# Aura outbound for sing-box

`outbound.Outbound` exposes a sing-box-shaped surface (`Network() / DialContext / ListenPacket`)
without importing `github.com/sagernet/sing-box`. This keeps the build self-contained for v1;
the next step is to vendor the sing-box module, register Aura via `init()` and add the JSON
options struct.

## Integration sketch (Option B from `docs/sing-box.md`)

```go
import (
    "github.com/sagernet/sing-box"
    "github.com/sagernet/sing-box/adapter"
    "github.com/sagernet/sing-box/option"
    auraout "github.com/aura/singbox-aura/aura/outbound"
)

func init() {
    sing-box.RegisterOutbound(auraout.Tag, func(ctx context.Context, router adapter.Router, logger logger.ContextLogger, tag string, options option.Outbound) (adapter.Outbound, error) {
        // Translate option fields to handshake.ClientConfig + transport.Options.
        // Construct &auraout.Outbound{...} and adapt to adapter.Outbound (DialContext signature).
    })
}
```

The exact `option.Outbound` schema is up to you — at minimum it needs:

* `server` (host:port)
* `tls.ca_cert_path` (PEM)
* `tls.cert_path`, `tls.key_path` (PEM, ECDSA P-256)
* `tls.server_name` (DNS SAN to verify in the server leaf)
* optional `knock_enabled`, `knock_secret_source = "ca_fingerprint"`

The packet path is **opaque IP** — Aura tunnels inner IP packets exactly as the existing Rust
client does. The router writes IPv4/IPv6 packets to the returned `net.PacketConn`; the same
conn yields incoming packets on `ReadFrom`. Multi-flow demultiplexing is the router's job, not
ours.