<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<!-- Release builds omit cs.allow-jit (Flutter hot-reload only). They keep
	     network.server because the macOS App Sandbox classifies UDP bind()
	     against a local port - including the ephemeral 0.0.0.0:0 that
	     tsclientlib's tokio::net::UdpSocket::bind() issues for outbound
	     voice traffic - as a server operation that requires
	     com.apple.security.network.server, regardless of whether the
	     socket is later used only to sendto() a remote peer. Without it,
	     bind() returns EPERM and the sandbox log records
	     "Sandbox: chanora(...) deny(1) network-bind". network.client
	     alone gates outbound connect()-style flows (TCP, connected UDP)
	     and is insufficient for the bind()-then-sendto() pattern Tokio's
	     UdpSocket uses. See Apple's App Sandbox entitlement reference:
	     "Network Server" covers any process that listens on, or binds
	     to, a network port. -->
	<key>com.apple.security.app-sandbox</key>
	<true/>
	<key>com.apple.security.network.client</key>
	<true/>
	<key>com.apple.security.network.server</key>
	<true/>
	<key>com.apple.security.device.audio-input</key>
	<true/>
</dict>
</plist>
