@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.7

package/lib/types/scope.d.ts

@@ -16,7 +16,8 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/scope
  */
 import { Context, Service } from '@deepseek-ai/cordis';
-import type { SandboxExecutionPolicy } from '@deepseek-ai/dsh-sandbox';
+import type { SandboxExecutionPolicy, SandboxMode } from '@deepseek-ai/dsh-sandbox';
+import type { RootAccess } from './roots.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         multiRootScope: MultiRootScopeService;
@@ -37,19 +38,82 @@ export interface AdditionalWorkspaceRoot {
      * ever registered.
      */
     recordedPath: string;
+    /**
+     * The write authority the registration carries (B9 three-state).
+     * `read-only` roots remain workspace members — instructions, LSP,
+     * workspace-file routing, and reads all still see them — but they are never
+     * part of `writableRoots` and never reach a write grant, under ANY mode.
+     * `inherit` follows the session mode; fixed `read-write` stays writable even
+     * under a read-only session.
+     */
+    access: RootAccess;
+    /** Registry withheld the positive grant; retain its recorded deny boundary. */
+    withheld?: boolean;
     /** Optional display alias. */
     alias?: string;
 }
+/** One granted workspace member, with the authority fact the enforcement reads. */
+export interface ScopeRoot {
+    /** Canonical absolute directory. */
+    readonly path: string;
+    /** The write authority the registration carries. */
+    readonly access: RootAccess;
+    /** Optional display alias. */
+    readonly alias?: string;
+    /** Stable registry identity. */
+    readonly id: string;
+}
 /**
  * The resolved scope of one confined call. `primaryRoot` equals the policy's
- * workspace root; `additionalRoots` are canonical, deduplicated, never equal to
- * the primary root, and empty in M1.
+ * workspace root; `additionalRoots` are canonical, deduplicated, never equal
+ * to the primary root.
  */
 export interface FilesystemScope {
     /** The session's workspace root (`session.header.cwd`, canonical). */
     primaryRoot: string;
-    /** Extra writable roots granted inside the same sandbox mechanism. */
+    /** Every granted member — ANY access level — canonical, in registry order. */
     additionalRoots: readonly string[];
+    /** The granted members with their access, in registry order. */
+    roots: readonly ScopeRoot[];
+    /**
+     * The members a write may reach under THIS call — the effective access
+     * (registration policy × session mode) narrowed by the tool cap.
+     */
+    writableRoots: readonly string[];
+    /**
+     * Registered boundaries THIS call must not write, including missing and
+     * redirected registrations. Negative restrictions never create a grant.
+     * It is the deny set enforcement reads: explicit
+     * `read-only` roots under `danger-full-access` (and wherever another grant,
+     * such as the platform temp area, would otherwise cover the same path), and
+     * every member when the call is tool-capped. Read access is unaffected —
+     * these are all still workspace members.
+     */
+    deniedRoots: readonly string[];
+    /**
+     * Whether this process holds the registry authority for the store. While it
+     * is `unavailable` — contended, storage-failed, config-invalid, or torn
+     * down — the empty root table is NOT evidence that nothing is restricted:
+     * the registrations this process cannot see may carry explicit `read-only`
+     * boundaries, so both writable modes limit writes to the primary root
+     * instead of trusting the empty deny set.
+     * A composition with no registry at all never reports `unavailable` — it can
+     * never have registered roots.
+     */
+    authority: 'available' | 'unavailable';
+    /**
+     * The canonical DSH home directory, present exactly when this scope appended
+     * it to `deniedRoots` — i.e. under `danger-full-access` while restrictions
+     * apply (a non-empty deny set or an unavailable authority). `$DSH_HOME`
+     * holds the store, the lease, the profiles and the user's own config: an
+     * ambient Full-access process must not edit them, so once the workspace
+     * carries ANY deny boundary the home joins it. Zero additional roots with a
+     * healthy authority never set this — the empty scope stays upstream-exact.
+     * Never set under `workspace-write` or `read-only`: those modes already
+     * confine writes by containment, so denying home adds nothing but the cost
+     * of a stale `FsTarget` re-resolution on every write.
+     */
+    protectedHome?: string;
 }
 /**
  * Canonicalize and sanitize one root list against a primary root: drop the
@@ -76,15 +140,65 @@ export declare function sanitizeAdditionalRoots(primaryRoot: string, roots: read
  */
 export declare const MULTI_ROOT_CONTEXT_NAME = "multi-root:scope";
 /**
- * Render the workspace topology the model is told about. Only roots are listed
- * (never files), and the sentence states the two facts a denied write would
- * otherwise have to teach: that the additional roots are part of the SAME
- * workspace, and that the session cwd is unchanged (requirement §5, §8).
- * @param primaryRoot - the canonical session workspace root.
- * @param additionalRoots - canonical additional roots, in scope order.
- * @returns the stable topology sentence.
+ * The deterministic sentence the model hears while the registry authority is
+ * unavailable under either writable mode — enforcement is then the
+ * primary-root-only one, which the prompt must not leave implicit.
+ */
+export declare const REGISTRY_UNAVAILABLE_NOTE: string;
+/**
+ * Render the workspace topology the model is told about. Pure: the text
+ * depends only on its inputs, so two consecutive assemblies of the same
+ * session state produce the same contribution byte for byte. Only granted
+ * members are ever listed — withheld, missing, or invalid roots never reach
+ * `roots` in the first place — and no host internals (ids, SIDs, store or
+ * lease paths) are ever named.
+ * @param options.platform - the host platform (`process.platform` of the contribution).
+ * @param options.mode - the session's sandbox mode.
+ * @param options.primaryRoot - the canonical session workspace root.
+ * @param options.roots - the granted additional members, in registry order.
+ * @param options.cappedTools - sorted tool names that can never write an additional root.
+ * @param options.toolAccessInvalid - invalid host config caps every additional-root write.
+ * @param options.authority - the registry-authority fact; `unavailable` under
+ *   `danger-full-access` and `workspace-write` limit writes to the primary root, which the
+ *   model must hear even when there is no topology to describe.
+ * @param options.protectedHome - the canonical DSH home when the scope appended
+ *   it to the deny set (`danger-full-access` with restrictions); stated by path
+ *   so the model can place the refusal.
+ * @returns the stable topology text; empty when there are no additional roots
+ *   and no downgrade to report.
  */
-export declare function renderWorkspaceRootsContext(primaryRoot: string, additionalRoots: readonly string[]): string;
+export declare function renderWorkspaceRootsContext(options: {
+    readonly platform: string;
+    readonly mode: SandboxMode;
+    readonly primaryRoot: string;
+    readonly roots: readonly ScopeRoot[];
+    readonly cappedTools: readonly string[];
+    readonly toolAccessInvalid?: boolean;
+    readonly authority?: 'available' | 'unavailable';
+    readonly protectedHome?: string;
+}): string;
+/**
+ * Plugin configuration for the `multi-root-scope` row.
+ */
+export interface Config {
+    /**
+     * Per-tool write caps: a listed tool may never write ANY additional root
+     * (the primary root and upstream behaviour are unchanged). `read-only` is
+     * the only legal value — a cap restricts, it can never widen past the
+     * root's own access.
+     */
+    readonly toolAccess?: Record<string, 'read-only'>;
+    /**
+     * The resolved DSH home directory (`$DSH_HOME` / `~/.dsh`), which the patch
+     * row fills from `dshHomePath()`. Under `danger-full-access` it joins the
+     * deny set exactly while restrictions apply — a non-empty derived deny set
+     * or an unavailable registry authority — so an ambient agent process cannot
+     * overwrite the store, the lease file, profiles, or the user's own config.
+     * Absent or invalid (non-string, empty, relative) means the boundary simply
+     * does not exist: bare test compositions carry no home.
+     */
+    readonly dshHome?: string;
+}
 /**
  * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
  * what the current scope is, which is what keeps the fs fence and every kernel
@@ -94,9 +208,37 @@ export declare class MultiRootScopeService extends Service {
     /** Additional roots keyed by canonical primary root; empty until roots are registered. */
     private readonly rootsByPrimary;
     private readonly listeners;
+    /**
+     * The registry-authority fact the registry row publishes. Defaults to
+     * `available`: a composition without a registry row can never have
+     * registered roots, so nothing is unknown there. The registry sets it false
+     * the moment it cannot prove the store is its own — before the lease is
+     * acquired, while contended or storage-failed, and at teardown — and true
+     * only after the accepted records have been published.
+     */
+    private registryAuthority;
+    /** Validated `toolAccess` row config; empty when no tool is capped. */
+    private readonly caps;
+    /** A malformed `toolAccess` refuses every additional-root write (fail closed). */
+    private readonly capsInvalid;
+    /**
+     * The configured DSH home boundary; `undefined` when the row carries no
+     * `dshHome` (bare test compositions) or one that is not an absolute string —
+     * an invalid value is logged at construction and ignored rather than
+     * treated as evidence.
+     */
+    private readonly dshHome;
     /** Observe registry publications; consumers still resolve authority from scopeOf(). */
     subscribe(listener: () => void): () => void;
-    constructor(ctx: Context);
+    /**
+     * The sorted names of the tools `toolAccess` caps — read-only for the
+     * prompt contribution. An invalid config is not enumerated (it caps every
+     * call but is not a listable tool set).
+     */
+    toolCaps(): readonly string[];
+    /** Whether malformed toolAccess caps every call, including unknown tools. */
+    get toolAccessInvalid(): boolean;
+    constructor(ctx: Context, config?: Config);
     /**
      * Resolve the scope of one confined call.
      * @param policy - the upstream policy whose workspace root is the primary root.
@@ -104,11 +246,45 @@ export declare class MultiRootScopeService extends Service {
      */
     resolve(policy: SandboxExecutionPolicy): FilesystemScope;
     /**
-     * The additional roots registered for one canonical primary root.
+     * Whether THIS call's additional-root writes are capped. Inside a tool
+     * dispatch the AsyncLocalStorage store answers; outside any dispatch (user
+     * PTY, panel, an unknown async boundary) the answer is fail-closed: capped
+     * whenever `toolAccess` names any tool, because an operation whose tool
+     * identity is unknown gets the most restrictive configured cap. Membership
+     * is never affected — only writability.
+     */
+    private capped;
+    /**
+     * The additional roots registered for one canonical primary root — every
+     * granted member, ANY access level (a read-only root is still a member of
+     * the workspace for instructions, LSP, routing, and reads).
      * @param primaryRoot - canonical primary root (or any spelling thereof).
      * @returns the canonical additional roots; empty when none are registered.
      */
     scopeOf(primaryRoot: string): readonly string[];
+    /**
+     * The additional roots a WRITE may reach for one primary root under
+     * `workspace-write` — the members whose effective access is writable there
+     * (`inherit` and fixed `read-write`). Tool caps are per-call and do not
+     * apply to this diagnostic projection.
+     * @param primaryRoot - canonical primary root (or any spelling thereof).
+     * @returns the canonical writable roots; empty when none qualify.
+     */
+    writableOf(primaryRoot: string): readonly string[];
+    /**
+     * Whether ANY registered primary currently publishes an explicit `read-only`
+     * member. The PTY seam resolves its caller through the agent-PTY
+     * environment markers; when that lookup fails this flag is the difference
+     * between pass-through (nothing to deny anywhere on the store) and fail
+     * closed. An unavailable registry authority answers `true` by itself: a
+     * terminal whose session cannot be resolved must not inherit a deny set
+     * this process cannot see.
+     * @returns whether at least one primary holds a restricted root, or the
+     *   registry cannot prove none does.
+     */
+    hasActiveDenyRoots(): boolean;
+    /** The sanitized members of one primary root, in registry order. */
+    private membersOf;
     /**
      * Replace the roots registered for one primary root.
      *
@@ -119,5 +295,15 @@ export declare class MultiRootScopeService extends Service {
      * @param roots - the additional roots, in display order.
      */
     setAdditionalRoots(primaryRoot: string, roots: readonly AdditionalWorkspaceRoot[]): void;
+    /**
+     * Publish the registry-authority fact. This is the REGISTRY's write port —
+     * the counterpart of {@link setAdditionalRoots}: the registry marks the
+     * scope `unavailable` the moment it stops being the store's authority
+     * (before acquisition, on contention or storage failure, at teardown) and
+     * `available` only once its stored records have been published. Nothing
+     * else may call it, and it never touches the root table.
+     * @param available - whether this process holds the registry authority.
+     */
+    setRegistryAuthority(available: boolean): void;
 }
 export default MultiRootScopeService;

package/lib/types/windows-broker.d.ts

@@ -0,0 +1,17 @@
+export declare function brokerPipeName(userSid: string): string;
+/** The broker must acknowledge before any ACL edits or process creation. The
+ * caller independently reads the deny-only groups from the token;
+ * even an impersonated pipe server cannot fabricate that kernel state.
+ */
+export declare function requestDenyToken(userSid: string, tokenHandle: bigint, deniedIds: readonly string[]): Promise<bigint>;
+/** Synchronous, bounded RPC inside the public suspended-create binding. The
+ * caller verifies the child's kernel token before the helper can resume it.
+ */
+export declare function assignDenyToken(userSid: string, processHandle: bigint, threadHandle: bigint, deniedIds: readonly string[], io: {
+    open(pipe: string): unknown;
+    write(pipe: unknown, bytes: Buffer): void;
+    available(pipe: unknown): number;
+    read(pipe: unknown, count: number): Buffer;
+    pause(): void;
+    close(pipe: unknown): void;
+}): void;

package/lib/types/windows-deny.d.ts

@@ -0,0 +1 @@
+export declare function runWindowsDenied(upstreamRunner: string, roots: readonly string[], argv: readonly string[], protectedHome?: string): Promise<number>;

package/lib/types/windows-profile.d.ts

@@ -1,13 +1,10 @@
-/** A root-set capability: removing or adding a root changes the token's identity. */
-export declare function workspaceScopeSid(roots: readonly string[]): string;
-export interface WindowsProfile {
-    workspace: string;
-    temp: string;
-    mode: 'workspace-write';
-    additionalRoots: string[];
-    writeSid?: string;
-    tempWriteSid?: string;
-}
-/** Strictly recognize the upstream public runner contract, failing closed on new flags. */
-export declare function parseWindowsProfile(args: readonly string[], allowAdditional?: boolean): WindowsProfile;
-export declare function widenWindowsProfile(profile: readonly string[], roots: readonly string[], primaryRoot?: string): string[];
+export { parseWindowsProfile, workspaceScopeSid, type WindowsProfile } from './windows-runner-contract.ts';
+/** Recognize the upstream runner, then select our ambient deny-token path.
+ *
+ * `protectedHome` is a diagnostics label only: when it names one of the deny
+ * roots it is forwarded as `--protected-home` so the runner can word its
+ * hardlink/scan remediation for the protected `$DSH_HOME`. It never changes
+ * which roots are denied or how.
+ */
+export declare function restrictWindowsProfile(profile: readonly string[], deniedRoots: readonly string[], protectedHome?: string): string[];
+export declare function widenWindowsProfile(profile: readonly string[], roots: readonly string[], deniedRoots: readonly string[], primaryRoot?: string): string[];

package/lib/types/windows-runner-contract.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The standalone Windows runner's contract — shared between the widened
+ * profile (`windows-profile.ts`, in-process) and `windows-runner.ts` (a
+ * separate Node process).
+ *
+ * ZERO bare-specifier imports: `lib/windows-runner.js` executes outside the
+ * host's plugin package resolution, so every module it statically reaches may
+ * import `node:` builtins only. tests/windows-multi-root.spec.ts and
+ * scripts/check-pack.mjs both walk the built runner's module graph and fail on
+ * any non-`node:` specifier.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/windows-runner-contract
+ */
+/** IPC budget, independent of the registry's configurable add limit. Historical
+ * over-limit stores retain their records. Beyond this native launch budget the
+ * whole ambient launch is refused before ACL edits; denies are never truncated.
+ * Keep the broker service's MaxDenyRoots in sync (covered by contract tests).
+ */
+export declare const MAX_WINDOWS_DENY_ROOTS = 256;
+export declare function assertWindowsDenyCapacity(count: number): void;
+/**
+ * Raised when a confined argv or a runner profile cannot be recognized or
+ * widened. The provider converts this into the fail-closed
+ * `SandboxUnavailableError`: an unrecognized dialect must never degrade into
+ * "the primary root was granted after all". Re-exported from `dialects.ts`.
+ */
+export declare class DialectUnrecognizedError extends Error {
+    constructor(message: string);
+}
+/**
+ * The canonical spelling of `path`, or `path` itself when it does not exist.
+ *
+ * Mirrors `canonicalPath` from `@deepseek-ai/dsh-sandbox`: the published
+ * package ships only its entry point, and this module may not import it at
+ * all (the runner resolves upstream packages from the upstream runner's own
+ * location, never from its own directory). Same precedent and justification
+ * as `src/containment.ts` (ADR-0002).
+ */
+export declare function canonicalPath(path: string): string;
+/**
+ * Whether a path names a Windows network or device location: two leading
+ * slashes or backslashes in any mix (`\\server\share`, `//server/share`,
+ * `\\?\…`, `\\.\…`). Windows ACL confinement cannot be shown to cover these —
+ * the restricted token's capability SID and Low label are not what an SMB
+ * server evaluates, and merely resolving an attacker-chosen UNC path triggers
+ * SMB authentication — so they are refused lexically, before any filesystem
+ * access. Because `canonicalPath` resolves a mapped drive letter to its
+ * `\\server\share` form, checking the canonical spelling also catches mapped
+ * network drives.
+ * @param path - the path spelling to test.
+ * @returns whether it is a network or device path.
+ */
+export declare function isWindowsNetworkOrDevicePath(path: string): boolean;
+/** A root-set capability: removing or adding a root changes the token's identity. */
+export declare function workspaceScopeSid(roots: readonly string[]): string;
+/** A standing deny identity, deliberately disjoint from all write capabilities. */
+export declare function rootDenySid(root: string): string;
+export interface WindowsProfile {
+    workspace: string;
+    temp: string;
+    /**
+     * `workspace-write` grants the workspace, the private temp, and every
+     * `--additional-root`. `read-only` is legal only on the widened form (the
+     * standalone runner): the runner then grants the additional roots ALONE — a
+     * workspace-write token over just those directories — which is how a fixed
+     * `read-write` additional root stays writable inside a read-only session
+     * (B9). An upstream `read-only` profile carries no `--additional-root`, so
+     * the mode only ever reaches the runner with grants attached.
+     */
+    mode: 'read-only' | 'workspace-write' | 'danger-full-access';
+    additionalRoots: string[];
+    deniedRoots: string[];
+    /**
+     * The upstream runner's own file (`--upstream-runner`). Required when
+     * `allowAdditional` parses — our standalone runner resolves
+     * `@deepseek-ai/dsh-sandbox-windows-acl` by package self-reference FROM this
+     * location, the only place that package is guaranteed importable.
+     */
+    upstreamRunner?: string;
+    /**
+     * Diagnostics label only (`--protected-home`): which `--deny-root` is the
+     * protected `$DSH_HOME`. It changes no authorization — every deny root's
+     * policy is identical — it only selects the remediation wording in
+     * hardlink/scan diagnostics. Valid only on the standalone
+     * `danger-full-access` form.
+     */
+    protectedHome?: string;
+    writeSid?: string;
+    tempWriteSid?: string;
+}
+/**
+ * Strictly recognize the upstream public runner contract, failing closed on
+ * new flags. `allowAdditional` is the standalone runner's own mode: it accepts
+ * repeated `--additional-root` and requires `--upstream-runner` exactly once
+ * naming an absolute, existing file — anything else exits 127 without a child.
+ */
+export declare function parseWindowsProfile(args: readonly string[], allowAdditional?: boolean): WindowsProfile;

package/lib/windows-runner-contract-CEfmZzu0.js

@@ -0,0 +1,141 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, win32 } from "node:path";
+import { createHash } from "node:crypto";
+function assertWindowsDenyCapacity(count) {
+	if (!Number.isInteger(count) || count < 1 || count > 256) throw new DialectUnrecognizedError(`Windows ambient restriction requires 1–256 deny roots including the protected DSH home; got ${count}. Reduce the registered restrictions before launching; no deny roots were dropped`);
+}
+/**
+* Raised when a confined argv or a runner profile cannot be recognized or
+* widened. The provider converts this into the fail-closed
+* `SandboxUnavailableError`: an unrecognized dialect must never degrade into
+* "the primary root was granted after all". Re-exported from `dialects.ts`.
+*/
+var DialectUnrecognizedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DialectUnrecognizedError";
+	}
+};
+/**
+* The canonical spelling of `path`, or `path` itself when it does not exist.
+*
+* Mirrors `canonicalPath` from `@deepseek-ai/dsh-sandbox`: the published
+* package ships only its entry point, and this module may not import it at
+* all (the runner resolves upstream packages from the upstream runner's own
+* location, never from its own directory). Same precedent and justification
+* as `src/containment.ts` (ADR-0002).
+*/
+function canonicalPath(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* Whether a path names a Windows network or device location: two leading
+* slashes or backslashes in any mix (`\\server\share`, `//server/share`,
+* `\\?\…`, `\\.\…`). Windows ACL confinement cannot be shown to cover these —
+* the restricted token's capability SID and Low label are not what an SMB
+* server evaluates, and merely resolving an attacker-chosen UNC path triggers
+* SMB authentication — so they are refused lexically, before any filesystem
+* access. Because `canonicalPath` resolves a mapped drive letter to its
+* `\\server\share` form, checking the canonical spelling also catches mapped
+* network drives.
+* @param path - the path spelling to test.
+* @returns whether it is a network or device path.
+*/
+function isWindowsNetworkOrDevicePath(path) {
+	return /^[\\/]{2}/.test(path);
+}
+/** A root-set capability: removing or adding a root changes the token's identity. */
+function workspaceScopeSid(roots) {
+	const paths = [...new Set(roots.map((root) => root.toLowerCase()))].sort();
+	const hash = createHash("sha256").update("dsh-multi-root-workspace\0").update(JSON.stringify(paths)).digest();
+	return `S-1-4-${[
+		0,
+		4,
+		8,
+		12
+	].map((offset) => hash.readUInt32LE(offset) % (2 ** 30 - 1) + 1).join("-")}-2`;
+}
+/** A standing deny identity, deliberately disjoint from all write capabilities. */
+function rootDenySid(root) {
+	const hash = createHash("sha256").update("dsh-multi-root-deny\0").update(root.toLowerCase()).digest();
+	return `S-1-4-${[
+		0,
+		4,
+		8,
+		12
+	].map((offset) => hash.readUInt32LE(offset) % (2 ** 30 - 1) + 1).join("-")}-3`;
+}
+/**
+* Strictly recognize the upstream public runner contract, failing closed on
+* new flags. `allowAdditional` is the standalone runner's own mode: it accepts
+* repeated `--additional-root` and requires `--upstream-runner` exactly once
+* naming an absolute, existing file — anything else exits 127 without a child.
+*/
+function parseWindowsProfile(args, allowAdditional = false) {
+	const fields = /* @__PURE__ */ new Map();
+	const additionalRoots = [];
+	const deniedRoots = [];
+	let upstreamRunner;
+	let protectedHome;
+	const known = /* @__PURE__ */ new Set([
+		"--workspace",
+		"--temp",
+		"--mode",
+		"--write-sid",
+		"--temp-write-sid"
+	]);
+	for (let index = 0; index < args.length; index += 2) {
+		const key = args[index];
+		const value = args[index + 1];
+		if (key === void 0 || value === void 0 || value === "") throw new DialectUnrecognizedError("Windows ACL profile has a missing value");
+		if (allowAdditional && key === "--additional-root") {
+			additionalRoots.push(value);
+			continue;
+		}
+		if (allowAdditional && key === "--deny-root") {
+			deniedRoots.push(value);
+			continue;
+		}
+		if (allowAdditional && key === "--upstream-runner") {
+			if (upstreamRunner !== void 0) throw new DialectUnrecognizedError("Windows ACL profile repeats --upstream-runner");
+			upstreamRunner = value;
+			continue;
+		}
+		if (allowAdditional && key === "--protected-home") {
+			if (protectedHome !== void 0) throw new DialectUnrecognizedError("Windows ACL profile repeats --protected-home");
+			protectedHome = value;
+			continue;
+		}
+		if (!known.has(key) || fields.has(key)) throw new DialectUnrecognizedError(`Windows ACL profile has unknown or duplicate flag ${key}`);
+		fields.set(key, value);
+	}
+	if (allowAdditional && upstreamRunner === void 0) throw new DialectUnrecognizedError("Windows multi-root runner requires --upstream-runner");
+	if (upstreamRunner !== void 0 && (!isAbsolute(upstreamRunner) || !existsSync(upstreamRunner) || !statSync(upstreamRunner).isFile())) throw new DialectUnrecognizedError(`--upstream-runner is not an absolute existing file: ${upstreamRunner}`);
+	const workspace = fields.get("--workspace");
+	const temp = fields.get("--temp");
+	const mode = fields.get("--mode");
+	if (workspace === void 0 || temp === void 0 || mode !== "workspace-write" && mode !== "read-only" && !(allowAdditional && mode === "danger-full-access")) throw new DialectUnrecognizedError("Windows multi-root requires --workspace, --temp, and --mode read-only or workspace-write");
+	if (mode === "danger-full-access" ? deniedRoots.length === 0 || additionalRoots.length > 0 || fields.has("--write-sid") || fields.has("--temp-write-sid") : deniedRoots.length > 0) throw new DialectUnrecognizedError("Windows ambient restriction requires deny roots only, without write grants or capability SIDs");
+	if (allowAdditional && mode === "read-only" && additionalRoots.length === 0) throw new DialectUnrecognizedError("Windows multi-root read-only requires at least one --additional-root");
+	const writeSid = fields.get("--write-sid");
+	const tempWriteSid = fields.get("--temp-write-sid");
+	if (writeSid === void 0 !== (tempWriteSid === void 0)) throw new DialectUnrecognizedError("Windows ACL profile requires both capability SIDs or neither");
+	if (protectedHome !== void 0 && (mode !== "danger-full-access" || !win32.isAbsolute(protectedHome) || !deniedRoots.some((root) => root.toLowerCase() === protectedHome.toLowerCase()))) throw new DialectUnrecognizedError("--protected-home must be an absolute member of the deny roots on a standalone danger-full-access profile");
+	return {
+		workspace,
+		temp,
+		mode,
+		additionalRoots,
+		deniedRoots,
+		...upstreamRunner === void 0 ? {} : { upstreamRunner },
+		...protectedHome === void 0 ? {} : { protectedHome },
+		...writeSid === void 0 ? {} : { writeSid },
+		...tempWriteSid === void 0 ? {} : { tempWriteSid }
+	};
+}
+//#endregion
+export { parseWindowsProfile as a, isWindowsNetworkOrDevicePath as i, assertWindowsDenyCapacity as n, rootDenySid as o, canonicalPath as r, workspaceScopeSid as s, DialectUnrecognizedError as t };