dodo-mcp 1.0.0

package/dist/setup/setup.js

@@ -0,0 +1,522 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { DodoError } from '../errors.js';
+import { resolveTrustedExecutable } from '../platform/execResolve.js';
+import { batchInvocation } from '../platform/shell.js';
+import { ensurePrivateDirectory } from '../platform/privateFs.js';
+import { isWithinPath } from '../platform/pathPolicy.js';
+import { renameWithRetry, removeWithRetry } from '../platform/fsRetry.js';
+import { findSpeechEngine } from '../platform/speech.js';
+import { SRT_VERSION } from '../platform/windowsSandbox.js';
+import { provisionWindowsSandbox } from './windowsSandboxInstall.js';
+import { installWindowsSpeech } from './windowsSpeechInstall.js';
+import { prepareWindowsChromiumSandboxAcl } from './windowsChromiumAcl.js';
+import { verifySandbox } from './sandboxProbe.js';
+import { verifyInstalledComponent } from './componentProbes.js';
+import { buildChildEnv } from '../security/env.js';
+import { loadGlobalConfig, GlobalConfigSchema } from '../config/globalConfig.js';
+import { sandboxAvailability } from '../services/jobs/sandbox.js';
+import { NativeDesktopBackend, setupNativeDesktop } from '../services/desktop/nativeBackend.js';
+import { activateManagedTools, registerManagedPath } from './managedTools.js';
+import { downloadVerified, verifiedFile, MODEL_PIN, WINDOWS_PINS, extractWindowsZip } from './download.js';
+import { importState, planStateImport } from '../config/stateImport.js';
+export const COMPONENTS = ['git', 'ripgrep', 'cloudflared', 'ffmpeg', 'whisper', 'model', 'chromium', 'lsp', 'speech', 'desktop', 'sandbox', 'web'];
+const WHISPER_COMMIT = '306c88f4d1286aec1bf96e544632897886af5501';
+const LSP_PACKAGES = ['pyright@1.1.414', 'vscode-langservers-extracted@4.10.0', 'yaml-language-server@1.24.0', 'bash-language-server@5.6.0'];
+const LSP_ENTRIES = {
+    python: { file: 'pyright/langserver.index.js', args: ['--stdio'], extensions: ['.py', '.pyi'] },
+    html: { file: 'vscode-langservers-extracted/bin/vscode-html-language-server', args: ['--stdio'], extensions: ['.html', '.htm'] },
+    css: { file: 'vscode-langservers-extracted/bin/vscode-css-language-server', args: ['--stdio'], extensions: ['.css', '.scss', '.less'] },
+    json: { file: 'vscode-langservers-extracted/bin/vscode-json-language-server', args: ['--stdio'], extensions: ['.json', '.jsonc'] },
+    yaml: { file: 'yaml-language-server/bin/yaml-language-server', args: ['--stdio'], extensions: ['.yaml', '.yml'] },
+    bash: { file: 'bash-language-server/out/cli.js', args: ['start'], extensions: ['.sh', '.bash'] },
+};
+const require = createRequire(import.meta.url);
+export function parseComponents(value) {
+    if (value === 'all')
+        return [...COMPONENTS];
+    const values = [...new Set(value.split(',').map(v => v.trim()))];
+    if (!values.length || values.some(v => !COMPONENTS.includes(v)))
+        throw new DodoError('INVALID_INPUT', `components must be all or a comma-separated selection of ${COMPONENTS.join(',')}`);
+    return values;
+}
+function executable(root, name) {
+    try {
+        return resolveTrustedExecutable(name, root);
+    }
+    catch {
+        return undefined;
+    }
+}
+function invocation(root, program, args) {
+    return process.platform === 'win32' && /\.(cmd|bat)$/i.test(program) ? batchInvocation(program, args, root) : { program, args, windowsVerbatimArguments: false };
+}
+function probe(root, name, args = ['--version']) {
+    const binary = executable(root, name);
+    if (!binary)
+        return undefined;
+    const call = invocation(root, binary, args);
+    const result = spawnSync(call.program, call.args, { cwd: root, env: buildChildEnv({ parentEnv: process.env, workspaceRoot: root, extraAllowlist: [] }), shell: false, windowsHide: true, windowsVerbatimArguments: call.windowsVerbatimArguments, encoding: 'utf8', timeout: 10000, maxBuffer: 65536 });
+    return !result.error && result.status === 0 ? `${binary}: ${(result.stdout || result.stderr).split(/\r?\n/)[0]?.slice(0, 200) ?? 'probe passed'}` : undefined;
+}
+function safeStateRoot(configDir, root) {
+    let nearest = path.resolve(configDir);
+    while (!fs.existsSync(nearest)) {
+        const parent = path.dirname(nearest);
+        if (parent === nearest)
+            break;
+        nearest = parent;
+    }
+    const real = fs.realpathSync.native(nearest);
+    if (isWithinPath(root, real) || isWithinPath(root, path.resolve(configDir)))
+        throw new DodoError('PATH_DENIED', 'setup state/tools must be outside the project workspace');
+}
+function setupContext(cwd) {
+    const root = fs.realpathSync.native(cwd);
+    // Setup is not a workspace server: running it from Home or a drive root
+    // must not classify every per-user installed tool as repository code.
+    return root === fs.realpathSync.native(os.homedir()) || root === path.parse(root).root ? fs.realpathSync.native(os.tmpdir()) : root;
+}
+export async function inspectSetup(options) {
+    const root = setupContext(options.cwd);
+    safeStateRoot(options.configDir, root);
+    activateManagedTools(options.configDir, root); // read-only ACL check; only this process gets the PATH entries.
+    const config = loadGlobalConfig(path.join(options.configDir, 'config.json'));
+    const results = [];
+    for (const component of options.components ?? COMPONENTS) {
+        let detail;
+        if (component === 'git')
+            detail = probe(root, 'git');
+        if (component === 'ripgrep')
+            detail = probe(root, 'rg');
+        if (component === 'cloudflared')
+            detail = probe(root, 'cloudflared');
+        if (component === 'ffmpeg') {
+            const a = probe(root, 'ffmpeg', ['-version']), b = probe(root, 'ffprobe', ['-version']);
+            if (a && b)
+                detail = `${a}; ffprobe probe passed`;
+        }
+        if (component === 'whisper')
+            detail = probe(root, 'whisper-cli', ['--help']) ?? probe(root, 'whisper-cpp', ['--help']);
+        if (component === 'model' && await verifiedFile(path.join(options.configDir, 'models', 'ggml-tiny.bin'), MODEL_PIN))
+            detail = 'multilingual tiny model: exact pinned SHA-256 and size verified';
+        if (component === 'chromium') {
+            const { chromium } = await import('playwright');
+            const binary = chromium.executablePath();
+            try {
+                const stat = fs.lstatSync(binary);
+                if (stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1)
+                    detail = 'Playwright-matched Chromium executable is present; deep launch verifies its browser sandbox';
+            }
+            catch { /* missing browser remains missing */ }
+        }
+        if (component === 'lsp' && Object.keys(LSP_ENTRIES).every(language => {
+            const server = config.lsp[language];
+            if (!server)
+                return false;
+            try {
+                resolveTrustedExecutable(server.command, root, { allowAbsolute: true, allowBatch: false });
+                return !server.args[0] || !path.isAbsolute(server.args[0]) || (fs.existsSync(server.args[0]) && fs.statSync(server.args[0]).isFile());
+            }
+            catch {
+                return false;
+            }
+        }))
+            detail = 'Python/HTML/CSS/JSON/YAML/Bash registered with available executables; existing owner registrations preserved (protocol behavior is tested separately)';
+        if (component === 'speech') {
+            const engine = findSpeechEngine(root);
+            if (engine)
+                detail = `${engine.kind}: ${engine.program}`;
+        }
+        if (component === 'desktop') {
+            const backend = new NativeDesktopBackend(options.configDir);
+            if (backend.available()) {
+                try {
+                    const status = await backend.run({ op: 'status' });
+                    if (status.screenRecording && status.accessibility)
+                        detail = `${status.backend}; app-specific DODO consent is still required`;
+                    else {
+                        results.push({ component, state: 'needs-permission', detail: 'backend installed; grant OS screen/accessibility permission in the interactive user session', action: 'dodo desktop setup --request-permissions' });
+                        continue;
+                    }
+                }
+                catch (e) {
+                    results.push({ component, state: 'failed', detail: e.message });
+                    continue;
+                }
+            }
+            else if (!['darwin', 'win32', 'linux'].includes(process.platform)) {
+                results.push({ component, state: 'needs-backend', detail: 'no reviewed desktop backend is packaged for this OS' });
+                continue;
+            }
+        }
+        if (component === 'sandbox') {
+            const status = sandboxAvailability(process.env, options.configDir, root);
+            if (status.available)
+                detail = `${status.kind}: available; setup installation runs bounded confinement checks`;
+            else if (process.platform === 'win32') {
+                results.push({ component, state: 'missing', detail: 'Windows sandbox runtime, native provisioning, or current confinement receipt is missing', action: 'install pinned sandbox runtime and verify file/network confinement' });
+                continue;
+            }
+        }
+        if (component === 'web') {
+            results.push({ component, state: config.allowWebFetch ? 'ready' : 'needs-permission', detail: config.allowWebFetch ? 'owner enabled SSRF-guarded HTTPS fetch' : 'software is already bundled; outbound access needs explicit owner consent', ...(!config.allowWebFetch ? { action: 'dodo setup --enable-web' } : {}) });
+            continue;
+        }
+        results.push(detail ? { component, state: 'ready', detail } : { component, state: 'missing', detail: 'missing or did not pass its bounded capability probe', action: `install ${component}` });
+    }
+    if (options.check) {
+        for (const item of results) {
+            if (item.state !== 'ready')
+                continue;
+            try {
+                const proof = await verifyInstalledComponent(item.component, root, options.configDir);
+                if (proof)
+                    item.detail = proof;
+            }
+            catch (error) {
+                item.state = 'failed';
+                item.detail = `capability verification failed: ${error.message.slice(0, 1000)}`;
+            }
+        }
+    }
+    const complete = results.every(item => item.state === 'ready');
+    const stateImport = options.detectExistingState ? { plan: planStateImport(options.configDir) } : undefined;
+    return { platform: process.platform, arch: process.arch, mode: options.check ? 'check' : options.plan ? 'plan' : 'install', components: results, complete, exitCode: complete ? 0 : results.some(item => item.state === 'failed') ? 1 : 2, ...(stateImport ? { stateImport } : {}) };
+}
+/** The local setup CLI alone chooses installers. No MCP tool or repository manifest selects commands. */
+export async function runSetup(options, log = console.log) {
+    if ((options.check || options.plan) && options.enableWeb)
+        throw new DodoError('INVALID_INPUT', '--enable-web cannot be combined with --check/--plan');
+    const root = setupContext(options.cwd), configDir = path.resolve(options.configDir);
+    if ((options.check || options.plan) && options.importState)
+        throw new DodoError('INVALID_INPUT', '--import-state cannot be combined with --check/--plan');
+    let stateImport;
+    const importPlan = options.detectExistingState ? planStateImport(configDir) : undefined;
+    if (options.importState) {
+        if (!options.detectExistingState)
+            throw new DodoError('INVALID_INPUT', '--import-state is available only with the default Dodo config directory; use an explicit import plan for custom state');
+        if (importPlan?.state === 'blocked') {
+            throw new DodoError('MIGRATION_REVIEW_REQUIRED', importPlan.reason ?? 'state import needs local review', {
+                recovery: 'inspect the source locally; Dodo did not create or modify the target',
+            });
+        }
+        if (importPlan?.state === 'available') {
+            const result = importState(importPlan);
+            stateImport = { plan: importPlan, result };
+        }
+        else if (importPlan) {
+            stateImport = { plan: importPlan };
+        }
+    }
+    if (!stateImport && importPlan)
+        stateImport = { plan: importPlan };
+    const initial = await inspectSetup({ ...options, ...(stateImport ? { detectExistingState: false } : {}) });
+    if (options.check || options.plan) {
+        if (stateImport)
+            initial.stateImport = stateImport;
+        return initial;
+    }
+    if (!['darwin', 'linux', 'win32'].includes(process.platform))
+        throw new DodoError('NOT_SUPPORTED', `no reviewed installer recipes for ${process.platform}`);
+    const installTargets = initial.components.filter(item => item.state === 'missing' || item.state === 'failed').map(item => item.component);
+    if (installTargets.length > 0 && !options.yes) {
+        throw new DodoError('APPROVAL_REQUIRED', 'setup found components that require installation; no installer was started', {
+            detail: { components: installTargets },
+            recovery: 'review dodo setup --plan for those components, then rerun with --yes',
+        });
+    }
+    ensurePrivateDirectory(configDir);
+    const tools = path.join(configDir, 'tools');
+    ensurePrivateDirectory(tools);
+    const receipts = path.join(configDir, 'setup-receipts');
+    ensurePrivateDirectory(receipts);
+    const id = randomUUID(), lock = path.join(configDir, 'setup.lock'), token = JSON.stringify({ id, pid: process.pid, startedAt: new Date().toISOString() });
+    try {
+        fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 });
+    }
+    catch {
+        throw new DodoError('CONFLICT', 'another setup may be running (setup.lock exists); inspect it locally, do not auto-kill a process or steal its lock');
+    }
+    const outcomes = new Map();
+    const steps = [];
+    const run = (component, program, args, cwd, interactive = false) => {
+        const call = invocation(root, program, args);
+        log(`[setup] ${component}: ${path.basename(program)} ${args.join(' ')}`);
+        const env = buildChildEnv({ parentEnv: process.env, workspaceRoot: root, extraAllowlist: [] });
+        const result = spawnSync(call.program, call.args, { cwd, env, shell: false, windowsHide: true, windowsVerbatimArguments: call.windowsVerbatimArguments, stdio: interactive ? 'inherit' : 'pipe', encoding: 'utf8', timeout: 600000, maxBuffer: 4 * 1024 * 1024 });
+        const record = `${id}-${steps.length}.log`;
+        fs.writeFileSync(path.join(receipts, record), `${result.stdout ?? ''}\n${result.stderr ?? ''}`, { mode: 0o600, flag: 'wx' });
+        steps.push({ component, command: [program, ...args], exitCode: result.status, log: record });
+        if (result.error || result.status !== 0)
+            throw new Error(`installer exited ${result.status ?? 'without a code'}; see setup receipt ${record}`);
+        return result.stdout ?? '';
+    };
+    const packageInstall = (component, packages) => {
+        const names = process.platform === 'darwin' ? ['brew'] : ['apt-get', 'dnf'];
+        const manager = names.map(name => ({ name, binary: executable(root, name) })).find(item => item.binary);
+        if (!manager?.binary)
+            throw new Error('no supported package manager found (Homebrew or apt/dnf); bootstrap it with owner approval first');
+        const pkg = manager.name === 'brew' ? packages.brew : manager.name === 'apt-get' ? packages.apt : packages.dnf;
+        let program = manager.binary, args = ['install', ...(manager.name === 'brew' ? [] : ['-y']), ...pkg];
+        if (manager.name !== 'brew' && process.getuid?.() !== 0) {
+            const sudo = executable(root, 'sudo');
+            if (!sudo || !process.stdin.isTTY)
+                throw new Error('system dependency installation needs a local sudo terminal; no password or elevation bypass was attempted');
+            program = sudo;
+            args = [manager.binary, ...args];
+        }
+        run(component, program, args, tools, true);
+    };
+    const installPortable = async (component) => {
+        if (process.arch !== 'x64')
+            throw new Error(`portable pin currently validated for win32/x64, not ${process.arch}; no incompatible binary was installed`);
+        const pin = WINDOWS_PINS[component], directory = path.join(tools, `${component}-${pin.sha256.slice(0, 16)}`);
+        const cache = path.join(tools, 'downloads');
+        ensurePrivateDirectory(cache);
+        await downloadVerified(pin, path.join(cache, `${component}-${pin.sha256}.zip`));
+        if (!fs.existsSync(directory)) {
+            const stage = fs.mkdtempSync(path.join(tools, `.stage-${component}-`));
+            ensurePrivateDirectory(stage);
+            try {
+                extractWindowsZip(path.join(cache, `${component}-${pin.sha256}.zip`), stage);
+                renameWithRetry(stage, directory);
+            }
+            finally {
+                if (fs.existsSync(stage))
+                    removeWithRetry(stage, true);
+            }
+        }
+        const wanted = { git: 'git.exe', ripgrep: 'rg.exe', ffmpeg: 'ffmpeg.exe', whisper: 'whisper-cli.exe' }[component];
+        const candidates = [];
+        const walk = (dir, depth) => {
+            if (depth > 6)
+                return;
+            for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+                if (item.isSymbolicLink())
+                    throw new Error('managed archive contains a link');
+                if (item.isDirectory())
+                    walk(path.join(dir, item.name), depth + 1);
+                else if (item.isFile() && item.name.toLowerCase() === wanted)
+                    candidates.push(path.join(dir, item.name));
+            }
+        };
+        walk(directory, 0);
+        const selected = candidates.find(p => component !== 'git' || path.basename(path.dirname(p)).toLowerCase() === 'cmd') ?? candidates[0];
+        if (!selected)
+            throw new Error(`verified archive did not contain ${wanted}`);
+        registerManagedPath(configDir, path.dirname(selected));
+        activateManagedTools(configDir, root);
+    };
+    try {
+        for (const item of initial.components) {
+            if (item.state === 'ready') {
+                // Playwright may already have downloaded Chromium while its Windows
+                // AppContainer RX ACEs are missing (common for elevated Administrator
+                // profiles). Reconcile only the exact browser revision; deep probing
+                // below still decides whether the component is actually ready.
+                if (process.platform === 'win32' && item.component === 'chromium') {
+                    try {
+                        const { chromium } = await import('playwright');
+                        prepareWindowsChromiumSandboxAcl(chromium.executablePath());
+                    }
+                    catch (error) {
+                        outcomes.set(item.component, error.message);
+                    }
+                }
+                continue;
+            }
+            if (item.state === 'needs-backend' || item.state === 'needs-permission')
+                continue;
+            const component = item.component;
+            try {
+                log(`[setup] installing missing ${component}`);
+                if (['git', 'ripgrep', 'ffmpeg'].includes(component)) {
+                    if (process.platform === 'win32')
+                        await installPortable(component);
+                    else
+                        packageInstall(component, { brew: [component], apt: [component], dnf: [component] });
+                }
+                else if (component === 'cloudflared') {
+                    if (process.platform === 'darwin')
+                        packageInstall(component, { brew: ['cloudflared'], apt: [], dnf: [] });
+                    else
+                        throw new Error('automatic cloudflared installation is not enabled on this OS; install the signed official package from https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/ then rerun dodo setup --check --components cloudflared');
+                }
+                else if (component === 'whisper') {
+                    if (process.platform === 'win32')
+                        await installPortable('whisper');
+                    else if (process.platform === 'darwin')
+                        packageInstall(component, { brew: ['whisper-cpp'], apt: [], dnf: [] });
+                    else {
+                        packageInstall(component, { brew: [], apt: ['git', 'cmake', 'build-essential'], dnf: ['git', 'cmake', 'gcc-c++', 'make'] });
+                        const source = path.join(tools, `whisper-${WHISPER_COMMIT}`);
+                        const git = executable(root, 'git'), cmake = executable(root, 'cmake');
+                        if (!git || !cmake)
+                            throw new Error('source-build prerequisites unavailable after installation');
+                        if (!fs.existsSync(source))
+                            run(component, git, ['clone', '--depth', '1', '--branch', 'v1.9.2', 'https://github.com/ggml-org/whisper.cpp', source], tools);
+                        if (run(component, git, ['rev-parse', 'HEAD'], source).trim() !== WHISPER_COMMIT)
+                            throw new Error('Whisper source commit does not match the reviewed pin');
+                        run(component, cmake, ['-S', source, '-B', path.join(source, 'build'), '-DBUILD_SHARED_LIBS=OFF', '-DGGML_NATIVE=OFF', '-DWHISPER_BUILD_TESTS=OFF'], tools);
+                        run(component, cmake, ['--build', path.join(source, 'build'), '--config', 'Release', '--target', 'whisper-cli', '--parallel', '2'], tools);
+                        registerManagedPath(configDir, path.join(source, 'build', 'bin'));
+                        activateManagedTools(configDir, root);
+                    }
+                }
+                else if (component === 'model') {
+                    const models = path.join(configDir, 'models');
+                    ensurePrivateDirectory(models);
+                    await downloadVerified(MODEL_PIN, path.join(models, 'ggml-tiny.bin'));
+                }
+                else if (component === 'chromium') {
+                    const cli = path.join(path.dirname(require.resolve('playwright/package.json')), 'cli.js');
+                    run(component, process.execPath, [cli, 'install', ...(process.platform === 'linux' ? ['--with-deps'] : []), 'chromium'], tools, process.platform === 'linux');
+                    if (process.platform === 'win32') {
+                        const { chromium } = await import('playwright');
+                        prepareWindowsChromiumSandboxAcl(chromium.executablePath());
+                    }
+                }
+                else if (component === 'lsp') {
+                    const prefix = path.join(tools, 'language-servers');
+                    ensurePrivateDirectory(prefix);
+                    const npm = executable(root, 'npm');
+                    if (!npm)
+                        throw new Error('npm is required for language-server setup');
+                    run(component, npm, ['install', '--prefix', prefix, '--ignore-scripts', '--no-audit', '--no-fund', '--save-exact', '--registry=https://registry.npmjs.org', ...LSP_PACKAGES], tools);
+                    updateOwnerConfig(configDir, current => {
+                        for (const [language, entry] of Object.entries(LSP_ENTRIES)) {
+                            if (current.lsp[language])
+                                continue;
+                            const script = path.join(prefix, 'node_modules', entry.file);
+                            if (!fs.existsSync(script))
+                                throw new Error(`missing installed language-server entrypoint: ${language}`);
+                            current.lsp[language] = { command: process.execPath, args: [script, ...entry.args], extensions: entry.extensions };
+                        }
+                        return current;
+                    });
+                }
+                else if (component === 'speech') {
+                    if (process.platform === 'win32')
+                        await installWindowsSpeech(configDir, root);
+                    else
+                        packageInstall(component, { brew: ['espeak-ng'], apt: ['espeak-ng'], dnf: ['espeak-ng'] });
+                }
+                else if (component === 'desktop') {
+                    if (process.platform === 'linux')
+                        packageInstall(component, { brew: [], apt: ['python3', 'python3-xlib', 'python3-pil', 'at-spi2-core', 'libatspi2.0-0'], dnf: ['python3', 'python3-xlib', 'python3-pillow', 'at-spi2-core'] });
+                    await setupNativeDesktop(configDir, false);
+                }
+                else if (component === 'sandbox') {
+                    if (process.platform === 'win32') {
+                        const prefix = path.join(tools, 'sandbox-runtime');
+                        ensurePrivateDirectory(prefix);
+                        const packageRoot = path.join(prefix, 'node_modules', '@anthropic-ai', 'sandbox-runtime');
+                        const manifest = path.join(packageRoot, 'package.json');
+                        let installed = false;
+                        try {
+                            const p = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+                            installed = p.name === '@anthropic-ai/sandbox-runtime' && p.version === SRT_VERSION;
+                        }
+                        catch { /* install the pinned package */ }
+                        if (!installed) {
+                            const npm = executable(root, 'npm');
+                            if (!npm)
+                                throw new Error('npm is required to prepare the Windows sandbox');
+                            run(component, npm, ['install', '--prefix', prefix, '--ignore-scripts', '--no-audit', '--no-fund', '--save-exact', '--registry=https://registry.npmjs.org', `@anthropic-ai/sandbox-runtime@${SRT_VERSION}`], tools);
+                        }
+                        await provisionWindowsSandbox(configDir, root, packageRoot, log);
+                    }
+                    else if (process.platform === 'linux')
+                        packageInstall(component, { brew: [], apt: ['bubblewrap'], dnf: ['bubblewrap'] });
+                    else
+                        throw new Error('the macOS system sandbox is absent; setup cannot replace an OS security facility');
+                }
+            }
+            catch (error) {
+                outcomes.set(component, error.message);
+                log(`[setup] ${component}: ${error.message}`);
+            }
+        }
+        if (options.enableWeb)
+            updateOwnerConfig(configDir, current => ({ ...current, allowWebFetch: true }));
+        const result = await inspectSetup({ ...options, detectExistingState: false });
+        for (const item of result.components)
+            if (outcomes.has(item.component)) {
+                item.state = 'failed';
+                item.detail = outcomes.get(item.component);
+            }
+        // Installer success is not readiness. Exercise installed components with
+        // private synthetic fixtures before reporting them as ready.
+        for (const item of result.components) {
+            if (item.state !== 'ready')
+                continue;
+            try {
+                const proof = await verifyInstalledComponent(item.component, root, configDir);
+                if (proof)
+                    item.detail = proof;
+            }
+            catch (error) {
+                item.state = 'failed';
+                item.detail = `capability verification failed: ${error.message.slice(0, 1000)}`;
+            }
+        }
+        const sandbox = result.components.find(item => item.component === 'sandbox' && item.state === 'ready');
+        if (sandbox) {
+            try {
+                const proof = await verifySandbox(configDir, root);
+                sandbox.detail = `native ${proof.platform} confinement checks passed: ${proof.checks.join(', ')}`;
+            }
+            catch (error) {
+                sandbox.state = 'failed';
+                sandbox.detail = `sandbox confinement verification failed: ${error.message.slice(0, 1000)}`;
+            }
+        }
+        result.complete = result.components.every(item => item.state === 'ready');
+        result.exitCode = result.complete ? 0 : result.components.some(item => item.state === 'failed') ? 1 : 2;
+        if (stateImport)
+            result.stateImport = stateImport;
+        const receipt = path.join(receipts, `${id}.json`);
+        result.receipt = receipt;
+        fs.writeFileSync(receipt, JSON.stringify({ schemaVersion: 1, kind: 'dodo-setup-receipt', ...result, completedAt: new Date().toISOString(), steps, scope: 'explicit local owner setup; no DODO OAuth/workspace-access/trust/desktop-consent resets; native sandbox provisioning may create its own dedicated account and SID-scoped rules', webConsentRequested: options.enableWeb === true, restartRequiredForExistingServer: true }, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+        return result;
+    }
+    finally {
+        try {
+            if (fs.readFileSync(lock, 'utf8') === token)
+                fs.unlinkSync(lock);
+        }
+        catch { /* Never remove a replaced lock. */ }
+    }
+}
+function updateOwnerConfig(configDir, update) {
+    const file = path.join(configDir, 'config.json');
+    if (fs.existsSync(file)) {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+            throw new DodoError('PATH_DENIED', 'owner configuration cannot be a link');
+        if (stat.size > 1024 * 1024)
+            throw new DodoError('RESOURCE_LIMIT', 'owner configuration is oversized');
+    }
+    const before = fs.existsSync(file) ? { bytes: fs.readFileSync(file), mtime: fs.statSync(file, { bigint: true }).mtimeNs } : undefined;
+    const current = before ? GlobalConfigSchema.parse(JSON.parse(before.bytes.toString('utf8'))) : GlobalConfigSchema.parse({});
+    const content = JSON.stringify(GlobalConfigSchema.parse(update(current)), null, 2) + '\n';
+    const tmp = `${file}.${randomUUID()}.tmp`;
+    fs.writeFileSync(tmp, content, { mode: 0o600, flag: 'wx' });
+    try {
+        if (before ? !fs.existsSync(file) || fs.statSync(file, { bigint: true }).mtimeNs !== before.mtime || !fs.readFileSync(file).equals(before.bytes) : fs.existsSync(file))
+            throw new DodoError('FILE_CHANGED', 'owner config changed concurrently; setup did not overwrite it');
+        renameWithRetry(tmp, file);
+    }
+    finally {
+        if (fs.existsSync(tmp))
+            fs.unlinkSync(tmp);
+    }
+}
+export const SETUP_MODULE_FILE = fileURLToPath(import.meta.url); // Useful to verify the shipped CLI uses its own implementation.
+//# sourceMappingURL=setup.js.map

package/dist/setup/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/setup/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAqB,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,WAAW,EAAE,eAAe,EAAgD,MAAM,0BAA0B,CAAC;AAEtH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAO7J,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,qCAAqC,EAAE,6BAA6B,EAAE,4BAA4B,CAAC,CAAC;AAC7I,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;IAC/F,IAAI,EAAE,EAAE,IAAI,EAAE,8DAA8D,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE;IAChI,GAAG,EAAE,EAAE,IAAI,EAAE,6DAA6D,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACvI,IAAI,EAAE,EAAE,IAAI,EAAE,8DAA8D,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;IAClI,IAAI,EAAE,EAAE,IAAI,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE;IACjH,IAAI,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;CACjG,CAAC;AACF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAc,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,4DAA4D,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvM,OAAO,MAAqB,CAAC;AAC/B,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,IAAI,CAAC;QAAC,OAAO,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAClF,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,IAAc;IAC/D,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;AACnK,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxS,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChK,CAAC;AACD,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAY;IACpD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM;QAAC,OAAO,GAAG,MAAM,CAAC;IAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,yDAAyD,CAAC,CAAC;AAC7K,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,gEAAgE;IAC/G,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,UAAU,EAAE,CAAC;QACzD,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAAS,KAAK,KAAK;YAAE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,aAAa;YAAE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,GAAG,GAAG,CAAC,wBAAwB,CAAC;QAAC,CAAC;QAC3K,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvH,IAAI,SAAS,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,SAAS,CAAC;YAAE,MAAM,GAAG,iEAAiE,CAAC;QAChM,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;oBAAE,MAAM,GAAG,6FAA6F,CAAC;YAC1K,CAAC;YAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YACnE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC/D,IAAI,CAAC;gBACH,wBAAwB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACxI,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC,CAAC;YAAE,MAAM,GAAG,uJAAuJ,CAAC;QACrK,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,MAAM;gBAAE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAChI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAA0E,CAAC;oBAC5H,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,aAAa;wBAAE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,+CAA+C,CAAC;yBACzH,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,6FAA6F,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;gBACvO,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;YACvG,CAAC;iBAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;gBAAC,SAAS;YAC/H,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,SAAS;gBAAE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,iEAAiE,CAAC;iBAC1G,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,yFAAyF,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;QACtR,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,2EAA2E,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS;QACpU,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sDAAsD,EAAE,MAAM,EAAE,WAAW,SAAS,EAAE,EAAE,CAAC,CAAC;IACjM,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;gBAAE,SAAS;YACrC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBACtF,IAAI,KAAK;oBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;gBACtB,IAAI,CAAC,MAAM,GAAG,mCAAoC,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvR,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB,EAAE,MAA8B,OAAO,CAAC,GAAG;IAC7F,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IACtJ,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IAC1J,IAAI,WAA+C,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,mBAAmB;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,uHAAuH,CAAC,CAAC;QAChM,IAAI,UAAU,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC,2BAA2B,EAAE,UAAU,CAAC,MAAM,IAAI,iCAAiC,EAAE;gBACvG,QAAQ,EAAE,sEAAsE;aACjF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACvC,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;aAAM,IAAI,UAAU,EAAE,CAAC;YACtB,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,UAAU;QAAE,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,WAAW;YAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,qCAAqC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5J,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1I,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,mBAAmB,EAAE,4EAA4E,EAAE;YACrH,MAAM,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;YACtC,QAAQ,EAAE,sEAAsE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC1F,MAAM,EAAE,GAAG,UAAU,EAAE,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1J,IAAI,CAAC;QAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACnE,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,oHAAoH,CAAC,CAAC;IAAC,CAAC;IAChK,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,KAAK,GAA6F,EAAE,CAAC;IAC3G,MAAM,GAAG,GAAG,CAAC,SAAoB,EAAE,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,WAAW,GAAG,KAAK,EAAU,EAAE;QAC9G,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,WAAW,SAAS,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAClQ,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC;QAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7H,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,MAAM,IAAI,gBAAgB,uBAAuB,MAAM,EAAE,CAAC,CAAC;QAC/I,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,SAAoB,EAAE,QAA0D,EAAQ,EAAE;QAChH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxG,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;QAC1I,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/G,IAAI,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;QACrG,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;YACvM,OAAO,GAAG,IAAI,CAAC;YAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,EAAE,SAAmD,EAAE,EAAE;QACpF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,CAAC,IAAI,wCAAwC,CAAC,CAAC;QACzJ,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,SAAS,GAAG,CAAC,CAAC,CAAC;YAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACtG,IAAI,CAAC;gBAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;oBAChH,CAAC;gBAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,SAAS,CAAC,CAAC;QAClH,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;YAChD,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO;YACtB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChE,IAAI,IAAI,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAC9E,IAAI,IAAI,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;qBAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QACtI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;QAC7E,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChG,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC3B,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAClE,IAAI,CAAC;wBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;wBAChD,gCAAgC,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC9D,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;gBAC7E,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB;gBAAE,SAAS;YAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC;gBACH,GAAG,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,MAAM,eAAe,CAAC,SAAyC,CAAC,CAAC;;wBAC9F,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC5F,CAAC;qBAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;oBACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;wBAAE,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;;wBACrG,MAAM,IAAI,KAAK,CAAC,wPAAwP,CAAC,CAAC;gBACjR,CAAC;qBAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;yBAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;wBAAE,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;yBAC1G,CAAC;wBACJ,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;wBAC5H,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,cAAc,EAAE,CAAC,CAAC;wBAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;4BAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;wBACjG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;4BAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,yCAAyC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;wBAC3J,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,cAAc;4BAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;wBAC3J,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,EAAE,KAAK,CAAC,CAAC;wBAC5J,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;wBAC3I,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;wBAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC3G,CAAC;gBACH,CAAC;qBAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;oBAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBAC9E,MAAM,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;gBACxE,CAAC;qBAAM,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBAC1F,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;oBAC9J,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;wBACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;wBAChD,gCAAgC,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;qBAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;oBAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBACpF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAAC,IAAI,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBAC5G,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,uCAAuC,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;oBACrL,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;wBACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC5D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gCAAE,SAAS;4BACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;4BAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gCAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,EAAE,CAAC,CAAC;4BACzG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;wBACrH,CAAC;wBACD,OAAO,OAAO,CAAC;oBACjB,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,MAAM,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;;wBACzE,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAClG,CAAC;qBAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;oBAChO,MAAM,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7C,CAAC;qBACI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;wBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;wBAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;wBACnF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;wBAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;wBACxD,IAAI,SAAS,GAAG,KAAK,CAAC;wBACtB,IAAI,CAAC;4BAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAsC,CAAC;4BAAC,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,+BAA+B,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;wBACrO,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;4BAAC,IAAI,CAAC,GAAG;gCAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;4BACjH,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,uCAAuC,EAAE,iCAAiC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;wBACtN,CAAC;wBACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;oBACnE,CAAC;yBAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;;wBACtH,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;gBAC3G,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;gBAAC,GAAG,CAAC,WAAW,SAAS,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,CAAC;QAClI,CAAC;QACD,IAAI,OAAO,CAAC,SAAS;YAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU;YAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAE,CAAC;YAAC,CAAC;QAC/I,yEAAyE;QACzE,6DAA6D;QAC7D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;gBAAE,SAAS;YACrC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9E,IAAI,KAAK;oBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;gBACtB,IAAI,CAAC,MAAM,GAAG,mCAAoC,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;QACvG,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,GAAG,UAAU,KAAK,CAAC,QAAQ,+BAA+B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC;YAC9J,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAAC,OAAO,CAAC,MAAM,GAAG,4CAA6C,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC;QACrJ,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;QAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnL,IAAI,WAAW;YAAE,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAC5E,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gLAAgL,EAAE,mBAAmB,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpd,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK;gBAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IAAC,CAAC;AACvI,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,MAA+C;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAC;QAC5I,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtI,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5H,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAC1F,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAC1C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,+DAA+D,CAAC,CAAC;QAC7Q,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,gEAAgE"}

package/dist/setup/windowsChromiumAcl.js

@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { DodoError } from '../errors.js';
+import { isWithinPath } from '../platform/pathPolicy.js';
+import { envValue, windowsSystemExecutable } from '../platform/system.js';
+// Chromium's Windows AppContainer/LPAC network sandbox must be able to read
+// and execute the installed browser image. These package SIDs receive RX only;
+// they never receive write/modify/full-control rights.
+const APP_PACKAGE_RX = ['S-1-15-2-1', 'S-1-15-2-2'];
+function regularExecutable(file) {
+    const absolute = path.resolve(file);
+    const stat = fs.lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+        throw new DodoError('PATH_DENIED', 'Chromium executable must be a regular non-linked file');
+    return fs.realpathSync.native(absolute);
+}
+/**
+ * Local-owner setup only. Grant Windows AppContainer identities read/execute
+ * on the exact Playwright Chromium revision, never on DODO state or the whole
+ * user profile. A custom browser location is refused rather than broadening
+ * ACLs based on environment/repository input.
+ */
+export function prepareWindowsChromiumSandboxAcl(executable) {
+    if (process.platform !== 'win32')
+        return executable;
+    const localAppData = envValue(process.env, 'LOCALAPPDATA');
+    if (!localAppData || !path.win32.isAbsolute(localAppData))
+        throw new DodoError('NOT_SUPPORTED', 'Windows Chromium sandbox setup requires LOCALAPPDATA');
+    const cache = path.join(localAppData, 'ms-playwright');
+    if (!fs.existsSync(cache))
+        throw new DodoError('NOT_FOUND', 'Playwright browser cache is missing after installation');
+    const cacheReal = fs.realpathSync.native(cache);
+    const exeReal = regularExecutable(executable);
+    if (!isWithinPath(cacheReal, exeReal))
+        throw new DodoError('PATH_DENIED', 'automatic Chromium ACL setup is limited to the Playwright cache under LOCALAPPDATA');
+    const relative = path.relative(cacheReal, exeReal);
+    const revision = relative.split(path.sep)[0] ?? '';
+    if (!/^chromium-\d+$/.test(revision))
+        throw new DodoError('PATH_DENIED', 'unexpected Playwright Chromium revision path');
+    const revisionRoot = path.join(cacheReal, revision);
+    const rootStat = fs.lstatSync(revisionRoot);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw new DodoError('PATH_DENIED', 'Playwright Chromium revision must be a real directory');
+    const icacls = windowsSystemExecutable('icacls.exe');
+    const args = [revisionRoot, '/grant', ...APP_PACKAGE_RX.map(sid => `*${sid}:(OI)(CI)(RX)`), '/T', '/C', '/Q'];
+    const result = spawnSync(icacls, args, { shell: false, windowsHide: true, timeout: 120000, maxBuffer: 256 * 1024, encoding: 'utf8' });
+    if (result.error || result.status !== 0)
+        throw new DodoError('NOT_SUPPORTED', 'Chromium AppContainer read/execute ACL could not be established; browser sandbox remains unavailable');
+    // Re-resolve after ACL mutation so a concurrent path swap cannot be reported
+    // as success. The subsequent deep probe launches Chromium with sandbox=true.
+    if (fs.realpathSync.native(executable) !== exeReal)
+        throw new DodoError('FILE_CHANGED', 'Chromium executable changed while establishing sandbox ACL');
+    return revisionRoot;
+}
+//# sourceMappingURL=windowsChromiumAcl.js.map