// Package sboxrun manages an embedded sing-box subprocess that
// implements the actual proxy engine (TUN inbound + per-process
// routing rule + SOCKS5 outbound).
//
// On first Start, the package extracts sing-box.exe + wintun.dll from
// embedded bytes into %PROGRAMDATA%\Drover\sboxrun\ (SHA256-verified),
// generates a JSON config from the GUI's proxy form, and launches
// sing-box as a child process. Stop kills the child cleanly.
package sboxrun

import _ "embed"

//go:embed assets/sing-box.exe
var singBoxExe []byte

//go:embed assets/wintun.dll
var wintunDLL []byte

// SHA256 sentinels for the embedded binaries — verified after extract.
// Update both when bumping versions:
//
//	sing-box: https://github.com/SagerNet/sing-box/releases
//	wintun:   https://www.wintun.net/
const (
	// Pinned to 1.12.25 — last release on the 1.12 line that still
	// accepts the legacy TUN inbound config layout. 1.13.0 removed
	// `address` from inbound and requires migration to rule-based
	// `endpoints` — when our config generator gets updated to that
	// shape, we can move to 1.13.x.
	SingBoxVersion = "1.12.25"
	SingBoxSHA256  = "fc7b65219abe8a0166d0b4891a2f7cabcbcc13b3adcf89e6d5913743a67aba10"
	WintunVersion  = "0.14.1"
	WintunSHA256   = "e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce"
)