<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<!-- Release builds omit cs.allow-jit (Flutter hot-reload only). They keep
	     network.server because the macOS App Sandbox treats every UDP bind()
	     - including the ephemeral 0.0.0.0:0 that tsclientlib's
	     tokio::net::UdpSocket::bind() issues for outbound traffic - as a
	     server operation. Without this entitlement UdpSocket::bind fails
	     with EPERM (sandbox_init: 'network-outbound deny') and the TS3
	     connect never starts. network.client alone is insufficient because
	     it gates connect()-style flows, not bind()-then-sendto. -->
	<key>com.apple.security.app-sandbox</key>
	<true/>
	<key>com.apple.security.network.client</key>
	<true/>
	<key>com.apple.security.network.server</key>
	<true/>
	<key>com.apple.security.device.audio-input</key>
	<true/>
</dict>
</plist>
