@sberpay-cli/cli-diagnostic 0.4.0-dev.4 → 0.4.0-dev.7

package/package/dist/cli.mjs

@@ -7375,7 +7375,7 @@ import { fileURLToPath } from "node:url";
 var NPM_PACKAGE = true ? "@sberpay-cli/cli-diagnostic" : "@sberpay-cli/cli";
 var kind = true ? "release" : "dev";
 var BUILD = {
-  sourceCommit: true ? "69476eab9e2bcd3f503aa72e038d52d8cafc2752" : "dev",
+  sourceCommit: true ? "9a9b74aaa8ed8a80225fe2dd94e6205b2c99352e" : "dev",
   profile: true ? "diagnostic" : "standard",
   kind,
   // Бандл — dist/cli.mjs в корне пакета; этот файл под tsx — packages/cli/src/core/.
@@ -7383,9 +7383,13 @@ var BUILD = {
 };
 var REINSTALL_HINT = `\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 sberpay-cli: npm i -g ${NPM_PACKAGE}`;
 
-// packages/cli/src/paymentMode/state.ts
-import { lstatSync, readFileSync, openSync as openSync2, closeSync as closeSync2, fstatSync, constants } from "node:fs";
-import { join } from "node:path";
+// packages/cli/src/core/privatePath.ts
+import { lstatSync } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+
+// packages/cli/src/core/windowsAcl.ts
+import { spawnSync } from "node:child_process";
+import { dirname, win32 } from "node:path";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -27055,12 +27059,104 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// packages/cli/src/core/windowsAcl.ts
+var Sid = external_exports.string().regex(/^S-1-(?:\d+-)*\d+$/);
+var Inspection = external_exports.object({ owner: Sid, currentUser: Sid, reparse: external_exports.literal(false), rules: external_exports.array(external_exports.object({ sid: Sid, allow: external_exports.boolean(), rights: external_exports.number().int() })).min(1) });
+var WRITE_ACCESS = 852310 | 1342177280;
+function assertWindowsAcl(value, policy) {
+  const parsed = Inspection.safeParse(value);
+  if (!parsed.success) throw Error("WINDOWS_ACL_UNSAFE");
+  const s = parsed.data, trusted = /* @__PURE__ */ new Set([s.currentUser, "S-1-5-18", "S-1-5-32-544"]);
+  if (!trusted.has(s.owner) || s.rules.some((r) => r.allow && !trusted.has(r.sid) && (policy === "private" ? r.rights !== 0 : (r.rights & WRITE_ACCESS) !== 0))) throw Error("WINDOWS_ACL_UNSAFE");
+}
+var SCRIPT = String.raw`
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=New-Object System.Text.UTF8Encoding($false)
+$p=[IO.Path]::GetFullPath($env:SBERPAY_ACL_PATH)
+$cursor=$p
+while($cursor){
+ if(Test-Path -LiteralPath $cursor){
+  $item=Get-Item -LiteralPath $cursor -Force
+  if(($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0){throw 'REPARSE_POINT'}
+ }
+ $next=[IO.Path]::GetDirectoryName($cursor)
+ if($next -eq $cursor){break};$cursor=$next
+}
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User
+if($env:SBERPAY_ACL_ACTION -eq 'create' -and !(Test-Path -LiteralPath $p)){
+ $acl=New-Object Security.AccessControl.DirectorySecurity
+ $acl.SetOwner($sid);$acl.SetAccessRuleProtection($true,$false)
+ foreach($id in @($sid.Value,'S-1-5-18','S-1-5-32-544')){
+  $principal=New-Object Security.Principal.SecurityIdentifier($id)
+  $rule=New-Object Security.AccessControl.FileSystemAccessRule($principal,'FullControl','ContainerInherit,ObjectInherit','None','Allow')
+  $acl.AddAccessRule($rule)
+ }
+ [IO.Directory]::CreateDirectory($p,$acl)|Out-Null
+}
+$acl=Get-Acl -LiteralPath $p
+$rules=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|ForEach-Object{
+ @{sid=$_.IdentityReference.Value;allow=($_.AccessControlType -eq 'Allow');rights=[int]$_.FileSystemRights}
+})
+@{owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;currentUser=$sid.Value;reparse=$false;rules=$rules}|ConvertTo-Json -Compress -Depth 5
+`;
+function windowsAclCommand(path2, action2, env = process.env) {
+  const root = env.SystemRoot;
+  if (!root || !win32.isAbsolute(root)) throw Error("WINDOWS_SYSTEM_ROOT_MISSING");
+  return { file: win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")], env: { SystemRoot: root, SBERPAY_ACL_PATH: path2, SBERPAY_ACL_ACTION: action2 } };
+}
+function inspect(path2, policy, action2) {
+  const c = windowsAclCommand(path2, action2);
+  const r = spawnSync(c.file, c.args, { env: c.env, encoding: "utf8", windowsHide: true, timeout: 1e4, maxBuffer: 128 * 1024 });
+  if (r.error || r.status !== 0) throw Error("WINDOWS_ACL_CHECK_FAILED");
+  let value;
+  try {
+    value = JSON.parse(r.stdout.trim().replace(/^\uFEFF/, ""));
+  } catch {
+    throw Error("WINDOWS_ACL_CHECK_FAILED");
+  }
+  assertWindowsAcl(value, policy);
+}
+function assertWindowsPrivatePath(path2) {
+  inspect(path2, "private", "inspect");
+}
+function ensureWindowsPrivateDirectory(path2) {
+  inspect(path2, "private", "create");
+}
+function assertWindowsHelperPath(path2) {
+  inspect(path2, "binary", "inspect");
+  inspect(dirname(path2), "binary", "inspect");
+}
+
+// packages/cli/src/core/privatePath.ts
+function assertPrivateFile(path2, info) {
+  const named = lstatSync(path2);
+  if (!info.isFile() || !named.isFile() || named.isSymbolicLink() || info.ino !== named.ino || info.dev !== named.dev) throw Error("UNSAFE_FILE");
+  if (process.platform === "win32") assertWindowsPrivatePath(path2);
+  else if (process.getuid && info.uid !== process.getuid() || info.mode & 63) throw Error("UNSAFE_FILE");
+}
+async function syncDirectory(path2) {
+  if (process.platform === "win32") return;
+  const f = await open2(path2, "r");
+  try {
+    await f.sync();
+  } finally {
+    await f.close();
+  }
+}
+
+// packages/cli/src/paymentMode/state.ts
+import { lstatSync as lstatSync2, readFileSync, openSync as openSync2, closeSync as closeSync2, fstatSync, constants } from "node:fs";
+import { join } from "node:path";
+
 // packages/cli/src/core/atomicFile.ts
-import { mkdirSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
-import { dirname } from "node:path";
+import { mkdirSync, existsSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
 import { randomUUID } from "node:crypto";
 function atomicJson(path2, value) {
-  mkdirSync(dirname(path2), { recursive: true, mode: 448 });
+  if (process.platform === "win32") {
+    ensureWindowsPrivateDirectory(dirname2(path2));
+    if (existsSync(path2)) assertWindowsPrivatePath(path2);
+  } else mkdirSync(dirname2(path2), { recursive: true, mode: 448 });
   const temp = `${path2}.${randomUUID()}.tmp`;
   try {
     const fd2 = openSync(temp, "wx", 384);
@@ -27072,7 +27168,7 @@ function atomicJson(path2, value) {
     }
     renameSync(temp, path2);
     if (process.platform !== "win32") {
-      const dir2 = openSync(dirname(path2), "r");
+      const dir2 = openSync(dirname2(path2), "r");
       try {
         fsyncSync(dir2);
       } finally {
@@ -27182,8 +27278,9 @@ function invalid() {
   throw new CliError(EXIT.CONFIG_OR_NETWORK, "PAYMENT_MODE_INVALID", "PAYMENT_MODE_INVALID: \u043D\u0430\u0441\u0442\u0440\u043E\u0439\u043A\u0430 \u0440\u0435\u0436\u0438\u043C\u0430 \u043E\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0438\u043B\u0438 \u043F\u043E\u0432\u0440\u0435\u0436\u0434\u0435\u043D\u0430; \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0439\u0442\u0435 payment-mode set.");
 }
 function checkDir(paths) {
-  const s = lstatSync(paths.configDir);
-  if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 63) !== 0) invalid();
+  const s = lstatSync2(paths.configDir);
+  if (!s.isDirectory() || s.isSymbolicLink() || process.platform !== "win32" && (s.mode & 63) !== 0) invalid();
+  if (process.platform === "win32") assertWindowsPrivatePath(paths.configDir);
 }
 function readPaymentMode(paths) {
   try {
@@ -27191,7 +27288,8 @@ function readPaymentMode(paths) {
     const fd2 = openSync2(modeFile(paths), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     try {
       const s = fstatSync(fd2);
-      if (!s.isFile() || s.size > 4096 || (s.mode & 63) !== 0) invalid();
+      assertPrivateFile(modeFile(paths), s);
+      if (s.size > 4096) invalid();
       return PaymentModeStateSchema.parse(JSON.parse(readFileSync(fd2, "utf8")));
     } finally {
       closeSync2(fd2);
@@ -27209,7 +27307,7 @@ async function writePaymentMode(paths, state) {
       if (e.code !== "ENOENT") throw e;
     }
     try {
-      const s = lstatSync(modeFile(paths));
+      const s = lstatSync2(modeFile(paths));
       if (!s.isFile() || s.isSymbolicLink()) invalid();
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
@@ -27222,8 +27320,8 @@ async function writePaymentMode(paths, state) {
 var modeLabel = { live: "\u0420\u0435\u0430\u043B\u044C\u043D\u044B\u0435 \u043F\u043B\u0430\u0442\u0435\u0436\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043D\u044B", blocked: "\u041E\u043F\u043B\u0430\u0442\u0430 \u043E\u0442\u043A\u043B\u044E\u0447\u0435\u043D\u0430", "invalid-token": "\u041F\u0440\u043E\u0431\u0430 \u0441 \u043F\u043E\u0432\u0440\u0435\u0436\u0434\u0451\u043D\u043D\u044B\u043C \u0442\u043E\u043A\u0435\u043D\u043E\u043C. \u041E\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u043F\u0438\u0441\u0430\u043D\u0438\u044F \u043D\u0435 \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043D\u043E" };
 
 // packages/cli/src/core/fileLock.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, renameSync as renameSync2, existsSync } from "node:fs";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, renameSync as renameSync2, existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname3, join as join2 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function processAlive(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0) return void 0;
@@ -27260,7 +27358,7 @@ function owner(path2) {
   }
 }
 async function withFileLock(path2, fn, timeoutMs = 5e3) {
-  mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
+  mkdirSync2(dirname3(path2), { recursive: true, mode: 448 });
   const nonce2 = randomUUID2(), deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -27287,7 +27385,7 @@ async function withFileLock(path2, fn, timeoutMs = 5e3) {
         } finally {
           if (acquired) rmSync2(reaper, { recursive: true, force: true });
         }
-        if (!existsSync(path2)) continue;
+        if (!existsSync2(path2)) continue;
       }
       if (Date.now() >= deadline)
         throw new CliError(EXIT.CONFIG_OR_NETWORK, "BINDING_BUSY", "\u0414\u0440\u0443\u0433\u0430\u044F \u043A\u043E\u043C\u0430\u043D\u0434\u0430 \u0432\u043B\u0430\u0434\u0435\u0435\u0442 \u0441\u043E\u0441\u0442\u043E\u044F\u043D\u0438\u0435\u043C \u0438\u043B\u0438 \u0432\u043B\u0430\u0434\u0435\u043B\u0435\u0446 \u0431\u043B\u043E\u043A\u0438\u0440\u043E\u0432\u043A\u0438 \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043D. \u041F\u043E\u0432\u0442\u043E\u0440\u0438\u0442\u0435 \u043F\u043E\u0437\u0436\u0435.");
@@ -27304,7 +27402,7 @@ async function withFileLock(path2, fn, timeoutMs = 5e3) {
 // packages/cli/src/probe/journal.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import {
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync4,
   rmSync as rmSync3,
@@ -27312,7 +27410,7 @@ import {
   openSync as openSync4,
   fsyncSync as fsyncSync3,
   closeSync as closeSync4,
-  lstatSync as lstatSync3
+  lstatSync as lstatSync4
 } from "node:fs";
 import { join as join4 } from "node:path";
 
@@ -27364,7 +27462,7 @@ import {
   closeSync as closeSync3,
   fsyncSync as fsyncSync2,
   fstatSync as fstatSync2,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
   openSync as openSync3,
   readFileSync as readFileSync3,
@@ -27381,14 +27479,16 @@ function journalError() {
   );
 }
 function privateDir(path2) {
-  mkdirSync3(path2, { recursive: true, mode: 448 });
-  const s = lstatSync2(path2);
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(path2);
+  else mkdirSync3(path2, { recursive: true, mode: 448 });
+  const s = lstatSync3(path2);
   if (!s.isDirectory() || s.isSymbolicLink() || process.platform !== "win32" && ((s.mode & 63) !== 0 || s.uid !== process.getuid?.()))
     journalError();
 }
 function registryDir(paths) {
-  mkdirSync3(paths.stateDir, { recursive: true, mode: 448 });
-  if (lstatSync2(paths.stateDir).isSymbolicLink()) journalError();
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(paths.stateDir);
+  else mkdirSync3(paths.stateDir, { recursive: true, mode: 448 });
+  if (lstatSync3(paths.stateDir).isSymbolicLink()) journalError();
   const dir2 = join3(paths.stateDir, "payment-probes");
   privateDir(dir2);
   return dir2;
@@ -27405,6 +27505,12 @@ function syncDir(dir2) {
 function openPrivate(path2, flags) {
   const fd2 = openSync3(path2, flags | (constants2.O_NOFOLLOW ?? 0), 384);
   const s = fstatSync2(fd2);
+  try {
+    assertPrivateFile(path2, s);
+  } catch {
+    closeSync3(fd2);
+    journalError();
+  }
   if (!s.isFile() || s.nlink !== 1 || s.size > MAX_FILE || process.platform !== "win32" && ((s.mode & 63) !== 0 || s.uid !== process.getuid?.())) {
     closeSync3(fd2);
     journalError();
@@ -27649,7 +27755,7 @@ function lockError(code) {
 }
 function ownerAlive(lock) {
   try {
-    if (lstatSync3(lock).isSymbolicLink()) journalError();
+    if (lstatSync4(lock).isSymbolicLink()) journalError();
     const raw = readFileSync4(join4(lock, "owner.json"), "utf8");
     if (raw.length > 256) journalError();
     const pid = JSON.parse(raw).pid;
@@ -27668,7 +27774,7 @@ function ownerAlive(lock) {
 async function exclusive(paths, recover, fn, installing2 = false) {
   const dir2 = registryDir(paths), lock = join4(dir2, ".lock");
   let recovered = false;
-  if (existsSync2(lock)) {
+  if (existsSync3(lock)) {
     if (ownerAlive(lock)) lockError("PROBE_BUSY");
     if (!recover) lockError("PROBE_STALE_LOCK");
     try {
@@ -27704,7 +27810,7 @@ async function exclusive(paths, recover, fn, installing2 = false) {
     }
     syncDir(lock);
     syncDir(dir2);
-    if (!installing2 && existsSync2(join4(paths.configDir, "../..", "install-pending.json")))
+    if (!installing2 && existsSync3(join4(paths.configDir, "../..", "install-pending.json")))
       throw new CliError(EXIT.CONFIG_OR_NETWORK, "INSTALL_IN_PROGRESS", "\u0423\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u0430 \u043D\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043D\u0430");
     return await fn();
   } finally {
@@ -28054,13 +28160,13 @@ function cliPaths(env = process.env) {
 }
 
 // packages/cli/src/report/storage.ts
-import { lstatSync as lstatSync4, mkdirSync as mkdirSync6, readdirSync as readdirSync2, unlinkSync } from "node:fs";
+import { lstatSync as lstatSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync2, unlinkSync } from "node:fs";
 import { join as join7 } from "node:path";
 
 // packages/cli/src/report/bindingFiles.ts
-import { open as open2, realpath, stat } from "node:fs/promises";
+import { open as open3, realpath, stat } from "node:fs/promises";
 import { constants as constants3 } from "node:fs";
-import { dirname as dirname3, isAbsolute, relative, resolve } from "node:path";
+import { dirname as dirname4, isAbsolute, relative, resolve } from "node:path";
 var BindingError = class extends Error {
   constructor(code, hint, reasonCode) {
     super(code);
@@ -28090,7 +28196,7 @@ async function futurePath(root, path2) {
       return target;
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
-      const parent = dirname3(ancestor);
+      const parent = dirname4(ancestor);
       if (parent === ancestor) throw new BindingError("PATH_OUTSIDE_ROOT");
       ancestor = parent;
     }
@@ -28100,9 +28206,10 @@ async function readPrefix(root, path2, maxBytes = 256 * 1024) {
   const canonicalRoot = await realpath(root);
   const canonical = await realpath(path2);
   if (!contained(canonicalRoot, canonical)) throw new BindingError("PATH_OUTSIDE_ROOT");
+  if (process.platform === "win32") assertWindowsHelperPath(canonical);
   const before = await stat(canonical);
   if (!before.isFile() || process.getuid && before.uid !== process.getuid()) throw new BindingError("UNSAFE_SOURCE");
-  const file2 = await open2(canonical, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0));
+  const file2 = await open3(canonical, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0));
   try {
     const now = await file2.stat();
     if (!now.isFile() || now.ino !== before.ino || now.dev !== before.dev) throw new BindingError("SOURCE_CHANGED");
@@ -28121,9 +28228,10 @@ async function readPrefix(root, path2, maxBytes = 256 * 1024) {
 
 // packages/cli/src/report/storage.ts
 function privateDir2(path2) {
-  mkdirSync6(path2, { recursive: true, mode: 448 });
-  const info = lstatSync4(path2);
-  if (!info.isDirectory() || info.isSymbolicLink() || process.getuid && info.uid !== process.getuid() || info.mode & 63) throw new BindingError("UNSAFE_REPORT_DIRECTORY");
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(path2);
+  else mkdirSync6(path2, { recursive: true, mode: 448 });
+  const info = lstatSync5(path2);
+  if (!info.isDirectory() || info.isSymbolicLink() || process.getuid && info.uid !== process.getuid() || process.platform !== "win32" && info.mode & 63) throw new BindingError("UNSAFE_REPORT_DIRECTORY");
   return path2;
 }
 function retain(dir2, pattern, maxBytes) {
@@ -28131,7 +28239,7 @@ function retain(dir2, pattern, maxBytes) {
   if (entries.length > 1e4) throw new BindingError("REPORT_STORAGE_ENTRY_LIMIT");
   const files = entries.filter((name) => pattern.test(name)).flatMap((name) => {
     const path2 = join7(dir2, name);
-    const info = lstatSync4(path2);
+    const info = lstatSync5(path2);
     return info.isFile() && !info.isSymbolicLink() ? [{ path: path2, size: info.size, mtime: info.mtimeMs }] : [];
   }).sort((a, b) => b.mtime - a.mtime);
   let total = 0;
@@ -28143,7 +28251,7 @@ function retain(dir2, pattern, maxBytes) {
 
 // packages/cli/src/report/transport.ts
 import { constants as constants4 } from "node:fs";
-import { open as open3, lstat, rename, rm, mkdir } from "node:fs/promises";
+import { open as open4, lstat, rename, rm, mkdir } from "node:fs/promises";
 import { join as join8 } from "node:path";
 import { request as httpsRequest } from "node:https";
 import { randomUUID as randomUUID4 } from "node:crypto";
@@ -28223,10 +28331,11 @@ function validatePackage(bytes, caseId) {
 
 // packages/cli/src/report/transport.ts
 async function privateRead(path2, limit) {
-  const file2 = await open3(path2, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  const file2 = await open4(path2, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
   try {
     const info = await file2.stat();
-    if (!info.isFile() || process.getuid && info.uid !== process.getuid() || info.mode & 63 || info.size > limit) throw Error("UNSAFE_FILE");
+    assertPrivateFile(path2, info);
+    if (info.size > limit) throw Error("UNSAFE_FILE");
     const buffer = Buffer.alloc(info.size);
     let at = 0;
     while (at < buffer.length) {
@@ -28275,7 +28384,7 @@ async function save(dir2, state) {
   const temp = join8(dir2, `.${randomUUID4()}.tmp`);
   const path2 = join8(dir2, `${state.caseId}.json`);
   try {
-    const file2 = await open3(temp, "wx", 384);
+    const file2 = await open4(temp, "wx", 384);
     try {
       await file2.writeFile(JSON.stringify({ ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }));
       await file2.sync();
@@ -28392,7 +28501,7 @@ import { homedir as homedir3 } from "node:os";
 import { join as join9 } from "node:path";
 
 // packages/cli/src/report/adapters/transcript.ts
-import { open as open4, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { open as open5, realpath as realpath2, stat as stat2 } from "node:fs/promises";
 import { constants as constants5 } from "node:fs";
 import { relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
@@ -28495,13 +28604,14 @@ async function collectTranscript(agent, parser3, binding, options = {}) {
       warn(result, "PATH_OUTSIDE_ROOT");
       return result;
     }
+    if (process.platform === "win32") assertWindowsHelperPath(path2);
     const before = await stat2(path2);
     if (!before.isFile()) {
       result.coverage = "failed";
       warn(result, "UNSAFE_SOURCE");
       return result;
     }
-    handle = await open4(path2, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0) | (constants5.O_NONBLOCK ?? 0));
+    handle = await open5(path2, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0) | (constants5.O_NONBLOCK ?? 0));
     const snapshot = await handle.stat();
     if (!snapshot.isFile() || snapshot.ino !== before.ino || snapshot.dev !== before.dev || process.getuid && snapshot.uid !== process.getuid()) {
       result.coverage = "failed";
@@ -28783,6 +28893,7 @@ async function codexBinding(env) {
     const dbPath = await realpath3(join9(home, name));
     const info = await stat3(dbPath);
     if (!contained(home, dbPath) || !info.isFile() || process.getuid && info.uid !== process.getuid()) throw new BindingError("UNSAFE_INDEX");
+    if (process.platform === "win32") assertWindowsHelperPath(dbPath);
     const db = new DatabaseSync(dbPath, { readOnly: true });
     try {
       db.exec("PRAGMA query_only=ON; PRAGMA busy_timeout=500");
@@ -29587,7 +29698,7 @@ function zipSync(data, opts) {
 }
 
 // packages/cli/src/core/version.ts
-var CLI_VERSION = "0.4.0-dev.4";
+var CLI_VERSION = "0.4.0-dev.7";
 
 // packages/cli/src/report/journal.ts
 import { closeSync as closeSync5, constants as constants6, openSync as openSync5, writeSync as writeSync2 } from "node:fs";
@@ -30606,7 +30717,7 @@ function registerPaymentModeCommands(program3) {
 
 // packages/cli/src/report/enrollment.ts
 import { generateKeyPairSync, createHash as createHash8, createPrivateKey, createPublicKey, randomUUID as randomUUID8, sign } from "node:crypto";
-import { open as open5, rename as rename4, rm as rm4 } from "node:fs/promises";
+import { open as open6, rename as rename4, rm as rm4 } from "node:fs/promises";
 import { join as join14 } from "node:path";
 import { request as httpsRequest2 } from "node:https";
 var DIAGNOSTIC_ENDPOINT = "https://aiplatilka.ru/case-reports";
@@ -30640,14 +30751,6 @@ var enrollmentPost = (path2, body) => new Promise((resolve6, reject) => {
   request.on("error", reject);
   request.end(bytes);
 });
-async function syncDir2(dir2) {
-  const f = await open5(dir2, "r");
-  try {
-    await f.sync();
-  } finally {
-    await f.close();
-  }
-}
 async function enrollInvitation(path2, env = process.env, request = enrollmentPost) {
   try {
     const invite = Invitation.parse(JSON.parse((await privateRead(path2, 8192)).toString("utf8")));
@@ -30656,20 +30759,20 @@ async function enrollInvitation(path2, env = process.env, request = enrollmentPo
     const statePath = join14(dir2, "report-installation.json");
     try {
       const pair = generateKeyPairSync("ed25519");
-      const file2 = await open5(statePath, "wx", 384);
+      const file2 = await open6(statePath, "wx", 384);
       try {
         await file2.writeFile(JSON.stringify({ invitationHash: hash3, installationId: randomUUID8(), privateKey: pair.privateKey.export({ format: "pem", type: "pkcs8" }), publicKey: pair.publicKey.export({ format: "pem", type: "spki" }) }));
         await file2.sync();
       } finally {
         await file2.close();
       }
-      await syncDir2(dir2);
+      await syncDirectory(dir2);
     } catch (error62) {
       if (error62.code !== "EEXIST") throw error62;
     }
     const state = State.parse(JSON.parse((await privateRead(statePath, 8192)).toString("utf8")));
     if (state.invitationHash !== hash3 || createPublicKey(state.privateKey).export({ format: "pem", type: "spki" }).toString() !== state.publicKey) throw Error("INSTALLATION_CONFLICT");
-    await syncDir2(dir2);
+    await syncDirectory(dir2);
     const body = { inviteToken: invite.token, installationId: state.installationId, publicKey: state.publicKey };
     const challenge = external_exports.object({ challenge: external_exports.string().max(2048) }).strict().parse(await request("/v1/enroll/challenge", body));
     const signature = sign(null, Buffer.from("sberpay-enroll-v1\n" + challenge.challenge), createPrivateKey(state.privateKey)).toString("base64url");
@@ -30677,7 +30780,7 @@ async function enrollInvitation(path2, env = process.env, request = enrollmentPo
     if (response.installationId !== state.installationId) throw Error("INSTALLATION_MISMATCH");
     const temp = join14(dir2, `.upload-${randomUUID8()}.tmp`);
     try {
-      const file2 = await open5(temp, "wx", 384);
+      const file2 = await open6(temp, "wx", 384);
       try {
         await file2.writeFile(JSON.stringify({ endpoint: DIAGNOSTIC_ENDPOINT, token: response.token }));
         await file2.sync();
@@ -30685,7 +30788,7 @@ async function enrollInvitation(path2, env = process.env, request = enrollmentPo
         await file2.close();
       }
       await rename4(temp, join14(dir2, "report-upload.json"));
-      await syncDir2(dir2);
+      await syncDirectory(dir2);
     } finally {
       await rm4(temp, { force: true });
     }
@@ -34065,10 +34168,11 @@ var program = new Command();
 
 // packages/cli/src/report/command.ts
 import { homedir as homedir5 } from "node:os";
-import { join as join16, dirname as dirname4, resolve as resolve2 } from "node:path";
+import { join as join16, dirname as dirname6, resolve as resolve2 } from "node:path";
 
 // packages/cli/src/report/claudeHook.ts
-import { open as open6, chmod, lstat as lstat3, mkdir as mkdir2, readFile as readFile2, realpath as realpath4, rename as rename5, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
+import { open as open7, chmod, lstat as lstat3, mkdir as mkdir2, readFile as readFile2, realpath as realpath4, rename as rename5, writeFile as writeFile4 } from "node:fs/promises";
 import { constants as constants7 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join15 } from "node:path";
@@ -34085,7 +34189,16 @@ async function captureClaudeBinding(input2, env = process.env) {
   if (/[\r\n\0]/.test(path2 + config2)) throw new BindingError("INVALID_HOOK_PATH");
   const lines = [["SBERPAY_CLAUDE_SESSION_ID", data.session_id], ["SBERPAY_CLAUDE_TRANSCRIPT", path2], ["SBERPAY_CLAUDE_CONFIG_DIR", config2]].map(([key, value]) => `export ${key}=${shellQuote(value)}
 `).join("");
-  const file2 = await open6(env.CLAUDE_ENV_FILE, constants7.O_WRONLY | constants7.O_APPEND | constants7.O_CREAT | (constants7.O_NOFOLLOW ?? 0) | (constants7.O_NONBLOCK ?? 0), 384);
+  if (process.platform === "win32") {
+    assertWindowsPrivatePath(dirname5(env.CLAUDE_ENV_FILE));
+    try {
+      await lstat3(env.CLAUDE_ENV_FILE);
+      assertWindowsPrivatePath(env.CLAUDE_ENV_FILE);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  const file2 = await open7(env.CLAUDE_ENV_FILE, constants7.O_WRONLY | constants7.O_APPEND | constants7.O_CREAT | (constants7.O_NOFOLLOW ?? 0) | (constants7.O_NONBLOCK ?? 0), 384);
   try {
     const info = await file2.stat();
     if (!info.isFile() || process.getuid && info.uid !== process.getuid()) throw new BindingError("UNSAFE_ENV_FILE");
@@ -34095,12 +34208,14 @@ async function captureClaudeBinding(input2, env = process.env) {
   }
 }
 async function installClaudeHook(configDir, command) {
-  await mkdir2(configDir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(configDir);
+  else await mkdir2(configDir, { recursive: true, mode: 448 });
   const path2 = join15(configDir, "settings.json");
   let original;
   try {
     const info = await lstat3(path2);
     if (!info.isFile() || info.isSymbolicLink()) throw new BindingError("UNSAFE_SETTINGS");
+    if (process.platform === "win32") assertWindowsPrivatePath(path2);
     original = await readFile2(path2, "utf8");
   } catch (error62) {
     if (error62.code !== "ENOENT") throw error62;
@@ -34132,7 +34247,7 @@ async function installClaudeHook(configDir, command) {
 // packages/cli/src/report/command.ts
 function claudeHookCommand() {
   const args = BUILD.kind === "release" ? [process.execPath, join16(BUILD.root, "dist", "cli.mjs")] : [process.execPath, "--import", import.meta.resolve("tsx"), join16(BUILD.root, "packages", "cli", "src", "main.ts")];
-  return [...args, "report", "claude-hook"].map(shellQuote).join(" ");
+  return [...args, "report", "claude-hook"].map((s) => shellQuote(process.platform === "win32" ? s.replaceAll("\\", "/") : s)).join(" ");
 }
 async function hookInput() {
   const chunks = [];
@@ -34196,7 +34311,7 @@ function registerReportCommands(program3) {
   for (const name of ["collect", "submit"]) report2.command(name).description(name === "collect" ? "\u0421\u043E\u0431\u0440\u0430\u0442\u044C \u043B\u043E\u043A\u0430\u043B\u044C\u043D\u044B\u0439 ZIP \u0442\u0435\u043A\u0443\u0449\u0435\u0433\u043E \u0447\u0430\u0442\u0430" : "\u0421\u043E\u0431\u0440\u0430\u0442\u044C \u043A\u0435\u0439\u0441 \u0438 \u043E\u0442\u043F\u0440\u0430\u0432\u0438\u0442\u044C \u0432 \u043D\u0430\u0441\u0442\u0440\u043E\u0435\u043D\u043D\u044B\u0439 HTTPS-\u043F\u0440\u0438\u0451\u043C\u043D\u0438\u043A").requiredOption("--input <path>", "JSON: title, scope=current_session, \u043D\u0435\u043E\u0431\u044F\u0437\u0430\u0442\u0435\u043B\u044C\u043D\u044B\u0435 request/expected/observed/agentSummary/hypotheses").addOption(new Option("--agent <agent>", "\u0438\u0441\u0442\u043E\u0447\u043D\u0438\u043A \u0442\u0435\u043A\u0443\u0449\u0435\u0439 \u0441\u0435\u0441\u0441\u0438\u0438").choices(["auto", "codex", "claude"]).default("auto")).action(async (opts) => {
     try {
       const path2 = resolve2(opts.input);
-      const text2 = await readPrefix(dirname4(path2), path2, 65537);
+      const text2 = await readPrefix(dirname6(path2), path2, 65537);
       if (Buffer.byteLength(text2) > 65536) throw new BindingError("CASE_INPUT_LIMIT");
       let input2;
       try {
@@ -34429,7 +34544,7 @@ function softwareDeviceKeys(storage, where = "os") {
 }
 
 // packages/device/src/helper.ts
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
 var HELPER_PROTOCOL = 1;
 var TIMEOUT_MS = 15e3;
 var MAX_OUTPUT_BYTES = 64 * 1024;
@@ -34497,7 +34612,7 @@ async function callHelper(path2, request, schema) {
   return parseReply(request.op, code, stdout, schema);
 }
 function callHelperSync(path2, request, schema) {
-  const result = spawnSync(path2, [], {
+  const result = spawnSync2(path2, [], {
     input: encode3(request),
     env: helperEnv(),
     stdio: ["pipe", "pipe", "ignore"],
@@ -34527,8 +34642,8 @@ function helperSecrets(helper) {
 
 // packages/device/src/hardware.ts
 import { createPublicKey as createPublicKey3, verify } from "node:crypto";
-import { chmodSync, closeSync as closeSync6, existsSync as existsSync3, fsyncSync as fsyncSync4, linkSync, mkdirSync as mkdirSync7, openSync as openSync6, readFileSync as readFileSync6, rmSync as rmSync4, writeSync as writeSync3 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { chmodSync, closeSync as closeSync6, existsSync as existsSync4, fsyncSync as fsyncSync4, linkSync, mkdirSync as mkdirSync7, openSync as openSync6, readFileSync as readFileSync6, rmSync as rmSync4, writeSync as writeSync3 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 var B64URL2 = external_exports.string().max(4096).regex(/^[A-Za-z0-9_-]+$/);
 var Point = external_exports.object({ x: B64URL2, y: B64URL2 });
 var Blobs = external_exports.object({ signKey: B64URL2, encKey: B64URL2 });
@@ -34544,7 +34659,7 @@ function toPublicKeys(pub) {
   return { deviceId: jwkThumbprint(publicKey), publicKey, encKey: jwk(pub.encPublicKey, "enc") };
 }
 function readBlobs(file2, kind2) {
-  if (!existsSync3(file2)) return void 0;
+  if (!existsSync4(file2)) return void 0;
   const parsed = KeyFile.safeParse((() => {
     try {
       return JSON.parse(readFileSync6(file2, "utf8"));
@@ -34556,7 +34671,7 @@ function readBlobs(file2, kind2) {
   return { signKey: parsed.data.signKey, encKey: parsed.data.encKey };
 }
 function saveNewBlobs(file2, kind2, blobs) {
-  mkdirSync7(dirname5(file2), { recursive: true, mode: 448 });
+  mkdirSync7(dirname7(file2), { recursive: true, mode: 448 });
   const tmp = `${file2}.${process.pid}.${Date.now()}.tmp`;
   const fd2 = openSync6(tmp, "wx", 384);
   try {
@@ -34589,7 +34704,7 @@ function checkSignature(pub, data, signature) {
   return signature;
 }
 async function hardwareAvailable(helper) {
-  if (!existsSync3(helper)) return false;
+  if (!existsSync4(helper)) return false;
   try {
     return (await callHelper(helper, { op: "status" }, external_exports.object({ available: external_exports.boolean() }))).available;
   } catch {
@@ -34619,7 +34734,7 @@ function hardwareDeviceKeys({ kind: kind2, helper, file: file2 }) {
   return {
     kind: kind2,
     storage: "hardware",
-    exists: () => Boolean(blobs) || existsSync3(file2),
+    exists: () => Boolean(blobs) || existsSync4(file2),
     ensure: publicKeys,
     async sign(data) {
       const signKey = required2().signKey;
@@ -34653,7 +34768,7 @@ function hardwareDeviceKeys({ kind: kind2, helper, file: file2 }) {
 }
 
 // packages/cli/src/core/context.ts
-import { appendFileSync, mkdirSync as mkdirSync9 } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync9, existsSync as existsSync8 } from "node:fs";
 import { join as join20 } from "node:path";
 
 // packages/netlog/src/masking.ts
@@ -34829,7 +34944,7 @@ async function loggedFetch(logger, meta3, url2, init = {}) {
 }
 
 // packages/cli/src/core/config.ts
-import { existsSync as existsSync4, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
 import { join as join17 } from "node:path";
 var STAND_NAMES = ["local", "ift", "prod"];
 var KEY_STORAGE_PREFERENCES = [
@@ -34853,7 +34968,7 @@ var DEFAULT_STANDS = {
   ift: { allowSoftwareKeys: true },
   // Шлюз ЭК ПРОМ (ЭлКом вышел на ПРОМ 07.10.2026). Реестр ФП временно на aiplatilka.ru. Кабинет под tsx — в config.json:
   // cabinetMockUrl для токена, выпущенного ЭлКом вручную, или cabinetOrigins и cabinetBaseUrl.
-  prod: { gatewayUrl: PROD_GATEWAY, merchantsUrl: PROD_MERCHANTS, addressesUrl: "https://aiplatilka.ru", addressesMode: "pilot-json", allowSoftwareKeys: false }
+  prod: { gatewayUrl: PROD_GATEWAY, merchantsUrl: PROD_MERCHANTS, addressesUrl: "https://aiplatilka.ru", addressesMode: "pilot-json", allowSoftwareKeys: true }
 };
 var RELEASE_PROD = {
   gatewayUrl: PROD_GATEWAY,
@@ -34863,7 +34978,7 @@ var RELEASE_PROD = {
   cabinetOrigins: [PROD_CABINET],
   cabinetBaseUrl: PROD_CABINET,
   staticUrl: PROD_CABINET,
-  allowSoftwareKeys: false
+  allowSoftwareKeys: true
 };
 var RELEASE_LOCKED = {
   local: ["cabinetMockUrl"],
@@ -34890,8 +35005,9 @@ function isStand(value) {
 }
 function loadConfig(paths, build = BUILD) {
   const file2 = join17(paths.configDir, "config.json");
-  if (!existsSync4(file2)) return defaultConfig(build);
+  if (!existsSync5(file2)) return defaultConfig(build);
   try {
+    if (process.platform === "win32") assertWindowsPrivatePath(file2);
     return { ...defaultConfig(build), ...JSON.parse(readFileSync8(file2, "utf8")) };
   } catch (error62) {
     throw new CliError(
@@ -35004,7 +35120,7 @@ function resolveStand(config2, name, build = BUILD) {
   if (merged.cabinetBaseUrl && !realOrigins.includes(new URL(merged.cabinetBaseUrl).origin)) {
     invalidField(name, "cabinetBaseUrl", "\u0430\u0434\u0440\u0435\u0441 \u043A\u0430\u0431\u0438\u043D\u0435\u0442\u0430 \u0441 origin \u0438\u0437 cabinetOrigins");
   }
-  const allowSoftwareKeys = defaults.allowSoftwareKeys === true && merged.allowSoftwareKeys !== false;
+  const allowSoftwareKeys = merged.allowSoftwareKeys !== false;
   return { ...merged, cabinetOrigins: mock ? [...realOrigins, mock] : realOrigins, allowSoftwareKeys };
 }
 async function updateConfig(paths, transform3) {
@@ -35018,7 +35134,7 @@ async function updateConfig(paths, transform3) {
 // packages/cli/src/core/secrets.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync9,
   renameSync as renameSync4,
@@ -35028,10 +35144,10 @@ import {
 import { join as join19 } from "node:path";
 
 // packages/cli/src/core/keyHelper.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5, realpathSync as realpathSync2, statSync } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute3, join as join18 } from "node:path";
-var PACKAGED = { "darwin-arm64": "darwin", "darwin-x64": "darwin", "linux-x64": "linux-x64", "linux-arm64": "linux-arm64" };
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync6, realpathSync as realpathSync2, statSync } from "node:fs";
+import { dirname as dirname8, isAbsolute as isAbsolute3, join as join18 } from "node:path";
+var PACKAGED = { "darwin-arm64": "darwin", "darwin-x64": "darwin", "linux-x64": "linux-x64", "linux-arm64": "linux-arm64", "win32-x64": "win32-x64", "win32-arm64": "win32-arm64" };
 function chipOf(platform2) {
   if (platform2 === "darwin") return "secure-enclave";
   return platform2 === "linux" || platform2 === "win32" ? "tpm" : void 0;
@@ -35057,17 +35173,25 @@ var TPM_LIBRARIES_HINT = "\u041F\u043E\u0441\u0442\u0430\u0432\u044C\u0442\u0435
 var LDD = "/usr/bin/ldd";
 var LDD_TIMEOUT_MS = 5e3;
 function missingLibraries(path2, platform2 = process.platform) {
-  if (platform2 !== "linux" || !existsSync5(LDD)) return [];
-  const result = spawnSync2(LDD, [path2], { encoding: "utf8", timeout: LDD_TIMEOUT_MS, env: { PATH: "/usr/bin:/bin" } });
+  if (platform2 !== "linux" || !existsSync6(LDD)) return [];
+  const result = spawnSync3(LDD, [path2], { encoding: "utf8", timeout: LDD_TIMEOUT_MS, env: { PATH: "/usr/bin:/bin" } });
   if (typeof result.stdout !== "string") return [];
   return result.stdout.split("\n").filter((line) => line.includes("=> not found")).map((line) => line.trim().split(/\s+/)[0] ?? "").filter(Boolean);
 }
 var WRITABLE_BY_GROUP = 16;
 var WRITABLE_BY_OTHERS = 2;
 function isTrustedFile(path2) {
+  if (process.platform === "win32") {
+    try {
+      assertWindowsHelperPath(path2);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   const real = realpathSync2(path2);
   const uid = process.getuid?.() ?? 0;
-  return [real, dirname6(real)].every((p) => {
+  return [real, dirname8(real)].every((p) => {
     const st = statSync(p);
     const groupOk = (st.mode & WRITABLE_BY_GROUP) === 0;
     return (st.uid === uid || st.uid === 0) && (st.mode & WRITABLE_BY_OTHERS) === 0 && groupOk;
@@ -35079,9 +35203,9 @@ function unavailable(message2, hint) {
 function findKeyHelper(opts) {
   const path2 = opts.override ?? opts.installed;
   if (!isAbsolute3(path2)) throw unavailable(`\u041F\u0443\u0442\u044C \u043A \u0445\u0435\u043B\u043F\u0435\u0440\u0443 ${path2} \u0434\u043E\u043B\u0436\u0435\u043D \u0431\u044B\u0442\u044C \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u044B\u043C`, "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 \u043F\u043E\u043B\u043D\u044B\u0439 \u043F\u0443\u0442\u044C \u0432 SBERPAY_KEY_HELPER");
-  if (!existsSync5(path2)) return void 0;
+  if (!existsSync6(path2)) return void 0;
   if (!isTrustedFile(path2)) {
-    throw unavailable(`\u0425\u0435\u043B\u043F\u0435\u0440 ${path2} \u043D\u0435 \u043F\u0440\u0438\u043D\u0430\u0434\u043B\u0435\u0436\u0438\u0442 \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044E \u0438\u043B\u0438 \u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D \u043D\u0430 \u0437\u0430\u043F\u0438\u0441\u044C \u0434\u0440\u0443\u0433\u0438\u043C`, "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 sberpay-cli; \u043F\u0440\u0430\u0432\u0430 \u043D\u0430 \u0445\u0435\u043B\u043F\u0435\u0440 \u0438 \u0435\u0433\u043E \u043A\u0430\u0442\u0430\u043B\u043E\u0433 \u2014 0755, \u0432\u043B\u0430\u0434\u0435\u043B\u0435\u0446 \u2014 \u0432\u044B \u0438\u043B\u0438 root");
+    throw unavailable(`\u0425\u0435\u043B\u043F\u0435\u0440 ${path2} \u043D\u0435 \u043F\u0440\u0438\u043D\u0430\u0434\u043B\u0435\u0436\u0438\u0442 \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044E \u0438\u043B\u0438 \u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D \u043D\u0430 \u0437\u0430\u043F\u0438\u0441\u044C \u0434\u0440\u0443\u0433\u0438\u043C`, "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 sberpay-cli; \u043F\u0440\u0430\u0432\u0430 \u043D\u0430 \u0445\u0435\u043B\u043F\u0435\u0440 \u0438 \u0435\u0433\u043E \u043A\u0430\u0442\u0430\u043B\u043E\u0433: Unix 0755; Windows \u2014 \u0437\u0430\u043F\u0438\u0441\u044C \u0442\u043E\u043B\u044C\u043A\u043E \u0432\u043B\u0430\u0434\u0435\u043B\u044C\u0446\u0443, SYSTEM \u0438 Administrators");
   }
   return path2;
 }
@@ -35112,7 +35236,7 @@ function helperError(action2, error62, softwareAllowed) {
 function osSecretStore(standName, stand, opts = {}) {
   const { env = process.env, platform: platform2 = process.platform } = opts;
   let secrets;
-  const open7 = () => {
+  const open8 = () => {
     if (secrets) return secrets;
     const backend = keyHelperBackend(platform2);
     if (!backend) throw keyringError(`\u041D\u0430 ${platform2} \u0445\u0440\u0430\u043D\u0438\u043B\u0438\u0449\u0430 \u0441\u0435\u043A\u0440\u0435\u0442\u043E\u0432 \u041E\u0421 \u043D\u0435\u0442`, FILE_HINT);
@@ -35125,7 +35249,7 @@ function osSecretStore(standName, stand, opts = {}) {
     return secrets;
   };
   const call = (action2, fn, name) => {
-    const store = open7();
+    const store = open8();
     try {
       return fn(store, `${standName}:${name}`);
     } catch (error62) {
@@ -35147,9 +35271,14 @@ function osSecretStore(standName, stand, opts = {}) {
 }
 function fileSecretStore(paths, stand) {
   const file2 = join19(paths.configDir, `secrets.${stand}.json`);
-  const read = () => existsSync6(file2) ? JSON.parse(readFileSync9(file2, "utf8")) : {};
+  const read = () => {
+    if (!existsSync7(file2)) return {};
+    if (process.platform === "win32") assertWindowsPrivatePath(file2);
+    return JSON.parse(readFileSync9(file2, "utf8"));
+  };
   const write = (data) => {
-    mkdirSync8(paths.configDir, { recursive: true, mode: 448 });
+    if (process.platform === "win32") ensureWindowsPrivateDirectory(paths.configDir);
+    else mkdirSync8(paths.configDir, { recursive: true, mode: 448 });
     if (Object.keys(data).length === 0) return rmSync5(file2, { force: true });
     const tmp = `${file2}.${process.pid}.tmp`;
     writeFileSync4(tmp, JSON.stringify(data), { mode: 384 });
@@ -35170,22 +35299,18 @@ function openSecretStore(paths, standName, stand, opts = {}) {
   const env = opts.env ?? process.env;
   if (env.SBERPAY_CLI_SECRETS !== "file")
     return osSecretStore(standName, stand, opts);
-  if (standName === "prod") {
-    throw new CliError(
-      EXIT.CONFIG_OR_NETWORK,
-      "INSECURE_SECRETS",
-      "\u041D\u0430 \u0441\u0442\u0435\u043D\u0434\u0435 prod \u0441\u0435\u043A\u0440\u0435\u0442\u044B \u0445\u0440\u0430\u043D\u044F\u0442\u0441\u044F \u0442\u043E\u043B\u044C\u043A\u043E \u0432 \u0445\u0440\u0430\u043D\u0438\u043B\u0438\u0449\u0435 \u041E\u0421",
-      { hint: "\u0423\u0431\u0435\u0440\u0438\u0442\u0435 SBERPAY_CLI_SECRETS=file" }
-    );
-  }
   return fileSecretStore(paths, standName);
 }
 
 // packages/cli/src/core/context.ts
 var DEFAULT_LOGGING = join20(BUILD.root, "config", "logging.yaml");
 function fileSink(paths, verbose) {
-  mkdirSync9(paths.stateDir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(paths.stateDir);
+  else mkdirSync9(paths.stateDir, { recursive: true, mode: 448 });
   const logFile = join20(paths.stateDir, "cli.log");
+  if (process.platform === "win32") {
+    if (existsSync8(logFile)) assertWindowsPrivatePath(logFile);
+  }
   return (line) => {
     appendFileSync(logFile, `${line}
 `, { mode: 384 });
@@ -35207,6 +35332,7 @@ function fileLogger(paths, verbose) {
 function buildCoreContext(opts, overridePaths) {
   const out = createOutput(Boolean(opts.json));
   const paths = overridePaths ?? cliPaths();
+  if (process.platform === "win32") for (const path2 of Object.values(paths)) ensureWindowsPrivateDirectory(path2);
   const config2 = loadConfig(paths);
   const requested = opts.stand ?? config2.stand;
   if (!isStand(requested)) throw new CliError(EXIT.VALIDATION, "INVALID_ARGUMENT", `\u041D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u044B\u0439 \u0441\u0442\u0435\u043D\u0434 \xAB${requested}\xBB: ${STAND_NAMES.join(", ")}`);
@@ -35235,7 +35361,7 @@ function buildCoreContext(opts, overridePaths) {
 }
 
 // packages/cli/src/schemes/v2/deviceKeys.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { join as join21 } from "node:path";
 var DEVICE_SECRETS = ["deviceSignKey", "deviceEncKey"];
 var SOFTWARE_ORDER = ["hardware", "os", "file"];
@@ -35267,12 +35393,13 @@ async function selectDeviceKeys(core, sel = {}) {
   if (pref !== "auto" && !allowed.includes(pref)) {
     throw unavailable2(
       `\u0421\u0442\u0435\u043D\u0434 ${core.standName}: \u043A\u043B\u044E\u0447\u0438 \u0443\u0441\u0442\u0440\u043E\u0439\u0441\u0442\u0432\u0430 \u0442\u043E\u043B\u044C\u043A\u043E \u0432 Secure Enclave \u0438\u043B\u0438 TPM, \u0445\u0440\u0430\u043D\u0438\u043B\u0438\u0449\u0435 ${pref} \u0437\u0430\u043F\u0440\u0435\u0449\u0435\u043D\u043E`,
-      "\u0414\u043B\u044F \u043F\u0440\u043E\u0432\u0435\u0440\u043A\u0438 \u0431\u0435\u0437 \u0447\u0438\u043F\u0430 \u2014 \u0441\u0442\u0435\u043D\u0434 local \u0438\u043B\u0438 ift (OQ-131)"
+      "\u0414\u043B\u044F \u0440\u0430\u0431\u043E\u0442\u044B \u0431\u0435\u0437 \u0447\u0438\u043F\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435 \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u043C\u043D\u044B\u0435 \u043A\u043B\u044E\u0447\u0438: allowSoftwareKeys: true"
     );
   }
   const backend = keyHelperBackend(platform2);
   const hint = backend ? keyHelperBuildHint(backend) : `\u041D\u0430 ${platform2} \u0430\u043F\u043F\u0430\u0440\u0430\u0442\u043D\u044B\u0445 \u043A\u043B\u044E\u0447\u0435\u0439 \u043D\u0435\u0442`;
   const hardwareFile = backend && hardwareKeyFile(core, backend.kind);
+  if (process.platform === "win32" && hardwareFile && existsSync9(hardwareFile)) assertWindowsPrivatePath(hardwareFile);
   let helperLookup;
   const keyHelper = () => {
     helperLookup ??= { path: backend && findKeyHelper({ override: overrides.SBERPAY_KEY_HELPER, installed: sel.installedHelper ?? backend.path }) };
@@ -35291,7 +35418,7 @@ async function selectDeviceKeys(core, sel = {}) {
     const cached2 = probes.get(storage);
     if (cached2) return cached2;
     const result = (() => {
-      if (storage === "hardware") return { ok: true, hasKeys: Boolean(hardwareFile && existsSync7(hardwareFile)) };
+      if (storage === "hardware") return { ok: true, hasKeys: Boolean(hardwareFile && existsSync9(hardwareFile)) };
       try {
         return { ok: true, hasKeys: stores[storage]().get(SIGN_KEY_NAME) !== void 0 };
       } catch {
@@ -35349,7 +35476,7 @@ async function selectDeviceKeys(core, sel = {}) {
     throw unavailable2("\u0425\u0440\u0430\u043D\u0438\u043B\u0438\u0449\u0435 \u041E\u0421 (keyring) \u043D\u0430 \u044D\u0442\u043E\u0439 \u043C\u0430\u0448\u0438\u043D\u0435 \u043D\u0435\u0434\u043E\u0441\u0442\u0443\u043F\u043D\u043E", "\u041D\u0430 \u043C\u0430\u0448\u0438\u043D\u0435 \u0431\u0435\u0437 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043A\u043E\u0439 \u0441\u0435\u0441\u0441\u0438\u0438: sberpay-cli auth login --key-storage file");
   throw unavailable2(
     softwareAllowed ? "\u041D\u0435\u0442 \u043D\u0438 \u0447\u0438\u043F\u0430, \u043D\u0438 \u0445\u0440\u0430\u043D\u0438\u043B\u0438\u0449\u0430 \u043A\u043B\u044E\u0447\u0435\u0439" : `\u0421\u0442\u0435\u043D\u0434 ${core.standName}: \u043D\u0443\u0436\u0435\u043D \u043A\u043B\u044E\u0447 \u0432 Secure Enclave \u0438\u043B\u0438 TPM, \u0430 \u0447\u0438\u043F \u043D\u0435\u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D`,
-    softwareAllowed ? hint : `${hint}. \u0414\u043B\u044F \u043F\u0440\u043E\u0432\u0435\u0440\u043A\u0438 \u0431\u0435\u0437 \u0447\u0438\u043F\u0430 \u2014 \u0441\u0442\u0435\u043D\u0434 local \u0438\u043B\u0438 ift (OQ-131)`
+    softwareAllowed ? hint : `${hint}. \u0414\u043B\u044F \u0440\u0430\u0431\u043E\u0442\u044B \u0431\u0435\u0437 \u0447\u0438\u043F\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435 \u043F\u0440\u043E\u0433\u0440\u0430\u043C\u043C\u043D\u044B\u0435 \u043A\u043B\u044E\u0447\u0438: allowSoftwareKeys: true`
   );
 }
 async function keyHelperStatus(platform2 = process.platform, installedHelper) {
@@ -35369,11 +35496,11 @@ async function keyHelperStatus(platform2 = process.platform, installedHelper) {
 }
 function deviceKeysExist(core, platform2 = process.platform, env = process.env) {
   const backend = keyHelperBackend(platform2);
-  if (backend && existsSync7(hardwareKeyFile(core, backend.kind))) return true;
+  if (backend && existsSync9(hardwareKeyFile(core, backend.kind))) return true;
   if (!core.stand.allowSoftwareKeys) return false;
-  const has = (open7) => {
+  const has = (open8) => {
     try {
-      return open7().get(SIGN_KEY_NAME) !== void 0;
+      return open8().get(SIGN_KEY_NAME) !== void 0;
     } catch {
       return false;
     }
@@ -38229,7 +38356,7 @@ async function prepareBinding(ctx, mode) {
 // packages/cli/src/schemes/v2/binding/launcher.ts
 import { spawn as spawn3 } from "node:child_process";
 import { openSync as openSync7, closeSync as closeSync7, mkdirSync as mkdirSync11 } from "node:fs";
-import { dirname as dirname7, join as join23 } from "node:path";
+import { dirname as dirname9, join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var Reply = external_exports.discriminatedUnion("type", [
   external_exports.object({ type: external_exports.literal("READY"), generation: external_exports.string() }),
@@ -38238,8 +38365,8 @@ var Reply = external_exports.discriminatedUnion("type", [
 ]);
 async function startLocalBinding(ctx, opts) {
   const scope = bindingScope(ctx);
-  const log = join23(dirname7(scope.recordPath), "worker.log");
-  mkdirSync11(dirname7(log), { recursive: true, mode: 448 });
+  const log = join23(dirname9(scope.recordPath), "worker.log");
+  mkdirSync11(dirname9(log), { recursive: true, mode: 448 });
   const fd2 = openSync7(log, "a", 384);
   let child;
   try {
@@ -38876,19 +39003,19 @@ function createScheme(core) {
 }
 
 // packages/cli/src/setup/command.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 
 // packages/cli/src/setup/collect.ts
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { resolve as resolve5 } from "node:path";
 
 // packages/cli/src/ca/rootCa.ts
 import { randomBytes as randomBytes3, X509Certificate as X509Certificate2 } from "node:crypto";
-import { closeSync as closeSync8, existsSync as existsSync8, fchmodSync, lstatSync as lstatSync5, mkdirSync as mkdirSync12, mkdtempSync, openSync as openSync8, readFileSync as readFileSync12, renameSync as renameSync5, rmSync as rmSync7, writeFileSync as writeFileSync5, writeSync as writeSync4 } from "node:fs";
+import { closeSync as closeSync8, existsSync as existsSync10, fchmodSync, lstatSync as lstatSync6, mkdirSync as mkdirSync12, mkdtempSync, openSync as openSync8, readFileSync as readFileSync12, renameSync as renameSync5, rmSync as rmSync7, writeFileSync as writeFileSync5, writeSync as writeSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname8, join as join24, resolve as resolve3 } from "node:path";
+import { dirname as dirname10, join as join24, resolve as resolve3 } from "node:path";
 var FETCH_TIMEOUT_MS = 15e3;
 var LOGIN_KEYCHAIN = "Library/Keychains/login.keychain-db";
 var SECURITY_BIN = "/usr/bin/security";
@@ -38920,11 +39047,11 @@ function verifyRootCert(data, root, now = /* @__PURE__ */ new Date()) {
 }
 function readFetchedRoot(paths, root = RUSSIAN_TRUSTED_ROOT_CA) {
   const file2 = rootCaFile(paths, root);
-  return existsSync8(file2) ? verifyRootCert(readFileSync12(file2), root) : void 0;
+  return existsSync10(file2) ? verifyRootCert(readFileSync12(file2), root) : void 0;
 }
 function ensureCaDir(dir2) {
   mkdirSync12(dir2, { recursive: true, mode: 448 });
-  const stat4 = lstatSync5(dir2);
+  const stat4 = lstatSync6(dir2);
   const foreign = typeof process.getuid === "function" && stat4.uid !== process.getuid();
   if (stat4.isSymbolicLink() || !stat4.isDirectory() || foreign) {
     throw new CliError(EXIT.CONFIG_OR_NETWORK, "CA_DIR_UNSAFE", `${dir2} \u2014 \u043D\u0435 \u0441\u0432\u043E\u0439 \u043A\u0430\u0442\u0430\u043B\u043E\u0433 (\u0441\u0438\u043C\u043B\u0438\u043D\u043A \u0438\u043B\u0438 \u0447\u0443\u0436\u043E\u0439 \u0432\u043B\u0430\u0434\u0435\u043B\u0435\u0446): \u0444\u0430\u0439\u043B \u043A\u043E\u0440\u043D\u044F \u0442\u0443\u0434\u0430 \u043D\u0435 \u043F\u0438\u0448\u0435\u043C`, {
@@ -38933,7 +39060,7 @@ function ensureCaDir(dir2) {
   }
 }
 function writeAtomically(path2, data, mode) {
-  const tmp = join24(dirname8(path2), `.${randomBytes3(6).toString("hex")}.tmp`);
+  const tmp = join24(dirname10(path2), `.${randomBytes3(6).toString("hex")}.tmp`);
   const fd2 = openSync8(tmp, "wx", mode);
   try {
     fchmodSync(fd2, mode);
@@ -38953,7 +39080,7 @@ async function fetchRootCa(deps) {
   const data = await callBytes(deps.logger, { op: `\u0441\u043A\u0430\u0447\u0438\u0432\u0430\u043D\u0438\u0435 \u043A\u043E\u0440\u043D\u044F ${root.name}`, peer: "\u0413\u043E\u0441\u0443\u0441\u043B\u0443\u0433\u0438", url: root.sourceUrl, timeoutMs: FETCH_TIMEOUT_MS });
   const cert = verifyRootCert(data, root);
   const path2 = rootCaFile(deps.paths, root);
-  ensureCaDir(dirname8(path2));
+  ensureCaDir(dirname10(path2));
   writeAtomically(path2, cert.toString(), 420);
   return { path: path2, jwkThumbprint: root.jwkThumbprint, fingerprint256: cert.fingerprint256, validTo: new Date(cert.validTo).toISOString(), sourceUrl: root.sourceUrl };
 }
@@ -39033,9 +39160,9 @@ function installRootCa(deps) {
 
 // packages/cli/src/setup/skill.ts
 import { createHash as createHash16 } from "node:crypto";
-import { cpSync, existsSync as existsSync9, lstatSync as lstatSync6, mkdirSync as mkdirSync13, readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync, realpathSync as realpathSync3, renameSync as renameSync6, rmSync as rmSync8, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { cpSync, existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync13, readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync, realpathSync as realpathSync3, renameSync as renameSync6, rmSync as rmSync8, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { basename, dirname as dirname9, join as join25, relative as relative3, resolve as resolve4 } from "node:path";
+import { basename, dirname as dirname11, join as join25, relative as relative3, resolve as resolve4 } from "node:path";
 var SKILL_NAME = "sberpay";
 var MANIFEST = ".sberpay-cli.json";
 var WORK_DIR = ".sberpay-cli";
@@ -39068,14 +39195,14 @@ function sameDir(a, b) {
 }
 function isLink(path2) {
   try {
-    return lstatSync6(path2).isSymbolicLink();
+    return lstatSync7(path2).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function readManifest(target) {
   const file2 = join25(target, MANIFEST);
-  if (!existsSync9(file2)) return void 0;
+  if (!existsSync11(file2)) return void 0;
   try {
     const data = JSON.parse(readFileSync13(file2, "utf8"));
     return typeof data.version === "string" && data.files && typeof data.files === "object" ? data : void 0;
@@ -39083,13 +39210,13 @@ function readManifest(target) {
     return void 0;
   }
 }
-var isStaleOwnLink = (target) => !existsSync9(target) && readlinkSync(target).replace(/[\\/]+$/, "").endsWith(join25("skill", SKILL_NAME));
+var isStaleOwnLink = (target) => !existsSync11(target) && readlinkSync(target).replace(/[\\/]+$/, "").endsWith(join25("skill", SKILL_NAME));
 function inspectSkill(source, target) {
   if (isLink(target)) {
-    if (existsSync9(target)) return sameDir(target, source) ? { state: "current", mode: "link" } : { state: "foreign" };
+    if (existsSync11(target)) return sameDir(target, source) ? { state: "current", mode: "link" } : { state: "foreign" };
     return isStaleOwnLink(target) ? { state: "outdated", mode: "link" } : { state: "foreign" };
   }
-  if (!existsSync9(target)) return { state: "missing" };
+  if (!existsSync11(target)) return { state: "missing" };
   const manifest = readManifest(target);
   if (!manifest) return { state: "foreign" };
   if (!sameFiles(hashFiles(target), manifest.files)) return { state: "modified", mode: "copy" };
@@ -39109,7 +39236,7 @@ function prepare(source, work, mode, version2) {
   return fresh;
 }
 function swap(fresh, target, aside, work) {
-  const previous = existsSync9(target) || isLink(target) ? aside ?? join25(work, `old-${process.pid}`) : void 0;
+  const previous = existsSync11(target) || isLink(target) ? aside ?? join25(work, `old-${process.pid}`) : void 0;
   if (previous) renameSync6(target, previous);
   try {
     renameSync6(fresh, target);
@@ -39129,7 +39256,7 @@ function installSkill(source, target, opts) {
       hint: "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u044C: sberpay-cli setup --force-skill \u2014 \u043F\u0440\u0435\u0436\u043D\u0438\u0439 \u043A\u0430\u0442\u0430\u043B\u043E\u0433 \u0443\u0439\u0434\u0451\u0442 \u0432 \u0431\u044D\u043A\u0430\u043F"
     });
   }
-  const work = join25(dirname9(target), WORK_DIR);
+  const work = join25(dirname11(target), WORK_DIR);
   mkdirSync13(work, { recursive: true });
   const backup = ours ? void 0 : join25(work, `backup-${basename(target)}-${(opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
   const fresh = prepare(source, work, opts.mode, opts.version);
@@ -39511,7 +39638,7 @@ function rootStep(stand, paths, root) {
     platform: process.platform,
     file: rootCaFile(paths, root),
     home: homedir7(),
-    exists: existsSync10,
+    exists: existsSync12,
     cert
   });
   return rootCaStep({
@@ -39608,10 +39735,10 @@ function run2(argv) {
   const self = process.argv[1];
   if (!head || head === "sberpay-cli" && !self) return false;
   const nested = head === "sberpay-cli" && rest.includes("setup");
-  const result = head === "sberpay-cli" ? spawnSync3(process.execPath, [...process.execArgv, self, ...rest, ...nested ? ["--yes", "--json"] : []], {
+  const result = head === "sberpay-cli" ? spawnSync4(process.execPath, [...process.execArgv, self, ...rest, ...nested ? ["--yes", "--json"] : []], {
     stdio: nested ? ["inherit", "pipe", "inherit"] : "inherit",
     encoding: "utf8"
-  }) : spawnSync3(head, rest, { stdio: "inherit", cwd: BUILD.root, shell: process.platform === "win32" });
+  }) : spawnSync4(head, rest, { stdio: "inherit", cwd: BUILD.root, shell: process.platform === "win32" });
   if (result.error) process.stderr.write(`\u2717 \u041D\u0435 \u0437\u0430\u043F\u0443\u0441\u0442\u0438\u043B\u043E\u0441\u044C ${argv.join(" ")}: ${result.error.message}
 `);
   if (nested && typeof result.stdout === "string") reportNestedError(result.stdout);
@@ -39665,14 +39792,14 @@ async function setupCommand(globals, opts) {
 }
 
 // packages/cli/src/ca/command.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync13 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 var INSTALL_TIMEOUT_MS = 12e4;
 var WHERE = { system: "\u0432 \u0434\u043E\u0432\u0435\u0440\u0435\u043D\u043D\u044B\u0445 \u043A\u043E\u0440\u043D\u044F\u0445 \u0441\u0438\u0441\u0442\u0435\u043C\u044B", extra: "\u0438\u0437 NODE_EXTRA_CA_CERTS (\u0441\u0438\u0441\u0442\u0435\u043C\u0430 \u0435\u0433\u043E \u043D\u0435 \u0437\u043D\u0430\u0435\u0442)" };
 function runSecurity(argv) {
   const [head = "", ...rest] = argv;
-  const result = spawnSync4(head, rest, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: INSTALL_TIMEOUT_MS });
+  const result = spawnSync5(head, rest, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: INSTALL_TIMEOUT_MS });
   return { status: result.status, stderr: result.error ? result.error.message : result.stderr };
 }
 function caStatusCommand(globals) {
@@ -39707,7 +39834,7 @@ async function caFetchCommand(globals) {
 function caInstallCommand(globals) {
   const out = createOutput(Boolean(globals.json));
   out.progress("\u0414\u043E\u0431\u0430\u0432\u043B\u044F\u044E \u043A\u043E\u0440\u0435\u043D\u044C \u0432 \u0434\u043E\u0432\u0435\u0440\u0435\u043D\u043D\u044B\u0435 \u043A\u043E\u0440\u043D\u0438 \u0441\u0438\u0441\u0442\u0435\u043C\u044B \u2014 \u0441\u0438\u0441\u0442\u0435\u043C\u0430 \u043C\u043E\u0436\u0435\u0442 \u0441\u043F\u0440\u043E\u0441\u0438\u0442\u044C \u043F\u0430\u0440\u043E\u043B\u044C\u2026");
-  const result = installRootCa({ paths: cliPaths(), platform: process.platform, home: homedir8(), exists: existsSync11, run: runSecurity });
+  const result = installRootCa({ paths: cliPaths(), platform: process.platform, home: homedir8(), exists: existsSync13, run: runSecurity });
   const human = result.installed ? `\u2713 ${result.say}` : [`\u041A\u043E\u043C\u0430\u043D\u0434\u0443 \u0432\u044B\u043F\u043E\u043B\u043D\u044F\u0435\u0442 \u0447\u0435\u043B\u043E\u0432\u0435\u043A: ${result.command ?? "\u2014"}`, `  ${result.say}`].join("\n");
   out.result(result, human);
 }