFO
+src/devconfig_gen_singbox.egg-info/SOURCES.txt
+src/devconfig_gen_singbox.egg-info/dependency_links.txt
+src/devconfig_gen_singbox.egg-info/entry_points.txt
+src/devconfig_gen_singbox.egg-info/requires.txt
+src/devconfig_gen_singbox.egg-info/top_level.txt
+src/singbox_ops/__init__.py
+src/singbox_ops/cli.py
+src/singbox_ops/adapters/__init__.py
+src/singbox_ops/adapters/base.py
+src/singbox_ops/adapters/acme/__init__.py
+src/singbox_ops/adapters/acme/base.py
+src/singbox_ops/adapters/acme/cloudflare_dns01.py
+src/singbox_ops/adapters/dns/__init__.py
+src/singbox_ops/adapters/dns/base.py
+src/singbox_ops/adapters/dns/cloudflare.py
+src/singbox_ops/adapters/export/__init__.py
+src/singbox_ops/adapters/export/local_files.py
+src/singbox_ops/adapters/runtime/__init__.py
+src/singbox_ops/adapters/runtime/nftables.py
+src/singbox_ops/adapters/runtime/packages.py
+src/singbox_ops/adapters/runtime/systemd.py
+src/singbox_ops/adapters/runtime/warp_watchdog.py
+src/singbox_ops/adapters/secrets/__init__.py
+src/singbox_ops/adapters/secrets/base.py
+src/singbox_ops/adapters/secrets/python_secrets.py
+src/singbox_ops/adapters/secrets/singbox_subprocess.py
+src/singbox_ops/adapters/secrets/static.py
+src/singbox_ops/adapters/state/__init__.py
+src/singbox_ops/adapters/state/local_json.py
+src/singbox_ops/core/__init__.py
+src/singbox_ops/core/command.py
+src/singbox_ops/core/context_builder.py
+src/singbox_ops/core/exceptions.py
+src/singbox_ops/core/network.py
+src/singbox_ops/core/orchestrator.py
+src/singbox_ops/core/plan.py
+src/singbox_ops/core/protocols.py
+src/singbox_ops/templates/singbox_auto_update.py.template
+src/singbox_ops/templates/warp_watchdog.sh.template
+tests/test_api_parity.py
+tests/test_cli_e2e.py
+tests/test_custom_provider.py
+tests/test_devconfig_core.py
+tests/test_env_provider.py
+tests/test_formats.py
+tests/test_merge.py
+tests/test_provider_metadata.py
+tests/test_singbox_ops_acme.py
+tests/test_singbox_ops_cli.py
+tests/test_singbox_ops_context_builder.py
+tests/test_singbox_ops_dns.py
+tests/test_singbox_ops_orchestrator.py
+tests/test_singbox_ops_plan.py
+tests/test_singbox_ops_runtime.py
+tests/test_singbox_ops_secrets.py
+tests/test_singbox_ops_state_export.py
+tests/test_singbox_provider.py
+tests/test_validation.py

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/src/devconfig_gen_singbox.egg-info/entry_points.txt

@@ -1,3 +1,4 @@
 [console_scripts]
 devconfig-gen = devconfig_gen.cli:main
 devconfig_gen_singbox = devconfig_gen.cli:main
+singbox-ops = singbox_ops.cli:main

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/src/devconfig_gen_singbox.egg-info/requires.txt

@@ -3,9 +3,13 @@
 build
 wheel
 PyYAML>=5.1
+cryptography>=3.4
 
 [docs]
 mkdocs-material<10,>=9.5
 
+[ops]
+cryptography>=3.4
+
 [yaml]
 PyYAML>=5.1

{devconfig_gen_singbox-2.0.0 → devconfig_gen_singbox-2.1.0}/src/devconfig_gen_singbox.egg-info/top_level.txt

@@ -1 +1,2 @@
 devconfig_gen
+singbox_ops

devconfig_gen_singbox-2.1.0/src/singbox_ops/__init__.py

@@ -0,0 +1,29 @@
+"""Deployment/operations layer for the sing-box provider.
+
+``devconfig_gen`` stays a pure, side-effect-free configuration engine. This
+sibling package owns everything that touches the outside world: DNS records,
+TLS certificates, package installation, systemd, firewall rules, watchdogs and
+state files.
+
+The two packages are deliberately isolated:
+
+- ``devconfig_gen``  -> context in, artifacts out. No I/O beyond explicit writes.
+- ``singbox_ops``    -> orchestrates side effects and *calls* the engine.
+
+Nothing in this package is registered as a ``ConfigProvider``.
+"""
+
+from __future__ import annotations
+
+from .core.exceptions import AdapterError, CommandError, OpsError, PlanError
+from .core.plan import DeployPlan, load_plan
+
+__all__ = [
+    "AdapterError",
+    "CommandError",
+    "DeployPlan",
+    "OpsError",
+    "PlanError",
+    "load_plan",
+]
+__version__ = "0.1.0"

devconfig_gen_singbox-2.1.0/src/singbox_ops/adapters/__init__.py

@@ -0,0 +1,27 @@
+"""Adapters: the pluggable ports on the ops dock.
+
+Each adapter is an ordinary Python class implementing a small protocol. We do
+**not** use setuptools entry points or dynamic discovery here: a plain name ->
+factory mapping keeps the two plugin systems (providers vs adapters) from
+tangling.
+"""
+
+from __future__ import annotations
+
+from .base import (
+    ACMEAdapter,
+    DNSAdapter,
+    ExportAdapter,
+    RuntimeAdapter,
+    SecretsAdapter,
+    StateAdapter,
+)
+
+__all__ = [
+    "ACMEAdapter",
+    "DNSAdapter",
+    "ExportAdapter",
+    "RuntimeAdapter",
+    "SecretsAdapter",
+    "StateAdapter",
+]

devconfig_gen_singbox-2.1.0/src/singbox_ops/adapters/acme/__init__.py

@@ -0,0 +1,7 @@
+"""ACME certificate adapters."""
+
+from __future__ import annotations
+
+from .cloudflare_dns01 import CloudflareDNS01ACME
+
+__all__ = ["CloudflareDNS01ACME"]

devconfig_gen_singbox-2.1.0/src/singbox_ops/adapters/acme/base.py

@@ -0,0 +1,16 @@
+"""ACME adapter contract."""
+
+from __future__ import annotations
+
+from typing import Mapping, Protocol, Sequence, Tuple
+
+
+class ACMEAdapter(Protocol):
+    def apply(
+        self,
+        hosts: Mapping[str, str],
+        protocols: Sequence[str],
+        *,
+        dry_run: bool = False,
+    ) -> Mapping[str, Tuple[str, str]]:
+        """Ensure certificates exist; return ``{protocol: (cert_path, key_path)}``."""

devconfig_gen_singbox-2.1.0/src/singbox_ops/adapters/acme/cloudflare_dns01.py

@@ -0,0 +1,130 @@
+"""acme.sh + Cloudflare DNS-01 certificate issuance.
+
+Renewal is intentionally *not* handled here: the adapter only makes sure a valid
+certificate exists. A systemd timer / cron job can call this adapter again, which
+is idempotent (a valid, host-matching certificate is left untouched).
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Mapping, Optional, Sequence, Tuple
+
+from ...core.command import CommandRunner, LocalCommandRunner
+from ...core.exceptions import AdapterError
+from ...core.protocols import CERT_PATHS, TLS_PROTOCOLS
+
+ACME_SH_PATH = "/root/.acme.sh/acme.sh"
+ACME_INSTALL_URL = "https://get.acme.sh"
+ACME_CA = "letsencrypt"
+CERT_VALIDITY_WINDOW = 30 * 24 * 3600
+CF_TOKEN_ENV = "CF_Token"
+CF_ZONE_ID_ENV = "CF_Zone_ID"
+RELOAD_CMD = "systemctl try-restart sing-box >/dev/null 2>&1 || true"
+
+SUPPORTED_PROTOCOLS = TLS_PROTOCOLS
+
+
+class CloudflareDNS01ACME:
+    def __init__(
+        self,
+        runner: Optional[CommandRunner] = None,
+        acme_sh: str = ACME_SH_PATH,
+        ca: str = ACME_CA,
+        token: Optional[str] = None,
+        zone_id: Optional[str] = None,
+        cert_paths: Optional[Mapping[str, Tuple[str, str]]] = None,
+        reload_cmd: str = RELOAD_CMD,
+    ):
+        self.runner = runner or LocalCommandRunner()
+        self.acme_sh = acme_sh
+        self.ca = ca
+        self.token = token
+        self.zone_id = zone_id
+        self.cert_paths = dict(cert_paths or CERT_PATHS)
+        self.reload_cmd = reload_cmd
+
+    # -- helpers ---------------------------------------------------------
+    def _dns_env(self) -> Mapping[str, str]:
+        token = (self.token or os.environ.get(CF_TOKEN_ENV, "")).strip()
+        zone_id = (self.zone_id or os.environ.get(CF_ZONE_ID_ENV, "")).strip()
+        if not token or not zone_id:
+            raise AdapterError(
+                "Cloudflare DNS-01 credentials missing; set CF_Token and CF_Zone_ID"
+            )
+        return {CF_TOKEN_ENV: token, CF_ZONE_ID_ENV: zone_id}
+
+    def cert_is_valid(self, cert_path: str, host: str) -> bool:
+        if not self.runner.exists(cert_path):
+            return False
+        check = self.runner.run(
+            ["openssl", "x509", "-in", cert_path, "-noout", "-checkend", str(CERT_VALIDITY_WINDOW)],
+            check=False,
+        )
+        if check.returncode != 0:
+            return False
+        san = self.runner.run(
+            ["openssl", "x509", "-in", cert_path, "-noout", "-ext", "subjectAltName"],
+            check=False,
+        )
+        return f"DNS:{host}" in (san.stdout or "")
+
+    def _ensure_acme_sh(self) -> str:
+        if self.runner.exists(self.acme_sh):
+            return self.acme_sh
+        self.runner.shell(f"curl -fsSL {ACME_INSTALL_URL} | sh", check=True)
+        if not self.runner.exists(self.acme_sh):
+            # Fall back to PATH lookup; the caller's runner may report a stub.
+            return "acme.sh"
+        return self.acme_sh
+
+    def _issue_and_install(self, host: str, cert_path: str, key_path: str) -> None:
+        env = self._dns_env()
+        if self.cert_is_valid(cert_path, host):
+            return
+        acme_sh = self._ensure_acme_sh()
+        self.runner.run([acme_sh, "--set-default-ca", "--server", self.ca], check=True)
+        self.runner.run(
+            [acme_sh, "--issue", "--dns", "dns_cf", "-d", host, "--keylength", "ec-256", "--server", self.ca],
+            check=True,
+            env=env,
+        )
+        self.runner.run(
+            [
+                acme_sh,
+                "--install-cert",
+                "-d",
+                host,
+                "--ecc",
+                "--fullchain-file",
+                cert_path,
+                "--key-file",
+                key_path,
+                "--reloadcmd",
+                self.reload_cmd,
+            ],
+            check=True,
+        )
+        self.runner.chmod(key_path, 0o600)
+
+    # -- adapter contract ------------------------------------------------
+    def apply(
+        self,
+        hosts: Mapping[str, str],
+        protocols: Sequence[str],
+        *,
+        dry_run: bool = False,
+    ) -> Mapping[str, Tuple[str, str]]:
+        wanted = [protocol for protocol in protocols if protocol in SUPPORTED_PROTOCOLS]
+        result: dict = {}
+        for protocol in wanted:
+            host = hosts.get(protocol)
+            if not host:
+                raise AdapterError(f"missing hostname for TLS protocol {protocol!r}")
+            cert_path, key_path = self.cert_paths[protocol]
+            if not dry_run:
+                self.runner.mkdir(os.path.dirname(cert_path), mode=0o700)
+                self.runner.mkdir(os.path.dirname(key_path), mode=0o700)
+                self._issue_and_install(host, cert_path, key_path)
+            result[protocol] = (cert_path, key_path)
+        return result