From 8083e317894f1c898c3df2f0d953624898306cfd Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Wed, 3 Jun 2026 16:28:16 -0700
Subject: [PATCH 01/20] feat(squirrel-windows): inline installer logic; remove
 electron-winstaller dependency and its vendored binaries

---
 .changeset/remove-electron-winstaller-dep.md  |   5 +
 .../package.json                              |   7 +-
 .../src/SquirrelWindowsTarget.ts              |  87 +++++------
 .../src/windowsInstaller.ts                   | 140 ++++++++++++++++++
 .../template.nuspectemplate                   |   4 +-
 pnpm-lock.yaml                                | 114 --------------
 test/package.json                             |   1 -
 test/src/helpers/packTester.ts                |   2 +-
 .../windows/squirrelWindowsInstallerTest.ts   | 122 +++++++++++++++
 9 files changed, 308 insertions(+), 174 deletions(-)
 create mode 100644 .changeset/remove-electron-winstaller-dep.md
 create mode 100644 packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
 create mode 100644 test/src/windows/squirrelWindowsInstallerTest.ts

diff --git a/.changeset/remove-electron-winstaller-dep.md b/.changeset/remove-electron-winstaller-dep.md
new file mode 100644
index 00000000000..9f9f091aaef
--- /dev/null
+++ b/.changeset/remove-electron-winstaller-dep.md
@@ -0,0 +1,5 @@
+---
+"electron-builder-squirrel-windows": minor
+---
+
+feat(squirrel-windows): inline installer logic; remove electron-winstaller dependency and its vendored binaries
diff --git a/packages/electron-builder-squirrel-windows/package.json b/packages/electron-builder-squirrel-windows/package.json
index 5f019e4eba5..29f513e774a 100644
--- a/packages/electron-builder-squirrel-windows/package.json
+++ b/packages/electron-builder-squirrel-windows/package.json
@@ -17,12 +17,7 @@
   ],
   "dependencies": {
     "app-builder-lib": "workspace:*",
-    "builder-util": "workspace:*",
-    "electron-winstaller": "5.4.0"
-  },
-  "devDependencies": {
-    "@types/archiver": "5.3.1",
-    "@types/fs-extra": "9.0.13"
+    "builder-util": "workspace:*"
   },
   "types": "./out/SquirrelWindowsTarget.d.ts"
 }
diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 64364c2e1cc..8b9726e6f59 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -7,7 +7,7 @@ import { withToolsetLock } from "app-builder-lib/out/util/toolsetLock"
 import * as path from "path"
 import * as fs from "fs"
 import * as os from "os"
-import { Options as SquirrelOptions, createWindowsInstaller, convertVersion } from "electron-winstaller"
+import { InstallerOptions, createWindowsInstaller, convertVersion } from "./windowsInstaller"
 
 export default class SquirrelWindowsTarget extends Target {
   //tslint:disable-next-line:no-object-literal-type-assertion
@@ -33,12 +33,7 @@ export default class SquirrelWindowsTarget extends Target {
         log.warn({ customSquirrelVendorDirectory }, "unable to access custom Squirrel.Windows vendor directory, falling back to default vendor")
       }
 
-      const windowInstallerPackage = require.resolve("electron-winstaller/package.json")
-      const [squirrelBin] = await Promise.all([
-        getBinFromUrl("squirrel.windows@1.0.0", "squirrel.windows-2.0.1-patched.7z", "76851f0c192eaf9bc6f8f3eecdfe325857ebe70d7833ec62ed846a1acd50c846"),
-        fs.promises.cp(path.join(path.dirname(windowInstallerPackage), "vendor"), tmpVendorDirectory, { recursive: true }),
-      ])
-
+      const squirrelBin = await getBinFromUrl("squirrel.windows@1.0.0", "squirrel.windows-2.0.1-patched.7z", "76851f0c192eaf9bc6f8f3eecdfe325857ebe70d7833ec62ed846a1acd50c846")
       await fs.promises.cp(path.join(squirrelBin, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
     }
 
@@ -143,7 +138,7 @@ export default class SquirrelWindowsTarget extends Target {
         arch,
       })
       const distOptions = await this.computeEffectiveDistOptions(appOutDir, installerOutDir, setupFile)
-      await this.generateStubExecutableExe(appOutDir, distOptions.vendorDirectory!)
+      await this.generateStubExecutableExe(appOutDir, distOptions.vendorDirectory)
       await withToolsetLock(() => createWindowsInstaller(distOptions))
 
       await packager.signAndEditResources(artifactPath, arch, installerOutDir)
@@ -211,7 +206,7 @@ export default class SquirrelWindowsTarget extends Target {
     // https://github.com/electron/windows-installer/blob/main/script/select-7z-arch.js
     // Even if we're cross-compiling for a different arch like arm64,
     // we still need to use the 7-Zip executable for the host arch
-    const resolvedArch = os.arch
+    const resolvedArch = os.arch()
     fs.copyFileSync(path.join(vendorDirectory, `7z-${resolvedArch}.exe`), path.join(vendorDirectory, "7z.exe"))
     fs.copyFileSync(path.join(vendorDirectory, `7z-${resolvedArch}.dll`), path.join(vendorDirectory, "7z.dll"))
   }
@@ -230,7 +225,7 @@ export default class SquirrelWindowsTarget extends Target {
     return templatePath
   }
 
-  async computeEffectiveDistOptions(appDirectory: string, outputDirectory: string, setupFile: string): Promise<SquirrelOptions> {
+  async computeEffectiveDistOptions(appDirectory: string, outputDirectory: string, setupFile: string): Promise<InstallerOptions> {
     const packager = this.packager
     let iconUrl = this.options.iconUrl
     if (iconUrl == null) {
@@ -246,60 +241,54 @@ export default class SquirrelWindowsTarget extends Target {
 
     checkConflictingOptions(this.options)
     const appInfo = packager.appInfo
-    const options: SquirrelOptions = {
-      appDirectory: appDirectory,
-      outputDirectory: outputDirectory,
-      name: this.options.useAppIdAsId ? appInfo.id : this.appName,
-      title: appInfo.productName || appInfo.name,
-      version: appInfo.version,
-      description: appInfo.description,
-      exe: `${this.exeName}.exe`,
-      authors: appInfo.companyName || "",
-      nuspecTemplate: await this.createNuspecTemplateWithProjectUrl(),
-      iconUrl,
-      copyright: appInfo.copyright,
-      noMsi: !this.options.msi,
-      usePackageJson: false,
-    }
-
-    options.vendorDirectory = await this.prepareSignedVendorDirectory()
-    this.select7zipArch(options.vendorDirectory)
-    options.fixUpPaths = true
-    options.setupExe = setupFile
-    if (this.options.msi) {
-      options.setupMsi = setupFile.replace(".exe", ".msi")
-    }
-
-    if (isEmptyOrSpaces(options.description)) {
-      options.description = this.options.name || appInfo.productName
-    }
 
-    if (options.remoteToken == null) {
-      options.remoteToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
-    }
+    const description = isEmptyOrSpaces(appInfo.description) ? (this.options.name || appInfo.productName) : appInfo.description
 
+    let remoteReleases: string | undefined
     if (this.options.remoteReleases === true) {
       const info = await packager.info.repositoryInfo
       if (info == null) {
         log.warn("remoteReleases set to true, but cannot get repository info")
       } else {
-        options.remoteReleases = `https://github.com/${info.user}/${info.project}`
-        log.info({ remoteReleases: options.remoteReleases }, `remoteReleases is set`)
+        remoteReleases = `https://github.com/${info.user}/${info.project}`
+        log.info({ remoteReleases }, `remoteReleases is set`)
       }
     } else if (typeof this.options.remoteReleases === "string" && !isEmptyOrSpaces(this.options.remoteReleases)) {
-      options.remoteReleases = this.options.remoteReleases
+      remoteReleases = this.options.remoteReleases
     }
 
+    let loadingGif: string | undefined
     if (this.options.loadingGif) {
-      options.loadingGif = path.resolve(packager.projectDir, this.options.loadingGif)
+      loadingGif = path.resolve(packager.projectDir, this.options.loadingGif)
     } else {
-      const resourceList = await packager.resourceList
-      if (resourceList.includes("install-spinner.gif")) {
-        options.loadingGif = path.join(packager.buildResourcesDir, "install-spinner.gif")
-      }
+      loadingGif = (await packager.getResource("install-spinner.gif")) ?? undefined
     }
 
-    return options
+    const vendorDirectory = await this.prepareSignedVendorDirectory()
+    this.select7zipArch(vendorDirectory)
+
+    return {
+      appDirectory,
+      outputDirectory,
+      vendorDirectory,
+      name: this.options.useAppIdAsId ? appInfo.id : this.appName,
+      title: appInfo.productName || appInfo.name,
+      version: appInfo.version,
+      description,
+      exe: `${this.exeName}.exe`,
+      authors: appInfo.companyName || "",
+      nuspecTemplate: await this.createNuspecTemplateWithProjectUrl(),
+      iconUrl,
+      copyright: appInfo.copyright,
+      noMsi: !this.options.msi,
+      fixUpPaths: true,
+      setupExe: setupFile,
+      setupMsi: this.options.msi ? setupFile.replace(".exe", ".msi") : undefined,
+      loadingGif,
+      remoteReleases,
+      remoteToken: this.options.remoteToken || process.env.GH_TOKEN || process.env.GITHUB_TOKEN,
+      createTempDir: opts => this.packager.info.tempDirManager.createTempDir(opts),
+    }
   }
 }
 
diff --git a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
new file mode 100644
index 00000000000..0e260fd560c
--- /dev/null
+++ b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
@@ -0,0 +1,140 @@
+import { exec, log } from "builder-util"
+import * as fs from "fs/promises"
+import * as path from "path"
+
+export function convertVersion(version: string): string {
+  const parts = version.split("+")[0].split("-")
+  const mainVersion = parts.shift()
+  return parts.length > 0 ? [mainVersion, parts.join("-").replace(/\./g, "")].join("-") : mainVersion!
+}
+
+export function escapeXml(value: string): string {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;")
+}
+
+export function renderNuspecTemplate(templateContent: string, vars: Record<string, string>): string {
+  return Object.entries(vars).reduce((t, [k, v]) => t.split(`<%- ${k} %>`).join(v), templateContent)
+}
+
+export async function buildAdditionalFilesXml(appDirectory: string): Promise<string> {
+  const checks: Array<{ rel: string; src: string; target: string }> = [
+    { rel: "swiftshader", src: "swiftshader\\**", target: "lib\\net45\\swiftshader" },
+    { rel: "vk_swiftshader_icd.json", src: "vk_swiftshader_icd.json", target: "lib\\net45" },
+  ]
+  const lines: string[] = []
+  for (const { rel, src, target } of checks) {
+    try {
+      await fs.access(path.join(appDirectory, rel))
+      lines.push(`    <file src="${src}" target="${target}" />`)
+    } catch {
+      // not present, skip
+    }
+  }
+  return lines.join("\n")
+}
+
+export interface InstallerOptions {
+  appDirectory: string
+  outputDirectory: string
+  vendorDirectory: string
+  name: string
+  title?: string | null
+  version: string
+  description?: string | null
+  exe: string
+  authors: string
+  owners?: string | null
+  iconUrl?: string | null
+  copyright?: string | null
+  nuspecTemplate: string
+  loadingGif?: string | null
+  noMsi?: boolean
+  remoteReleases?: string | null
+  remoteToken?: string | null
+  setupExe?: string | null
+  setupMsi?: string | null
+  fixUpPaths?: boolean
+  createTempDir: (options: { prefix: string }) => Promise<string>
+}
+
+export async function createWindowsInstaller(options: InstallerOptions): Promise<void> {
+  const { appDirectory, outputDirectory, vendorDirectory, name, version, exe, nuspecTemplate, loadingGif, noMsi, remoteReleases, remoteToken, setupExe, setupMsi, fixUpPaths = false, createTempDir } = options
+
+  const useMono = process.platform !== "win32"
+  if (useMono) {
+    log.warn("building Squirrel.Windows on non-Windows requires mono in PATH; spawn will fail if it is missing")
+  }
+
+  // Squirrel.exe must live in the app directory so the nuspec can reference it
+  await fs.copyFile(path.join(vendorDirectory, "Squirrel.exe"), path.join(appDirectory, "Squirrel.exe"))
+
+  const nugetVersion = convertVersion(version)
+  const authors = options.authors || ""
+  const copyright = options.copyright || `Copyright © ${new Date().getFullYear()} ${authors}`
+  const owners = options.owners || authors
+  const additionalFilesXml = await buildAdditionalFilesXml(appDirectory)
+
+  let templateContent = await fs.readFile(nuspecTemplate, "utf8")
+  if (path.sep === "/") {
+    templateContent = templateContent.replace(/\\/g, "/")
+  }
+
+  const nuspecContent = renderNuspecTemplate(templateContent, {
+    name: escapeXml(name),
+    title: escapeXml(options.title || name),
+    version: escapeXml(nugetVersion),
+    authors: escapeXml(authors),
+    owners: escapeXml(owners),
+    iconUrl: escapeXml(options.iconUrl || ""),
+    description: escapeXml(options.description || options.title || name),
+    copyright: escapeXml(copyright),
+    exe: escapeXml(exe),
+    additionalFilesXml,
+  })
+
+  const nugetOutput = await createTempDir({ prefix: "squirrel-nuget-" })
+  const nuspecPath = path.join(nugetOutput, `${name}.nuspec`)
+  await fs.writeFile(nuspecPath, nuspecContent)
+
+  const nugetExe = path.join(vendorDirectory, "nuget.exe")
+  const nugetArgs = ["pack", nuspecPath, "-BasePath", appDirectory, "-OutputDirectory", nugetOutput, "-NoDefaultExcludes"]
+  await (useMono ? exec("mono", [nugetExe, ...nugetArgs]) : exec(nugetExe, nugetArgs))
+
+  const nupkgPath = path.join(nugetOutput, `${name}.${nugetVersion}.nupkg`)
+
+  if (remoteReleases) {
+    const syncReleasesExe = path.join(vendorDirectory, "SyncReleases.exe")
+    const syncArgs = ["-u", remoteReleases, "-r", outputDirectory]
+    if (remoteToken) {
+      syncArgs.push("-t", remoteToken)
+    }
+    await (useMono ? exec("mono", [syncReleasesExe, ...syncArgs]) : exec(syncReleasesExe, syncArgs))
+  }
+
+  const releasifyArgs = ["--releasify", nupkgPath, "--releaseDir", outputDirectory]
+  if (loadingGif) {
+    releasifyArgs.push("--loadingGif", loadingGif)
+  }
+  if (noMsi) {
+    releasifyArgs.push("--no-msi")
+  }
+
+  if (useMono) {
+    await exec("mono", [path.join(vendorDirectory, "Squirrel-Mono.exe"), ...releasifyArgs])
+  } else {
+    await exec(path.join(vendorDirectory, "Squirrel.exe"), releasifyArgs)
+  }
+
+  if (fixUpPaths) {
+    if (setupExe) {
+      await fs.rename(path.join(outputDirectory, "Setup.exe"), path.join(outputDirectory, setupExe))
+    }
+    if (setupMsi) {
+      try {
+        await fs.rename(path.join(outputDirectory, "Setup.msi"), path.join(outputDirectory, setupMsi))
+      } catch {
+        // Setup.msi won't exist when noMsi is true
+      }
+    }
+  }
+}
diff --git a/packages/electron-builder-squirrel-windows/template.nuspectemplate b/packages/electron-builder-squirrel-windows/template.nuspectemplate
index 688a369d20d..e5bad0bb152 100644
--- a/packages/electron-builder-squirrel-windows/template.nuspectemplate
+++ b/packages/electron-builder-squirrel-windows/template.nuspectemplate
@@ -25,8 +25,6 @@
     <file src="LICENSE.electron.txt" target="lib\net45\LICENSE.electron.txt" />
     <file src="LICENSES.chromium.html" target="lib\net45\LICENSES.chromium.html" />
     <file src="<%- exe %>" target="lib\net45\<%- exe %>" />
-    <% additionalFiles.forEach(function(f) { %>
-    <file src="<%- f.src %>" target="<%- f.target %>" />
-    <% }); %>
+<%- additionalFilesXml %>
   </files>
 </package>
\ No newline at end of file
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 261f3e2315e..611b4ab729b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -466,16 +466,6 @@ importers:
       builder-util:
         specifier: workspace:*
         version: link:../builder-util
-      electron-winstaller:
-        specifier: 5.4.0
-        version: 5.4.0
-    devDependencies:
-      '@types/archiver':
-        specifier: 5.3.1
-        version: 5.3.1
-      '@types/fs-extra':
-        specifier: 9.0.13
-        version: 9.0.13
 
   packages/electron-forge-maker-appimage:
     dependencies:
@@ -670,9 +660,6 @@ importers:
       electron-updater:
         specifier: workspace:*
         version: link:../packages/electron-updater
-      electron-winstaller:
-        specifier: 5.4.0
-        version: 5.4.0
       fast-xml-parser:
         specifier: 5.7.0
         version: 5.7.0
@@ -2826,11 +2813,6 @@ packages:
     resolution: {integrity: sha512-Wn9sPYIVFRFl5HmwMJkARCCf7rqK/EurkfQ/rJZ14mHP3iYTjZSIOSVonEAnhWeAXwtw7zOekGRlc6yTtZ0t+g==}
     engines: {node: '>=16.4'}
 
-  '@electron/windows-sign@1.2.1':
-    resolution: {integrity: sha512-YfASnrhJ+ve6Q43ZiDwmpBgYgi2u0bYjeAVi2tDfN7YWAKO8X9EEOuPGtqbJpPLM6TfAHimghICjWe2eaJ8BAg==}
-    engines: {node: '>=14.14'}
-    hasBin: true
-
   '@emnapi/core@1.10.0':
     resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
@@ -4052,9 +4034,6 @@ packages:
   '@types/adm-zip@0.5.6':
     resolution: {integrity: sha512-lRlcSLg5Yoo7C2H2AUiAoYlvifWoCx/se7iUNiCBTfEVVYFVn+Tr9ZGed4K73tYgLe9O4PjdJvbxlkdAOx/qiw==}
 
-  '@types/archiver@5.3.1':
-    resolution: {integrity: sha512-wKYZaSXaDvTZuInAWjCeGG7BEAgTWG2zZW0/f7IYFcoHB2X2d9lkVFnrOlXl3W6NrvO6Ml3FLLu8Uksyymcpnw==}
-
   '@types/aws4@1.11.6':
     resolution: {integrity: sha512-5CnVUkHNyLGpD9AnOcK66YyP0qvIh6nhJJoeK8zSl5YKikUcUbdB7SlHevUYVqicgeh6j5AJa1qa/h08dSZHoA==}
 
@@ -4214,9 +4193,6 @@ packages:
   '@types/geojson@7946.0.16':
     resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
 
-  '@types/glob@8.1.0':
-    resolution: {integrity: sha512-IO+MJPVhoqz+28h1qLAcBEH2+xHMK6MTyHJc7MTnnYb6wsoLR29POVGJ7LycmVXIqyy/4/2ShP5sUwTXuOwb/w==}
-
   '@types/graceful-fs@4.1.9':
     resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
 
@@ -4289,9 +4265,6 @@ packages:
   '@types/minimatch@3.0.5':
     resolution: {integrity: sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==}
 
-  '@types/minimatch@5.1.2':
-    resolution: {integrity: sha512-K0VQKziLUWkVKiRVrx4a40iPaxTUefQmjtkQofBkYRcoaaL/8rhwDWww9qWbrgicNOgnpIsMxyNIUM4+n6dUIA==}
-
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
@@ -5216,10 +5189,6 @@ packages:
     resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
     engines: {node: '>= 12'}
 
-  commander@9.5.0:
-    resolution: {integrity: sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==}
-    engines: {node: ^12.20.0 || >=14}
-
   common-path-prefix@3.0.0:
     resolution: {integrity: sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w==}
 
@@ -5390,9 +5359,6 @@ packages:
   create-require@1.1.1:
     resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
 
-  cross-dirname@0.1.0:
-    resolution: {integrity: sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==}
-
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -5912,10 +5878,6 @@ packages:
   electron-to-chromium@1.5.353:
     resolution: {integrity: sha512-kOrWphBi8TOZyiJZqsgqIle0lw+tzmnQK83pV9dZUd01Nm2POECSyFQMAuarzZdYqQW7FH9RaYOuaRo3h+bQ3w==}
 
-  electron-winstaller@5.4.0:
-    resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
-    engines: {node: '>=8.0.0'}
-
   electron@39.8.5:
     resolution: {integrity: sha512-q6+LiQIcTadSyvtPgLDQkCtVA9jQJXQVMrQcctfOJILh6OFMN+UJJLRkuUTy8CZDYeCIBn1ZycqsL1dAXugxZA==}
     engines: {node: '>= 12.20.55'}
@@ -7673,10 +7635,6 @@ packages:
     resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
     engines: {node: '>= 18'}
 
-  mkdirp@0.5.6:
-    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
-    hasBin: true
-
   mri@1.2.0:
     resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
     engines: {node: '>=4'}
@@ -8477,11 +8435,6 @@ packages:
     resolution: {integrity: sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==}
     engines: {node: ^10 || ^12 || >=14}
 
-  postject@1.0.0-alpha.6:
-    resolution: {integrity: sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==}
-    engines: {node: '>=14.0.0'}
-    hasBin: true
-
   prelude-ls@1.2.1:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
@@ -8871,11 +8824,6 @@ packages:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
-  rimraf@2.6.3:
-    resolution: {integrity: sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==}
-    deprecated: Rimraf versions prior to v4 are no longer supported
-    hasBin: true
-
   roarr@2.15.4:
     resolution: {integrity: sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==}
     engines: {node: '>=8.0'}
@@ -9307,10 +9255,6 @@ packages:
   temp-file@3.4.0:
     resolution: {integrity: sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg==}
 
-  temp@0.9.4:
-    resolution: {integrity: sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==}
-    engines: {node: '>=6.0.0'}
-
   tempfile@5.0.0:
     resolution: {integrity: sha512-bX655WZI/F7EoTDw9JvQURqAXiPHi8o8+yFxPF2lWYyz1aHnmMRuXWqL6YB6GmeO0o4DIYWHLgGNi/X64T+X4Q==}
     engines: {node: '>=14.18'}
@@ -13788,17 +13732,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@electron/windows-sign@1.2.1':
-    dependencies:
-      cross-dirname: 0.1.0
-      debug: 4.4.3
-      fs-extra: 11.3.0
-      minimist: 1.2.8
-      postject: 1.0.0-alpha.6
-    transitivePeerDependencies:
-      - supports-color
-    optional: true
-
   '@emnapi/core@1.10.0':
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
@@ -14984,10 +14917,6 @@ snapshots:
     dependencies:
       '@types/node': 22.13.17
 
-  '@types/archiver@5.3.1':
-    dependencies:
-      '@types/glob': 8.1.0
-
   '@types/aws4@1.11.6':
     dependencies:
       '@types/node': 22.13.17
@@ -15195,11 +15124,6 @@ snapshots:
 
   '@types/geojson@7946.0.16': {}
 
-  '@types/glob@8.1.0':
-    dependencies:
-      '@types/minimatch': 5.1.2
-      '@types/node': 22.13.17
-
   '@types/graceful-fs@4.1.9':
     dependencies:
       '@types/node': 22.13.17
@@ -15268,8 +15192,6 @@ snapshots:
 
   '@types/minimatch@3.0.5': {}
 
-  '@types/minimatch@5.1.2': {}
-
   '@types/ms@2.1.0': {}
 
   '@types/node@12.20.55': {}
@@ -16352,9 +16274,6 @@ snapshots:
 
   commander@8.3.0: {}
 
-  commander@9.5.0:
-    optional: true
-
   common-path-prefix@3.0.0: {}
 
   compare-func@2.0.0:
@@ -16543,9 +16462,6 @@ snapshots:
 
   create-require@1.1.1: {}
 
-  cross-dirname@0.1.0:
-    optional: true
-
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -17135,18 +17051,6 @@ snapshots:
 
   electron-to-chromium@1.5.353: {}
 
-  electron-winstaller@5.4.0:
-    dependencies:
-      '@electron/asar': 3.4.1
-      debug: 4.4.3
-      fs-extra: 7.0.1
-      lodash: 4.17.21
-      temp: 0.9.4
-    optionalDependencies:
-      '@electron/windows-sign': 1.2.1
-    transitivePeerDependencies:
-      - supports-color
-
   electron@39.8.5:
     dependencies:
       '@electron/get': 2.0.3
@@ -19392,10 +19296,6 @@ snapshots:
     dependencies:
       minipass: 7.1.3
 
-  mkdirp@0.5.6:
-    dependencies:
-      minimist: 1.2.8
-
   mri@1.2.0: {}
 
   mrmime@2.0.1: {}
@@ -20244,11 +20144,6 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  postject@1.0.0-alpha.6:
-    dependencies:
-      commander: 9.5.0
-    optional: true
-
   prelude-ls@1.2.1: {}
 
   prettier-linter-helpers@1.0.1:
@@ -20718,10 +20613,6 @@ snapshots:
 
   reusify@1.1.0: {}
 
-  rimraf@2.6.3:
-    dependencies:
-      glob: 7.2.3
-
   roarr@2.15.4:
     dependencies:
       boolean: 3.2.0
@@ -21228,11 +21119,6 @@ snapshots:
       async-exit-hook: 2.0.1
       fs-extra: 10.1.0
 
-  temp@0.9.4:
-    dependencies:
-      mkdirp: 0.5.6
-      rimraf: 2.6.3
-
   tempfile@5.0.0:
     dependencies:
       temp-dir: 3.0.0
diff --git a/test/package.json b/test/package.json
index 4148c450b92..cbda10ef7d8 100644
--- a/test/package.json
+++ b/test/package.json
@@ -31,7 +31,6 @@
     "electron-builder-squirrel-windows": "workspace:*",
     "electron-publish": "workspace:*",
     "electron-updater": "workspace:*",
-    "electron-winstaller": "5.4.0",
     "fast-xml-parser": "5.7.0",
     "fs-extra": "^10.1.0",
     "js-yaml": "^4.1.0",
diff --git a/test/src/helpers/packTester.ts b/test/src/helpers/packTester.ts
index 005b68b7b1d..c8ad3a116e2 100644
--- a/test/src/helpers/packTester.ts
+++ b/test/src/helpers/packTester.ts
@@ -7,7 +7,7 @@ import { AsarIntegrity } from "app-builder-lib/out/asar/integrity"
 import { addValue, copyDir, exec, executeFinally, exists, FileCopier, log, USE_HARD_LINKS, walk } from "builder-util"
 import { CancellationToken, deepAssign, UpdateFileInfo } from "builder-util-runtime"
 import { Arch, ArtifactCreated, Configuration, DIR_TARGET, getArchSuffix, MacOsTargetName, Packager, PackagerOptions, Platform, Target } from "electron-builder"
-import { convertVersion } from "electron-winstaller"
+import { convertVersion } from "electron-builder-squirrel-windows/out/windowsInstaller"
 import { PublishPolicy } from "electron-publish"
 import { copyFile, emptyDir, mkdir, writeJson } from "fs-extra"
 import * as fs from "fs/promises"
diff --git a/test/src/windows/squirrelWindowsInstallerTest.ts b/test/src/windows/squirrelWindowsInstallerTest.ts
new file mode 100644
index 00000000000..fb0385dfac9
--- /dev/null
+++ b/test/src/windows/squirrelWindowsInstallerTest.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest"
+import { convertVersion, escapeXml, renderNuspecTemplate, buildAdditionalFilesXml } from "electron-builder-squirrel-windows/out/windowsInstaller"
+import { mkdir, mkdtemp, rm, writeFile } from "fs/promises"
+import { tmpdir } from "os"
+import * as path from "path"
+
+describe("convertVersion", () => {
+  test.each([
+    ["1.0.0", "1.0.0"],
+    ["1.2.3", "1.2.3"],
+    ["1.0.0-alpha", "1.0.0-alpha"],
+    ["1.0.0-alpha.1", "1.0.0-alpha1"],
+    ["1.0.0-alpha.beta", "1.0.0-alphabeta"],
+    ["1.0.0-rc.1", "1.0.0-rc1"],
+    ["2.0.0-beta.2", "2.0.0-beta2"],
+    ["1.0.0+build.123", "1.0.0"],
+    ["1.0.0-beta+build.1", "1.0.0-beta"],
+    ["2.0.0-rc.1+sha.abc123", "2.0.0-rc1"],
+    ["10.20.30", "10.20.30"],
+  ])("converts %s → %s", (input, expected) => {
+    expect(convertVersion(input)).toBe(expected)
+  })
+})
+
+describe("escapeXml", () => {
+  test.each([
+    ["Foo & Bar", "Foo &amp; Bar"],
+    ["<script>alert(1)</script>", "&lt;script&gt;alert(1)&lt;/script&gt;"],
+    ['"double quoted"', "&quot;double quoted&quot;"],
+    ["it's fine", "it&apos;s fine"],
+    ["normal text", "normal text"],
+    ["a & b < c > d", "a &amp; b &lt; c &gt; d"],
+    ["", ""],
+  ])("escapes %s", (input, expected) => {
+    expect(escapeXml(input)).toBe(expected)
+  })
+
+  test("escapes all five XML special characters", () => {
+    expect(escapeXml(`&<>"'`)).toBe("&amp;&lt;&gt;&quot;&apos;")
+  })
+})
+
+describe("renderNuspecTemplate", () => {
+  test("substitutes a single variable", () => {
+    expect(renderNuspecTemplate("<id><%- name %></id>", { name: "MyApp" })).toBe("<id>MyApp</id>")
+  })
+
+  test("substitutes multiple variables", () => {
+    const template = "<id><%- name %></id><version><%- version %></version>"
+    expect(renderNuspecTemplate(template, { name: "App", version: "1.2.3" })).toBe("<id>App</id><version>1.2.3</version>")
+  })
+
+  test("leaves unknown placeholders untouched", () => {
+    expect(renderNuspecTemplate("<%- unknown %>", {})).toBe("<%- unknown %>")
+  })
+
+  test("handles empty string values", () => {
+    expect(renderNuspecTemplate("<a><%- val %></a>", { val: "" })).toBe("<a></a>")
+  })
+
+  test("substitutes the same key multiple times", () => {
+    const template = "<%- x %> and <%- x %>"
+    expect(renderNuspecTemplate(template, { x: "hello" })).toBe("hello and hello")
+  })
+
+  test("inserts pre-escaped XML values verbatim", () => {
+    const template = "<desc><%- description %></desc>"
+    const result = renderNuspecTemplate(template, { description: "A &amp; B" })
+    expect(result).toBe("<desc>A &amp; B</desc>")
+  })
+
+  test("inserts additionalFilesXml block without double-escaping", () => {
+    const extra = `    <file src="swiftshader\\**" target="lib\\net45\\swiftshader" />`
+    const template = "<%- additionalFilesXml %>"
+    expect(renderNuspecTemplate(template, { additionalFilesXml: extra })).toBe(extra)
+  })
+})
+
+describe("buildAdditionalFilesXml", () => {
+  let tmpDir: string
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(path.join(tmpdir(), "eb-installer-test-"))
+  })
+
+  afterEach(() => rm(tmpDir, { recursive: true, force: true }).catch(() => {}))
+
+  test("returns empty string when no optional GPU files present", async () => {
+    const result = await buildAdditionalFilesXml(tmpDir)
+    expect(result).toBe("")
+  })
+
+  test("includes swiftshader entry when directory present", async () => {
+    await mkdir(path.join(tmpDir, "swiftshader"), { recursive: true })
+    const result = await buildAdditionalFilesXml(tmpDir)
+    expect(result).toContain("swiftshader")
+    expect(result).toContain("<file")
+  })
+
+  test("includes vk_swiftshader_icd.json entry when file present", async () => {
+    await writeFile(path.join(tmpDir, "vk_swiftshader_icd.json"), "{}")
+    const result = await buildAdditionalFilesXml(tmpDir)
+    expect(result).toContain("vk_swiftshader_icd.json")
+    expect(result).toContain("<file")
+  })
+
+  test("includes both entries when both present", async () => {
+    await mkdir(path.join(tmpDir, "swiftshader"), { recursive: true })
+    await writeFile(path.join(tmpDir, "vk_swiftshader_icd.json"), "{}")
+    const result = await buildAdditionalFilesXml(tmpDir)
+    expect(result).toContain("swiftshader")
+    expect(result).toContain("vk_swiftshader_icd.json")
+    const lines = result.split("\n").filter((l: string) => l.trim())
+    expect(lines).toHaveLength(2)
+  })
+
+  test("does not include unrelated files", async () => {
+    await writeFile(path.join(tmpDir, "some-other-file.dll"), "")
+    const result = await buildAdditionalFilesXml(tmpDir)
+    expect(result).toBe("")
+  })
+})

From 5a62ecc75418e2911d1afa3e29b8e1043f099fe9 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Wed, 3 Jun 2026 17:39:30 -0700
Subject: [PATCH 02/20] address PR

---
 .gitignore                                       |  1 +
 .../src/SquirrelWindowsTarget.ts                 | 16 ++++++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index a00c7e29ab6..0d9764f33a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,4 @@ _vitest-smart-cache.json
 yalc.lock
 
 .claude
+test/vitest-scripts/_vitest-smart-cache.json
\ No newline at end of file
diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 8b9726e6f59..d9965a6724a 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -205,10 +205,18 @@ export default class SquirrelWindowsTarget extends Target {
   private select7zipArch(vendorDirectory: string) {
     // https://github.com/electron/windows-installer/blob/main/script/select-7z-arch.js
     // Even if we're cross-compiling for a different arch like arm64,
-    // we still need to use the 7-Zip executable for the host arch
+    // we still need to use the 7-Zip executable for the host arch.
+    // When arch-specific variants aren't present (vendor bundle ships a pre-selected 7z.exe),
+    // skip the copy — the bundle's 7z.exe is already correct.
     const resolvedArch = os.arch()
-    fs.copyFileSync(path.join(vendorDirectory, `7z-${resolvedArch}.exe`), path.join(vendorDirectory, "7z.exe"))
-    fs.copyFileSync(path.join(vendorDirectory, `7z-${resolvedArch}.dll`), path.join(vendorDirectory, "7z.dll"))
+    const archExe = path.join(vendorDirectory, `7z-${resolvedArch}.exe`)
+    const archDll = path.join(vendorDirectory, `7z-${resolvedArch}.dll`)
+    if (fs.existsSync(archExe)) {
+      fs.copyFileSync(archExe, path.join(vendorDirectory, "7z.exe"))
+    }
+    if (fs.existsSync(archDll)) {
+      fs.copyFileSync(archDll, path.join(vendorDirectory, "7z.dll"))
+    }
   }
 
   private async createNuspecTemplateWithProjectUrl() {
@@ -261,7 +269,7 @@ export default class SquirrelWindowsTarget extends Target {
     if (this.options.loadingGif) {
       loadingGif = path.resolve(packager.projectDir, this.options.loadingGif)
     } else {
-      loadingGif = (await packager.getResource("install-spinner.gif")) ?? undefined
+      loadingGif = (await packager.getResource(undefined, "install-spinner.gif")) ?? undefined
     }
 
     const vendorDirectory = await this.prepareSignedVendorDirectory()

From 6c914d324dc088a9c0e7a2241ce850f826839193 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Wed, 3 Jun 2026 22:49:14 -0700
Subject: [PATCH 03/20] combine wix and wincodesign toolsets for squirrel

---
 .../src/SquirrelWindowsTarget.ts                   | 14 ++++++++++++--
 .../src/windowsInstaller.ts                        |  9 ++++++---
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index d9965a6724a..d644de8947a 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -33,7 +33,17 @@ export default class SquirrelWindowsTarget extends Target {
         log.warn({ customSquirrelVendorDirectory }, "unable to access custom Squirrel.Windows vendor directory, falling back to default vendor")
       }
 
-      const squirrelBin = await getBinFromUrl("squirrel.windows@1.0.0", "squirrel.windows-2.0.1-patched.7z", "76851f0c192eaf9bc6f8f3eecdfe325857ebe70d7833ec62ed846a1acd50c846")
+      const [squirrelBin, wixBin] = await Promise.all([
+        getBinFromUrl("squirrel.windows@1.0.0", "squirrel.windows-2.0.1-patched.7z", "76851f0c192eaf9bc6f8f3eecdfe325857ebe70d7833ec62ed846a1acd50c846"),
+        getBinFromUrl(
+          "wix@1.0.0",
+          "wix-4.0.6.tar.gz",
+          "e84c8f37bdfd833b6c7d92489ca4102f001517e9dd50a1204146d616f6fdc611e2049c79f13325dbb491454d03247847ed426d8b4ad8556693c72eb95f08cde0"
+        ),
+      ])
+
+      // WiX tools first (lower precedence), then Squirrel executables overlay
+      await fs.promises.cp(wixBin, tmpVendorDirectory, { recursive: true })
       await fs.promises.cp(path.join(squirrelBin, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
     }
 
@@ -294,7 +304,7 @@ export default class SquirrelWindowsTarget extends Target {
       setupMsi: this.options.msi ? setupFile.replace(".exe", ".msi") : undefined,
       loadingGif,
       remoteReleases,
-      remoteToken: this.options.remoteToken || process.env.GH_TOKEN || process.env.GITHUB_TOKEN,
+      remoteToken: this.options.remoteToken ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN,
       createTempDir: opts => this.packager.info.tempDirManager.createTempDir(opts),
     }
   }
diff --git a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
index 0e260fd560c..0cff051031a 100644
--- a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
+++ b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
@@ -26,8 +26,10 @@ export async function buildAdditionalFilesXml(appDirectory: string): Promise<str
     try {
       await fs.access(path.join(appDirectory, rel))
       lines.push(`    <file src="${src}" target="${target}" />`)
-    } catch {
-      // not present, skip
+    } catch (e: any) {
+      if (e?.code !== "ENOENT") {
+        throw e
+      }
     }
   }
   return lines.join("\n")
@@ -72,11 +74,12 @@ export async function createWindowsInstaller(options: InstallerOptions): Promise
   const authors = options.authors || ""
   const copyright = options.copyright || `Copyright © ${new Date().getFullYear()} ${authors}`
   const owners = options.owners || authors
-  const additionalFilesXml = await buildAdditionalFilesXml(appDirectory)
+  let additionalFilesXml = await buildAdditionalFilesXml(appDirectory)
 
   let templateContent = await fs.readFile(nuspecTemplate, "utf8")
   if (path.sep === "/") {
     templateContent = templateContent.replace(/\\/g, "/")
+    additionalFilesXml = additionalFilesXml.replace(/\\/g, "/")
   }
 
   const nuspecContent = renderNuspecTemplate(templateContent, {

From 8a18420bd3735f6171cf6ef5fbb95084446904a4 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Thu, 4 Jun 2026 06:54:27 -0700
Subject: [PATCH 04/20] migrate to updated squirrel windows vendor toolset
 bundle

---
 .../src/SquirrelWindowsTarget.ts              | 29 +++++------
 .../src/toolset.ts                            | 29 +++++++++++
 test/src/electronGetTest.ts                   |  1 +
 .../windows/squirrelWindowsSecurityTest.ts    |  9 ++++
 test/src/windows/squirrelWindowsTargetTest.ts | 49 +++++++++++++++++++
 .../src/windows/squirrelWindowsToolsetTest.ts | 49 +++++++++++++++++++
 6 files changed, 149 insertions(+), 17 deletions(-)
 create mode 100644 packages/electron-builder-squirrel-windows/src/toolset.ts
 create mode 100644 test/src/windows/squirrelWindowsTargetTest.ts
 create mode 100644 test/src/windows/squirrelWindowsToolsetTest.ts

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index d644de8947a..070716ecbaf 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -1,6 +1,5 @@
 import { InvalidConfigurationError, log, isEmptyOrSpaces, exists } from "builder-util"
 import { execWine } from "app-builder-lib/out/wine"
-import { getBinFromUrl } from "app-builder-lib/out/binDownload"
 import { sanitizeFileName } from "builder-util/out/filename"
 import { Arch, getArchSuffix, SquirrelWindowsOptions, Target, WinPackager } from "app-builder-lib"
 import { withToolsetLock } from "app-builder-lib/out/util/toolsetLock"
@@ -8,6 +7,7 @@ import * as path from "path"
 import * as fs from "fs"
 import * as os from "os"
 import { InstallerOptions, createWindowsInstaller, convertVersion } from "./windowsInstaller"
+import { getSquirrelToolsetPath } from "./toolset"
 
 export default class SquirrelWindowsTarget extends Target {
   //tslint:disable-next-line:no-object-literal-type-assertion
@@ -33,18 +33,8 @@ export default class SquirrelWindowsTarget extends Target {
         log.warn({ customSquirrelVendorDirectory }, "unable to access custom Squirrel.Windows vendor directory, falling back to default vendor")
       }
 
-      const [squirrelBin, wixBin] = await Promise.all([
-        getBinFromUrl("squirrel.windows@1.0.0", "squirrel.windows-2.0.1-patched.7z", "76851f0c192eaf9bc6f8f3eecdfe325857ebe70d7833ec62ed846a1acd50c846"),
-        getBinFromUrl(
-          "wix@1.0.0",
-          "wix-4.0.6.tar.gz",
-          "e84c8f37bdfd833b6c7d92489ca4102f001517e9dd50a1204146d616f6fdc611e2049c79f13325dbb491454d03247847ed426d8b4ad8556693c72eb95f08cde0"
-        ),
-      ])
-
-      // WiX tools first (lower precedence), then Squirrel executables overlay
-      await fs.promises.cp(wixBin, tmpVendorDirectory, { recursive: true })
-      await fs.promises.cp(path.join(squirrelBin, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
+      const squirrelToolset = await getSquirrelToolsetPath()
+      await fs.promises.cp(path.join(squirrelToolset, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
     }
 
     const files = await fs.promises.readdir(tmpVendorDirectory)
@@ -60,7 +50,7 @@ export default class SquirrelWindowsTarget extends Target {
   }
 
   private assertShellSafePath(filePath: string, description: string): void {
-    if (/[\r\n`$;&|<>]/.test(filePath)) {
+    if (/[\r\n\0`$;&|<>]/.test(filePath)) {
       throw new InvalidConfigurationError(`${description} contains unsafe shell characters: ${filePath}`)
     }
   }
@@ -95,7 +85,12 @@ export default class SquirrelWindowsTarget extends Target {
           throw new InvalidConfigurationError(`${description} contains invalid path segments`)
         }
         canonicalTargetPath = path.resolve(canonicalTargetParent, relativeFromResolvedParent)
-      } catch {
+      } catch (e: unknown) {
+        // Only fall back for filesystem errors (target parent not found, permission, etc.).
+        // Validation errors must propagate so callers get an actionable message.
+        if (e instanceof InvalidConfigurationError) {
+          throw e
+        }
         canonicalTargetPath = resolvedTargetPath
       }
     }
@@ -257,7 +252,7 @@ export default class SquirrelWindowsTarget extends Target {
       }
     }
 
-    checkConflictingOptions(this.options)
+    normalizeSquirrelOptions(this.options)
     const appInfo = packager.appInfo
 
     const description = isEmptyOrSpaces(appInfo.description) ? (this.options.name || appInfo.productName) : appInfo.description
@@ -310,7 +305,7 @@ export default class SquirrelWindowsTarget extends Target {
   }
 }
 
-function checkConflictingOptions(options: any) {
+function normalizeSquirrelOptions(options: any) {
   for (const name of ["outputDirectory", "appDirectory", "exe", "fixUpPaths", "usePackageJson", "extraFileSpecs", "extraMetadataSpecs", "skipUpdateIcon", "setupExe"]) {
     if (name in options) {
       throw new InvalidConfigurationError(`Option ${name} is ignored, do not specify it.`)
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
new file mode 100644
index 00000000000..19414b4bdf4
--- /dev/null
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -0,0 +1,29 @@
+import { downloadBuilderToolset } from "app-builder-lib/out/util/electronGet"
+import { resolveEnvToolsetPath } from "builder-util"
+
+const squirrelWindowsChecksums = {
+  // TODO: update after the squirrel.windows@1.0.0 release is officially published to
+  // electron-userland/electron-builder-binaries. This value was computed from a local
+  // CI artifact build and may differ from the final published archive.
+  "squirrel.windows-2.0.1-patched.tar.gz": "140f625bd26e5022c333993de580fb028033d4940e368bc41960329f92ff6334455dde53cb0834f9529a871e86700abbbaaa681aece40892675b2b25bb22e870",
+} as const
+
+/**
+ * Returns the path to the squirrel.windows toolset directory. The directory
+ * contains an `electron-winstaller/vendor/` subtree with all vendor executables
+ * (Squirrel.exe, nuget.exe, 7z, etc.).
+ *
+ * Override with ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR for local development or
+ * to pin a custom build.
+ */
+export async function getSquirrelToolsetPath(): Promise<string> {
+  const envPath = await resolveEnvToolsetPath("ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR", "directory")
+  if (envPath != null) {
+    return envPath
+  }
+  return downloadBuilderToolset({
+    releaseName: "squirrel.windows@1.0.0",
+    filenameWithExt: "squirrel.windows-2.0.1-patched.tar.gz",
+    checksums: squirrelWindowsChecksums,
+  })
+}
diff --git a/test/src/electronGetTest.ts b/test/src/electronGetTest.ts
index 737f00ca080..bbdcc786b48 100644
--- a/test/src/electronGetTest.ts
+++ b/test/src/electronGetTest.ts
@@ -293,6 +293,7 @@ describe("downloadBuilderToolset", { sequential: true }, () => {
       downloadBuilderToolset({
         releaseName: "dmg-builder@1.2.2",
         filenameWithExt: "dmgbuild-bundle-arm64-75c8a6c.tar.gz",
+        checksums: {},
       })
     ).rejects.toThrow("mock-stop")
 
diff --git a/test/src/windows/squirrelWindowsSecurityTest.ts b/test/src/windows/squirrelWindowsSecurityTest.ts
index fae15922877..76b5f0b26f1 100644
--- a/test/src/windows/squirrelWindowsSecurityTest.ts
+++ b/test/src/windows/squirrelWindowsSecurityTest.ts
@@ -13,6 +13,7 @@ describe("SquirrelWindowsTarget.assertShellSafePath", () => {
   test.each([
     ["newline \\n", "C:\\foo\nbar"],
     ["carriage return \\r", "C:\\foo\rbar"],
+    ["null byte \\0", "C:\\foo\0bar"],
     ["backtick", "C:\\foo`bar"],
     ["dollar sign", "C:\\foo$bar"],
     ["semicolon", "C:\\foo;bar"],
@@ -63,4 +64,12 @@ describe("SquirrelWindowsTarget.ensurePathInside", () => {
   test("rejects path containing shell-unsafe characters", async () => {
     await expect(t.ensurePathInside(base, path.join(base, "file$evil.exe"), "file")).rejects.toThrow("unsafe shell characters")
   })
+
+  test("rejects a non-existent path whose filename contains a null byte", async () => {
+    // The target does not exist (parent base does), so we enter the parent-resolution
+    // branch. The null byte in the relative segment triggers inner path validation,
+    // and the assertShellSafePath guard also catches it — both layers must reject this.
+    const nullByteTarget = path.join(base, "file\0evil.exe")
+    await expect(t.ensurePathInside(base, nullByteTarget, "file")).rejects.toThrow()
+  })
 })
diff --git a/test/src/windows/squirrelWindowsTargetTest.ts b/test/src/windows/squirrelWindowsTargetTest.ts
new file mode 100644
index 00000000000..39189e68adb
--- /dev/null
+++ b/test/src/windows/squirrelWindowsTargetTest.ts
@@ -0,0 +1,49 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest"
+import SquirrelWindowsTarget from "electron-builder-squirrel-windows/out/SquirrelWindowsTarget"
+import { mkdtemp, readFile, rm, writeFile } from "fs/promises"
+import { arch as osArch } from "os"
+import * as path from "path"
+import { tmpdir } from "os"
+
+describe("SquirrelWindowsTarget.select7zipArch", () => {
+  let tmpDir: string
+  let t: any
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(path.join(tmpdir(), "eb-7z-test-"))
+    t = Object.create(SquirrelWindowsTarget.prototype)
+  })
+
+  afterEach(() => rm(tmpDir, { recursive: true, force: true }).catch(() => {}))
+
+  test("copies arch-specific 7z.exe and 7z.dll when both are present", async () => {
+    const arch = osArch()
+    await writeFile(path.join(tmpDir, `7z-${arch}.exe`), "exe-content")
+    await writeFile(path.join(tmpDir, `7z-${arch}.dll`), "dll-content")
+
+    t.select7zipArch(tmpDir)
+
+    expect((await readFile(path.join(tmpDir, "7z.exe"), "utf8"))).toBe("exe-content")
+    expect((await readFile(path.join(tmpDir, "7z.dll"), "utf8"))).toBe("dll-content")
+  })
+
+  test("skips copy and leaves existing 7z.exe unchanged when arch-specific exe is absent", async () => {
+    await writeFile(path.join(tmpDir, "7z.exe"), "original-exe")
+
+    t.select7zipArch(tmpDir)
+
+    expect((await readFile(path.join(tmpDir, "7z.exe"), "utf8"))).toBe("original-exe")
+  })
+
+  test("copies exe but skips dll when only arch-specific exe is present", async () => {
+    const arch = osArch()
+    await writeFile(path.join(tmpDir, `7z-${arch}.exe`), "exe-only")
+    await writeFile(path.join(tmpDir, "7z.exe"), "original-exe")
+
+    t.select7zipArch(tmpDir)
+
+    expect((await readFile(path.join(tmpDir, "7z.exe"), "utf8"))).toBe("exe-only")
+    // 7z.dll was never created — should still not exist
+    await expect(readFile(path.join(tmpDir, "7z.dll"), "utf8")).rejects.toThrow()
+  })
+})
diff --git a/test/src/windows/squirrelWindowsToolsetTest.ts b/test/src/windows/squirrelWindowsToolsetTest.ts
new file mode 100644
index 00000000000..6c8e478e15a
--- /dev/null
+++ b/test/src/windows/squirrelWindowsToolsetTest.ts
@@ -0,0 +1,49 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest"
+import { getSquirrelToolsetPath } from "electron-builder-squirrel-windows/out/toolset"
+import { mkdtemp, rm, writeFile } from "fs/promises"
+import { tmpdir } from "os"
+import * as path from "path"
+
+const ENV_KEY = "ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR"
+
+describe("getSquirrelToolsetPath", () => {
+  let savedEnv: string | undefined
+  let tmpDir: string
+
+  beforeEach(async () => {
+    savedEnv = process.env[ENV_KEY]
+    tmpDir = await mkdtemp(path.join(tmpdir(), "eb-squirrel-toolset-test-"))
+  })
+
+  afterEach(async () => {
+    if (savedEnv === undefined) {
+      delete process.env[ENV_KEY]
+    } else {
+      process.env[ENV_KEY] = savedEnv
+    }
+    await rm(tmpDir, { recursive: true, force: true }).catch(() => {})
+  })
+
+  test("returns env var path when set to an existing directory", async () => {
+    process.env[ENV_KEY] = tmpDir
+    const result = await getSquirrelToolsetPath()
+    expect(result).toBe(tmpDir)
+  })
+
+  test("throws when env var points to a non-existent path", async () => {
+    process.env[ENV_KEY] = path.join(tmpDir, "does-not-exist")
+    await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
+  })
+
+  test("throws when env var points to a file instead of a directory", async () => {
+    const filePath = path.join(tmpDir, "not-a-dir.txt")
+    await writeFile(filePath, "")
+    process.env[ENV_KEY] = filePath
+    await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
+  })
+
+  test("throws when env var is a relative path", async () => {
+    process.env[ENV_KEY] = "relative/path"
+    await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
+  })
+})

From 9d475414f52f4769a09014547cf3b1b97cb83ab5 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Thu, 4 Jun 2026 08:59:19 -0700
Subject: [PATCH 05/20] update with published electron-builder-binaries toolset

---
 .../src/SquirrelWindowsTarget.ts               |  2 +-
 .../src/toolset.ts                             | 14 +++++++-------
 .../src/windowsInstaller.ts                    | 18 +++++++++++++++++-
 test/src/windows/squirrelWindowsTargetTest.ts  |  8 ++++----
 4 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 070716ecbaf..0951eb8b807 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -255,7 +255,7 @@ export default class SquirrelWindowsTarget extends Target {
     normalizeSquirrelOptions(this.options)
     const appInfo = packager.appInfo
 
-    const description = isEmptyOrSpaces(appInfo.description) ? (this.options.name || appInfo.productName) : appInfo.description
+    const description = isEmptyOrSpaces(appInfo.description) ? this.options.name || appInfo.productName : appInfo.description
 
     let remoteReleases: string | undefined
     if (this.options.remoteReleases === true) {
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index 19414b4bdf4..f086310e265 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -2,10 +2,9 @@ import { downloadBuilderToolset } from "app-builder-lib/out/util/electronGet"
 import { resolveEnvToolsetPath } from "builder-util"
 
 const squirrelWindowsChecksums = {
-  // TODO: update after the squirrel.windows@1.0.0 release is officially published to
-  // electron-userland/electron-builder-binaries. This value was computed from a local
-  // CI artifact build and may differ from the final published archive.
-  "squirrel.windows-2.0.1-patched.tar.gz": "140f625bd26e5022c333993de580fb028033d4940e368bc41960329f92ff6334455dde53cb0834f9529a871e86700abbbaaa681aece40892675b2b25bb22e870",
+  "1.1.0": {
+    "squirrel.windows-2.0.1-patched.zip": "86e6c3e9ebf10e29cfde99dfff98f3738c29c9562495c540270129ffde1f79cf",
+  },
 } as const
 
 /**
@@ -21,9 +20,10 @@ export async function getSquirrelToolsetPath(): Promise<string> {
   if (envPath != null) {
     return envPath
   }
+  const toolset = "1.1.0"
   return downloadBuilderToolset({
-    releaseName: "squirrel.windows@1.0.0",
-    filenameWithExt: "squirrel.windows-2.0.1-patched.tar.gz",
-    checksums: squirrelWindowsChecksums,
+    releaseName: `squirrel.windows@${toolset}`,
+    filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
+    checksums: squirrelWindowsChecksums[toolset],
   })
 }
diff --git a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
index 0cff051031a..20b7f063bcf 100644
--- a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
+++ b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
@@ -60,7 +60,23 @@ export interface InstallerOptions {
 }
 
 export async function createWindowsInstaller(options: InstallerOptions): Promise<void> {
-  const { appDirectory, outputDirectory, vendorDirectory, name, version, exe, nuspecTemplate, loadingGif, noMsi, remoteReleases, remoteToken, setupExe, setupMsi, fixUpPaths = false, createTempDir } = options
+  const {
+    appDirectory,
+    outputDirectory,
+    vendorDirectory,
+    name,
+    version,
+    exe,
+    nuspecTemplate,
+    loadingGif,
+    noMsi,
+    remoteReleases,
+    remoteToken,
+    setupExe,
+    setupMsi,
+    fixUpPaths = false,
+    createTempDir,
+  } = options
 
   const useMono = process.platform !== "win32"
   if (useMono) {
diff --git a/test/src/windows/squirrelWindowsTargetTest.ts b/test/src/windows/squirrelWindowsTargetTest.ts
index 39189e68adb..648828c81a9 100644
--- a/test/src/windows/squirrelWindowsTargetTest.ts
+++ b/test/src/windows/squirrelWindowsTargetTest.ts
@@ -23,8 +23,8 @@ describe("SquirrelWindowsTarget.select7zipArch", () => {
 
     t.select7zipArch(tmpDir)
 
-    expect((await readFile(path.join(tmpDir, "7z.exe"), "utf8"))).toBe("exe-content")
-    expect((await readFile(path.join(tmpDir, "7z.dll"), "utf8"))).toBe("dll-content")
+    expect(await readFile(path.join(tmpDir, "7z.exe"), "utf8")).toBe("exe-content")
+    expect(await readFile(path.join(tmpDir, "7z.dll"), "utf8")).toBe("dll-content")
   })
 
   test("skips copy and leaves existing 7z.exe unchanged when arch-specific exe is absent", async () => {
@@ -32,7 +32,7 @@ describe("SquirrelWindowsTarget.select7zipArch", () => {
 
     t.select7zipArch(tmpDir)
 
-    expect((await readFile(path.join(tmpDir, "7z.exe"), "utf8"))).toBe("original-exe")
+    expect(await readFile(path.join(tmpDir, "7z.exe"), "utf8")).toBe("original-exe")
   })
 
   test("copies exe but skips dll when only arch-specific exe is present", async () => {
@@ -42,7 +42,7 @@ describe("SquirrelWindowsTarget.select7zipArch", () => {
 
     t.select7zipArch(tmpDir)
 
-    expect((await readFile(path.join(tmpDir, "7z.exe"), "utf8"))).toBe("exe-only")
+    expect(await readFile(path.join(tmpDir, "7z.exe"), "utf8")).toBe("exe-only")
     // 7z.dll was never created — should still not exist
     await expect(readFile(path.join(tmpDir, "7z.dll"), "utf8")).rejects.toThrow()
   })

From fc7980d61950740d99339a20b8e369334048590e Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Thu, 4 Jun 2026 10:59:48 -0700
Subject: [PATCH 06/20] temp toolset test from electron-builder-binaries

---
 .../src/toolset.ts                            | 27 ++++++++++++++-----
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index f086310e265..f5373033d2f 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -1,9 +1,11 @@
 import { downloadBuilderToolset } from "app-builder-lib/out/util/electronGet"
 import { resolveEnvToolsetPath } from "builder-util"
 
-const squirrelWindowsChecksums = {
-  "1.1.0": {
-    "squirrel.windows-2.0.1-patched.zip": "86e6c3e9ebf10e29cfde99dfff98f3738c29c9562495c540270129ffde1f79cf",
+export const squirrelWindowsChecksums = {
+  // 1.1.0 bundled the Chocolatey shim instead of the standalone NuGet.CommandLine portable exe.
+  // 1.1.1 fixes that; checksum will be set once the new archive is published.
+  "1.1.1": {
+    "squirrel.windows-2.0.1-patched.zip": "TODO-update-after-squirrel.windows@1.1.1-is-published",
   },
 } as const
 
@@ -20,10 +22,21 @@ export async function getSquirrelToolsetPath(): Promise<string> {
   if (envPath != null) {
     return envPath
   }
-  const toolset = "1.1.0"
-  return downloadBuilderToolset({
-    releaseName: `squirrel.windows@${toolset}`,
+  const tempUpgrade = {
     filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
-    checksums: squirrelWindowsChecksums[toolset],
+    checksums: {
+      "squirrel.windows-2.0.1-patched.zip": "00ce495de66c4e985474e58e07c2713f07db955c8da3f90a115e66aa31fb4ffe",
+    },
+    overrideUrl: "https://github.com/electron-userland/electron-builder-binaries/actions/runs/26968100864/artifacts/7418460150",
+  }
+  return downloadBuilderToolset({
+    releaseName: "squirrel.windows@1.1.1-temp-upgrade",
+    ...tempUpgrade,
   })
+  // const toolset = "1.1.1"
+  // return downloadBuilderToolset({
+  //   releaseName: `squirrel.windows@${toolset}`,
+  //   filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
+  //   checksums: squirrelWindowsChecksums[toolset],
+  // })
 }

From b73ca20740cb13fdba99fd86261e84dfd4aa0a92 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Thu, 4 Jun 2026 15:43:20 -0700
Subject: [PATCH 07/20] temporarily add logic to insert build job artifact via
 env var into test flow

---
 .github/workflows/test.yaml                   | 37 ++++++++++++++++++-
 .../src/toolset.ts                            | 21 +++--------
 2 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index e96adfb60c7..e825d300513 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -168,12 +168,31 @@ jobs:
         env:
           CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 
+      - name: Provision squirrel.windows toolset
+        run: |
+          # squirrel.windows@1.1.0 bundles the Chocolatey shim for nuget.exe which fails when
+          # relocated. Download the published bundle and replace the shim with a standalone
+          # portable nuget.exe (the mono-compatible PE32 from dist.nuget.org, CI-only download).
+          TOOLSET_DIR="${{ runner.temp }}/squirrel-toolset"
+          mkdir -p "$TOOLSET_DIR"
+          curl -fsSL -o "${{ runner.temp }}/squirrel.zip" \
+            "https://github.com/electron-userland/electron-builder-binaries/releases/download/squirrel.windows%401.1.0/squirrel.windows-2.0.1-patched.zip"
+          unzip -q "${{ runner.temp }}/squirrel.zip" -d "$TOOLSET_DIR"
+          curl -fsSL -o "$TOOLSET_DIR/electron-winstaller/vendor/nuget.exe" \
+            "https://dist.nuget.org/win-x86-commandline/v6.14.0/nuget.exe"
+          echo "SQUIRREL_TOOLSET_HOST_DIR=$TOOLSET_DIR" >> "$GITHUB_ENV"
+
       - name: Run shard in docker
         run: |
           echo $TEST_RUNNER_IMAGE_TAG
+          export ADDITIONAL_DOCKER_ARGS="--env-file ${{ runner.temp }}/docker-secrets.env \
+            -e VITEST_SHARD_INDEX=${{ matrix.shard }} \
+            -e VITEST_SMART_CACHE_FILE=./test/vitest-scripts/_vitest-smart-cache.json \
+            -e RESET_VITEST_SHARD_CACHE=${{ inputs.reset-vitest-smart-cache }} \
+            -v ${SQUIRREL_TOOLSET_HOST_DIR}:/squirrel-toolset:ro \
+            -e ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR=/squirrel-toolset"
           pnpm test-linux
         env:
-          ADDITIONAL_DOCKER_ARGS: "--env-file ${{ runner.temp }}/docker-secrets.env -e VITEST_SHARD_INDEX=${{ matrix.shard }} -e VITEST_SMART_CACHE_FILE=./test/vitest-scripts/_vitest-smart-cache.json -e RESET_VITEST_SHARD_CACHE=${{ inputs.reset-vitest-smart-cache }}"
           TEST_RUNNER_IMAGE_TAG: electronuserland/builder:${{ env.TEST_IMAGE_NODE_MAJOR_VERSION }}-wine-mono
 
       - name: Upload smart cache artifact
@@ -218,6 +237,22 @@ jobs:
           # the CLR create its hashed subdirectory without error.
           New-Item -ItemType Directory -Force -Path "$env:LOCALAPPDATA\IsolatedStorage" | Out-Null
 
+      - name: Provision squirrel.windows toolset
+        shell: pwsh
+        run: |
+          # squirrel.windows@1.1.0 bundles the Chocolatey shim for nuget.exe. The shim resolves the
+          # real binary relative to its Chocolatey install path and fails when copied to a temp dir.
+          # Download the published bundle, then replace the shim with the standalone portable exe.
+          $toolsetDir = "$env:RUNNER_TEMP\squirrel-toolset"
+          $zipPath    = "$env:RUNNER_TEMP\squirrel.zip"
+          Invoke-WebRequest `
+            -Uri "https://github.com/electron-userland/electron-builder-binaries/releases/download/squirrel.windows%401.1.0/squirrel.windows-2.0.1-patched.zip" `
+            -OutFile $zipPath
+          Expand-Archive -Path $zipPath -DestinationPath $toolsetDir -Force
+          $realNuget = Join-Path $env:ChocolateyInstall "lib\NuGet.CommandLine\tools\nuget.exe"
+          Copy-Item $realNuget "$toolsetDir\electron-winstaller\vendor\nuget.exe" -Force
+          "ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR=$toolsetDir" >> $env:GITHUB_ENV
+
       - name: Run shard
         run: pnpm ci:test
         env:
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index f5373033d2f..14e64349f2d 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -3,7 +3,7 @@ import { resolveEnvToolsetPath } from "builder-util"
 
 export const squirrelWindowsChecksums = {
   // 1.1.0 bundled the Chocolatey shim instead of the standalone NuGet.CommandLine portable exe.
-  // 1.1.1 fixes that; checksum will be set once the new archive is published.
+  // 1.1.1 fixes that; update after squirrel.windows@1.1.1 is published to electron-builder-binaries.
   "1.1.1": {
     "squirrel.windows-2.0.1-patched.zip": "TODO-update-after-squirrel.windows@1.1.1-is-published",
   },
@@ -22,21 +22,10 @@ export async function getSquirrelToolsetPath(): Promise<string> {
   if (envPath != null) {
     return envPath
   }
-  const tempUpgrade = {
-    filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
-    checksums: {
-      "squirrel.windows-2.0.1-patched.zip": "00ce495de66c4e985474e58e07c2713f07db955c8da3f90a115e66aa31fb4ffe",
-    },
-    overrideUrl: "https://github.com/electron-userland/electron-builder-binaries/actions/runs/26968100864/artifacts/7418460150",
-  }
+  const toolset = "1.1.1"
   return downloadBuilderToolset({
-    releaseName: "squirrel.windows@1.1.1-temp-upgrade",
-    ...tempUpgrade,
+    releaseName: `squirrel.windows@${toolset}`,
+    filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
+    checksums: squirrelWindowsChecksums[toolset],
   })
-  // const toolset = "1.1.1"
-  // return downloadBuilderToolset({
-  //   releaseName: `squirrel.windows@${toolset}`,
-  //   filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
-  //   checksums: squirrelWindowsChecksums[toolset],
-  // })
 }

From 2d1458844ae6eaa4b0b51e7486885e06a1b65f77 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Thu, 4 Jun 2026 17:14:55 -0700
Subject: [PATCH 08/20] try again, use rcedit toolset bundle to merge into the
 vendor directory

---
 .github/workflows/test.yaml                           |  9 +++++----
 .../src/SquirrelWindowsTarget.ts                      | 11 +++++++++++
 .../electron-builder-squirrel-windows/src/toolset.ts  | 10 ++++++----
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index e825d300513..c3103320945 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -171,14 +171,15 @@ jobs:
       - name: Provision squirrel.windows toolset
         run: |
           # squirrel.windows@1.1.0 bundles the Chocolatey shim for nuget.exe which fails when
-          # relocated. Download the published bundle and replace the shim with a standalone
-          # portable nuget.exe (the mono-compatible PE32 from dist.nuget.org, CI-only download).
+          # relocated. Replace the shim with a standalone portable nuget.exe (CI-only download).
+          # rcedit.exe is supplied at runtime from the win-codesign toolset by SquirrelWindowsTarget.
           TOOLSET_DIR="${{ runner.temp }}/squirrel-toolset"
+          VENDOR_DIR="$TOOLSET_DIR/electron-winstaller/vendor"
           mkdir -p "$TOOLSET_DIR"
           curl -fsSL -o "${{ runner.temp }}/squirrel.zip" \
             "https://github.com/electron-userland/electron-builder-binaries/releases/download/squirrel.windows%401.1.0/squirrel.windows-2.0.1-patched.zip"
           unzip -q "${{ runner.temp }}/squirrel.zip" -d "$TOOLSET_DIR"
-          curl -fsSL -o "$TOOLSET_DIR/electron-winstaller/vendor/nuget.exe" \
+          curl -fsSL -o "$VENDOR_DIR/nuget.exe" \
             "https://dist.nuget.org/win-x86-commandline/v6.14.0/nuget.exe"
           echo "SQUIRREL_TOOLSET_HOST_DIR=$TOOLSET_DIR" >> "$GITHUB_ENV"
 
@@ -242,7 +243,7 @@ jobs:
         run: |
           # squirrel.windows@1.1.0 bundles the Chocolatey shim for nuget.exe. The shim resolves the
           # real binary relative to its Chocolatey install path and fails when copied to a temp dir.
-          # Download the published bundle, then replace the shim with the standalone portable exe.
+          # rcedit.exe is supplied at runtime from the win-codesign toolset by SquirrelWindowsTarget.
           $toolsetDir = "$env:RUNNER_TEMP\squirrel-toolset"
           $zipPath    = "$env:RUNNER_TEMP\squirrel.zip"
           Invoke-WebRequest `
diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 9b23873d4a1..47b9bdafecf 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -1,4 +1,5 @@
 import { Arch, SquirrelWindowsOptions, Target, WinPackager, getArchSuffix } from "app-builder-lib"
+import { getRceditBundle } from "app-builder-lib/out/toolsets/windows"
 import { withToolsetLock } from "app-builder-lib/out/util/toolsetLock"
 import { WineVmManager } from "app-builder-lib/out/vm/WineVm"
 import { InvalidConfigurationError, exists, isEmptyOrSpaces, log } from "builder-util"
@@ -37,6 +38,16 @@ export default class SquirrelWindowsTarget extends Target {
       await fs.promises.cp(path.join(squirrelToolset, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
     }
 
+    // Squirrel.exe --releasify calls rcedit.exe (via setPEVersionInfoAndIcon) to embed the app
+    // icon into Setup.exe. Resolve it from the win-codesign toolset which already versions and
+    // caches it across all platforms, rather than duplicating it in the squirrel.windows bundle.
+    // Squirrel-Mono.exe (used on non-Windows) does not call rcedit, so skip on other platforms.
+    if (process.platform === "win32") {
+      const rcedit = await getRceditBundle(this.packager.config.toolsets?.winCodeSign)
+      const rceditExe = os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
+      await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
+    }
+
     const files = await fs.promises.readdir(tmpVendorDirectory)
     const squirrelExe = files.find(f => f === "Squirrel.exe")
     if (squirrelExe) {
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index 14e64349f2d..fcadb95779a 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -2,8 +2,10 @@ import { downloadBuilderToolset } from "app-builder-lib/out/util/electronGet"
 import { resolveEnvToolsetPath } from "builder-util"
 
 export const squirrelWindowsChecksums = {
-  // 1.1.0 bundled the Chocolatey shim instead of the standalone NuGet.CommandLine portable exe.
-  // 1.1.1 fixes that; update after squirrel.windows@1.1.1 is published to electron-builder-binaries.
+  "1.1.0": {
+    "squirrel.windows-2.0.1-patched.zip": "86e6c3e9ebf10e29cfde99dfff98f3738c29c9562495c540270129ffde1f79cf",
+  },
+  // 1.1.1 will add rcedit.exe to the vendor directory directly; update after it is published.
   "1.1.1": {
     "squirrel.windows-2.0.1-patched.zip": "TODO-update-after-squirrel.windows@1.1.1-is-published",
   },
@@ -12,7 +14,7 @@ export const squirrelWindowsChecksums = {
 /**
  * Returns the path to the squirrel.windows toolset directory. The directory
  * contains an `electron-winstaller/vendor/` subtree with all vendor executables
- * (Squirrel.exe, nuget.exe, 7z, etc.).
+ * (Squirrel.exe, nuget.exe, rcedit.exe, 7z, etc.).
  *
  * Override with ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR for local development or
  * to pin a custom build.
@@ -22,7 +24,7 @@ export async function getSquirrelToolsetPath(): Promise<string> {
   if (envPath != null) {
     return envPath
   }
-  const toolset = "1.1.1"
+  const toolset = "1.1.0"
   return downloadBuilderToolset({
     releaseName: `squirrel.windows@${toolset}`,
     filenameWithExt: "squirrel.windows-2.0.1-patched.zip",

From 4e3d038a931d722f82ba614d2c0e17874863ee5a Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 15:26:39 -0700
Subject: [PATCH 09/20] feat(squirrel-windows)!: remove
 customSquirrelVendorDir; offline nuget + default spinner

- BREAKING: remove squirrelWindows.customSquirrelVendorDir. The vendor toolset
  source is overridden via ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR (same nuget/rcedit
  provisioning). prepareSignedVendorDirectory collapses to one code path.
- nuget download is offline/mirror-friendly: skips when a real (multi-MB) nuget.exe
  is already present (future bundle / pre-staged toolset), and is redirectable via
  ELECTRON_BUILDER_SQUIRREL_NUGET_URL (+ _SHA256). Adds a network-free skip test.
- bundle install-spinner.gif and use it as the loadingGif fallback, restoring
  electron-winstaller parity (default fresh-install spinner).
- regenerate scheme.json; changeset bumped to major with the breaking note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .changeset/remove-electron-winstaller-dep.md  |   6 +-
 packages/app-builder-lib/scheme.json          |   4 --
 .../src/options/SquirrelWindowsOptions.ts     |   6 --
 .../install-spinner.gif                       | Bin 0 -> 44410 bytes
 .../package.json                              |   3 +-
 .../src/SquirrelWindowsTarget.ts              |  62 ++++++++----------
 .../src/toolset.ts                            |  34 ++++++++--
 .../src/windows/squirrelWindowsToolsetTest.ts |  28 +++++++-
 8 files changed, 91 insertions(+), 52 deletions(-)
 create mode 100644 packages/electron-builder-squirrel-windows/install-spinner.gif

diff --git a/.changeset/remove-electron-winstaller-dep.md b/.changeset/remove-electron-winstaller-dep.md
index 9f9f091aaef..ce5b196b6ce 100644
--- a/.changeset/remove-electron-winstaller-dep.md
+++ b/.changeset/remove-electron-winstaller-dep.md
@@ -1,5 +1,7 @@
 ---
-"electron-builder-squirrel-windows": minor
+"electron-builder-squirrel-windows": major
 ---
 
-feat(squirrel-windows): inline installer logic; remove electron-winstaller dependency and its vendored binaries
+feat(squirrel-windows)!: inline installer logic; remove electron-winstaller dependency and its vendored binaries
+
+BREAKING: the `squirrelWindows.customSquirrelVendorDir` option has been removed. Override the vendor toolset source with the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` environment variable instead (it goes through the same nuget/rcedit provisioning).
diff --git a/packages/app-builder-lib/scheme.json b/packages/app-builder-lib/scheme.json
index a44267e0bc4..66b3e1519a8 100644
--- a/packages/app-builder-lib/scheme.json
+++ b/packages/app-builder-lib/scheme.json
@@ -7866,10 +7866,6 @@
             "string"
           ]
         },
-        "customSquirrelVendorDir": {
-          "description": "The custom squirrel vendor dir. If not specified will use the Squirrel.Windows that is shipped with electron-installer(https://github.com/electron/windows-installer/tree/main/vendor).\nAfter https://github.com/electron-userland/electron-builder-binaries/pull/56 merged, will add `electron-builder-binaries` to get the latest version of squirrel.",
-          "type": "string"
-        },
         "iconUrl": {
           "description": "A URL to an ICO file to use as the application icon (displayed in Control Panel > Programs and Features). Defaults to the Electron icon.\n\nPlease note — [local icon file url is not accepted](https://github.com/atom/grunt-electron-installer/issues/73), must be https/http.\n\nIf you don't plan to build windows installer, you can omit it.\nIf your project repository is public on GitHub, it will be `https://github.com/${u}/${p}/blob/master/build/icon.ico?raw=true` by default.",
           "type": [
diff --git a/packages/app-builder-lib/src/options/SquirrelWindowsOptions.ts b/packages/app-builder-lib/src/options/SquirrelWindowsOptions.ts
index c9176c70e7f..64a90a46c67 100644
--- a/packages/app-builder-lib/src/options/SquirrelWindowsOptions.ts
+++ b/packages/app-builder-lib/src/options/SquirrelWindowsOptions.ts
@@ -40,12 +40,6 @@ export interface SquirrelWindowsOptions extends TargetSpecificOptions {
    */
   readonly useAppIdAsId?: boolean
 
-  /**
-   * The custom squirrel vendor dir. If not specified will use the Squirrel.Windows that is shipped with electron-installer(https://github.com/electron/windows-installer/tree/main/vendor).
-   * After https://github.com/electron-userland/electron-builder-binaries/pull/56 merged, will add `electron-builder-binaries` to get the latest version of squirrel.
-   */
-  readonly customSquirrelVendorDir?: string
-
   /**
    * https://github.com/electron-userland/electron-builder/issues/1743
    * @private
diff --git a/packages/electron-builder-squirrel-windows/install-spinner.gif b/packages/electron-builder-squirrel-windows/install-spinner.gif
new file mode 100644
index 0000000000000000000000000000000000000000..9be998f3d336e896adebeffca103e293e91a1044
GIT binary patch
literal 44410
zcmeFZbySpH7dVQ_i-3rVihzKCv@{|iDpJxdDc#-OF*6L^HFWpT-Q6HagOoIg3KF7n
zpBYf`{oXJ9t-F5z-0NB{g|qkB`|PvNKD*BILRgT4Qxoe#7Ro3Uifw0+ViY)Qt3)3T
z>(J8<Sg7}$ZZXaT#muH@$9up(*SgdOJ5&Tpcw5CUW*fj^emzN=8DX-%cG7-M0lleA
zGQvS?UH$`cnVZE;_I58rJnH=d3rccQJ2L$HVdd$$ZVjPTG4buDrjU0%WnbGw+{`0K
zvr+!v`$KwiMM6MMmhZWg01E@tr3=8!z^@d=rAYWSZ8U*@xt}>$Xlfhl+K_1J>KmFp
zA={~KBqK4@c|xYZCe9>o!KZ6rDCA_NE9)d7r|o2{&8b87>?sMi1DAuTg{iKMCW(Wo
ziJ3K*!xJ)19dj*RF5v%&Uo(=CAVF-5pO8IA43Hpb@|j!dlCUwb(Q7lYFq5!zGBC3}
z<YZ>1BVl1;W@Th%Vr1c@XJ+Pl$j-(5h~(@K89>cSM~_Q}U+|0;@Y54A0~;F)E=ERs
zdwT|ZRt9q`eMV+ZPEJN97Dg5pdH{mn+R@BL(}CX1`u>j@_;szdtqd(}49(3*5Ho6O
zncLbtAp<x)U4p5FxcJYB&8!)a3u4eVH)V9tv|warU}7{iMXU=6ZEYi?`-_c#gtnG*
zw9sXg(X}?WwbIrF!0-P+24wf22_XOhZnz|^41rD2G~qYbwl&o?vk~ThLI#X5=osp7
zv1#crYqIKb(ra<BY0^K`)#9Y*VAIj2*Jfd5f5@(<smGzE{bQbg!sq7@cqG93oSjX8
zkAs<6fR&SlRq(kWKNAZFFAFap|Dzwc!e-Vsnr7O%KWG~Qw9jxK{YP9bJ}X^K8*?i;
zb90j)S|DX$Zewn3U~WOe$45dfuBmNkhWMEVu}7y%=GV0{wA0lQv@$m(K?<46@E;h^
zV`XC2d!)xoudSuUO8<~mlZ_tWpP8QXAq(@PN7^jfx~%MEXZSk*r@~_dm|{d|$~n#X
z@hd<b5&!*p4uBtio+Mo};P_Yp=j6i4_ita1zZ@MN?0??d{q*s}&in1H&5iZ7)s^LU
zON$Hhb8ly7rl%$+#>YnAj10dX8XV~F>+R|8>g;H5Yi((6YHX;ltF5W7s;nq4D=jH5
zf)^I#=jG;PXJuxjr=_MOCnYAt!{TCNqN5@s!oxyCf`bAB{QaQ55HQHc+so6#-Obg-
z*~!tt-p<y>+RD<x+|1O(*vQa8Ur$#@TT4?zT}}0sin5ZTg8WN4Ss7_5NeOW=Q4wLG
z7lH!(e7w(jo;`iS{g{iBgZ&ZPLsk~xfHKh2J)otbrlO=EzfVR=a*vpZ@Gb#9-W}ZA
zw{GIxxPA@$D%KTD4D`!rf1zHw2v{4^Bh<ezQK(Sp5GD;_Q&G@Pc)~1%Zp8(4rCW8I
za3u|8+lUk>!zc3X{OO#8XNnxe7+`}2>y<HPwR0b;2x}+@b`I;@2J^2Sd3btxE4vB$
z_(J`>?Nr@GC_*V-phlwl$Hc}d1inZR3Ja%<iiTxoWm6_4y-10O$|)}K%?lPTOe-p_
zt#c@cREEJL>)Sg_8#O{&s@pmThhBAyR;9llpO72r4Q<VsoL>+I_bjfg+JM(Kx0W`x
zKdip{xVNzT`SA6@(bx9lZz#Iot_TgiY4Sq9LnPJ}^12p$o#+cxh<T{R4{zaBU)PQP
zjv$gw7cAkDq1G_!)&Q|?mY$v{rsMbkVb<BUIF6*cJ`8Ir$&;w3?x|R`5#+B^NrK6i
zvu$WPG9_qu12HXWUxMY~WPQ1jB;$oBjb6)Cc61FTdh03TSIp^E?9Ap;{U3}I&erVf
zEfzS~GgdUXeO|vhbDe2H8+`5fZhn=<Vn;18A8wa})wAv>Y0UwXB9>Jr*fV`hdgYYW
z;ccO`Ok1bVGh>C@EkOwfl&0mS<|q9HDn;9GEgUbspmRA~oa@lNFR50Gy*u8Uv=hWI
zTe-W@Kdv$OUH37^=-UyGYwmj7M=UFY{&a=JvS0RxCt4-<+}xtR>~nSxGNM0oH$DE=
z330zzb4$b1@w#vFO-u&ro3_}r!x}#Cd4xzwZ>nYYcoNiv1}=c^$>3@E+~-nU^r9k*
z(eiwNIkD)@`00+e8|#$9k_&rFw6^o(-0>yHXJL1A9Qd3R-r2p-iq^3e6&ZhLEy;36
z*GiT^VcA0AVzjQg%Es8TsroRko{4si{ECr&YLuR#vESH=zPS~yzMi$R{Hl&UZ<M~a
zGws-_raKO<frj^&muqT}#Yh8H|DM~ZNDaM)&`?|yG!!fpbU;Iio5Cy{xNZdbkiPbn
z!}RY;zd04p5<Gx&+c;3K(ud@iQWO3;3fUi_AQ_|nBNXImLj_QnP;h{?h&P2>2+<J)
z3#A(xif|=Kk(S~YC`*py?Z?hK1<u0pdI^JDSLnI=&5XwdyyEAHTcFlX33WCr2QG3#
z?#}jnKDJ<9Uo$_d0Mnolljq2#qyIS17f^r`j&`X@_WCc8;GkSb!9+@tuqmv_=7$t<
zL%SDBX>^Gb#<DG(3V6MLA>aZC|GU_c0wMe(6r@1N{s`qv?0>=-k_y8gQTgkK9F<W{
z?c(W9@rPM;%aI}NA{!e#J=d-`QVTX)6mzT_G`Obk7;9ELE>Y=XLOce|0PNz<@#;%^
zc@qIQFvQtI&dZC}H`v`z&4)LTG9<<+EZj0Of-g1}CLNFzloFCAm64E~9h_^F6a_CT
zeqo_hS(|8FSC?PoP@ckz+KC$0EZEjg+12gW3+j*Q=;|rWj2_JyoEV-e$eQ&X@0=_s
zTV9!4TiBT1+8$bO@m`wQ4gLH<x3SjhLLG%ga;_H|JE_>(&J{k81@V+M^$ox-nlfnd
zr&-=l@FiyT!s@mp?+$K|NL<gBxzZcuFV-^i$%>LD_K|jG-#QM};0f%pyF?C68T#u~
zI~OuGD;q=EbV+}~+gzXZUnVM8>y=mA>M6vitAJl}?&~Op>GNfNuCmis2{3=q5y^3&
zsS38gxx!Xuuc7YY?*12Arj21(3)uOaDBS~U?KIz;*Rb&>Kj?TxCg_1{l#KLqlM28c
zT*}6Vg<18PXtl~F#wGCn4#CGNrlu8@vn$|Q6*Kdi#%;9D$FIyS8#=#HUaos(VcimR
zk1CLXXl`)>k|Wwk=zrY28d3gi|EV80|HpuS$u=({7N_oc=Eh3GM(1xkyKJkgb#vD4
zLnlyN62nVz@+3x=bE8O%uhfi@m|W|@B{jV{B~NO0XCsQ#{O*@A22zWAn0Lr5?-MAH
zSy9nOlUYCD8Yi<EFV`m$U>WFA3w)&JsU4&-pRLBnPI>Fpa3NKQ1h`s7&Z$tGP**yR
zA>wK^uo0#Z2Cml9nm103vSv793|HE<OO^fg3g=`fq}Avq5m)QAXIbCO_?^9d99&<x
z`+D+$0$p5fJmhVIBJCide&JqGkulI%-h{-EWN2zyV3L0dWlnB}0i;yG6joLmTL4ev
zMQubi$@I^zOK)mcs>v$s=xl1q?;99wd|g@lrl@P&dSnXJFx1mp**+gU^KQ7Ue{Fq9
zv7)MKcdy#?;IQONvDUZmRVY5%=E-qhXuTw2=z64ljM(=IkEx0^8~oJCw6I#um-s!2
zpUGp;gkcIh-jTFQ&&KiVh~iUgd4p=DcQcmBvf@on*sAbJ61gY%)<)=>U>aViyc})l
zI$su63T1>*$OcayO7Z?kZt&(4_+HbPs9`DYWC`<NY6hoOL1mEHWL&_59KBb?Wgp&a
zJ1WpC*XJG9{6$zquiAq8ElS`k_#;8*<=fLfCg2j@ZdUs6*CsdKYxHqG-?=p#z9%{I
zT>9Ee)rim1<HDMZk+Tu|veVL*lB24T2QTN8Jk4*vjXYFX(hLp$To+|6xa^p+Q+^zK
zq`vN%!``Xp@Luyhw15$9F6OKDZfLutpnB{#-OsVJ=23G>AM6fOJ_e7e$DJ6S<XotV
z^C-A+80T3`$^r8#XLf*jS3j?U`P54v!a&WM9P!|GONU$WkZ#Yac-L_#UIKIkf9#H*
z4C)1>sYNOZ6QC%(KNW?V96wm-z9rHJ)3p-uQ-&*&vBhpX#j3os-@1CQdo52X*6eXR
zA4f4ie0t}QTghzk%C3i}owL3r$l43);A0{H;qwc%4R{F-3<(R3P!4vF^@Bx4`X+g$
z1Vtxict)t0!DWn#N?n89DD#qdQR`66D-x=z!)ogrqbpn6DC--<UAlXc`#J`ja$1Hn
z-_&)cl}}7T+h@nRnir@0-^MSjd%PRaC@F&*&wVyHI5Io_YWV$oc`BLIy?QV8i)34=
z7Nk*N>;j$ubX_t5^FoGP&g^2c&LBJtuRQ}j@@^)|Bt^06VV&Mk#^)Vd9J1Q|{_Hd>
z0aYWKgD0S8H_+%g<TPHpzc`}kuPjrORhHBj0I`j}?Tkoe(F%NN^*|v)ZQApyzY*PJ
z?zciSfoU*3Pr2eO!IlVa{A7{UWr-XW`AwxNx(l_pu)>SPS|8q+mJ0|kmgwXrJ&wSN
zD3R*rXTCcc5K$^KDE9pE?W>VxawBrmDjCPoY-*#1s?Pn7!FIe8rk0J7_3{TZwWY3`
z%Pr$}_zUHsb1Os&N0uv|Dc7RZV!mi@LW>#4-o_kj?}Ro>;;P4f)!mJKZ7x3-`%V8K
zWg$39J?^{Van46L+FKQOlkfdU(J+tN3wQ~hBczH6UgOL$3EtDsClY+-r126#OPY#_
z;8n|*8;Ouj&xu6eolv|a=x&OT;OPyH)DjLrOP>DFk|BOtg5dTPq^B;C9)SvY>OC|#
zz1s}sFW@m(9t91KTH*BTfg$F)h7t%ZF^e})TRicwb#mo(=JoV-)bVjKwt|LOdj|!|
zxrK&=M}Yz$G0-@r1j?jj{|In;hG(3zDcr)SsK_}7p(8b@so80jG1ay8ut>3{(3YCE
zzUVIBp1R_Oh{VBs%G%-hH|=BN?yvi2-sa9POty}+SFEm0wH20{8ZGateLgTb`lA2!
zo7VRWCTzMIJW6O7BEs1gSNP~I-s6Q*Gh?>+-DK1%Q`FP$2qNb6!l02M?q(#A3}el)
z(ru2~RIEsM2%{8+ky<*vsSc$QJW0CkDRS#e2sK|CMks+CR|pMH*0<!1aHrr6?!3~X
zVUZk}%?I$ks<B(n;U*HLk6-W09fzArRq`$1Mmk5B$<&H|d^CC-VJ_DwdqLs0OQeN-
ztIG41eDcx<i}2u9S}=y4x=wGnzM7zH?5>`BQl|}C!ldPTaaM2U(^@Xm&2sp3huh=F
zX4}=3n=1{qkIi@L8;{XW9&=lKZ0@{5^{kHjV^@2CIs-91*Ix5VNU^Bf(^;;kJ6B~>
zRwVGh(tL_5*A_I7`*zr|lM$`36Z_QgAopYG*iPItlarDQLNJet8@@2l8qzM9R|7M8
zym!lUp?IGTY2SEIk7idqc%V5ND+zM!Ig#Xh651toPC>W<1>ydoAW(if0%*%=DA$vQ
zRFIbS8@=0<<$~}-OopJrK^C0;pt!~}1#vLJYlvDp@vw2S<nuXI5N9`NFom}(C>#<J
z946-y7ZmLoYZghF2u+5GrTfMzn-)Z96q*LYvvZ<(QL9mv0>Eh%AyqYX;iXYc8I(1(
zWm%$KF+HvQZSlfG-MynJW1SQ3E!EQl33K)feWe|ZD}Gb({9*&6*-xr_`}&7RTE|}x
zjJ`X5q_U8X^?HR)=96lX5)Q_W<q7DbCvJyaVASHyF7D<JyvGPm=U~wihEUzf<gY5x
z5cOm{X@AGgsxI!#zPubzKJs$#ME;qs?p75!_1&~xFwU%wrD1udMCgVrLF9%^j&{+0
zsfgSrPa#qL#dm9a>k%blgQ=h_+=2-ojprS=Iiqz{!|kP4URFozsz<wPqD67W=xM?r
zmXu@FG5Xp`!JdM+A{ATHFHPwspVn|1F6Sn}?Gg!UHrMjADx<JrUp9@Z;p-h0kMEkB
z)>j^_?APA4FmG<exXjK?XldEriBDx;M`&f;JxJ54>^wPdQ(4fdHcpseZ9h2u9CGJd
z!k)v(vUHY$YvO08@omk{=qE{buG0sWtK;=a_U>~h7w#lmT*6UEw!BOhoosc5WjxvX
z8t<JH8>vwC6#F|~3Zzc>ag`V;&P2I)wC+4V4fK)b<0+sWkI%GY#88MXQK$o<9f>~T
z>DD5;ys^W%^3JMymGgQEM^|BiOFBn=4SKT%b|nu%*S6ap!rr$n?N|xAXz`naEIs+X
z<slw?x=#B3qHckXP(Rx!cgYyOaFNJh-<V|K(5OU>?6h3X)EDW6NeO(YMIogEHVT!n
zobno~I{t=&=IWN#=8oc^f#{yLimH;*5vqQ0=U~mm)a#+y@xJ`U9v|s7xfSEhEQ$9!
z0^7Umiu(Z@M=2k_emnmDdY8&Vqsgnejsz>qLX(#T`(7?oaZs}zbmxX1U6r&(r~ADl
zP#^oSTDK$BT*j+P992<WMo{}3Hfwot1@@QAdu2Ce2lx1&UHU7Mwe0HifER3(%T;f*
zWkVzd1SvR2bzVj&ywuaJ9@PaLT3v7k=a`;SyuNMba`l+LO0qeqgMw>(?Rlns!V0KH
z!AL#Vy#TF)OVL=f5K>QxR;y^DT@u_cDEL^(RJS5}Ru5dOWTsz}w7poWcpxS{lF=V8
zpYY}7=1X{Gz8w*Pt?5{$VX$D_T|4v1;%Zbl%k+U+Mk9!d>S?^HwRmsB3y2$`xo!RU
zk={Wqk%fKp90r7)o7mE^eHA~;zK+<+xqFAEvy%IswQK(Y=juV-JsbDeS3mA2nO<6y
zPd2+iW}j?{p*&7vcg^Sy>9aFMU_nGS&;EZ!`2V~jAT5Fg5EY-M1n%&7g=o+cK=`$9
z<h;U$QR>O&rV}UipJr5$utvYZO8tVR_*Yn+KY&&H16alX4VD<8<TC#o>@5T=KLC50
zlu<z@Ww6DODNwS&p;T)TaY1-iZUr>ZtZ}UH1{Q8`w@T@)f|oZZO)Fg_;M$QBVTe%w
z#LYp$!w2N<B@Oli`%3u-Lo}fw5l(@Ek&)2?u@Nx-gpkt|%^5v{^YqA1Q?9RYlUg%v
zdVF|u6mvhvZp&8!_cS_oaQ*Tce!|m&$?YnDUTx_789iY~fS#v=3P8^b3eeLD3W=Zy
zln3ZZ0rVvQMvwgeGChX>%k&WY#|5Ok(h&Ox$TKq)xY-_s3TN4D_{hK&Q`mY7$ZF@8
zABjB;?44(I>Nl&+@ZnfUh#Xv3c>I)cPWH2#g{!B8hmRN-;^!X_7!({58WtWA85Iqr
zuwn5DiAjM{scGpMMv|F1x$1Ixg_#QQlGNhTit>t*s_Mepy4>V|EPjgij?S*`p6*t@
z-oc@se%{xkuSclHriSyyrsp~)=I0lerk7X7PW1qpm6Aar05lJg*d*iu_`Zb`<dZt=
zBgO#jr@BQ$B$y{gyRU4Db{Z$5Arw^&K=^TB0R(CsF#mlS18xSG=*_*HblkMF1B=X(
zAz)7@Cqv}*xf9TZE?Nq+P)7Epu;ND&=Zvo0jvakkD{J;h4E-W96h)FS0MO2|egN9P
zCR-)`HQ8$M2VB|xgeBw&3-RGN%jN$2ETq#P@q=8s#~+~}cLMxJC`dsC{anc%#OD3G
zy+Fc7{DeiU`hUp1#{3aK$R#BIr12m5LBeMKg#GXQAQzDP=lm4?5ejnSD*gxsX-ez<
z2nD%#BLGDWnSz%=T6=<Egtga+OU%p!3SJT^(s_2hs#>-4Oa~7bVD&?#PEW{7=d{>e
z8X`w_4qXzPsMbzIUEMr<1ie7Md=RLwe}GR=uzP5jvumWsxx;OQLVk8u|9ie2nYcFt
z5dQakJ8~&De~#kxM<__fJpKp;$r$*LP>@uD0F<-(#D6^_NQAIoH2w!mg;cPZKSxRY
zBNQZK>3@WRlvnN_p&+Rg{SnI9`TD70|AWMkR2l#(|7+C<iO}+kt)_pvKYlOPA=&Es
zBNQZ+fj>ui^G7JiU77kL6r??x|05J66@;PiLfRv>bM^?R5(tLBL8SF2wyZ@)of_vY
zLIHa;D8}N{|0r+z!{KLo_;mPQty<FD@rj401*#9K7sLPr_6^YV3k*>U4vmlxkBkwI
zj*S<BB_#7Dr6ix)CZzauP#Avt5&yyQNA8Z={}JqezgLixYXOu0@7@N|u{Zc56lCmz
zhH@DNQFui`yUv4(wqy|^)UJ(V$dAeFdoI910{~Ew&e%;J$Pg(>=q&`09Ch5_($I}_
zMV(W)8^B~_JONtSB>4U>?qgKTkwN*wZA2o;nD8L2*~@0as!Y88XMWWg4~Xdzg<ldL
zkkoS^dE1p9s`!vINdm${LQjh-Pq!Xd&T>1b=sx<dy1*%|y8sdm&tE{w2B;RN8g{?J
zyd||DC6cNPeUrsIw8e7cqGu~JVRSdSH32vFsVjGmBq4x(A2{v^Z2oYo966FCDUe*V
z4p$+zr&J1sW#ufKJ;3&SH3ALr8&OeCss6&dMV;uUDaS$a63(|8-mOZ8dJ)1$O&Kh#
z`;d3*_k|LiE%YA1Gc_TwP;%+!vxQP%<|~FR<}T9`YP>j?xJ0b;HVPxasV?FOAcRAD
zqx&H(sDEwumZ?Nu--G?^S=`#UImjNAwK9YQKli~QZZESJaV6*NTw})cG{Kbe1{wRv
zf&F|TMo>E=4==Y!b96jBY!hq&m~jGml2J;UVTMUe+*!5!r;JE|-~k2A<n-_fccq8v
zm~cf)WksOBq|KZ#`s5dB6gp$JD~jpwue0kIqlV~y0YWh#r;e=h0*BAb+Xv)~DGas}
za|v(`atd(_b1?FY7RSDL5!>maMj~&N&BfFdsx<42?8Ib8?4kt6)1&y40V)(ufPtX1
z(+`xHg?YJ>1XgfF1Vpk%w?5>)ajF(K$E72-?tKZIezT+|efF;#ZiBI(AFCDad^&b?
z)im|;wuJ!gH@{*RU2sTrBqDZkk4;R`#ly@9#pF%)%Qnx-DJ%%d&xMwTre}tr*P^F3
z7$am9iY?L>(m~!8+|w5{5Zc@t`ZpG7k>Qos4+BMN7;C~6E;?*25-0-~e_*Hb#;Wn{
z&Lg^pu->&YuDhn9<1g&*5=XPHs~+ElzuAR4IlFthyV`+%WAR6LWr(StkOK1xOb^KP
z$4t$WL&z=YqG)d5Mc(p&N~&uA+IqjnlCmJ|j^e=I*dhRwh6<3J{2wY!?Y3#1%iulh
zV-LxTm_C5sfPIZ2a?n73KcfIA18>ZWCg^eKziSBr3JD4&KuY3YwM10{{&LwiPTVX*
z_1ytJF?%a!>8XDHO-t-C)ojHaAofr@f3RbqjUiQ-&EHl-jU@5vydIDw4Ut)|2PlWi
z>VEDa(u2)@Sbu;W-aEs}^@XBf?!#dfB8C-v?3O#nc<g3o<tgIf26nbPrw4$L4ZLEI
zF|37S_&I`i0XO&#(jc*)S_fgjv`^HET#)`OR@#>`c^wa;vS%^>$~^1)8et_;E1fmu
zP<G3NZR=)vnPQ%^G+4k~lqf`id{oXX&F?*Aim8UZ+rSkD%tfpp>ihmEW~DH2d%G5o
zy}x{;b|`Od^|LPG6zNEU)FHm^V*UZ5L1q%6R^btTp)o<|hyXl-@;Bbe0p4!{^q%|~
z?{>5k8_VAcI`4n?@I-ewHzO8s3DY1~p!Y+^ZyM4FaV2$9<X{v$&5+9*^PP2q&hD_&
zy$$OfL!=P0GGu)2Vnh$D+YUd8o3lQ4<8u@R76Ib*cJie{4+^#lQ1*kEMR=G-+git2
z#3%SfCHu#wB_&&j<mOqQBYhVjO^76|cuE>d9yZ@)k{BkMWrLoeoF`B7XnMvf_^mlJ
z9RsXdxP+sCTXsa6{jpnOEok3a4ZAVvx`&6Ggb7I47;NGTg{TJ@`UiwU!$FvlCeiAi
z@$p*ch*1E<ZUW>`&^VFAFoiMG!hBzG!6YaiD#yz}#x`l3myH_d@6*%~L4@^~;_9Ae
zHJW}t_9sEuyQj~__u=PeV+Urth`ck=dBS*v2nqbp4RV|x<onwoCop&ciHXMJX+e#3
zPMOXRfqowX64wCMZ@o>_h`h*ol(64XFi|j2j8N!-1v@s$tOGSM;NF$#qVtRZ+8b$a
z%fN>+KS0k^6Y#EnTrGb)x(EXg{@uR*FkXOaCZ`~BLw=Oml$mllxp^`L@S>a&>Ed#c
z$||9nTET*IGPwkB!v%;81r4_;?87NHR!X<Hk|==KlY$p?4)g*5`V<Lz`zPa8-E^3s
z{%o7vTW47z<Q0MfK=L3VZ#6X`y#(O&L9x(dhq5E^&tJ{w0f&DA(qSL~mCm2%e~|MT
zB{YB%B4PE62W;U$o9KfqArU}^sLS{ZD02q#?UVpv&Ketvj(H6(l_2e4KOC=6aJoQ{
zF2UtMBwWZ@MaGBk+&WQE{sQL2L~0}m>7{g~vnUyHNe;=fBKuFXt$SznkhbI81|3$3
zCiE1{)>(J&9Dn=A+31=)e$3`*biSMQhb20lt=6P=Zs(jE_=_E89_arvfr`<YLojmM
zJBM^qPiH|WDpu2}3k56+|I~{_#tEkYw*UYq9>C*4s-=}MH>YGv7NYAmNi5@`)3#IA
z<h!vwdgs=zVn<bhd!t)bBc?vRlY6P(%m&ztbzF?yd_X=FzwT5&Oi5p_$gtR;2#Kg@
zs<;$?nZ)SSEQ<7;r0mq(q~wA)cz#K2S!P98l~+weW5cP~kOv3_<r=UF2zK1gu|v)&
zj9@2&1ukq@*0ZeDC{U0inh0#{YQ-x-?{<@l<14}8s}nV|{`wmS@~&Rqt`xsci7%!k
z*dtOlBp^&8A}S%qKaM;;Au`D?B`w`K6Pittn~@JGEb=IU$mEpkR_4^ys@Au(R-UqS
zCPMr(md;D)jHLqQEU|Qigz_er00~96b`(3h3fvjpI-KaY9b2~iay@8pvs=>MRnHv+
zcB1&@82MvLLcL?6!XhQ2V`IYO$rF=YQ{pnbvl1wBGGW<;R^c+~CB|jNl~v*O4ULWG
z*g*rr4tf-RKtkTXB=mcm^zVv=bW#6qNA$@-<h<Zhb|93&Vd25P5z#SGF|f$c_@sci
z<g}3V%+$;XZv|*}x_CiiPKao6DX0ism{wg?l2e~i*<734)|e%BPT{ctxA|9W;|;_%
z*!N{(xw(7>&nYz)!2D@!a|4KNQqE!<9a<RQc`y7F3K7{50U?Sd;Drm3cXPCnhofVm
zEs%r~jvC_{+wy1qMjSCOBB&uei%(vFWHgPqU_se@LNeF|FKO)_{1#fAl0bwO_jyh&
z(2Fn`UpbE3UD<mWk=Qrzuv$`VEQH^_ANL$RZ{n~}IDQfelOjbPmzFjY79zX=Zy_0}
zg4R5{wKXoUUy;)(0+LWucnCQHft)$VfHrI>dl&yU5T*He^IMtJsxyvT_Ww?Z_l(e8
zp5F*bT@Fo;k%x?JF>RbTsfY#LL`E*kO{bBIKzoR<32k&%=1qb~;v~_{$Xqt9*jacH
zEIsc0^<p2s0mKiD4ZEK)J+<6{>qXAX8{$s|_~Phh*aFyL5mDrkrs1(>K_O;;6F3nv
zT(Llqqr(Qm6&Vc^+(;>$5#d0FoR<%*{Md|uK1l_FeYa}e1-t}gv;N=16&qm(awB_R
zDt}x5KoHa}*e@(d$R`#Vu-Ib?VJ7pY*=1(hW~Wo-*rbpbT4R?b+5L@)`{!e(;PiAE
z3llDA&$6{&Kv>M1{2`}NqiV&STXdOWy@P<S#9&?Rx4&*0Sh+6!7>EbpN5XCf9^_tT
z9$+mWsMT-fmT2-g<dv!vpPHeDnH`XsmtRoGmy>ICjsX;u`+#Y93~15hud^sjo{)HI
zJmHFK!#Vv<jT)2(xBh|+%2-bMm_aIyD+%-75A4Y5B?j(nF1b30A@1~Z#xq3L*Hf09
zJS+|xK@lYr1A`?bNv5QRrDtSihs#9f#TFDw7A57E2If|lRM)^0iyK<o3Nkvolwx}O
z$S-!g_V*7C*$?-<8MPYkot!eAiFrGxzcBF5Y-MRpePe6q!^cm%d!P3Y4v)SZfBp9T
z1mzMYp-@qBvp4!pG8Mg$UOZ3iD}v-4mKp-SndDl-cg`got^vA#8ho5Z2GCP+OP+~a
zF86cXsB*FDDlXyEpx#ABr~U!6O3eLf0`<W(+db7-#+`6iO?PrnRd0})yRYeQ)vZAC
zScG$(EEIK4yu<*(+sISRiuA5=|LV}e$uYr<1$;!Kcp2!}rmPB^Bl1SZef*d12xmP*
zW%rKd%nX0+=K49Sg9FTiaBWf0w2{gR<R8L@Jx#d$MR0b71q6|y?RH|-TRILgqVR+j
zAZn5jjP!c6C+^o<X><GyHg{#+*3HG-$=(BG1@ZFN_wc|p39<<>4l|E1ijs~A1a1_a
z#H7%~WX;q}wZHL?kEAPh8XZ9V(yU@%aY6f6S!s3Uv&Qo)3^q=q5j1m%*N#%mexdO8
z`^RQ+dE+*<ch%n?pJ+?i=z4j8+#zmISAQQ-Z=FD$a|BR;n}7#}8CclzFa68;ad}I`
zPNY0E+IC8q+ybs9h1Q8;$8Y?sqg&<97{Sr2{f{QyI`40~sJeOkm{I)lDT8Goo_6Hq
zp@HEPk(SZ10k8y<q-4L;G`);W-|QUqy!?2{2zXIUNx4K#g(^^Ute0=BZtn<f>F()`
z?j4}&AMANO-126$VtgWJYC2)|t>^s0yXBSi==F=MYwP5jTe<IdK7M-t;j`NA-qDxc
z!*97;m+&llfG0CIr>3JNp7Vlt3CVocB($FUUA?D8uE{(v7(~Eqw{>8tQ*v%giBZJP
zRD<Qet48lzR%KPa@LBDuYUrcx)^h@60j4><kFa^dhDgb8K-$xoy9v)5Vm1KeXK2Cu
zx9H)~&%w(`Ho{IV|CuYp{;z(+&&~N0zd`Jr-w-MT_0|m!kEDoJj}3z*s3k>6Mx`pG
zhoof7=LY8&$iah(OJHUG6_paz4UM^{OFeUAo}aPf@DIA8oYIGM^pce5C-&&oTl<S0
zp9oM@>Qu}G`t+{aq<w1`*c^4y`v+aIM{0^ybU-Z3B*8x^SufQuJwrVUnv<)V?^_6$
zFOHC`EK{hct3RK~K|v7(n7INdu6UE*53lo|WK;3!zxY&Q=s$g`V5)OF3rvl&f|3IK
zb8>d(5t#sToJ7=cC_f^ZO^0h}dV2O4V346Txn48#;Mr2d1+{FL<GiyXzk|r9={p*`
z_$s)``2crA5EvTnZV?#*l;X9*BEtR2VL-SgA>{=0A!g(k1SjOU<Q0~cS5#J2*VNY4
zS5q`Kx3spkceJQ=_Vo7k4^T8@432bmzZstxe4Rcy$!jS%ySUUvH9sBrZe%W6U}I-u
zD_||?L;t6g7yHKtE8BZshcvAa{^VvY)C)LVzC{?VkfE>rvUu0En2d4%qD=29PU{RN
z;j`*n6Z4G-rxr)oq?WnU?M5S8$UX6CyjNFHYv5s3F=gcm?2`W)ce9Mv)1+sf1idr>
zXqr$4jVf)K;cIJYHt`ICo68b`Ql)-VQ$?HI@UKpOs=XBj)0NV(vCNyJh8-z3z$33K
z3ik$BoL@g}tF0_rXju3j_FO=BO_WCLs%WPFM8YC-fG`IoM)k(KLGcGyC?6e!=;g(~
zbVBP_-n(AyA#UD~7l*z%T`th7mT$k;JWyfjZMR)ZXx?B)fAJof3&+RRp)}DKB999A
z!bbcR4(y(2@4uVw&T$QVlE3-kLx*u?&~4@~_8ZO50#5epYYrLLYs(oMY6ZTTeq_fM
zJc&J+^+c!4PL^M04xRJz;9k@4zCQL*!+CT2k_PCell}?GjXU34HStI#bYdZRK|&<_
zhmp~#enhx<_x<m+R4uxEe|?x5$i2Uo7VH`Md@11T=iB7?d<>+?mS#kp;2<(Rp)oKq
zCk<KzrB@X>lboFn1(YMRiXxhAY>xs@k=S-IOx4O}<&H2dvmXCruf3JPu^Wc!uxEPg
zREDk<B{10#DcxZu-Udiks)(AP-jl0DH8YU`8%l;a-cREs(y88n$kVifIMp(5JjcvV
zua@>x^H&MlFvx)=PSK<$6)I=CIFAV#rNldZA<vdx#59R&VaZwNtsnl9R}eKd^|mk=
zk83ksgJs$vujYHVPIB7A)oq=b?`y_Y=s}|I?N<^XpQzSs2zHv)4%T0R8-E&5QL5ix
z$=hl8deMs!uNXDI3-96%v#836o3ur<4&6*gvkAo(sPzK7m?iFYIECfSJ6T$moit;U
z!ySTc7g#7h#=2M)k@@pm-Jpfj^%gM0<BJs;Z%UW;T^o6YF=(_wNGHR2t(bKP@0k1A
z5c|RA-iXwTs0|_kwkz`0J%Wc3qmIOid#N90m9>W2Tocm3TD2Sxwe+l?XiQNTn(B<n
zJ-cl*(>5$xN%T@(MWa{zz3IZ3TNeK31z)Nl{%O$CTE&x1ObLij-~kc*oppd}$duz{
z3HrJCaC%**O0s}z!nk8l<yxZT)h`>cRtAD4D;dR;+O2~`H?-x-6Z*=<rpx!Jw`2UA
zDwgkWnsvl$sBho=SX_!xxs&h!wSHrGPW;K{*n=eMimAKA!=Is^_e?hIoYeF7g2S<^
z7~jEZG<LVXF?{`YxcdEQek#hwg{^>3{^ZN+2JHng*It5o^_EJWV`*|XWf_f2k1K<Q
zT~WQ>g=$FQRXx9KXYL+8qH&of`|1^W49{E~(k!RTu!9Sz-f4G9zJZ&wzD|As-{2$d
z<M!oy5z`NPLf&@G5wGnzR<V;nTicE5XnrBOVrYf~*{#|Pz7$eRKgGUO+~B1e`u&Sw
zwOgoot!r@Fuuwk|?j`z;Y(cJ~;y^2h`-H1PFTSc?hHHy!i(W_h6_fA)X_day2Hd6}
zNrAt;wEgE0GMe>$0OY%;KH+zd3j|(1-e3^$j@aWjM=mx52(J_4DUqot;H52)hXVX&
z;4xWAN>Vv_>8WjONUKO{MA*j8?B>KSz%~x%^&||v869g&yf}5SH~rq+y_D%Cz-?H)
zn6)&%wOuxnI-7>Nhq^O-c$oF+{kOrdUwKDM^~sW+>mJV^sdQl_^GaXZA&N)uk>dg5
zxpU@oz!UlXF5k536Dk?+P)R4lMHQAN?+IhFO`yvN(-rl<roG|A#+uQ268Y$A&5Uq_
zewO7OKI*Ha*a;(9({BXmMcCpRaurKO_~XJy6X6=Ienbx{ZcmmPjO3~wduR?S7$}cI
z7xx$1Us{Uiv$EY0ku}|VThrq_&Ob+mb7^|p??6ne0RrQ$pj0f>PG%Gqhzd~p*wvEr
z={<dUZ1+2(NTp@dS6tnOMw1nuf*CoFlI1I`H{JHwXUkoby=4OnO!sLjy29Pr^5P3D
z;*;?6Qnm5>c4cyuI@euAu<REmvj!dMdz|$@_`i^!b4#?r`}DFELOiFod;CRdIW4u&
zKG%8kP%}f_e$R0AFPBy#3YbmK){4gcswe2(_RSaUXF>QkI<I<XKU_VDS0H`_NqKOI
z7cJRSJ77WtdgA&##Z|8^TZ?;Lx8kkm1u!oj<W32Cnm;FjU99E!5r>~6Xgm9Dz~>v2
zWI<`)gwVY16DYlPr6%jv4#mW+)TP0Z=n{#E?CMGfiDhC0f+fOm7GV~N?XTjE9ix<B
zFDk$>M$yvp+H_9u@pTiK_b<n=%5UIN>kDHaQ7}R=tJiSQX$_Z{LnVxqL!!R#Qqjf9
z7-gGFX5x`QN@}^CYwUvSmnEiZR`rfnXG~eer^1huI#VHM-I%YqfdDh%ULmhZLZjYP
zmILTZu1QKQEoOl`-cuF9jGzHOHJhn{)m)o|T!Zb1cs=KJ>!mn?lY;c|#N3xPE4q$J
zMO?*4Yt+?(Ud9dAgShU;HKGO3QoXXBUMNQ2WY%wKo5JX;S0J|2Cc+*uVDiK{Hr7(t
zBe=xq8mK3>LwB#&v!Ltxstk)Wsr6Q&U=B8}Qs>ryz%tW=R%T}R`@LE_?U^5r=NovZ
z1$Ud!G4dbwp)#V|&|o!ITfDItYu~Q!E1`mSUs;Yv>xU6t-5T}q!g}AwxGVA~ThI8e
z-4t<Wo%LO++L>JjHGe_+6uYb~(YL)$(+4B%UjuBt1+;l>7Gr$_v6@6*1o<z7DLk#7
ziPAS4or<$B6iH8Hyy~=eF<8Q>BqoWtW<57c*l{zL58HVazIyRwbh`@1D*C=|hrXxg
zd(n4kskU&jx-ItF``mh+mvvosg|$~Jv*OjU>vx~3-|LfN5~zvZpMW1fIV`tOmr0)u
z8N~5g&r_e6)t+0oKYkCnMgHwGOcLkIhd0k|9Dm!rH#UDzrEz4+ST8y+YXIi?Yf*w0
z!le$^Tdkft@-o7_bOWvV6a39OnVQmlg-Gt0E4%rk<~LmKU|6P5RK{LWeGo5jr5Lvm
zvt0_8wN0@WeIjT%((j6f^FqbD7aT7WsC_aQQxY)kI9{QfT1vi&xtj6(`LI&aox51Q
zZ%WWxH$H2z388AbnJHEnW`vl(yZH8dS6793^-!RA-}SqJRjsAXC(KW+BPNO11sN#F
zXoIaU4Pk&3Z`~8=mQ%SDb`NGLpvLt6k+##j3xtpx?_Nq<1<nZI=4CdES7aD_m_+vC
zK-1<yVG-u&srbU6I9YJ9=|ggz2lZY4mF4-tBi<1Y{?aeC+I}rrHq$<hcGRnc!yLrH
zf0x!1y|M+r$hR=$T>;sVkVr?MUv&B`YbgE|NvGZL4%#sS@1y3Iq@*D)e4(VT4F*WF
z!&r@c`WX&JB<{a4mG$?z%_*ulNH!xYcO*B-Z96fD^Hmn3TV;gjXkyTQku_S#8Smk1
zd|JORrLh4sl+5X|9Ml`4e&3389z{k8zihKk-@wx4k^a)@N_i=jm##pOH-r6k3|KCM
zsXT|7qDNdNUoLB$TaV5S^Np`^eik>q5h)v{e>m;u%n6s=(iqy8Yz3vck*}!bJ89k&
zu+W@q65s*48~RX^kuLXtyjD1jXkml8U?*1tWX4+jd<olu>OWLCe92SD1N40ifNLek
zFCz)KRzg$L{0nj`s|tK;it8JSOVjl-tK0LSb&Wl}vDgFH0e6S*`e2TYPfSitPx(#s
z%`Yq>ua&j+jm@p?_dqseu^WQAkLpv3$c8jSPu^kV^A8R^aiRK3^9t{SRIBIpd$;Lq
znC`Xuf0KEVubU6J+}Sg(Ds3s`mw5+ea$j|qWO&Qbkb1@om&Vivh8Ycz%Y!2aPLg;W
z<9P1u%6O#-h106`lo`sT_{EDPh?M7!qDtMbfMrK&4;F3;dbyI@ZE?oyjr8#4?Guf^
z(DqZr%AhWcsV?iQx7D#n@6oqCc5C)GGr!+VVReId3-qD7Bm!3`QLMUTxi^O9!PC&{
z($&FaKE}gMEFu*skF0w__LrCiPXT(>1o7i_D70K(-?VpnbI20z3<LEAR9P%!1wXhJ
z?c$g}?}<-k8L(!?D_x&L6;|l;uxwj1J8x7i;W3W(80^|ZV&SsmgE;?Y`<?nqr?~>i
z>{#Q2XN9u^_&6#Q)vA9blm3P4py8n$dO+xoW!Ij_aZ?a)&=prN1_MmswRDn9x~_Ry
zO?^?|P?L1*Dtf901&hO?mS%G2qHW6Ionh^94VEN>j;*RR`$vgdalTQghUwzRuA_6I
z26Tu1e&OWQ%Mmi1ju#_qD2`Mhm+B9p(XVi$wYhGCbFd-64x`60@Crd4HOkQMLm#fR
z2Si(7+g*&Xo}$QNbXb`L1=y722*(B<X0N3teD2CN_{{u*{JGepoD9jxjms;KT?D-{
zJfkT;<-C;7jUC90Pd3_k;L9+wk-Lb8nHN_wAd(XnNwS|+Xp4qNosjTJ*_gX=N+7$K
zvQO(i7o7GJb?~PrSCsK-=$*&XBXn}ZBd5mXjOY@0SvIPKl!O_o=caN`pt-wMIfYdH
z6*qTk!>~l*p#4JS{Nxu~Jv%n_;L@E&etu=*X2GwMy-n!R9y$0|sR)@kc8STh+ryu{
zLhHc0+t*h#OVDcCMUs&xRuvroAfuYr-RM*OWX;_hwM+`ED~h+r`-B>}9(0!0V70EB
zx4DVGk{DWXtRs8POYM@?7y1wjV?^L2KzIOTkxxyoESk5+A%D<!w?`}5bbrzyt6+c1
z<kDr^Y08GHm2j(0u}@I3r*&`pVKb&Vv(Go^r6$~#T+`=2g*?Gv4`6@K!5+oUz`6AH
zLjq}kOcC%DwIL^svoQXJ*AYdMIldFQVr`4shMv>WHNm1zi7U$RUgDElGR@Y-8sCb8
z_k&60#{<{jPt=qj4b)wMbE{rRN;N6zeZbGX`>9ARLUckO{_V4eq3|~AoH=8Ih#&P+
z^3U*hL>pmK4Rj$#g5?3DUm#tB5yx5nZgnhakO8i`sNOlS9~Dp14JnUre9{g96%U^=
z57A+4$!hPvsrTk&vNyXlOVvh_euMOi_btq1sv62zY%(vOXpA}gsf#VVAtpMrEpuG+
zRCkYQK)R3U?tH_Hss8qj%**0foyw=H^)l}3r<YCcUI*FoP^OyeJ?$F}@M25DWuWsj
z$LT9xlmV~K@{*Hnp<>c6Wiv|%f?%4E+w}@njPHj)q~WA=213b%l#}QXyNIP5ldGI`
z?>}DWpW!FDQq}QHWCOaVOg2iW*LIWRwZuCq^3ev$W@Zjk{4kv<T>42NKTzmRJvlji
zKH+XY-cO>YSTlD)CHN%DUO^E>X>_ZQyHeG|AqktXdzLg^k_-dUbv^>5-benLxO&mj
zD(SbtV?LsKLpFs{D=ajM1lL%aW4DJjB$6rnsl~Q2Ca^AVQsVSj1+CoJOIg7jzrdn{
zBYU$5m7Hl#c+hETH}SA9t7&FZ*ws$U-gl3Rww%VF9J4HXtcjodn(~kbiw*d;OEyr~
zI3Gk{0@gm^AFchyo?-!s<bKbZ(>07D4l!a_uMYftE6V$D<Xe@~hNWMXy1&15NG4Au
z_oB?Cbjm^o5!vp!$)#nGi<K9>?$+LQs%k_eSgPF{%YnBJhy=^v(Cgt5Ac#O(`<dCd
z!zG@mOQ=q1K;Cg<Gu?f4?t^ouCn4cI!iKgl$5kG?ALrh(ISCYzJm*8ZN&BixYN}B{
zpDZ<0=tf|QA0CxaUzg>5e2<|P&j4E^@)8K;@@G-N+V@5?RbvDQm)`7&>*i-j<!!${
z2v~b)%-!}aN-}PtdOQ)p+QVEbWBOmU73IEE^eJR;G2D~tgcCnj!xDXTUm}X@dB&64
zf(KNUCQCgDqLqc|Id;3aUU}@VmHD4vy7rOguuDq%{t>oSk3;`(hob~_2Y4Jl=7Y|t
zQt+7b`othchZiwXjd^)vxfHB$^k}<hv`D)*v7ms(w7$Un8r@`e(E@KnETNeKYvsMJ
zPz=(fOXZ5<(~yUvNpERcZTory4oLg!^AG$|8~vlRYhyQ*R(rLF8@`u+Iry;D`vTR~
z&GNu;<QnF{Gt7nWjib>R&dzlDBr?H7c=(<{=rN<V6Hm}JpX)O_@Y*MXASw3yDV-;G
zS-;q>`GO)ss28EsnFe9rw3J|Ve@`DgbPu7gFVdu_iq--_m<^#C!9l|Ni$Yu-91Edi
zM2@P`d`@g{!|xiQFGpxJ<IO^5yBt!XRBVRJ(HdZ3(NHa;Rti<+@0Qw9j|w^4Ey_Ni
zlWRX4h?TR}#wmw|DN}T3*<d>=b%A}{9#Tj8$}3Tl7=nE=V)Q#`)>0$njc8n*)G#H}
zo!F)zFsU*OqijySxPW-OF=_o=`}u0D*f=zTm-%I5Mw<myE4iD6b;?VI@MH^26N(~{
zLn@FQQSVyXh(*s}=@4eCP}!SDG+RXzddA)G=;V&=sBpL8(ekM%V+Q)UD8G}Knys?U
z_qE$RRM+eFaxV!L=Yt+}agXlT2Iskb*kmmGzIL3OGfk_~RXkeF|DG5WW^d4@lK{gk
z?MlCr(_GkZ^s$o!4mR(iurf*NIDSpN5oqDHS43=GNKhI=+{yYW600|6mzH771fyL~
zJU-juUK$<rwR%Im?=U(0_QQwl&z_`qFOy#F%I3|_XQ_QGlYpKla{Hp)9TfAMpIaWQ
zujmhyaM@!F@g<Q`%xK>Vv^26`?J1*I6Wu<TdlP?^gUs1kyF5-&G=<HB{z2N_1iIf7
zyU8x}r$SRP+O|jX<J98zGrj}cujdV5RyJ?llax5t^D7GjmJ2VJ)UZH~L+Ptv{+E3%
zScCb@vihD5Z&k4Bj|UZiN;?a`e(Gc2`MT?ob)~kt>p=X|Uhm}#=Pk$;z=FV#7Q~0?
z1~nR(U%R*s`N1!%vk!hD(h!s3zcpL_y^{T_BgP9e7}JO-oJb4%^tBYsAU5z{(-5U+
zDcWR1{04lj5M+urRKKMLupn7Iw%5-r$Q!dsz=F)pUmpPcMVq?iwUsk}v25tm=l$vp
zD~)48v#%#8d8pnt@MH!j>lT_<*#%emKxp?xY@&Ch+M#%?Ml)T-ODsObe15O2KLTG_
zlKq-e#`58HSM)BrpfkGJ-F^s@^#-b(jP&410*^N)kw_VSSE`V}cb(EOU09}yGMT7I
z<Qr)Y_EMu|J!|9sTnz|Axi3xrX&S=Xwm^kfdz2@kR+2(B%XDs~Z*yo<;gQ?P29XP+
z8ELD}%?E0Icz5PHLWD`5S|9k$_RvUj2j$zB#x*5p*<Rg_E;W1^E}8MPzovY1EK$8z
zzBCR?FCyA}H=OISw#mcv(je@@^2(2`x~8K~2kNS=V;YlK)fog2qG!h7#!)m+wD#W5
zxBB0cY^Xch?axV5f41?sTLQ2kt2Sm0-z1X4O6LX}8}EL0i9k(uN5xf4b{Zl~oA<(^
z>{7+Yenh>%WKgBA!GPQFJpLiz=0q=mNU*aZz9dlwi%@eN-$iBeRLi?|jApCDerP!p
z(U7Ybz}i6%OU4(8p6ye=3;8xFl&<*YTd3+YNqT$~^B0BM?+6}a+G|HjC*IK^Qqfyq
zj_wr4(0ig9w4kFZ&VaETlj|ER7-`{WoxyH0ETk1{yOOhNZT24jN+MOfAyGh7H%DYr
z&ICGjYQUq7wX_gH5j?MJiRWvdh+@SLT?HfR-IB=0LV{l(r<0%9`cY0eUtT{S+jyx1
zT^H(<P)hILQ)Z_x`%b&J9LTcCguuv@8ALok6DTKmmKpig0ZkxHjoQtKlv$U5)%n{F
zRx>^|{YK^ORqeUOCH_3{%v$24LHG9iy4IcU^<S0V-p%h9F>Uw?=Wj5hrNlgVSd>EH
zq4%!;=6&hZR{v971!5aL5--Aa=7n$z$}GAFff9;)p*plZ@xpY(;yMi08#CRdS%}-N
zxd}_;jdV|%k`&n!M=gWbE)uOX@zk~(#aW7_MzcNTdE<i8jeh-Qa-=OKg7QHW1h}E2
zl~9wGgqn)N*;<F)je>DI_}oK-ZknrG;@fjZuC;xUH1;3+T0`!O0<jHCd|MRj1JVFp
zrqy)uLBk-hW7+yhwrrjnLRZHLMOzcaYb&;=tE_9sZs%3*%+(37Vqn)f<S~@kYKst$
z6qn=<IMXCa)Yp98w2ILl_aC#?Xq}EV%)(RUI{M_-lBYh{;JW?seW}}u)jsRt;fBx1
z^T9)I_pc~u)bk$N%`Zp<cTE>m?NgX-=I^1^w9mPJ$KRa?;pt^-O5ZT!z!&%Op~q`?
zC4T=}6S(cN7yaled}G{V|N1wU4G{_dpJ|IV`f0BpR2Aa=FYiE4wIwslD@YABA2l11
zU_G^L2DxRmK<V$S_|(}YT(7UvPoX{VdYHfa)HjOnb(x+183`NB>5Oc@(0VVmj_eCa
z*>wMMc-9wy7or~HAel@W&s&tz3b}rNk$J5@r0rB&J`%SxUg6V|re@LX45yaOeYGns
z*&E5E4QNa0N=CGVNE~<eh;M&$5@6Zbyu)Q)rywKYTa(fhPqIP-rt)(}^AtUw1eUSo
zjUy7QwuaJIU((4A1`#5QPZkK@NI_$~#({!<s<(0{^`YCP9aFhS@P$_DoerfeyyB(K
zJ9qg2ZLwnOHe*tG+gDwxUjSO)6TADlbbUmVtyDS?p)ExRMQW*0SL&vUtv4mO?pmzP
zHhEvUSD0=eHl-pIOgT{J_-<|^`7xj^TsliaA+j%t+qr1A-Xbj<xAg~c?{gk6Kgtc1
zRFue{B}LrR*V!zAyc9n^Q2Ebk^D`U3D0+O(<8^TNR|yRI^}07K1ooqYQ#HXV8`*Ax
z*j10*($kWnX}N7f-Dyd&Q>&>9X#>)Ga)gJFy9#`R4RK#p%~&igtROtzxaCbme#2+m
zbMF(P+oN~?80hvm_`Jl*gzWZ^pv^wrRgrk1Vl6T-E~~O-OL5u@D)py+?>PQS>j<ZA
zj@je8+S3!kq+RGpQ<~Wi%Tj)y0tIZqlcafvi@<%ADHX}(59Bv)O});PN=tRw0Oh{P
zQ!MQ$&MnVV@MElYBNDAJ!7bJ+ND)8X)ye$NxaT@b5QT_4z`Glu3+uE=@={pZr<hk<
zp#D`BM1zC^1>55ptI)aB=*I&h=bEbI0lce7JR$_%EfK%2CT8JREP;b5yPUf6;R-qx
zRi=XHd-SycjLS$2?4RwJR^1QJ7y1nWkV{Aqj2|E*znm2lVDut#6#aA*a<15H1`J+6
z4qis`bADQLU<@BQM$6Mp!-Hr5^Wcv$p^WAO9(E*1<jGS#I@YnOeZ6D(fFZ0`gfT8x
zP4wJS5$F_1bjBv0Q*?3}GC8g!;g#zmt|EC82CTglYPB<rcn^qWd-XOST@@%TAE}hZ
zIVa|DV2=N?_&5OM-!C4B^8Wqe5prWka`@;+rCo<58F1r-C~ZUn<>3=e{4C8*37&#E
zAL(DT>y$cWFBi@Yv%g{p9_imdX1{)pQ3GHqPUKV^Kc-6mM6LvUlu{dL!6l~1Fd6Fs
zX_aRbDjq#C?OfA3iZ^pF-#&y9-ILt>{P=DC;Cc5l8JO(fZ3-|1j3L@$e}0?ttgrab
zejf*Pk6Z%&qM%)Ag6a%Yv-w?JAU~H9)dof%BOiRxHVK|JeOtxSaVGErZPo%$Q(ANF
zjES_WH41n4uEMg$W%l~yGf%sBk?gz#(61rUZ}SKPebTs~j(68{9<spNsLIGe=e6v`
zFUY3<49SmV81V)T{j~UZUXl5LL0Ke0nx>8)joIBM*mo&XtO1wYUuxa9cU!M^{=**d
z1hDuukbSy(@z)taV9Ow}nVWvLb$3TZBm!;S!a&ajRhG?_cBe)KdiyI3u;4|@y}n0T
zqk|PQ$MWa*&EeNlc*OtXqAh`4WJ0RT<0hXUT_lKBSSdY2L;#_<DP`Q})HrVX8J)qs
zU9QBjU%U*ub$IK^PS50?j1A&*86GcAk1_H!;;;FhHTj;OZ%B6u*)y_bTSYHXK5xO!
zLhROVKtFE8oi#UVJ97mtyKG-W6!c8s^bOY8oXAI&G60W~K=&C6TEUr0x3&s*1MeJ$
zvK|7j^x%qGwvV^1@+O%+ZPJG~FWOis$<%_x3wG)CD%RHzm7#-E$F|na9*RI`rk4d2
zVs+U*;DwW)OGsdFWS~G;jJ{rCLQHHzT9SW!MtV-lk6J6j6@XJ#Q&tuMttf>JP0cl}
z1>{}i9r-|}Bn4;?>>dU#jbhX()CtJ+%&f=U!s7Hh*QHgP^$oMFZNr@pnx|61LcD1>
zT>%5Ig8Z`;wEeb%iFY<C+g6Q}Ov9qzqtX`3<ong`M4Ga34<y#ED?NUie`o(d(B0#O
zyO*~c#Ki}y9iRvb^3)60j|f$cjExeH_Ki!5N<chZ_^n#}BTTEUE23<qtTzSx8Kbt2
z&Zcg|u0G9yLB-d@LT^SVCR0&oP^Vr1H=n@5(!1Fe{^fPv&8_$AA6Cw7>*)f3kJh0T
z{n!G}({lG3j&K1^#zeln;Wk<2{D(K95>~wi3lrQz;p1kEUmphF+uYxYO@J>R3s}2*
zczYN*LrlSfAn^aw-dBf3xpwcm4Fp>Z6c9JvsHljb=mw;_ySt>jyJ3K#hK?C}$RURA
zMpC-F6{MB(&H#%0+uz=w=emB^IoCPg#h*Ouo#%blQ}0^$x^HJsA1{?)5s*_zxKOBM
zL^L1d<TiFH-TmVQP<Qv^bGuQStc9%U9T2Qy`_R?h+RNJ0KiE6mHQGNh$$oz3JaBUN
zFU-%b%&aZ;E-$V2|MU`%kMY1a-yY%gxrmg}uy2i1+`1w_QO6Mu`roud&vOv~KK{3@
zj%TjG-?ut`mek+3I)0YQ-?ut`mfqjDI)0Y<-?uuRwT^$^>iAjSf8Xl(Ss{Pl3f+5l
zU?)mA1019Pe|a##iWub1HU&yS?MB4dsZnVDa^QLh6VDF0PYdzsU$+2&`N+lT9lii)
z!x~V*>36xt%!%JZ%NF2D6avT`{QRZ80bqWJjlDeSG5HHbAr8GxNOi-2XhU2=R!(k8
znx$f1o&$obsH{9*jn}ohup+-os=hh5#H~iZ1=?0y+S!-fEt4+$F>ye0WFls)LvL~_
zd~R`Ca!6(|DtmomxqB77vl|TB`}z&M9n{853YV>L9LM0{<rI9#N_`2(fLSu2vxf3!
z4k2&<x=Molm8bS;6t0u?oCF@8o95Vwj6t3vp>i+jr=N#=s71y}2luudhQ5qFz~kw;
zQIWtEoZG40HTO1I>@CxCEt3agQPO+@VxD*6#0=gPvRqgU(C&xdM2gT4-K3Swy;xDc
z|ME`Epq+7E*9B$?^4LVlb8HuAin2uzuM+R%U#5gt)_SKi=+A`{tEoTkMzGuNO3oG<
zF<PvCDTdQ_CYn@@VC|Wzd#1kTWm(euGTfh}SxBo|WFcH#?!s)lVyq{h&Mv%G_WFA2
z=aC*UMAizp#2`%tGGxAqkCg51`{X{C{+d~}!m4Dfw4C5;!>88!4?ptAT{oQA!5iu5
z7*nxZDALZoXE1p1Lew$h$~{@9^#wO2s`S_4;~E&bTT0rPxrqd7_b^fpmEEvewFsPU
zGwevYFB?gzm~JFP<9w=?KaTmXU1go}^U+I@_DSqjNl*_f>z~455@<+pqZkz>vE+33
z><yZ+3sX}NiXl(-7!vowx00g5BJzD@E&=jo3@yG8p#g0g2k9UN`U4E=i=(5AOE@(h
z%ts>>W2`SVXvUU*#hMq_y5<cNavyDi{qEZ(teU79B08lQD6v?Z7&@vsmk?p@tqo(4
z$<cO8aMoFXLH%D)MXB5l(n)^&+vmmPkQ^#XkV$K^Rz~sSUT>OSd9f?pd3}*8CoPD|
zBeUh2Pex*TllO9_!tF>3`#y!1*tp(jw`Z+)4KM#LJ|=SuCyy1k`!HU7GSu6^yV#Fw
z49SAAUth|POBqvUFm96o-kiiWw4JR+w#qM1@*1kmaP%4YUeaa0mw;WkyY4S%kg8aF
zsIwerPGNL~1SuKx$}sbQHF2%+TRjQA9-sNJu@HF+pKSRPq}<b%7P~8k&1cV*Vbot9
z<D<;HGZn7i<y0<*4*-YpO^F3?eFu7c#c1K3)grVLB~KHVzqsAZ;>#qI3ByMqS#j9R
zdn9d&pSB8VmNL|uJe9v&XHC6gT1ZH6?uBcx#sf?01#^|Lu_=PA&c5f#ra4pR!Scn^
zz7M%xQYux@Yo_aym+!g;Cc0RSItGjekHi4bie7)8Ygbr#x9ybgjUhTxx@(FhWeL~H
zwm;d-R@FRtwOF_Rjc&aumiE=>wpgo!rA{1$_g{i~{9m&SzJC*CcHULcal74#<lD|P
zxn}v!Li%-<{gp$Lrrl3174|z{*1ocQ+jV&O;Okci`!Sa5cn7<3Cgfz-0X~I7k5m)L
z+>$6#8BI~U4&ppmq@pgff56YVVLrd;)dgg)j>SCzIPt*eJUa+{^-#;w?ne+6T?0Yp
zXyY2f8{{2k77DS5@Qg8Z76T|0<K9D^$VBv$p=cO*mUTjIo=Jgirb2#Bg$A;yOgg%_
z23}X%Ak`F8(srDN@lWq88}b-&>41&9O%_&lbkA~BFJv#Ztkgr6r{y*_KXvULjD6eM
z74EzE5NSSnDTtZk=%ci~`l3+$E4JIZR^9jLrkIru8LLHSa>lrbFwXT+W6h7Uf)}Mk
zj49XD_#zw_63%gBYqlR6J<{jF=gCj$^vBsqvMmx@;D!ESmEg;Bg-~2WRF`KYRAfFW
zeZR!O3|5d<3^lHeyx@T#e+%bCg&J^z1gV+ULTggOxE0Fc_f(v@CDzG{&Rq@LNZY|u
z*7Vk9(2!#MJXP<}z{+s2O*aD%XWl=MD+B^lap!&Nn=;pQA~JtdtdF|>iKjo0?Tx?^
z)Asa;f%HB?Zy##tQ{m%L>lam|(F5RIj{;NudAeimWytL{bP&}ZlD;wDovs+GaC3iq
zJ?EP6C`I|#{ms<zu}86{cHhpV%_%s3asrJJohRFoBe+zqIqrN8yIaY5IqB(y_4TYT
zo^Cj2r49)nKR|5PIk_6%BeH+UW0@dHa!qB@`vS|>r1$+T$x%N>o{&IM?yCjF?_V$O
zfZV}e=Lsd*22(=)Bq(d{N!?gsC(&xy@n{RE;%=Iju70LD9rDthl1x~Cq%WCG9oIu$
zN{B9u1fotkKo({cxiAgtq0xqMTQUSgAr{V7ZLtvTm$UJn4D7Nj3Rw|N3Gjkxa{ZvP
zUUJ2f*V1!|A=kENLL*Jnw852bX|jp$jjgEyk`UqZ>DhNn=I?-3pU-FLo=J9ND4J!W
zdX~)6mHw!r3s+CC23M9wp@AWYhCYUViAtm+D4sgMTSZ3yRzaV+cE&hCq<)d7FK-s%
zY>ce>WZ@zQrVi3S=`tK2z_})t?Vxe4TT5#dXD-sLSDweAdHfsZt?X5|ZU3<BYC7}&
zY|HD9UQN_ah~q!0A<kuvuHSQ_FluntxoCXzDV66FOY&PFdN+~^ANiIIuU4Z*QqAL#
zFnZ-F0O!5u(aJkPQBHTN5xwMY)e_^*3=J1dF>P5f&m7Oj-rw}@_^2_^V(_$cJ=+Gi
zFerNC0MRbExG!cQWBn7{#mZ4NC|C*P70TrhDIV?_&Ec#OA0i!VlFXi{m<G|YOwrF`
z&5+CI&34Jn%tF`{y{jm#EC*My)zq5Sr#3c~v>c}|3Ok0P0MJp@NXOv#L}%Gl$xLJO
z`*G)`S=jvY;-~x-vYGYmHiP}GJutT9dj$kg{6oc#`61$k?$yIGB*usFLT6o1@m5P=
z0#0c>RS>V{&FR{pRxW$?J4Ss?;8>YltYY2xHVC81Vh{O;?wrFId#1B@woFne;yHAq
z@ghvcE1?3yB`&yMu*4HYtQ5o})v5C{6pCf8@&;19fvd;Q4mBY%W%YD?BEjL$^hG^5
zHr)7K=;@?#c}1`FUM^Z2sTA3w^6}YToUHMi)3D=3!(E>0qJn%VxQh<~e+fDyJk(l^
z4)V#9d-EgB+bDvu21eVMEg++n@8P`<N_Un9>h*0tMUw;Ri?-MXg==58aTnS*+G?&r
zO1LI-its+#%iHR%RgdVsxE^I|xg{N8B7NPV(1!L)e2ZjTg#&|}`L4+gN8_8}H=G=-
z@)SuhSvhaX?fgy_&N(LB4S>rP!ecmYazGCWUC*{}V!M9>Yb6NKgFXvAr|eR_#!d{~
z9;bgw|8BxPu*Wmx$z`epRh1_^-3fjVyBI+pH@7S&gZSt%?*$POBuF_u*pmu(`2&|;
z-I)r+^-;o=QYzY0i<?nAj4=(94E)MJ6{@P2MlTm^+P5&N!170gPq1b4%{gJ)Ep3ko
znX75j(az=7$$}o(5n6OU7_3@^0l3~Xq`}xC+A)gsi?gv149o?Xd8mv^B9y>cC(SLR
zIgKEzoQX3dS7uH<)9-_~E>6kn;u5?PgL*l;_O9-7P9s_Ra&BFuheBHWXC57g&h{6y
z4!s7Qx*D6x+cd!=JliWl6D%)Qy=FAX8CNn}5laRzlLasLK*8#ki)HE@*6*PaatrF@
zCeD*^-^lYcGnMbRl(R#>l&CdThcNKXlHA}tCbL0bo>7Y_@~6eb5$sh<LK!QVWXf}g
z3L=nVj*6|0rAb-qn>T3bL|_5+gcJD(v~Zk{(na<U3w;*s%`I(zT1?(f!6BlKU{$Yh
zNO)LOsAp_~Gp~kRVw{w1N`^zS9xRg^Ze^HT$mx<(B$1z9T3I4nS(au~TN+bTjc6=v
z?kESHpb5wtKjaR%ju=diTTj;4)V9tbo4OXN)|OXVJ`2r3H#R%xWp=Xn#*1|~;1ZP-
zi}j?-7RRyG=~)`TLT@!z<<=xa)jRwIZwA@!(TkUBkUpg+iJ<?;<xC68P`w}A$QS;6
ztu!gTd$#?M<+aVk6`4u0dkJiG_0O1cQoCV7uo<zz&z(K~?3sPfyz~2;SS2N?7GyTb
zo70$^=wCyEbUzk|QP<OA;poaDUoUZtv=qX}Djd&UCg3Z|o~ZFe<pPU<h&hm7!SGE+
zVaI@6UJ?*7cM+_W*yk(BpJ#xIy7Vn^6)d$zDLSkgTSqPrDNc;9@-c4{t0LdyT_C_W
zdGCnezvJ*)Zr8Y_L9)>N+pwvLR4+AWA;&A`g(d0IeFo-YAQw2c4&6q6(_-Dq9Ij7a
zd0aN{EW8rXa9#Y(XPe7@7lm!!_OdCmowu$Uv%11CKYo9$7^g#Ynu{?|^zz=VaR*ET
zibHw#FIJcnwrAVV5%C{{Gzz#~fHqG2K|@6`>GG@(GeTyuuJEcqTW{i3|Lr!etAYDi
zl)bXr_wQqY9(|r}clw?1`A71M2i1vg7-?Elp>mO2efTe%Z+{3=+DfSpS4$v_r50ie
zf<|&1_h=BmZ<bDq=D#Kl<N9NgGCIb_Sp~{%MQ~q>!zC?AJ<OMZNj~0R<Eds+(;qyP
z7Cs6x3$c+ZI@&N0-z6&I1b>~y)D&piVp;}baWOr+o@xm|6Qm6p52fzOWu>k*ze|<f
zE4h$;#T*A89*K*@%MGLQ!OII_q8^4v4C<^D^vMlOl3;67Pmzrf4QP^2%hybMM2Tth
zYDpLc@zO+3jxHD!EMYt+jas9hT=Cqn_g<-(aWh?mROmf3jJ%+lKO3KiPhp6>vNWB|
zd6_dxtoV9>?x(t2c=%*BX0M~PYAuhcl)fKUKd&z!f0_C$f=ejKgh^cnPO2%!15^qE
zC*rUzM+I3fldgNh*g}DAjH~E^^2)$!-To(AB?mrh1E(LAf~ed@kc+ER7%w<VJkl&8
zmMa>F<LJxTK{?z~ll;;%QnYg3Wx@jr*b5a)*h-6h%ULVsYxHERvTHmV>Y6><<I6if
z9HVsx8&uoItO6&eY-glE^OC*JOOQP8weY604fQWx+dDRC`<yGw2h8A({<qQ>Y90(f
z*C))e+{6E-Gyhnr5S@|oT!~}#O2)9yXlx>8cfkgIF;SzBhlSit^m=7Qp3K8mtWjcm
zF$kJ{7%`_;kN+}2s|AdY#%7|{SK<*i6Ubd0<uB2Ye_r#>P&DKpg19+UXeci{kV*sO
zFHLvHN2o1$6y$8r!Of@{=^`uOm#8_swLT5i_%ipJWH64aHR}*goiDwZr_>VtI<a?H
z(pan0@((;#yU=I(Eg36mv)IhJ9l1p&OIi8NDU=yyl=Wx7?VIE4)Ppf#)K@>%&mbT}
z5(-f-^QO67F1}lpOEh=-h+HE8a_yx{LuTCI(DJ^$_0Ea+vlMpUc)#=`dmq{1SM2ER
zcM?5xxR-O0z@l4T?RWg&BIm|kZVa9aHXM^zy@j`Ob<R(y{`tMbR=3}*JTH4bxQ2Pv
ztB+7ik?WQQ=7=|`(Y%To7Khf9pO8G}HMh9iDTyyH%1n#|EC5T;KIw+Enl~#^Q$o=C
zV{Sn|Zq}EizEcOBUf}Rnt{Y%MW2_qiiq)P|5n2jK>XCgJO&an_<yL+WW3s!N(T0&;
z<P4^((%iB37*z9du6K3j<2}jJ=8tpjlVp*)UIKd;;$FxsUVt*_3|@duS8?1=cJ^Mp
zm+BN*axcw3O=ck3f&*Az_d)Zd_xT2JNgfm%Q_SGANxP`n+Ml;cfY+X#Oroz*+4ab2
zZ7!nDZn3AJb?K1cT|zLFPeH=3zjJLb9H*Pi1dS813(pi+K=%VpmdTb@+1ImfO_m~l
zw_43q!9cF%Z?LwkRPtWnn<ZB^=FTF+lC^?+pKlIXt@&0*HC{Vk0$Zt@(a0c7!Pv0z
zs(kNy<*}bN)8C(BTnSC=IzgdATE;xlbkQA0r&wp2rCbRUa@w?O_&k7s&bH37?Os!#
zec8UI`^nVM(L_(${-;%D=MpOB92Uvp3yEQih=l-)%vxVA87gI;7U`yy6`Bpsb;*}S
z6vEt%N*s$EDlDqvYjo-x)auNe8{67jN<&UCalD-pA4bK4Cb*iWXFzjN-KmRX89u9K
z>&2hvH@&u4TSxYmc03P0J)Kw^BY1bV>Q3vqbs^Rlm**Z#bL1q{{Xhx)&gPBJotxBz
z&ifu=;#8aUypn+oA*0DCdlCvIpdgH^u+N>J^5F$X@L4zG{KziYODoo|1Id&HsZ!*h
zn+EgJ`ncDNR36-upb>zlM6Eu#3|^K&Fm%#^#qMSa7p5%tg)nbsDkNCu9eiangaW77
z%VzpQOLbMx1}O%Xv<$<BCRZ#D4Nhzm8RZ%pYV+rSmK`XdDjdNib4RrccB=(I34DQn
z%;Jr7$CugGXs&pwDi<BGqd8Q<bMZ}i=Z;)knY83^ruFW|1jK60Umgj3j0F%mi)i^I
z?AT3<YBG0Z7k$xP26N&Nd@DUz>EiaPh>hB3++U~)ReW_u=i`{;IB7~8-||iD-<kTK
zQ}{WBtC1+<9*BD?+2MGD4kws5g}Wy1J<OVjeNJp`N#ss05uCtyoq%wV<dFmyp=T>?
z%9KB~exvF;mT!&xfvh@gYM_36ucYTZbXMY?0wO(XAz~8RGhiu=)R|B@a{$qz<W4yo
zuC~>9S5c+fO(R^#_z7u%zQLzi3p1|*XsDU7nP#Y!Mge)Ko&OA3i27Zf6x9n7+s&Mx
z>gMA({mvH7N1b0SoTPG1z>G@@YsDOcuJT8w`gqw-c)=oNtceLy2o|YA=f)*e32bW@
z=Y28*MJF>>W-udPAlsP|GowCJf#AljxAgpK7Oi!?+o<-JJu}O7XnE?p(&o(r)u_`c
z4nLJFllRsWttM{}E>Za8OvMaNmdxFi9Yu~YNWqcst(h}Z78QPcjOndcVIJpw&;`o>
zdIbcIC@p$WOcGSABtr(?NcN0r#TwF|EtTqK&p(x4B4!^mHeYaXDYkvBg`se?Za)Ax
zqFh+5|8ztJyP9}}xqzJ`wIgCIqm1HJ+!d28U;(L60gaSQ-E{w4seE%pEZiWlM50Kn
zB1;xjW98JKT;<cu9oH`2ns~B!&~UJSDIYi{Qvl1N$rQfg{)W$GC>W+PdWlNT)9_}E
z2L|lfG)B(k8>hRMV<L)Z6FH@>y*WFK*@eprB7jA+F9fK;b*ZIU#jtoaDj(se*5wxm
zYCJlO*_Y$!k-nuRsK6$8pOzA&U5+}UNRzQ5Gi;JG5Y@OkgK+JIT%y+-W;CyIUNXx+
z-@leAS|B@6a;pWVCu3&1)NjXJ09*k#oBMk22xco(Yu+3i*~fk`l_WMb`d~XeL!~_A
z(TjHV%NdL{hE!AUUKQoZRRR#3YdBY>=(~nxcy07cAbM&(&)Kp}A+6fVP;$}5ugfon
z#bRi0UQ~NU|9Q4F46k!fuE=<SJq0;ZS^_Md_t~lmD@=Ko&j)=VZ{E}|(a!hvC%!Mg
zV*h*>Y22M7c-6sXZ%z7Rtiu=ZY@}o24XJVEeL~Dpmm8B)O0F|}Toa6U748YR<J#98
zDtnCBVybY4`*Hbuk{v;8<|lm~*HcXSKI;RHD8|{8L?I%qf<%6nMNAR_(t5@u917MV
z(ExVi?a82r7hV#FP(Cll^AXb^nemr1PsO!gXu}D$RbHhhvsv8*MKLIyO(Am_$WM)>
zFjOHXSA_If@k21u5;Seqg61@X6z(>w=&Dmmu|Mr3Nu#*s{rlo<VmTJYLR5%G)mXBn
zhKx3--D}nj7Rxlindlr8IRZ`DN~KD2#ii1fg)>EJnx+lzaXJ?WP~A_-5{aCZ$tiDk
zhxh*0@_TB{Hys_K`o%qsoHC4|-q<{i^cBRg`O-?^xI6V~(RAqLevwPc`R{r{NfMX?
zOE_}U{gCIYE{Bv3eAuTWUY%^=4&D1!i&IIln=UB)+n6a%6(3RRGVzt}rCT^(Wg;F`
zV_oc(s}*NDpdtF>2)KggcoG33geUnPXLMc@;NLvTlOE-cj$8f6h5TKsA9<C(Y=vIS
zB4>W&X#TR*@h|?!_x$@-@@Mn_kSK~&AIPixl$HIi3;S<jH$oS+QCVJxOPtm=&Xyjo
zj@~{b?(e+(J<Pp)!L}f_z#z*IK)sGN5@HCjz4*kDB_tXo!(vj?GxW0Hu`XeGnZ;0q
zeNJ(SK4vW@YaI$`UdPo~4FJvgaY(-d&HJ!>#-{ow%zCF678hoD=a)uSOxD)FY)#~{
zZEnq^RT=E>U>&%xJp?(Py?oc%#W1c$?-JevZOe|a>KC^kviOEm5x?@k^4z;eV>RMt
zz|vb4{3h%uMi3RONlnEV+9pgPyQLZ=3hRi+{v5TrdH;6Phgce)&+JTevwuK^xMf1-
z>2yj{A7tv7>4+^cWU=~N&s^M^mhzM$k5QLFc=jhXL`KN(=dFmAyj7gk*WR9OjkG_<
zX@!(r?8;QY#2J;oV}w)ZBR_i?(3ASmh}GR*pd<ZgHXw3D;+p&g<LO-JAA+GlC5GI^
z2{+*c2gQ@h?MWBL&SxM2=p717B~V)QX{s@pT9J<S2>F2atvoOTAZTim|KGh9@PCun
ze2>v76sXL;{252UM=0XbU-yylk^Bdjt)&aAgS&?_r<bdRr@y1Ojjv?@I0$4NY~&Rh
z>J%1f5EUH|8xfxnmXsV$l9CEb_lIV|(SSBZ((j4!a)J7$N{eQogrl*ez7@bGG?4kc
z`&i=^XD~d`J__TQY#A8SpIfe-E|^^*T{HT;)j!C-wQ0D$-MO+;_NfrgU1f{JrjiTy
z8E164Mtm1S^yGe}_dOfo)_z*~VtxFlm&C9|`nl{#sbkoKuph7z(voJq!oC$-Liqea
zyRYPiiojJX=0CPvcQ(fP-MNk-f9SB32(b73r@|P=-`RR6H07wx>W3IZ5`~v`hycG3
zWr5ZR_7T48I?4xXz%Tq@oBw+q3bcV1VDN*f+Ve!X;=2g(&$<}sw=np16VqQZLBG27
zPbU8)*nxf*XTan?kP$&|D4yTj{xhXF`mGfJgUBD}2Ab&FxbfKo$cdgfjcC&fOQK>X
zs=Oe2)KmnQ1vzGzV{M@Jacal*fEPC8W9{UuYHO$CK;q)<BkJa^;OQF_>>nTp3O>%q
z$HhyWPdc9fOA$(jre?y@vvT6Ha|<B(h+^NOk}{{#@+!m1YP1+ju6}cypGAA8(ub~I
z*4Dnx{(-ik;il2ChKWgl<={s->Ipd)EHtp&aZhr`tm=HWcO~yP>^sja4f(6x_^F;B
zTy(={@w$b@%D(ZQ2;1+*6NdA}IY~`^q(|kbK!K8KS}jo?8Lu=00NLg?f$_bLVsW_?
z-6TvH68{J;yziQyDv*2|!dND~+0&E$I35@5UEnH_E?)yZz$K*_5K^hzs<pl=CX**Q
zF5`OZ2%d*_mkzL}{}Knk0bp=ESAi7CzfOstIr!1D$n=*?(2lnLbrZ*5GC_CD{g+J8
z<K_EHCg^tw`Xv)|$HITzB<7b)&>e#UCMWyU$;PJ5jg5=d3SGEwMitRVL~k?9a)ez(
zzkJ4bgTIx5LATBQ-u9m*O3?3&`1Kbk{UsChuT=lKN#ie>phvd-*G+nU$pk&b!+^<=
z{~mlln11q~ikY>%2G$Yc3~hnJ$i6*hi8;ERqf1_XVz7N>C0Gqd?VlAAMmwzr0p0V?
zHlyw~A2$z>X`xGp7Pdx?j^;}Cu2$}rUM6y=A_hA@qhJ@X2cX~?2?~h_^7Zvf@brj=
z#(~qqGoS$6T{Jz~EI$jOCst6RQCeKCUKv%bS({Q{QB>Eg)|k}pl-JW6P}bGJ+dohP
zq&G)-h9~T%#%E@^rx#+lmKWsbS62JBwguOdW%pd=zPjzS*(6^Wk99bQN2oWet4y!F
zL&S5tHXAQr^lrrKD;7EO4VJix-1}1gBn@5^qSu}jy}!w!DkZgtBzhXx;`<`6jxXGs
ztRqH<D(?dx3R!Sm&JTo)L!D>!DAQ(RB<@_V&P_Au=75MhtPWC1;Pt^}lGCm>gLTSt
z5v=7sl*uct6y{asZ9F)ShGXn^{pEP2Bu2B&URdJy?W0u%S-`(OxV&H}<`Ia46Qzg9
z{wcqCT=Ie{@H{SgSsHEo`QGhw9OXw(rPD40{hLpve{~t?zb^Yf;xhCeqX4W+Pc(-q
z`VM}A-(iYvOfbdFlnL(6*lJ#pDR>8$!lDyx(8>v{B~$O7G8>|C8>)aJY^(t&v#GM3
z3$KHXnX9<F6T6o`sgG@d0LYgt*wrbVAM6XUi;PvXG6_A6u4Ox)e?AxBsZ%OI0Q}3j
zrIj_cY1P2jt$G7+2PbRo=&J4P?knj93d>MYuMF$)sg%j-Ij7nAB^iK1lznx5{qx51
zm#z7o-9J%?0%g?b#Ank&1Xm7G9nJplGQ*9Zgh0O6nZ2VtbHr)`h($xs-|m#-0gJvR
zGTjxK<_Wl_-8XHyk<^Y6eb<KLn13BTG&;cN$$xs?KpPkU2LJhW1HEEQf5`;>E7rec
zg5F9Uf5`;hF;BqcKRs{J2L9g-{`tHO`QG-Q&s+4v!++@o(C-}cOD5=FN%|!dv@_Cv
z-6Z>$OwjLw_$3o`1gsn|`H#=rzpXt%Y0^9czGYBf=}tn1Ojl7daW83@V(T@4stSVm
z4@*7G@+z@|Kv9gDdxMs8v86!3M_I&vnL$VK`jIk>l(~tcl8A+ftC6gWm$!$GpR)mg
z^9u>m4s#C;LDB9?Ljo)n!;{pYi78_0unZZebU-;EFdxONqfo-`Q|cLCQyUAfDsGIZ
zY!)|elkfN-(be75*VEcxQ8zMb*WhbA5j>ukVn5w7HJ7xo619xXU)#tY+u3zooG<Tf
z&Km!8Neh0zO0oaiH#Vry&|8OVMhg(G9PFA`2erL7`>zYs8xy=NsiB}Bt#`)ePDql>
zNiGlYz$J5K?7qvYOK;TGqiv#`EgRJ>cZn3^mKQ7`hX~x7teqU5$Q$w23^((Zh_Y7}
zD{k`_NS~Qo3d?O$2GRk@tD1zXgHIEr3s@WwBYg!1eJKN56J{Lqx?R?~s#_y1n*oX$
zv&}3IGK#3;PE~rH9&eWq{~hoD!SP0`K%X9O#~c40@BiuXt_60cBhF*2<9K@Q(d<Wi
z<Me-zZvFr6zeln7fA`=2+MXWC|0~7{eUzQ<)lWV`2ieY?`A!mjf@uX{LMMdcr%0lU
z{(&T#_y>RiMJSFUi6#dB=OoeSuA<6HkF-Fn|Ee=Tgf|fXB)q{#{GB8^=!8I<_!kJY
zkH-c@wvLh}vHXkfoFZEXy7RYW>wg*>C-m6Zq6oCjQ3Tq0C<1K_7(k${h$7IIM-yl(
z{2<Ui9vhVM0ID<QKRUzx-BEB64TLLzmmJjG<fZcolg-2RWr2@<%r?0Kj|FQZ6|T)J
zuJECRu84oIFZqkOJBS5_dIS-Nh=zqlKq7#^eVjl-ARs)DC>Wefo(=+ZTXOtT;}9iC
z*ioF|cwA2OQ7rzdE5G0->r-y>0eH^C1cSlE;o*^hG=NL2Kxl$p5;+uRj84wQXXgY#
z@{NK~Oxr*8<wQQ_)RZ|HmQ(UE`u`vwb81*TMcf@jQ0g(nU<i4bPec?r#yc+FF%f{f
zn5TdQgMpIEY=Qh7^*jWkP#z#&$UExJT~u)Yhq%sP4$Tj79bn4*y|@nXDRCVUPiMiP
z@PH8FP=Sb8A4oKLTyj(xEEF1-5S<>InFbHfan8$6Ni0N`B9HolzFxisf&)<C54c8F
zI%cC4pGZXRG1Bw8q!<I*@)sL)fzn=UzYaK~oUKmXn2E5T0TMR-;<*An?~FLZrvDl;
z;)uP#+2-8MBV9LtNk40Qu$((Uh|VU7x<<w)#D*rzLsC-B69EPjXtvnZlPbu3QtXo|
z$cmi5;_GTB86_c`AR8N>oJgMi&d&IGV{v+RYhiv94X;>k#5%w@(yGY9V-!MjQj8K)
zT#H3<QZ(l=`X|%}{Qkyx`W}EyawUEp1F$nH^1P>2ZT8*H9d3m%*7UYEnE(jen75Mj
zx9{a^HN}(oQTgoz6NtF~7R%$u6augpJbuCu?IAu>n{^e3sNj-$h6I><0!%8~r%?ja
z8^V4K5r;`eDoxGakp;u$QcOpnc7=U#xiYh{Z!0!NOZ8=6?jpZlV$7W`_UjxKzbySp
zr8byap`NDm$!Jy_+*x3RA#pJ|J3_#ZUp8LbrFq#u)OK}X#krVy^_$+=!S{|;9vgJ4
zvL-67P2j_okv1!>;U-hwM|#71HS<HoF9cuRvofEU5Pk|5uz$L~u~3)yLKbOX^>J$h
zxmgZ>>~wg3{$rQX%Fe|&N1B_BxGZNdJjb~&;WEg&TxV^J6}1tTnh?e@1|Lp1;kn<A
zSC?{2RQ4n?+X=TOPnaLnqbu=L^d<D?BGzXZ#gz4DqN-C3c=r{PM2PiTlPHK|(p4>p
zrK(ZQ?kS5`qW4lA5h*M5g2jxTm`?G`8|j#B(r|h2m$UXOuO&%oG=m~Ev=k6t6OhGP
z$~o`N5$>d5Yl0@tSe|cKTET`_7d7MEF}$@BTxXlK_=H&^<KluMZ)+!qig;6Ug&8!b
zLSxE{v{Hzid33a)F_(m4X$ed^=}u2D(o_7~7j-fbS&=$f7&*<<p~!EGWLec`_jPjW
zv3+R58t7Uwa@+T&bn_4Rcvqr6DEMS%3|?!|FVxbwOsCoA?=x38Yb^ybC~>{elBGFW
z&P!DCxkOdJETq#1?y9`PYf$=a6fYaObEy<wb>WuWqw34lG>>YoGat~^-r{YgtHY6v
zqN~T#)uU^8X!DA$k=W-7T@yKEn6{ZZJ%hI85z>~n^=S(qZQF|>eA;&ArDd9qH~XbD
zAJ{JY(R6a+$<uW4Qq$6O3o?JD?h)l}qwbZIji&A^K3&I;TBXVWS;H9&!6TZ9fX3<U
zXIcb63B4&#G{eQNbmNwlOA#N@Vu*F4`PNnd4!$kuNLS}oSrw|J9oX0Htbgq5XjVP<
zKkWp{z!mTe2IJ}9I122V@nrR9ps@Bi$*xDdTbo6-f70$jo}wr?>hM|MVT6^(GG)`*
zx3!NS7JB?Jltv5QDWV6IRVxsyIfDT@IWtIvtAScs;57%uPHJWUthIJR{q@aY5pvh@
zvb}?oqvp>_p8h0ZBrf3*E@Ya~r%SR^A(7#6fMyPw`YS2R9_f->j4H`4C?l)4tEdI2
zRBGxQV>H?Utk<z*#`i6=73~a_lU@QE5=Xr}MNl@LjV836aXU?M2xuz7$#xGN?X`Zc
zt@CmUCIN*W5tL~<#yGghMWZU;-G1`VZ@}Q3L;J@CDCxsED(U+Xcqax#EDiWkB9^Cw
z=otHX$(xR(V117KgAR}!jWo(XXzktGk$--esu6GV5pk8k@kB)1i2!<1L}=}uSCvP%
zSJvPzS3M>V-dPhJUqG&q^serR2y&F1aTq_iLyJh6pNn`vzwjnqY~Ip4Ci|4J*gYG^
zV_{45hlL0r!b5?6APZ0)ZF-cBeMv$WD>VC<CzBz)f9`q9YXjuSBSvZhwEiKV)~!C_
zZM<(G-Ak+cU0H&k_c<LL-yO>@siBTn6xT!%S_<v(t#hCu`jNtwKlx_}9~-Rn*aAIJ
zsV`bNpnzs>X{o``9N-^?!n|!@u}In3tGIZ2xwyG=dj|yCviT{W_~+<I`*+L)XG26n
z{DmE=DyorXHMQ@`!HrFo^?ohwT|7PQoJhU~p^xN!25lqF14Du%V?crbKxyaVj6mJ&
z<iZE{`PJdpz0IjD`<>M?S$acUB&q_dr#nEJ&E@)ULEf0YlaKW8ZhJLz1tz`?=q0nR
z#T1d^HcWgQ^y+>PX;ldEP;mxhUI<Ub)9#u4`%lUF#ltQG1af;=1f7x`0SKNn(>vYJ
z)EL&+q-IotP7>1MZ75Q%BTzfym_QCq$P;K#?M7^25Lsg0G2SMt@o4Oc{h<LC4ddmB
zYDwoK1le(H>O>py?a3-n`b(8S^UwcqkvTQbe<&Qjt#mrcR-9bcPD>A(umA5nRQT<Q
zvWy7U?=dmtm(HL$K~hYm^)983WmwAHu`Zrn7v(ol_0WWh@)`}nWlba7%Ez{?6_m{E
z-3+yifGJ@lr|IqEVC7^D4h8?I>z96e2dt{Y%9BJ3{lBO?!s}t{Ncp?5NzW*CPsACI
z)tb9&1XR_eHQ2Ru^z4r=Qvr_r&Mr!BA>=x`Qi151=b-6C43-KDkMv4FDJYl(k%z-X
z0oZDK6hL)d0ZIxkMu-)8XlGOc`<HQEL7h-TiDzkh|3Jlu+AiT9ex&5!^h{>a{DPbO
z?8<7)=qJS5<`?_VJ0g=JTVKDK?Vgq3<(P@Bav?i^X&C21Je$p>bM&sCvlEb>yJRdm
zjUapuTij?<{DtMj(m;N$wDTJD1kJaoRqJ)QZ$Voj2|9?{rj1~ML)k|*m+Uq-#6HAx
z-MN!#`YcuSHSfjec06~KdLD_U>$sWRNiU$3tubC1Bu$sfRBN%Hv5?S{vDF_b_rrOy
zEJv%cL{<hNg^$MD=IneOdb$p-ay7z5I5Xz7)`{aXD_})<PdAZJ3l{qpCu-0~|K_lT
zEi<o05ykuFm7m@%sa|hs580s`Tl@ogSmlTZw=Bp8Z(D8GN6Qqw8LRVSBe`aq__?(l
z{(A17{NAQ_BgCgvAiCH9F`Q##ah0XCW_e5(z^axv@Aa-+F6Z=&Dc##WTtqg!&)#GF
zw!2&S(DCa$`9r6crciumnz}+fm$iF4zq_t*NfEfsN?AU1pV7K^3E$&BlO>_&z;PZ9
zy<G5sjp-peWE=UmMhh*f8UMIRk1ASdnx5wYfBFY%MCu3`ax~lWfHbU)Gh3QpBVa_u
zQp!JT$Zu1h014kpbr5!vwqSR0^R)Hykn{2P^yLF-dVvE2+=4~IEh4p}LgRJg%wjB)
zw4m?O+!L}A!*U{0vh#A`Mc#$x8G^{<eEs4Y`>OZ#MvW%TwY6mut=63-h~Bo3u@$M^
zb%O=bUZ-aB6`;E}(A{PDKAZpYocrm(IXR74a8DiVs9@fC^rK$AZPvoP=kLl+Y%GRP
z2dPi##<ZhK{g@=C6Ri^<^~j{<s!PSlMtJL~yM?Xwdx5-NEjx`<eM3F)H}nIq|J1kB
ztVKA$ZQ{*Qruyw=fH5fOHuUJ67J`1zV&?#A;Ej1mWeUdE5wZu~9a3}yz6Q*_@(3HC
zxM|>lGYcEeP&%KL4WLb@?qq%5)>Q@o`ndQ?`?Fbk`2<OZa0YruXsZSAI>*EcLqb7N
z!IX5Z%q;tOFu=HHTmZ|9D)s}a-``hM1=rL@);9=cH)k}p@wa{u>F8E1?Cb0u=o%m!
z86N5zpPKBRo}2wJzqHu4ytdlBzVW$Xb9<|HXMeBi;PBwfSw<lxI_Ha5`&f&Flxf_r
zKPYi#6rQB=#-WX@E)t$1_kZ|W<Lpb3B$6O<etOno5mLg?NAg=vFGa~7M842(uPPRW
z;dR8ku|xdEBsNc-sOd>iH@hN3p|ldt@YTJiuRGN&?QYj44sDUF@+5{YI%ZcT(p1Vo
zBasYpL&opB>-?<mEDdHU`Ly{J7AlO{I_zJ###p2@;p%}$=3i8#GUXe<%yI2yvD!>X
zn5>3>ak0i+RIH8rHKr1+g=90>=v9cdo`MjpqMi<KZds=+v$vds0ithESTTVS#vGL;
zjYOJ#sYgbAG3sp!duP#yzisldR~csxIr843a_oW!`KwVwtJ=9cFwN3YBb&xG(gxV8
zH=;-AWb~540(?w*>|=mZk%W>Dg+>s&8`}Ui-J{`vNokr{wrLc~!SB&5dnc<A2UoU7
z@oVRK@f*fYEp6ddBn>sF8Qa@9S(&*iIa^z}+4(qny_d2L;tv7yhJ|wj0ARnEsJQr8
zP!d-(BsDx8oEZf7lr>IEjL-3f!ioa(U@3^0QiU4Ds)CZFy5NS4wyciq&Rp^Q_NKya
z;IqF)Y_P1iB6%1&UOQLcU%k+})Hu_;GPd^d)4-PxyIuP|LQ|t3T5t8ghZGr{qa{_t
z7E-P<JiNie{z7=<wfUV9c~^@MavaupD`p|vASEt4^4;W3%?snze2)r3OpCgd*aMyu
zB0|E0RRj}#h(CSpxp#X?DDd6OQ4*^jH4zZ68_T<w;_Bj|>>0v-I-6;2(Trt_t&7HF
zHQ@=Z)ne3nl>9j?6K7}AZqtYsvoEj~P>Zigl*@mWx#Ro%ieM=hmIJAc)F-JL<p&Mm
zS2%|9^&r}{I@>T~g*Jzm+ZSGkn@-THkHn}$B)-Ue)W6C6C8~c@r7>Fn4abPow%Qo@
z-9?OV(mU$IiGJ@nSmdmdPi0epYb>CE2t%EeXl2$QeAL>!jqAq+6<e^yP88MdwQdzC
zl*kBcF7t=X#P{bD7QLL`EcxmmHfM0w7R!Ee$yQsQ*VNiv&cWTun9t2d&DYf`fZI+;
z)5jt_FcLx*`c79hP9r8sCnnZ8K>_9h$;yz<NzI3*7ZeqOvP;TJ!x0tHHJ-(ln$=b1
zEscq-O&>biGrM|w^7;n)6$eL#Wkx5)J(L@2+vYo`BkGZh-RmDe4{eTZP3_Fs&#l(Y
zt{o)bDiTm+c0Am<z|I(`{D<?W-`j(w0w!Pk>^@#a<_jsa`afj*VsZ~O%^rM5SV1fT
zG{XUU@CU;tqv$MK*hTHp9_gSt?)X?rr>xt9LGvvlgrGjxh}+_PP+stA{y^}eVEP|9
z*Lr0_mV{yaithmGn`N;S&18vpNQo73#QPBqH)hFIi4uzy^E#yDnq;1S6Z8)LJwv%_
zkE<Wwl}Z^Y)CWA+c6%lLSy3AFM6%D;DycI{;g5}#gC4k6chs{OC?6BeTyLmyg@9l1
zmgZ2rQ9$U*OAAt?%$D|VZ2~WJCNcc-W>=1-JkXbQz-ec2f2=mtSA$w^BT$arsB!ZW
z7&}#P=|*}FZn5xM@LMvPy5`)M84tobRyHB}X2BC?yU}z7@Bjq?YX>qXC0l+EM=cL`
zZ+|~urNH1Ixsb3>sc=Z7SX69`c!G42Jk-)IAjOl<+bzS#2$Tmdh$xIMjz=bzC0D?z
zQoYh^GDYjH@>>vXMI9xbrQPMdl^?4IYO|WtTF2TaK1_AZ^vv}w^e+vr3^$F}eID8T
zG`X?!Wp8_W_uKxNt*6@oN^f1xb>0!P3{++{yG+OsvJ)uJ?sMyjgsBBcl_LOeLjF^q
z@bulFhy3<AFM?*c!>D%)LUw~R_?(^^_4QcYQWmg_Wp>&!-3itbN@SzFD{dX4E#k);
z&j8-LttOT(nj;}jiK!t8QM7Wu!*o|$8m5^F?JWsiq88E`t9Lfz>tj%p97(w1^&(vX
zZoJf0rn@Z<XlV?QUE{ONo~S0pS!<)dzphpRuA;YJW~84EiKsK!8os}&Sq`Iw)!QCp
cwb35IMjxyw#q+<)+MNFHPf`8<w``gJ7jcre=l}o!

literal 0
HcmV?d00001

diff --git a/packages/electron-builder-squirrel-windows/package.json b/packages/electron-builder-squirrel-windows/package.json
index 4fd75176e0a..df59d1f6041 100644
--- a/packages/electron-builder-squirrel-windows/package.json
+++ b/packages/electron-builder-squirrel-windows/package.json
@@ -26,7 +26,8 @@
   "homepage": "https://github.com/electron-userland/electron-builder",
   "files": [
     "dist",
-    "template.nuspectemplate"
+    "template.nuspectemplate",
+    "install-spinner.gif"
   ],
   "engines": {
     "node": ">=22.12.0"
diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index be04cf6c121..90a43a83eca 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -1,6 +1,6 @@
 import { Arch, getArchSuffix, SquirrelWindowsOptions, Target, WinPackager } from "app-builder-lib"
 import { getRceditBundle, withToolsetLock, WineVmManager } from "app-builder-lib/internal"
-import { InvalidConfigurationError, exists, isEmptyOrSpaces, log } from "builder-util"
+import { InvalidConfigurationError, isEmptyOrSpaces, log } from "builder-util"
 import { sanitizeFileName } from "builder-util/internal"
 import * as fs from "fs"
 import * as os from "os"
@@ -22,38 +22,31 @@ export default class SquirrelWindowsTarget extends Target {
   }
 
   private async prepareSignedVendorDirectory(): Promise<string> {
-    const customSquirrelVendorDirectory = this.options.customSquirrelVendorDir
     const tmpVendorDirectory = await this.packager.tempDirManager.createTempDir({ prefix: "squirrel-windows-vendor" })
 
-    if (customSquirrelVendorDirectory && (await exists(customSquirrelVendorDirectory))) {
-      await fs.promises.cp(customSquirrelVendorDirectory, tmpVendorDirectory, { recursive: true })
-    } else {
-      if (!isEmptyOrSpaces(customSquirrelVendorDirectory)) {
-        log.warn({ customSquirrelVendorDirectory }, "unable to access custom Squirrel.Windows vendor directory, falling back to default vendor")
-      }
-
-      const squirrelToolset = await getSquirrelToolsetPath()
-      await fs.promises.cp(path.join(squirrelToolset, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
-
-      // TEMPORARY: the published squirrel.windows@1.1.0 bundle ships the Chocolatey shim for nuget.exe,
-      // which resolves the real binary relative to its own install path and fails once relocated to a
-      // temp vendor directory. Overwrite it with a standalone portable nuget.exe, downloaded and cached
-      // at runtime. Remove once squirrel.windows bundles the standalone exe (electron-builder-binaries#203).
-      await prepareNugetExe(tmpVendorDirectory)
-
-      // Squirrel.exe --releasify shells out to rcedit.exe (via setPEVersionInfoAndIcon) to embed the app
-      // icon into Setup.exe. The bundle does not ship rcedit, so resolve it from the win-codesign toolset,
-      // which already versions and caches it across all platforms. Squirrel-Mono.exe (used on non-Windows)
-      // does not call rcedit, so this is only needed on win32.
-      //
-      // getRceditBundle honors the user's `toolsets.winCodeSign` selection, so users retain a bypass if a
-      // newer toolset regresses: `"0.0.0"` falls back to the legacy winCodeSign-2.6.0 rcedit, a custom
-      // toolset object uses their own rcedit, and the default (unset/"latest") pulls rcedit-windows-2_0_0.
-      if (process.platform === "win32") {
-        const rcedit = await getRceditBundle(this.packager.config.toolsets?.winCodeSign, this.packager.buildResourcesDir)
-        const rceditExe = os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
-        await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
-      }
+    // The vendor toolset comes from the maintained squirrel.windows bundle. Override the bundle source
+    // (e.g. a local copy for air-gapped builds) with ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR.
+    const squirrelToolset = await getSquirrelToolsetPath()
+    await fs.promises.cp(path.join(squirrelToolset, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
+
+    // TEMPORARY: the published squirrel.windows@1.1.0 bundle ships the Chocolatey shim for nuget.exe,
+    // which resolves the real binary relative to its own install path and fails once relocated to a
+    // temp vendor directory. Replace it with a standalone portable nuget.exe (no-op when the bundle
+    // already ships a real one). Remove once squirrel.windows bundles it (electron-builder-binaries#203).
+    await prepareNugetExe(tmpVendorDirectory)
+
+    // Squirrel.exe --releasify shells out to rcedit.exe (via setPEVersionInfoAndIcon) to embed the app
+    // icon into Setup.exe. The bundle does not ship rcedit, so resolve it from the win-codesign toolset,
+    // which already versions and caches it across all platforms. Squirrel-Mono.exe (used on non-Windows)
+    // does not call rcedit, so this is only needed on win32.
+    //
+    // getRceditBundle honors the user's `toolsets.winCodeSign` selection, so users retain a bypass if a
+    // newer toolset regresses: `"0.0.0"` falls back to the legacy winCodeSign-2.6.0 rcedit, a custom
+    // toolset object uses their own rcedit, and the default (unset/"latest") pulls rcedit-windows-2_0_0.
+    if (process.platform === "win32") {
+      const rcedit = await getRceditBundle(this.packager.config.toolsets?.winCodeSign, this.packager.buildResourcesDir)
+      const rceditExe = os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
+      await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
     }
 
     const files = await fs.promises.readdir(tmpVendorDirectory)
@@ -290,11 +283,14 @@ export default class SquirrelWindowsTarget extends Target {
       remoteReleases = this.options.remoteReleases
     }
 
-    let loadingGif: string | undefined
+    let loadingGif: string
     if (this.options.loadingGif) {
       loadingGif = path.resolve(packager.projectDir, this.options.loadingGif)
     } else {
-      loadingGif = (await packager.getResource(undefined, "install-spinner.gif")) ?? undefined
+      // User-supplied buildResources gif wins; otherwise fall back to the bundled default spinner —
+      // parity with electron-winstaller, which always supplied resources/install-spinner.gif when none
+      // was configured (a fresh-install progress animation; never omitted).
+      loadingGif = (await packager.getResource(undefined, "install-spinner.gif")) ?? path.resolve(import.meta.dirname, "..", "install-spinner.gif")
     }
 
     const vendorDirectory = await this.prepareSignedVendorDirectory()
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index 4e2c0f49509..ad08e234309 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -1,5 +1,5 @@
 import { download, downloadBuilderToolset } from "app-builder-lib/internal"
-import { exists, log, resolveEnvShellValue } from "builder-util"
+import { exists, log, parseValidEnvVarUrl, resolveEnvShellValue } from "builder-util"
 import { stat } from "fs/promises"
 import * as path from "path"
 
@@ -63,11 +63,37 @@ export async function getSquirrelToolsetPath(): Promise<string> {
 const NUGET_VERSION = "6.14.0"
 const NUGET_SHA256 = "92dbed160ddee0f64b901e907439e021211b428e57c089ecc12fc38dcc4bd9a5"
 const NUGET_URL = `https://dist.nuget.org/win-x86-commandline/v${NUGET_VERSION}/nuget.exe`
+// Redirect the nuget.exe download for air-gapped / mirrored builds.
+const NUGET_URL_ENV = "ELECTRON_BUILDER_SQUIRREL_NUGET_URL"
+const NUGET_SHA256_ENV = "ELECTRON_BUILDER_SQUIRREL_NUGET_SHA256"
+// A Chocolatey shim is ~0.4 MB; a real nuget.exe is several MB. Anything above this is already usable.
+const MIN_USABLE_NUGET_BYTES = 2_000_000
+
+async function isUsableNuget(file: string): Promise<boolean> {
+  try {
+    return (await stat(file)).size >= MIN_USABLE_NUGET_BYTES
+  } catch {
+    return false
+  }
+}
 
 /**
- * Downloads (and caches) a standalone portable nuget.exe and writes it into `vendorDirectory`,
- * overwriting the broken Chocolatey shim shipped in the squirrel.windows bundle.
+ * Ensures `vendorDirectory` holds a usable standalone nuget.exe. If the bundle already ships a real one
+ * (e.g. a future squirrel.windows release, or a pre-staged offline toolset dir), it is kept as-is.
+ * Otherwise a pinned NuGet.CommandLine build is downloaded and cached, replacing the broken Chocolatey
+ * shim. Air-gapped/mirrored builds can redirect the download with {@link NUGET_URL_ENV} (and
+ * {@link NUGET_SHA256_ENV} to supply a non-default build's checksum, or an empty value to skip it).
  */
 export async function prepareNugetExe(vendorDirectory: string): Promise<void> {
-  await download(NUGET_URL, path.join(vendorDirectory, "nuget.exe"), NUGET_SHA256)
+  const target = path.join(vendorDirectory, "nuget.exe")
+  if (await isUsableNuget(target)) {
+    return
+  }
+  const overrideUrl = parseValidEnvVarUrl(NUGET_URL_ENV)
+  const url = overrideUrl ?? NUGET_URL
+  // The pinned hash matches the official 6.14.0 build and any plain mirror of it. For a different
+  // build, set NUGET_SHA256_ENV to its sha256 (an empty value disables verification).
+  const shaOverride = overrideUrl != null ? process.env[NUGET_SHA256_ENV]?.trim() : undefined
+  const checksum = shaOverride !== undefined ? shaOverride || null : NUGET_SHA256
+  await download(url, target, checksum)
 }
diff --git a/test/src/windows/squirrelWindowsToolsetTest.ts b/test/src/windows/squirrelWindowsToolsetTest.ts
index e6cd2bb214a..455dbd4dd60 100644
--- a/test/src/windows/squirrelWindowsToolsetTest.ts
+++ b/test/src/windows/squirrelWindowsToolsetTest.ts
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "vitest"
-import { getSquirrelToolsetPath } from "electron-builder-squirrel-windows/src/toolset"
-import { mkdtemp, rm, writeFile } from "fs/promises"
+import { getSquirrelToolsetPath, prepareNugetExe } from "electron-builder-squirrel-windows/src/toolset"
+import { mkdtemp, rm, stat, writeFile } from "fs/promises"
 import { tmpdir } from "os"
 import * as path from "path"
 
@@ -47,3 +47,27 @@ describe("getSquirrelToolsetPath", () => {
     await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
   })
 })
+
+describe("prepareNugetExe", () => {
+  let tmpDir: string
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(path.join(tmpdir(), "eb-squirrel-nuget-test-"))
+  })
+
+  afterEach(() => rm(tmpDir, { recursive: true, force: true }).catch(() => {}))
+
+  test("keeps an already-usable nuget.exe and performs no download", async () => {
+    // A real nuget.exe is several MB; staging one larger than the shim threshold must short-circuit
+    // the download entirely (this is the offline / pre-staged-toolset path, so it must not hit network).
+    const nugetExe = path.join(tmpDir, "nuget.exe")
+    await writeFile(nugetExe, Buffer.alloc(2_100_000, 1))
+    const before = await stat(nugetExe)
+
+    await prepareNugetExe(tmpDir)
+
+    const after = await stat(nugetExe)
+    expect(after.size).toBe(before.size)
+    expect(after.mtimeMs).toBe(before.mtimeMs)
+  })
+})

From 0788d33bca093a0128799c7246130c914f2b2d44 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 16:10:21 -0700
Subject: [PATCH 10/20] docs(migration): document
 squirrelWindows.customSquirrelVendorDir removal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the v27 breaking-change entry for the removed customSquirrelVendorDir option
(at-a-glance row + detail section) and a manual-step bullet in the v26→v27 guide,
explaining the ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR replacement, its different
directory layout, and the offline nuget options.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 website/docs/migration/v26-to-v27.md           |  1 +
 website/docs/migration/v27-breaking-changes.md | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/website/docs/migration/v26-to-v27.md b/website/docs/migration/v26-to-v27.md
index d0715692de0..589c71bdc20 100644
--- a/website/docs/migration/v26-to-v27.md
+++ b/website/docs/migration/v26-to-v27.md
@@ -145,6 +145,7 @@ import { build } from "electron-builder"
 - [ ] [Replace `CI_BUILD_TAG`](./v27-breaking-changes#ci_build_tag-environment-variable) with `CI_COMMIT_TAG`.
 - [ ] [Replace toolset env-var overrides](./v27-breaking-changes#toolset-env-var-overrides-removed) (`APPIMAGE_TOOLS_PATH`, `ELECTRON_BUILDER_NSIS_DIR`, `USE_SYSTEM_WINE`, …) with `toolsets.X: { url, checksum }`.
 - [ ] [Validate toolset pins](./v27-breaking-changes#toolset-defaults-resolve-to-latest-newest-bundle) — defaults now resolve to `"latest"` (newest bundle); pin to `"0.0.0"` only if a legacy bundle is needed.
+- [ ] [Remove `squirrelWindows.customSquirrelVendorDir`](./v27-breaking-changes#squirrelwindowscustomsquirrelvendordir) — the option is deleted; point at a custom Squirrel toolset with the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` env var instead (note the different directory layout).
 - [ ] **Plugin/custom-target authors:** [replace `packager.info.X` and `platformSpecificBuildOptions`](./v27-breaking-changes#programmatic--plugin-author-api-changes) with the new pass-through getters.
 
 ---
diff --git a/website/docs/migration/v27-breaking-changes.md b/website/docs/migration/v27-breaking-changes.md
index 50ab49f0e4c..e04eda5b6b4 100644
--- a/website/docs/migration/v27-breaking-changes.md
+++ b/website/docs/migration/v27-breaking-changes.md
@@ -61,6 +61,7 @@ To stay on a legacy bundle, pin the toolset to `"0.0.0"`. Because `winCodeSign`
 | [Root-level `directories` removed](#root-level-directories-in-packagejson) | ✓ | Move under `build.directories` |
 | [`build.helper-bundle-id` removed](#buildhelper-bundle-id) | ✓ | Moved to `mac.helperBundleId` |
 | [`squirrelWindows.noMsi` removed](#squirrelwindowsnomsi) | ✓ | Replaced by `msi` (inverted) |
+| [`squirrelWindows.customSquirrelVendorDir` removed](#squirrelwindowscustomsquirrelvendordir) | — | Override the vendor toolset with the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` env var |
 | [`GithubOptions.vPrefixedTagName` removed](#githuboptions--gitlaboptions-vprefixedtagname) | ✓ | Use `tagNamePrefix` |
 | [`GitlabOptions.vPrefixedTagName` retained](#githuboptions--gitlaboptions-vprefixedtagname) | — | None — still functional; the migrator leaves GitLab entries untouched |
 | [`devMetadata` / `extraMetadata` in `PackagerOptions` removed](#devmetadata--extrametadata-programmatic-packageroptions) | — | Use `config` / `config.extraMetadata` |
@@ -219,6 +220,23 @@ The `noMsi` boolean is removed in favor of its inverse, `msi`.
 { "build": { "squirrelWindows": { "msi": false } } }    // After
 ```
 
+### `squirrelWindows.customSquirrelVendorDir`
+
+Removed. v27 inlines the Squirrel.Windows installer logic and drops the `electron-winstaller` npm dependency (and its vendored binaries); the Squirrel vendor toolset is now fetched from the maintained `squirrel.windows` electron-builder-binaries bundle. To pin a custom or local toolset — for example an air-gapped mirror — set the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` environment variable instead.
+
+The shape and behaviour differ, so this is not a 1-to-1 rename:
+
+- The old `customSquirrelVendorDir` pointed at a directory **whose contents were the vendor files** (`Squirrel.exe`, `nuget.exe`, …) and was copied verbatim, bypassing all provisioning.
+- `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` points at a **toolset directory containing an `electron-winstaller/vendor/` subtree**, and still goes through normal provisioning: a working `nuget.exe` is ensured (downloaded unless your `vendor/` already ships a real, non-shim one) and, on Windows, `rcedit.exe` is supplied from the `winCodeSign` toolset.
+
+```bash
+# Before (removed):  "squirrelWindows": { "customSquirrelVendorDir": "./my-vendor" }
+# After: point at a toolset dir whose electron-winstaller/vendor/ holds the binaries
+export ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR=/abs/path/to/squirrel-toolset
+```
+
+For a fully offline build, stage a real (multi-MB, non-shim) `nuget.exe` inside that `vendor/` directory so no download is attempted, or redirect the download to an internal mirror with `ELECTRON_BUILDER_SQUIRREL_NUGET_URL` (and `ELECTRON_BUILDER_SQUIRREL_NUGET_SHA256` for a non-default build's checksum).
+
 ### `GithubOptions` / `GitlabOptions` `vPrefixedTagName`
 
 The `vPrefixedTagName` boolean on `GithubOptions` is removed. Use `tagNamePrefix` to control the tag prefix.

From b7c1f7fa29d7591315a464e018e22c6cc1db96d0 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 16:14:26 -0700
Subject: [PATCH 11/20] chore(squirrel-windows): add cleanup TODO for the
 temporary nuget download

Mark prepareNugetExe/isUsableNuget/NUGET_* for removal once squirrel.windows@1.1.1
(electron-builder-binaries#203) bundles the pinned nuget.exe; the skip-if-real-nuget
logic already makes the runtime download a no-op against such a bundle.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 packages/electron-builder-squirrel-windows/src/toolset.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index ad08e234309..5e87c68a4cf 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -60,6 +60,11 @@ export async function getSquirrelToolsetPath(): Promise<string> {
 // relocated to a temp vendor directory. Until squirrel.windows bundles the standalone portable exe
 // (electron-builder-binaries#203), download a pinned NuGet.CommandLine build at runtime and overwrite
 // the bundled shim. The same win-x86 exe runs natively on Windows and under mono on Linux/macOS.
+//
+// TODO(remove after squirrel.windows@1.1.1): once electron-builder-binaries#203 ships the pinned
+// nuget.exe in the bundle, delete prepareNugetExe + isUsableNuget + the NUGET_* constants/env vars
+// and bump getSquirrelToolsetPath's `toolset` to that release. (isUsableNuget already makes this a
+// no-op against such a bundle, so the runtime download stops on its own once the version is bumped.)
 const NUGET_VERSION = "6.14.0"
 const NUGET_SHA256 = "92dbed160ddee0f64b901e907439e021211b428e57c089ecc12fc38dcc4bd9a5"
 const NUGET_URL = `https://dist.nuget.org/win-x86-commandline/v${NUGET_VERSION}/nuget.exe`

From cb9a70bdba8006cc1c64fd25b4b94b33909d2b1a Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 16:35:19 -0700
Subject: [PATCH 12/20] feat(squirrel-windows): override the Squirrel toolset
 via toolsets.squirrel config

Replace the bespoke ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR / ELECTRON_BUILDER_SQUIRREL_NUGET_*
env vars with the standard ToolsetConfig pattern:

- add a `squirrel` field to ToolsetConfig ("1.1.0" | ToolsetCustom | "latest"), resolved
  exactly like the other toolsets (version -> downloadBuilderToolset, object -> getCustomToolsetPath)
- export getCustomToolsetPath + resolveToolsetVersion from app-builder-lib/internal
- getSquirrelToolsetPath(toolset, resourcesDir) reads packager.config.toolsets.squirrel
- offline/custom bundles now use toolsets.squirrel (a ToolsetCustom whose vendor/ may ship a
  real nuget.exe, which the skip-if-real check keeps); drop the nuget URL/SHA env overrides
- rewrite the toolset test (custom-dir resolution + invalid-url) ; keep the nuget skip test
- regenerate scheme.json; update v26->v27 + v27-breaking-changes docs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 packages/app-builder-lib/scheme.json          | 16 ++++
 packages/app-builder-lib/src/configuration.ts | 25 ++++++
 packages/app-builder-lib/src/indexInternal.ts |  2 +
 .../src/SquirrelWindowsTarget.ts              |  6 +-
 .../src/toolset.ts                            | 79 ++++++-------------
 .../src/windows/squirrelWindowsToolsetTest.ts | 41 +++-------
 website/docs/migration/v26-to-v27.md          |  2 +-
 .../docs/migration/v27-breaking-changes.md    | 18 +++--
 8 files changed, 89 insertions(+), 100 deletions(-)

diff --git a/packages/app-builder-lib/scheme.json b/packages/app-builder-lib/scheme.json
index 66b3e1519a8..03c3ad3e48a 100644
--- a/packages/app-builder-lib/scheme.json
+++ b/packages/app-builder-lib/scheme.json
@@ -8090,6 +8090,22 @@
           "default": "latest",
           "description": "Version of the 7-Zip binary bundle used internally to extract `.7z` and `.tar.xz` archives.\n\nSet to a {@link ToolsetCustom} object to supply your own 7za binary.\nThe `url` must point to a directory (or a `.tar.gz`/`.zip` archive of one) that contains\n`bin/7za` (macOS/Linux) or `bin/7za.exe` (Windows).\n\n**Bootstrap constraint:** the custom bundle itself must be a `.tar.gz` or `.zip` archive\n(or a bare `file://` directory). `.7z` and `.tar.xz` archives cannot be used here because\nextracting them requires 7za — a circular dependency."
         },
+        "squirrel": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ToolsetCustom"
+            },
+            {
+              "enum": [
+                "1.1.0",
+                "latest"
+              ],
+              "type": "string"
+            }
+          ],
+          "default": "latest",
+          "description": "Version of the `squirrel.windows` bundle used to build Squirrel.Windows installers.\n\nThe bundle ships the Squirrel vendor toolset under `electron-winstaller/vendor/`:\n- **`Squirrel.exe`** / **`Squirrel-Mono.exe`** — releasify the app into `Setup.exe` (and an optional MSI).\n- **`SyncReleases.exe`** — downloads prior releases to produce delta packages.\n- **`nuget.exe`**, **`7z`** — pack the app into a `.nupkg` and compress release assets.\n\n`rcedit.exe` is provisioned from the {@link winCodeSign} toolset at runtime, and a usable\n`nuget.exe` is ensured at runtime (the published bundle ships a shim that cannot be relocated).\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.1.0\"` | Squirrel.Windows 2.0.1 (patched) |\n\nSet to a {@link ToolsetCustom} object to supply your own bundle — it must contain the\n`electron-winstaller/vendor/` subtree. Only used when building the `squirrelWindows` target.\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/squirrel.windows/CHANGELOG.md"
+        },
         "winCodeSign": {
           "anyOf": [
             {
diff --git a/packages/app-builder-lib/src/configuration.ts b/packages/app-builder-lib/src/configuration.ts
index 7e81c655272..375331c9d82 100644
--- a/packages/app-builder-lib/src/configuration.ts
+++ b/packages/app-builder-lib/src/configuration.ts
@@ -697,6 +697,31 @@ export interface ToolsetConfig {
    * @default "latest"
    */
   readonly icons?: "1.2.1" | ToolsetCustom | "latest"
+
+  /**
+   * Version of the `squirrel.windows` bundle used to build Squirrel.Windows installers.
+   *
+   * The bundle ships the Squirrel vendor toolset under `electron-winstaller/vendor/`:
+   * - **`Squirrel.exe`** / **`Squirrel-Mono.exe`** — releasify the app into `Setup.exe` (and an optional MSI).
+   * - **`SyncReleases.exe`** — downloads prior releases to produce delta packages.
+   * - **`nuget.exe`**, **`7z`** — pack the app into a `.nupkg` and compress release assets.
+   *
+   * `rcedit.exe` is provisioned from the {@link winCodeSign} toolset at runtime, and a usable
+   * `nuget.exe` is ensured at runtime (the published bundle ships a shim that cannot be relocated).
+   *
+   * Available versions:
+   * | Version | Notes |
+   * |---------|-------|
+   * | `"1.1.0"` | Squirrel.Windows 2.0.1 (patched) |
+   *
+   * Set to a {@link ToolsetCustom} object to supply your own bundle — it must contain the
+   * `electron-winstaller/vendor/` subtree. Only used when building the `squirrelWindows` target.
+   *
+   * Releases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/squirrel.windows/CHANGELOG.md
+   *
+   * @default "latest"
+   */
+  readonly squirrel?: "1.1.0" | ToolsetCustom | "latest"
 }
 
 /**
diff --git a/packages/app-builder-lib/src/indexInternal.ts b/packages/app-builder-lib/src/indexInternal.ts
index ddce1804c4b..ff99a657b25 100644
--- a/packages/app-builder-lib/src/indexInternal.ts
+++ b/packages/app-builder-lib/src/indexInternal.ts
@@ -45,6 +45,8 @@ export { nsisEscapeString, NsisScriptGenerator } from "./targets/win/nsis/nsisSc
 export { ProgIdMaker } from "./targets/win/nsis/progId.js"
 export { checkMakensisOutput, verifyInstallerSize } from "./targets/win/nsis/nsisValidation.js"
 export { getLinuxToolsMacToolset, getLinuxToolsPath } from "./toolsets/linuxToolsMac.js"
+export { getCustomToolsetPath } from "./toolsets/custom.js"
+export { resolveToolsetVersion } from "./toolsets/version.js"
 export { getRceditBundle, getWindowsKitsBundle } from "./toolsets/winCodeSign.js"
 export { CacheState } from "./util/cacheState.js"
 export { computeDefaultAppDirectory, createProjectMetadataLazy, doMergeConfigs, getConfig, validateConfiguration } from "./util/config/config.js"
diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 90a43a83eca..43a49c13a3a 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -24,9 +24,9 @@ export default class SquirrelWindowsTarget extends Target {
   private async prepareSignedVendorDirectory(): Promise<string> {
     const tmpVendorDirectory = await this.packager.tempDirManager.createTempDir({ prefix: "squirrel-windows-vendor" })
 
-    // The vendor toolset comes from the maintained squirrel.windows bundle. Override the bundle source
-    // (e.g. a local copy for air-gapped builds) with ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR.
-    const squirrelToolset = await getSquirrelToolsetPath()
+    // The vendor toolset comes from the maintained squirrel.windows bundle. Pin a version or supply a
+    // custom/local bundle (e.g. for air-gapped builds) via `toolsets.squirrel` (a ToolsetCustom object).
+    const squirrelToolset = await getSquirrelToolsetPath(this.packager.config.toolsets?.squirrel, this.packager.buildResourcesDir)
     await fs.promises.cp(path.join(squirrelToolset, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
 
     // TEMPORARY: the published squirrel.windows@1.1.0 bundle ships the Chocolatey shim for nuget.exe,
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index 5e87c68a4cf..75d9f36233e 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -1,9 +1,10 @@
-import { download, downloadBuilderToolset } from "app-builder-lib/internal"
-import { exists, log, parseValidEnvVarUrl, resolveEnvShellValue } from "builder-util"
+import { ToolsetConfig } from "app-builder-lib"
+import { download, downloadBuilderToolset, getCustomToolsetPath, resolveToolsetVersion } from "app-builder-lib/internal"
 import { stat } from "fs/promises"
 import * as path from "path"
 
-const ENV_KEY = "ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR"
+// Newest squirrel.windows bundle — selected when `toolsets.squirrel` is unset / null / "latest".
+const SQUIRREL_LATEST = "1.1.0"
 
 export const squirrelWindowsChecksums = {
   "1.1.0": {
@@ -12,46 +13,23 @@ export const squirrelWindowsChecksums = {
 } as const
 
 /**
- * Validates and resolves the {@link ENV_KEY} override. Returns the absolute directory path when the
- * env var is set, or `null` when it is absent. Throws an actionable error when the value is set but
- * invalid (relative path, missing, or not a directory) rather than silently falling back to download.
- */
-async function resolveToolsetEnvDir(): Promise<string | null> {
-  const value = resolveEnvShellValue(ENV_KEY)
-  if (value == null) {
-    return null
-  }
-  if (!path.isAbsolute(value)) {
-    throw new Error(`${ENV_KEY} must be an absolute path: ${value}`)
-  }
-  const dir = path.resolve(value)
-  if (!(await exists(dir))) {
-    throw new Error(`${ENV_KEY} path does not exist: ${dir}`)
-  }
-  if (!(await stat(dir)).isDirectory()) {
-    throw new Error(`${ENV_KEY} path must be a directory: ${dir}`)
-  }
-  log.info({ [ENV_KEY]: dir }, "resolved Squirrel.Windows toolset directory from environment variable")
-  return dir
-}
-
-/**
- * Returns the path to the squirrel.windows toolset directory. The directory
- * contains an `electron-winstaller/vendor/` subtree with all vendor executables
- * (Squirrel.exe, nuget.exe, SyncReleases.exe, 7z, etc.).
+ * Returns the path to the squirrel.windows toolset directory. It contains an
+ * `electron-winstaller/vendor/` subtree with the Squirrel vendor executables (Squirrel.exe,
+ * nuget.exe, SyncReleases.exe, 7z, …).
  *
- * Override with {@link ENV_KEY} for local development or to pin a custom build.
+ * Honors `toolsets.squirrel`: a pinned version (or unset / `"latest"`) downloads the maintained
+ * electron-builder-binaries bundle; a {@link ToolsetCustom} object supplies a custom or local bundle
+ * (which must mirror the same `electron-winstaller/vendor/` layout).
  */
-export async function getSquirrelToolsetPath(): Promise<string> {
-  const envPath = await resolveToolsetEnvDir()
-  if (envPath != null) {
-    return envPath
+export async function getSquirrelToolsetPath(toolset: ToolsetConfig["squirrel"], resourcesDir: string): Promise<string> {
+  if (typeof toolset === "object" && toolset != null) {
+    return getCustomToolsetPath(toolset, resourcesDir)
   }
-  const toolset = "1.1.0"
+  const version = resolveToolsetVersion(toolset, SQUIRREL_LATEST)
   return downloadBuilderToolset({
-    releaseName: `squirrel.windows@${toolset}`,
+    releaseName: `squirrel.windows@${version}`,
     filenameWithExt: "squirrel.windows-2.0.1-patched.zip",
-    checksums: squirrelWindowsChecksums[toolset],
+    checksums: squirrelWindowsChecksums[version],
   })
 }
 
@@ -62,15 +40,12 @@ export async function getSquirrelToolsetPath(): Promise<string> {
 // the bundled shim. The same win-x86 exe runs natively on Windows and under mono on Linux/macOS.
 //
 // TODO(remove after squirrel.windows@1.1.1): once electron-builder-binaries#203 ships the pinned
-// nuget.exe in the bundle, delete prepareNugetExe + isUsableNuget + the NUGET_* constants/env vars
-// and bump getSquirrelToolsetPath's `toolset` to that release. (isUsableNuget already makes this a
-// no-op against such a bundle, so the runtime download stops on its own once the version is bumped.)
+// nuget.exe in the bundle, delete prepareNugetExe + isUsableNuget + the NUGET_* constants and bump
+// SQUIRREL_LATEST to that release. (isUsableNuget already makes this a no-op against such a bundle,
+// so the runtime download stops on its own once the version is bumped.)
 const NUGET_VERSION = "6.14.0"
 const NUGET_SHA256 = "92dbed160ddee0f64b901e907439e021211b428e57c089ecc12fc38dcc4bd9a5"
 const NUGET_URL = `https://dist.nuget.org/win-x86-commandline/v${NUGET_VERSION}/nuget.exe`
-// Redirect the nuget.exe download for air-gapped / mirrored builds.
-const NUGET_URL_ENV = "ELECTRON_BUILDER_SQUIRREL_NUGET_URL"
-const NUGET_SHA256_ENV = "ELECTRON_BUILDER_SQUIRREL_NUGET_SHA256"
 // A Chocolatey shim is ~0.4 MB; a real nuget.exe is several MB. Anything above this is already usable.
 const MIN_USABLE_NUGET_BYTES = 2_000_000
 
@@ -83,22 +58,14 @@ async function isUsableNuget(file: string): Promise<boolean> {
 }
 
 /**
- * Ensures `vendorDirectory` holds a usable standalone nuget.exe. If the bundle already ships a real one
- * (e.g. a future squirrel.windows release, or a pre-staged offline toolset dir), it is kept as-is.
- * Otherwise a pinned NuGet.CommandLine build is downloaded and cached, replacing the broken Chocolatey
- * shim. Air-gapped/mirrored builds can redirect the download with {@link NUGET_URL_ENV} (and
- * {@link NUGET_SHA256_ENV} to supply a non-default build's checksum, or an empty value to skip it).
+ * Ensures `vendorDirectory` holds a usable standalone nuget.exe. If the bundle already ships a real
+ * one (a future squirrel.windows release, or a custom `toolsets.squirrel` bundle), it is kept as-is;
+ * otherwise a pinned NuGet.CommandLine build is downloaded and cached, replacing the broken shim.
  */
 export async function prepareNugetExe(vendorDirectory: string): Promise<void> {
   const target = path.join(vendorDirectory, "nuget.exe")
   if (await isUsableNuget(target)) {
     return
   }
-  const overrideUrl = parseValidEnvVarUrl(NUGET_URL_ENV)
-  const url = overrideUrl ?? NUGET_URL
-  // The pinned hash matches the official 6.14.0 build and any plain mirror of it. For a different
-  // build, set NUGET_SHA256_ENV to its sha256 (an empty value disables verification).
-  const shaOverride = overrideUrl != null ? process.env[NUGET_SHA256_ENV]?.trim() : undefined
-  const checksum = shaOverride !== undefined ? shaOverride || null : NUGET_SHA256
-  await download(url, target, checksum)
+  await download(NUGET_URL, target, NUGET_SHA256)
 }
diff --git a/test/src/windows/squirrelWindowsToolsetTest.ts b/test/src/windows/squirrelWindowsToolsetTest.ts
index 455dbd4dd60..3959193442c 100644
--- a/test/src/windows/squirrelWindowsToolsetTest.ts
+++ b/test/src/windows/squirrelWindowsToolsetTest.ts
@@ -4,47 +4,24 @@ import { mkdtemp, rm, stat, writeFile } from "fs/promises"
 import { tmpdir } from "os"
 import * as path from "path"
 
-const ENV_KEY = "ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR"
-
 describe("getSquirrelToolsetPath", () => {
-  let savedEnv: string | undefined
   let tmpDir: string
 
   beforeEach(async () => {
-    savedEnv = process.env[ENV_KEY]
     tmpDir = await mkdtemp(path.join(tmpdir(), "eb-squirrel-toolset-test-"))
   })
 
-  afterEach(async () => {
-    if (savedEnv === undefined) {
-      delete process.env[ENV_KEY]
-    } else {
-      process.env[ENV_KEY] = savedEnv
-    }
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => {})
-  })
-
-  test("returns env var path when set to an existing directory", async () => {
-    process.env[ENV_KEY] = tmpDir
-    const result = await getSquirrelToolsetPath()
-    expect(result).toBe(tmpDir)
-  })
-
-  test("throws when env var points to a non-existent path", async () => {
-    process.env[ENV_KEY] = path.join(tmpDir, "does-not-exist")
-    await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
-  })
+  afterEach(() => rm(tmpDir, { recursive: true, force: true }).catch(() => {}))
 
-  test("throws when env var points to a file instead of a directory", async () => {
-    const filePath = path.join(tmpDir, "not-a-dir.txt")
-    await writeFile(filePath, "")
-    process.env[ENV_KEY] = filePath
-    await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
+  test("resolves a ToolsetCustom bare directory in place (no download)", async () => {
+    // A `file://` directory custom toolset is used as-is — no checksum, no network — so this is the
+    // air-gapped / local-bundle path and must resolve without touching the network.
+    const result = await getSquirrelToolsetPath({ url: `file://${tmpDir}` }, tmpDir)
+    expect(result).toBe(path.resolve(tmpDir))
   })
 
-  test("throws when env var is a relative path", async () => {
-    process.env[ENV_KEY] = "relative/path"
-    await expect(getSquirrelToolsetPath()).rejects.toThrow(ENV_KEY)
+  test("rejects an invalid ToolsetCustom url", async () => {
+    await expect(getSquirrelToolsetPath({ url: "not-a-url" }, tmpDir)).rejects.toThrow(/Invalid custom toolset/)
   })
 })
 
@@ -59,7 +36,7 @@ describe("prepareNugetExe", () => {
 
   test("keeps an already-usable nuget.exe and performs no download", async () => {
     // A real nuget.exe is several MB; staging one larger than the shim threshold must short-circuit
-    // the download entirely (this is the offline / pre-staged-toolset path, so it must not hit network).
+    // the download entirely (this is the offline / custom-bundle path, so it must not hit network).
     const nugetExe = path.join(tmpDir, "nuget.exe")
     await writeFile(nugetExe, Buffer.alloc(2_100_000, 1))
     const before = await stat(nugetExe)
diff --git a/website/docs/migration/v26-to-v27.md b/website/docs/migration/v26-to-v27.md
index 589c71bdc20..a44a510824e 100644
--- a/website/docs/migration/v26-to-v27.md
+++ b/website/docs/migration/v26-to-v27.md
@@ -145,7 +145,7 @@ import { build } from "electron-builder"
 - [ ] [Replace `CI_BUILD_TAG`](./v27-breaking-changes#ci_build_tag-environment-variable) with `CI_COMMIT_TAG`.
 - [ ] [Replace toolset env-var overrides](./v27-breaking-changes#toolset-env-var-overrides-removed) (`APPIMAGE_TOOLS_PATH`, `ELECTRON_BUILDER_NSIS_DIR`, `USE_SYSTEM_WINE`, …) with `toolsets.X: { url, checksum }`.
 - [ ] [Validate toolset pins](./v27-breaking-changes#toolset-defaults-resolve-to-latest-newest-bundle) — defaults now resolve to `"latest"` (newest bundle); pin to `"0.0.0"` only if a legacy bundle is needed.
-- [ ] [Remove `squirrelWindows.customSquirrelVendorDir`](./v27-breaking-changes#squirrelwindowscustomsquirrelvendordir) — the option is deleted; point at a custom Squirrel toolset with the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` env var instead (note the different directory layout).
+- [ ] [Remove `squirrelWindows.customSquirrelVendorDir`](./v27-breaking-changes#squirrelwindowscustomsquirrelvendordir) — the option is deleted; supply a custom Squirrel bundle via `toolsets.squirrel` (a `ToolsetCustom` object) instead (note the different bundle layout).
 - [ ] **Plugin/custom-target authors:** [replace `packager.info.X` and `platformSpecificBuildOptions`](./v27-breaking-changes#programmatic--plugin-author-api-changes) with the new pass-through getters.
 
 ---
diff --git a/website/docs/migration/v27-breaking-changes.md b/website/docs/migration/v27-breaking-changes.md
index e04eda5b6b4..4ed8462d3aa 100644
--- a/website/docs/migration/v27-breaking-changes.md
+++ b/website/docs/migration/v27-breaking-changes.md
@@ -61,7 +61,7 @@ To stay on a legacy bundle, pin the toolset to `"0.0.0"`. Because `winCodeSign`
 | [Root-level `directories` removed](#root-level-directories-in-packagejson) | ✓ | Move under `build.directories` |
 | [`build.helper-bundle-id` removed](#buildhelper-bundle-id) | ✓ | Moved to `mac.helperBundleId` |
 | [`squirrelWindows.noMsi` removed](#squirrelwindowsnomsi) | ✓ | Replaced by `msi` (inverted) |
-| [`squirrelWindows.customSquirrelVendorDir` removed](#squirrelwindowscustomsquirrelvendordir) | — | Override the vendor toolset with the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` env var |
+| [`squirrelWindows.customSquirrelVendorDir` removed](#squirrelwindowscustomsquirrelvendordir) | — | Supply a custom Squirrel bundle via `toolsets.squirrel` (a `ToolsetCustom` object) |
 | [`GithubOptions.vPrefixedTagName` removed](#githuboptions--gitlaboptions-vprefixedtagname) | ✓ | Use `tagNamePrefix` |
 | [`GitlabOptions.vPrefixedTagName` retained](#githuboptions--gitlaboptions-vprefixedtagname) | — | None — still functional; the migrator leaves GitLab entries untouched |
 | [`devMetadata` / `extraMetadata` in `PackagerOptions` removed](#devmetadata--extrametadata-programmatic-packageroptions) | — | Use `config` / `config.extraMetadata` |
@@ -222,20 +222,22 @@ The `noMsi` boolean is removed in favor of its inverse, `msi`.
 
 ### `squirrelWindows.customSquirrelVendorDir`
 
-Removed. v27 inlines the Squirrel.Windows installer logic and drops the `electron-winstaller` npm dependency (and its vendored binaries); the Squirrel vendor toolset is now fetched from the maintained `squirrel.windows` electron-builder-binaries bundle. To pin a custom or local toolset — for example an air-gapped mirror — set the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` environment variable instead.
+Removed. v27 inlines the Squirrel.Windows installer logic and drops the `electron-winstaller` npm dependency (and its vendored binaries); the Squirrel vendor toolset is now fetched from the maintained `squirrel.windows` electron-builder-binaries bundle. To pin a version or supply a custom/local bundle — for example an air-gapped mirror — use the standard `toolsets.squirrel` setting instead, the same way you would pin `toolsets.nsis` or `toolsets.winCodeSign`.
 
 The shape and behaviour differ, so this is not a 1-to-1 rename:
 
 - The old `customSquirrelVendorDir` pointed at a directory **whose contents were the vendor files** (`Squirrel.exe`, `nuget.exe`, …) and was copied verbatim, bypassing all provisioning.
-- `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` points at a **toolset directory containing an `electron-winstaller/vendor/` subtree**, and still goes through normal provisioning: a working `nuget.exe` is ensured (downloaded unless your `vendor/` already ships a real, non-shim one) and, on Windows, `rcedit.exe` is supplied from the `winCodeSign` toolset.
+- `toolsets.squirrel` accepts a version pin (`"1.1.0"` / `"latest"`) **or** a `ToolsetCustom` object whose `url` points at a bundle that **contains an `electron-winstaller/vendor/` subtree**. The bundle still goes through normal provisioning: a working `nuget.exe` is ensured (no download when your `vendor/` already ships a real, non-shim one) and, on Windows, `rcedit.exe` is supplied from the `winCodeSign` toolset.
 
-```bash
-# Before (removed):  "squirrelWindows": { "customSquirrelVendorDir": "./my-vendor" }
-# After: point at a toolset dir whose electron-winstaller/vendor/ holds the binaries
-export ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR=/abs/path/to/squirrel-toolset
+```json5
+// Before (removed):
+{ "squirrelWindows": { "customSquirrelVendorDir": "./my-vendor" } }
+// After: a custom toolset bundle whose electron-winstaller/vendor/ holds the binaries.
+// A bare file:// directory is used as-is (no checksum); a remote/archive url needs a checksum.
+{ "toolsets": { "squirrel": { "url": "file:///abs/path/to/squirrel-toolset" } } }
 ```
 
-For a fully offline build, stage a real (multi-MB, non-shim) `nuget.exe` inside that `vendor/` directory so no download is attempted, or redirect the download to an internal mirror with `ELECTRON_BUILDER_SQUIRREL_NUGET_URL` (and `ELECTRON_BUILDER_SQUIRREL_NUGET_SHA256` for a non-default build's checksum).
+For a fully offline build, point `toolsets.squirrel` at a bundle whose `vendor/` already contains a real (multi-MB, non-shim) `nuget.exe` — the runtime nuget download is then skipped entirely.
 
 ### `GithubOptions` / `GitlabOptions` `vPrefixedTagName`
 

From f75c69f74513d49943de41bcc5712365eda03841 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 17:49:49 -0700
Subject: [PATCH 13/20] update lockfile

---
 pnpm-lock.yaml | 125 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 44334ec11eb..e3d968db650 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -420,6 +420,16 @@ importers:
       builder-util:
         specifier: workspace:*
         version: link:../builder-util
+      electron-winstaller:
+        specifier: 5.4.0
+        version: 5.4.0
+    devDependencies:
+      '@types/archiver':
+        specifier: 5.3.1
+        version: 5.3.1
+      '@types/fs-extra':
+        specifier: 9.0.13
+        version: 9.0.13
 
   packages/electron-forge-maker-appimage:
     dependencies:
@@ -617,6 +627,9 @@ importers:
       electron-updater:
         specifier: workspace:*
         version: link:../packages/electron-updater
+      electron-winstaller:
+        specifier: 5.4.0
+        version: 5.4.0
       fast-xml-parser:
         specifier: 5.7.0
         version: 5.7.0
@@ -2662,6 +2675,11 @@ packages:
     resolution: {integrity: sha512-3ojeJry9xBYdJO6qoyyzqeJFSJBVx2mXhyDzSdjwL2+URFQMf+h25gG38iswGImicK0ELjTd1EL2xzk8hf3QPw==}
     engines: {node: '>=20.0'}
 
+  '@electron/asar@3.4.1':
+    resolution: {integrity: sha512-i4/rNPRS84t0vSRa2HorerGRXWyF4vThfHesw0dmcWHp+cspK743UanA0suA5Q5y8kzY2y6YKrvbIUn69BCAiA==}
+    engines: {node: '>=10.12.0'}
+    hasBin: true
+
   '@electron/asar@4.1.1':
     resolution: {integrity: sha512-grbomy1TPEauyu+N4UdRQqSjOhsm0ZoTbprLpvJWQGYeEIMVBwSPV3Rv3E3EfqU5iFSufd/k+2KZvTDbgfesnw==}
     engines: {node: '>=22.12.0'}
@@ -2707,6 +2725,11 @@ packages:
     resolution: {integrity: sha512-G7mNdfZIdPbx54dTorGlV7SN7nHAKlbJU1NjjeuEo7RzEMYBG62+tKpA2VrzocGcvFLxqJI5XYIknca9EijwOw==}
     engines: {node: '>=22.12.0'}
 
+  '@electron/windows-sign@1.2.1':
+    resolution: {integrity: sha512-YfASnrhJ+ve6Q43ZiDwmpBgYgi2u0bYjeAVi2tDfN7YWAKO8X9EEOuPGtqbJpPLM6TfAHimghICjWe2eaJ8BAg==}
+    engines: {node: '>=14.14'}
+    hasBin: true
+
   '@emnapi/core@1.10.0':
     resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
@@ -3951,6 +3974,9 @@ packages:
   '@types/adm-zip@0.5.6':
     resolution: {integrity: sha512-lRlcSLg5Yoo7C2H2AUiAoYlvifWoCx/se7iUNiCBTfEVVYFVn+Tr9ZGed4K73tYgLe9O4PjdJvbxlkdAOx/qiw==}
 
+  '@types/archiver@5.3.1':
+    resolution: {integrity: sha512-wKYZaSXaDvTZuInAWjCeGG7BEAgTWG2zZW0/f7IYFcoHB2X2d9lkVFnrOlXl3W6NrvO6Ml3FLLu8Uksyymcpnw==}
+
   '@types/aws4@1.11.6':
     resolution: {integrity: sha512-5CnVUkHNyLGpD9AnOcK66YyP0qvIh6nhJJoeK8zSl5YKikUcUbdB7SlHevUYVqicgeh6j5AJa1qa/h08dSZHoA==}
 
@@ -4107,6 +4133,9 @@ packages:
   '@types/geojson@7946.0.16':
     resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
 
+  '@types/glob@8.1.0':
+    resolution: {integrity: sha512-IO+MJPVhoqz+28h1qLAcBEH2+xHMK6MTyHJc7MTnnYb6wsoLR29POVGJ7LycmVXIqyy/4/2ShP5sUwTXuOwb/w==}
+
   '@types/graceful-fs@4.1.9':
     resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
 
@@ -4176,6 +4205,9 @@ packages:
   '@types/minimatch@3.0.5':
     resolution: {integrity: sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==}
 
+  '@types/minimatch@5.1.2':
+    resolution: {integrity: sha512-K0VQKziLUWkVKiRVrx4a40iPaxTUefQmjtkQofBkYRcoaaL/8rhwDWww9qWbrgicNOgnpIsMxyNIUM4+n6dUIA==}
+
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
@@ -5087,6 +5119,10 @@ packages:
     resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
     engines: {node: '>= 12'}
 
+  commander@9.5.0:
+    resolution: {integrity: sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==}
+    engines: {node: ^12.20.0 || >=14}
+
   common-path-prefix@3.0.0:
     resolution: {integrity: sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w==}
 
@@ -5257,6 +5293,9 @@ packages:
   create-require@1.1.1:
     resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
 
+  cross-dirname@0.1.0:
+    resolution: {integrity: sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==}
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -5766,6 +5805,10 @@ packages:
   electron-to-chromium@1.5.353:
     resolution: {integrity: sha512-kOrWphBi8TOZyiJZqsgqIle0lw+tzmnQK83pV9dZUd01Nm2POECSyFQMAuarzZdYqQW7FH9RaYOuaRo3h+bQ3w==}
 
+  electron-winstaller@5.4.0:
+    resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
+    engines: {node: '>=8.0.0'}
+
   electron@39.8.5:
     resolution: {integrity: sha512-q6+LiQIcTadSyvtPgLDQkCtVA9jQJXQVMrQcctfOJILh6OFMN+UJJLRkuUTy8CZDYeCIBn1ZycqsL1dAXugxZA==}
     engines: {node: '>= 12.20.55'}
@@ -7489,6 +7532,10 @@ packages:
     resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
     engines: {node: '>= 18'}
 
+  mkdirp@0.5.6:
+    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
+    hasBin: true
+
   mri@1.2.0:
     resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
     engines: {node: '>=4'}
@@ -8290,6 +8337,11 @@ packages:
     resolution: {integrity: sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==}
     engines: {node: ^10 || ^12 || >=14}
 
+  postject@1.0.0-alpha.6:
+    resolution: {integrity: sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
   prelude-ls@1.2.1:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
@@ -8672,6 +8724,11 @@ packages:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
+  rimraf@2.6.3:
+    resolution: {integrity: sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==}
+    deprecated: Rimraf versions prior to v4 are no longer supported
+    hasBin: true
+
   roarr@2.15.4:
     resolution: {integrity: sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==}
     engines: {node: '>=8.0'}
@@ -9092,6 +9149,10 @@ packages:
   temp-file@3.4.0:
     resolution: {integrity: sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg==}
 
+  temp@0.9.4:
+    resolution: {integrity: sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==}
+    engines: {node: '>=6.0.0'}
+
   tempfile@5.0.0:
     resolution: {integrity: sha512-bX655WZI/F7EoTDw9JvQURqAXiPHi8o8+yFxPF2lWYyz1aHnmMRuXWqL6YB6GmeO0o4DIYWHLgGNi/X64T+X4Q==}
     engines: {node: '>=14.18'}
@@ -13410,6 +13471,12 @@ snapshots:
       - uglify-js
       - webpack-cli
 
+  '@electron/asar@3.4.1':
+    dependencies:
+      commander: 5.1.0
+      glob: 7.2.3
+      minimatch: 3.1.5
+
   '@electron/asar@4.1.1':
     dependencies:
       commander: 13.1.0
@@ -13506,6 +13573,17 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@electron/windows-sign@1.2.1':
+    dependencies:
+      cross-dirname: 0.1.0
+      debug: 4.4.3
+      fs-extra: 11.3.0
+      minimist: 1.2.8
+      postject: 1.0.0-alpha.6
+    transitivePeerDependencies:
+      - supports-color
+    optional: true
+
   '@emnapi/core@1.10.0':
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
@@ -14687,6 +14765,10 @@ snapshots:
     dependencies:
       '@types/node': 22.13.17
 
+  '@types/archiver@5.3.1':
+    dependencies:
+      '@types/glob': 8.1.0
+
   '@types/aws4@1.11.6':
     dependencies:
       '@types/node': 22.13.17
@@ -14890,6 +14972,11 @@ snapshots:
 
   '@types/geojson@7946.0.16': {}
 
+  '@types/glob@8.1.0':
+    dependencies:
+      '@types/minimatch': 5.1.2
+      '@types/node': 22.13.17
+
   '@types/graceful-fs@4.1.9':
     dependencies:
       '@types/node': 22.13.17
@@ -14954,6 +15041,8 @@ snapshots:
 
   '@types/minimatch@3.0.5': {}
 
+  '@types/minimatch@5.1.2': {}
+
   '@types/ms@2.1.0': {}
 
   '@types/node@12.20.55': {}
@@ -16031,6 +16120,9 @@ snapshots:
 
   commander@8.3.0: {}
 
+  commander@9.5.0:
+    optional: true
+
   common-path-prefix@3.0.0: {}
 
   compare-func@2.0.0:
@@ -16219,6 +16311,9 @@ snapshots:
 
   create-require@1.1.1: {}
 
+  cross-dirname@0.1.0:
+    optional: true
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -16845,6 +16940,18 @@ snapshots:
 
   electron-to-chromium@1.5.353: {}
 
+  electron-winstaller@5.4.0:
+    dependencies:
+      '@electron/asar': 3.4.1
+      debug: 4.4.3
+      fs-extra: 7.0.1
+      lodash: 4.18.1
+      temp: 0.9.4
+    optionalDependencies:
+      '@electron/windows-sign': 1.2.1
+    transitivePeerDependencies:
+      - supports-color
+
   electron@39.8.5:
     dependencies:
       '@electron/get': 2.0.3
@@ -19043,6 +19150,10 @@ snapshots:
     dependencies:
       minipass: 7.1.3
 
+  mkdirp@0.5.6:
+    dependencies:
+      minimist: 1.2.8
+
   mri@1.2.0: {}
 
   mrmime@2.0.1: {}
@@ -20028,6 +20139,11 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
+  postject@1.0.0-alpha.6:
+    dependencies:
+      commander: 9.5.0
+    optional: true
+
   prelude-ls@1.2.1: {}
 
   prettier-linter-helpers@1.0.1:
@@ -20488,6 +20604,10 @@ snapshots:
 
   reusify@1.1.0: {}
 
+  rimraf@2.6.3:
+    dependencies:
+      glob: 7.2.3
+
   roarr@2.15.4:
     dependencies:
       boolean: 3.2.0
@@ -20988,6 +21108,11 @@ snapshots:
       async-exit-hook: 2.0.1
       fs-extra: 10.1.0
 
+  temp@0.9.4:
+    dependencies:
+      mkdirp: 0.5.6
+      rimraf: 2.6.3
+
   tempfile@5.0.0:
     dependencies:
       temp-dir: 3.0.0

From 2d8e89e7779f17855b6bf5a5636118bfa6d46725 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 17:54:03 -0700
Subject: [PATCH 14/20] refactor(squirrel-windows): drop deprecated noMsi;
 throw on missing requested MSI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- InstallerOptions uses `msi` (positive form) instead of `noMsi`; createWindowsInstaller
  passes --no-msi when !msi. Removes the redundant runtime noMsi deprecation shim
  (migrate-schema already rewrites the deprecated squirrelWindows.noMsi config to msi).
- fixUpPaths: the Setup.msi rename only runs when MSI output was requested, so a missing
  Setup.msi is a real failure — throw an explicit error instead of swallowing it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/SquirrelWindowsTarget.ts              |  7 +-----
 .../src/windowsInstaller.ts                   | 23 +++++++++----------
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 43a49c13a3a..872ad46acde 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -309,7 +309,7 @@ export default class SquirrelWindowsTarget extends Target {
       nuspecTemplate: await this.createNuspecTemplateWithProjectUrl(),
       iconUrl,
       copyright: appInfo.copyright,
-      noMsi: !this.options.msi,
+      msi: this.options.msi,
       fixUpPaths: true,
       setupExe: setupFile,
       setupMsi: this.options.msi ? setupFile.replace(".exe", ".msi") : undefined,
@@ -328,11 +328,6 @@ function normalizeSquirrelOptions(options: any) {
     }
   }
 
-  if ("noMsi" in options) {
-    log.warn(`noMsi is deprecated, please specify as "msi": true if you want to create an MSI installer`)
-    options.msi = !options.noMsi
-  }
-
   const msi = options.msi
   if (msi != null && typeof msi !== "boolean") {
     throw new InvalidConfigurationError(`msi expected to be boolean value, but string '"${msi}"' was specified`)
diff --git a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
index b1b619719bb..6e0462b215d 100644
--- a/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
+++ b/packages/electron-builder-squirrel-windows/src/windowsInstaller.ts
@@ -1,4 +1,4 @@
-import { exec, log } from "builder-util"
+import { exec, exists, log } from "builder-util"
 import * as fs from "fs/promises"
 import * as path from "path"
 
@@ -50,7 +50,7 @@ export interface InstallerOptions {
   copyright?: string | null
   nuspecTemplate: string
   loadingGif?: string | null
-  noMsi?: boolean
+  msi?: boolean
   remoteReleases?: string | null
   remoteToken?: string | null
   setupExe?: string | null
@@ -69,7 +69,7 @@ export async function createWindowsInstaller(options: InstallerOptions): Promise
     exe,
     nuspecTemplate,
     loadingGif,
-    noMsi,
+    msi,
     remoteReleases,
     remoteToken,
     setupExe,
@@ -134,7 +134,7 @@ export async function createWindowsInstaller(options: InstallerOptions): Promise
   if (loadingGif) {
     releasifyArgs.push("--loadingGif", loadingGif)
   }
-  if (noMsi) {
+  if (!msi) {
     releasifyArgs.push("--no-msi")
   }
 
@@ -149,15 +149,14 @@ export async function createWindowsInstaller(options: InstallerOptions): Promise
       await fs.rename(path.join(outputDirectory, "Setup.exe"), path.join(outputDirectory, setupExe))
     }
     if (setupMsi) {
-      try {
-        await fs.rename(path.join(outputDirectory, "Setup.msi"), path.join(outputDirectory, setupMsi))
-      } catch (e: any) {
-        // Setup.msi is absent when releasify produced no MSI; only that case is expected.
-        // Surface real failures (permissions, cross-device) instead of silently dropping the artifact.
-        if (e?.code !== "ENOENT") {
-          throw e
-        }
+      // setupMsi is only set when MSI output was requested (msi: true), so releasify ran without
+      // --no-msi and Setup.msi must exist. A missing file here is a real failure, not an expected
+      // absence — surface it instead of silently dropping the artifact.
+      const setupMsiPath = path.join(outputDirectory, "Setup.msi")
+      if (!(await exists(setupMsiPath))) {
+        throw new Error(`MSI output was requested but Squirrel.Windows did not produce ${setupMsiPath}`)
       }
+      await fs.rename(setupMsiPath, path.join(outputDirectory, setupMsi))
     }
   }
 }

From 9aa26fd1e9262ad79d2c5b20801725d5171a4e71 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 17:57:34 -0700
Subject: [PATCH 15/20] update lockfile

---
 pnpm-lock.yaml      | 125 --------------------------------------------
 pnpm-workspace.yaml |   1 -
 2 files changed, 126 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e3d968db650..44334ec11eb 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -420,16 +420,6 @@ importers:
       builder-util:
         specifier: workspace:*
         version: link:../builder-util
-      electron-winstaller:
-        specifier: 5.4.0
-        version: 5.4.0
-    devDependencies:
-      '@types/archiver':
-        specifier: 5.3.1
-        version: 5.3.1
-      '@types/fs-extra':
-        specifier: 9.0.13
-        version: 9.0.13
 
   packages/electron-forge-maker-appimage:
     dependencies:
@@ -627,9 +617,6 @@ importers:
       electron-updater:
         specifier: workspace:*
         version: link:../packages/electron-updater
-      electron-winstaller:
-        specifier: 5.4.0
-        version: 5.4.0
       fast-xml-parser:
         specifier: 5.7.0
         version: 5.7.0
@@ -2675,11 +2662,6 @@ packages:
     resolution: {integrity: sha512-3ojeJry9xBYdJO6qoyyzqeJFSJBVx2mXhyDzSdjwL2+URFQMf+h25gG38iswGImicK0ELjTd1EL2xzk8hf3QPw==}
     engines: {node: '>=20.0'}
 
-  '@electron/asar@3.4.1':
-    resolution: {integrity: sha512-i4/rNPRS84t0vSRa2HorerGRXWyF4vThfHesw0dmcWHp+cspK743UanA0suA5Q5y8kzY2y6YKrvbIUn69BCAiA==}
-    engines: {node: '>=10.12.0'}
-    hasBin: true
-
   '@electron/asar@4.1.1':
     resolution: {integrity: sha512-grbomy1TPEauyu+N4UdRQqSjOhsm0ZoTbprLpvJWQGYeEIMVBwSPV3Rv3E3EfqU5iFSufd/k+2KZvTDbgfesnw==}
     engines: {node: '>=22.12.0'}
@@ -2725,11 +2707,6 @@ packages:
     resolution: {integrity: sha512-G7mNdfZIdPbx54dTorGlV7SN7nHAKlbJU1NjjeuEo7RzEMYBG62+tKpA2VrzocGcvFLxqJI5XYIknca9EijwOw==}
     engines: {node: '>=22.12.0'}
 
-  '@electron/windows-sign@1.2.1':
-    resolution: {integrity: sha512-YfASnrhJ+ve6Q43ZiDwmpBgYgi2u0bYjeAVi2tDfN7YWAKO8X9EEOuPGtqbJpPLM6TfAHimghICjWe2eaJ8BAg==}
-    engines: {node: '>=14.14'}
-    hasBin: true
-
   '@emnapi/core@1.10.0':
     resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
@@ -3974,9 +3951,6 @@ packages:
   '@types/adm-zip@0.5.6':
     resolution: {integrity: sha512-lRlcSLg5Yoo7C2H2AUiAoYlvifWoCx/se7iUNiCBTfEVVYFVn+Tr9ZGed4K73tYgLe9O4PjdJvbxlkdAOx/qiw==}
 
-  '@types/archiver@5.3.1':
-    resolution: {integrity: sha512-wKYZaSXaDvTZuInAWjCeGG7BEAgTWG2zZW0/f7IYFcoHB2X2d9lkVFnrOlXl3W6NrvO6Ml3FLLu8Uksyymcpnw==}
-
   '@types/aws4@1.11.6':
     resolution: {integrity: sha512-5CnVUkHNyLGpD9AnOcK66YyP0qvIh6nhJJoeK8zSl5YKikUcUbdB7SlHevUYVqicgeh6j5AJa1qa/h08dSZHoA==}
 
@@ -4133,9 +4107,6 @@ packages:
   '@types/geojson@7946.0.16':
     resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
 
-  '@types/glob@8.1.0':
-    resolution: {integrity: sha512-IO+MJPVhoqz+28h1qLAcBEH2+xHMK6MTyHJc7MTnnYb6wsoLR29POVGJ7LycmVXIqyy/4/2ShP5sUwTXuOwb/w==}
-
   '@types/graceful-fs@4.1.9':
     resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
 
@@ -4205,9 +4176,6 @@ packages:
   '@types/minimatch@3.0.5':
     resolution: {integrity: sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==}
 
-  '@types/minimatch@5.1.2':
-    resolution: {integrity: sha512-K0VQKziLUWkVKiRVrx4a40iPaxTUefQmjtkQofBkYRcoaaL/8rhwDWww9qWbrgicNOgnpIsMxyNIUM4+n6dUIA==}
-
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
@@ -5119,10 +5087,6 @@ packages:
     resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
     engines: {node: '>= 12'}
 
-  commander@9.5.0:
-    resolution: {integrity: sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==}
-    engines: {node: ^12.20.0 || >=14}
-
   common-path-prefix@3.0.0:
     resolution: {integrity: sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w==}
 
@@ -5293,9 +5257,6 @@ packages:
   create-require@1.1.1:
     resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
 
-  cross-dirname@0.1.0:
-    resolution: {integrity: sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==}
-
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -5805,10 +5766,6 @@ packages:
   electron-to-chromium@1.5.353:
     resolution: {integrity: sha512-kOrWphBi8TOZyiJZqsgqIle0lw+tzmnQK83pV9dZUd01Nm2POECSyFQMAuarzZdYqQW7FH9RaYOuaRo3h+bQ3w==}
 
-  electron-winstaller@5.4.0:
-    resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
-    engines: {node: '>=8.0.0'}
-
   electron@39.8.5:
     resolution: {integrity: sha512-q6+LiQIcTadSyvtPgLDQkCtVA9jQJXQVMrQcctfOJILh6OFMN+UJJLRkuUTy8CZDYeCIBn1ZycqsL1dAXugxZA==}
     engines: {node: '>= 12.20.55'}
@@ -7532,10 +7489,6 @@ packages:
     resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
     engines: {node: '>= 18'}
 
-  mkdirp@0.5.6:
-    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
-    hasBin: true
-
   mri@1.2.0:
     resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
     engines: {node: '>=4'}
@@ -8337,11 +8290,6 @@ packages:
     resolution: {integrity: sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==}
     engines: {node: ^10 || ^12 || >=14}
 
-  postject@1.0.0-alpha.6:
-    resolution: {integrity: sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==}
-    engines: {node: '>=14.0.0'}
-    hasBin: true
-
   prelude-ls@1.2.1:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
@@ -8724,11 +8672,6 @@ packages:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
-  rimraf@2.6.3:
-    resolution: {integrity: sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==}
-    deprecated: Rimraf versions prior to v4 are no longer supported
-    hasBin: true
-
   roarr@2.15.4:
     resolution: {integrity: sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==}
     engines: {node: '>=8.0'}
@@ -9149,10 +9092,6 @@ packages:
   temp-file@3.4.0:
     resolution: {integrity: sha512-C5tjlC/HCtVUOi3KWVokd4vHVViOmGjtLwIh4MuzPo/nMYTV/p1urt3RnMz2IWXDdKEGJH3k5+KPxtqRsUYGtg==}
 
-  temp@0.9.4:
-    resolution: {integrity: sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==}
-    engines: {node: '>=6.0.0'}
-
   tempfile@5.0.0:
     resolution: {integrity: sha512-bX655WZI/F7EoTDw9JvQURqAXiPHi8o8+yFxPF2lWYyz1aHnmMRuXWqL6YB6GmeO0o4DIYWHLgGNi/X64T+X4Q==}
     engines: {node: '>=14.18'}
@@ -13471,12 +13410,6 @@ snapshots:
       - uglify-js
       - webpack-cli
 
-  '@electron/asar@3.4.1':
-    dependencies:
-      commander: 5.1.0
-      glob: 7.2.3
-      minimatch: 3.1.5
-
   '@electron/asar@4.1.1':
     dependencies:
       commander: 13.1.0
@@ -13573,17 +13506,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@electron/windows-sign@1.2.1':
-    dependencies:
-      cross-dirname: 0.1.0
-      debug: 4.4.3
-      fs-extra: 11.3.0
-      minimist: 1.2.8
-      postject: 1.0.0-alpha.6
-    transitivePeerDependencies:
-      - supports-color
-    optional: true
-
   '@emnapi/core@1.10.0':
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
@@ -14765,10 +14687,6 @@ snapshots:
     dependencies:
       '@types/node': 22.13.17
 
-  '@types/archiver@5.3.1':
-    dependencies:
-      '@types/glob': 8.1.0
-
   '@types/aws4@1.11.6':
     dependencies:
       '@types/node': 22.13.17
@@ -14972,11 +14890,6 @@ snapshots:
 
   '@types/geojson@7946.0.16': {}
 
-  '@types/glob@8.1.0':
-    dependencies:
-      '@types/minimatch': 5.1.2
-      '@types/node': 22.13.17
-
   '@types/graceful-fs@4.1.9':
     dependencies:
       '@types/node': 22.13.17
@@ -15041,8 +14954,6 @@ snapshots:
 
   '@types/minimatch@3.0.5': {}
 
-  '@types/minimatch@5.1.2': {}
-
   '@types/ms@2.1.0': {}
 
   '@types/node@12.20.55': {}
@@ -16120,9 +16031,6 @@ snapshots:
 
   commander@8.3.0: {}
 
-  commander@9.5.0:
-    optional: true
-
   common-path-prefix@3.0.0: {}
 
   compare-func@2.0.0:
@@ -16311,9 +16219,6 @@ snapshots:
 
   create-require@1.1.1: {}
 
-  cross-dirname@0.1.0:
-    optional: true
-
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -16940,18 +16845,6 @@ snapshots:
 
   electron-to-chromium@1.5.353: {}
 
-  electron-winstaller@5.4.0:
-    dependencies:
-      '@electron/asar': 3.4.1
-      debug: 4.4.3
-      fs-extra: 7.0.1
-      lodash: 4.18.1
-      temp: 0.9.4
-    optionalDependencies:
-      '@electron/windows-sign': 1.2.1
-    transitivePeerDependencies:
-      - supports-color
-
   electron@39.8.5:
     dependencies:
       '@electron/get': 2.0.3
@@ -19150,10 +19043,6 @@ snapshots:
     dependencies:
       minipass: 7.1.3
 
-  mkdirp@0.5.6:
-    dependencies:
-      minimist: 1.2.8
-
   mri@1.2.0: {}
 
   mrmime@2.0.1: {}
@@ -20139,11 +20028,6 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  postject@1.0.0-alpha.6:
-    dependencies:
-      commander: 9.5.0
-    optional: true
-
   prelude-ls@1.2.1: {}
 
   prettier-linter-helpers@1.0.1:
@@ -20604,10 +20488,6 @@ snapshots:
 
   reusify@1.1.0: {}
 
-  rimraf@2.6.3:
-    dependencies:
-      glob: 7.2.3
-
   roarr@2.15.4:
     dependencies:
       boolean: 3.2.0
@@ -21108,11 +20988,6 @@ snapshots:
       async-exit-hook: 2.0.1
       fs-extra: 10.1.0
 
-  temp@0.9.4:
-    dependencies:
-      mkdirp: 0.5.6
-      rimraf: 2.6.3
-
   tempfile@5.0.0:
     dependencies:
       temp-dir: 3.0.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 2765f5c48fc..d4ec743bdec 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -8,7 +8,6 @@ allowBuilds:
   '@swc/core': true
   core-js: false
   electron: false
-  electron-winstaller: true
   esbuild: false
 
 # 10080 minutes = 7 days

From df1d2dcd7ca7071b1bdd5462ce44761f2da520ad Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 18:00:59 -0700
Subject: [PATCH 16/20] docs(changeset): point customSquirrelVendorDir
 migration at toolsets.squirrel

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .changeset/remove-electron-winstaller-dep.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/remove-electron-winstaller-dep.md b/.changeset/remove-electron-winstaller-dep.md
index ce5b196b6ce..ff85ed28562 100644
--- a/.changeset/remove-electron-winstaller-dep.md
+++ b/.changeset/remove-electron-winstaller-dep.md
@@ -4,4 +4,4 @@
 
 feat(squirrel-windows)!: inline installer logic; remove electron-winstaller dependency and its vendored binaries
 
-BREAKING: the `squirrelWindows.customSquirrelVendorDir` option has been removed. Override the vendor toolset source with the `ELECTRON_BUILDER_SQUIRREL_TOOLSET_DIR` environment variable instead (it goes through the same nuget/rcedit provisioning).
+BREAKING: the `squirrelWindows.customSquirrelVendorDir` option has been removed. Supply a custom Squirrel vendor bundle with the `toolsets.squirrel` config (a `ToolsetCustom` object) instead — it goes through the same nuget/rcedit provisioning as the default bundle.

From d6fab954943f61d81fdd52140a86ddc23b5e3630 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 18:21:47 -0700
Subject: [PATCH 17/20] fix(squirrel-windows): provision rcedit.exe on all
 platforms, not just win32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squirrel-Mono.exe also shells out to rcedit.exe during --releasify (setPEVersionInfoAndIcon)
to stamp version info + the app icon into Setup.exe, so the win32-only gate left rcedit.exe
missing from the vendor dir on Linux/macOS, failing the build under mono/wine with
"Failed to modify resources / ShellExecuteEx failed". electron-winstaller's vendor shipped a
32-bit rcedit.exe on all platforms; match that — use the 32-bit rcedit under wine (alongside
the Win32 Squirrel vendor exes wine already runs), host-arch rcedit on Windows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/SquirrelWindowsTarget.ts              | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 872ad46acde..4879b2aa381 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -35,19 +35,20 @@ export default class SquirrelWindowsTarget extends Target {
     // already ships a real one). Remove once squirrel.windows bundles it (electron-builder-binaries#203).
     await prepareNugetExe(tmpVendorDirectory)
 
-    // Squirrel.exe --releasify shells out to rcedit.exe (via setPEVersionInfoAndIcon) to embed the app
-    // icon into Setup.exe. The bundle does not ship rcedit, so resolve it from the win-codesign toolset,
-    // which already versions and caches it across all platforms. Squirrel-Mono.exe (used on non-Windows)
-    // does not call rcedit, so this is only needed on win32.
+    // Both Squirrel.exe and Squirrel-Mono.exe shell out to rcedit.exe (via setPEVersionInfoAndIcon)
+    // during --releasify to stamp version info and the app icon into Setup.exe, so rcedit must live in
+    // the vendor dir on every host — on non-Windows it runs under wine alongside the other Win32 vendor
+    // exes (Setup.exe, StubExecutable.exe, …). The bundle omits rcedit, so resolve it from the
+    // win-codesign toolset, which already versions and caches it across platforms.
     //
     // getRceditBundle honors the user's `toolsets.winCodeSign` selection, so users retain a bypass if a
     // newer toolset regresses: `"0.0.0"` falls back to the legacy winCodeSign-2.6.0 rcedit, a custom
     // toolset object uses their own rcedit, and the default (unset/"latest") pulls rcedit-windows-2_0_0.
-    if (process.platform === "win32") {
-      const rcedit = await getRceditBundle(this.packager.config.toolsets?.winCodeSign, this.packager.buildResourcesDir)
-      const rceditExe = os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
-      await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
-    }
+    const rcedit = await getRceditBundle(this.packager.config.toolsets?.winCodeSign, this.packager.buildResourcesDir)
+    // On non-Windows, run the 32-bit rcedit under wine (matching the Win32 vendor exes wine already runs);
+    // on Windows pick the host arch.
+    const rceditExe = process.platform !== "win32" || os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
+    await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
 
     const files = await fs.promises.readdir(tmpVendorDirectory)
     const squirrelExe = files.find(f => f === "Squirrel.exe")

From c69746bd0593366a658c9077ccba7f2ca9be535b Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 18:28:45 -0700
Subject: [PATCH 18/20] fix(squirrel-windows): provision WiX toolset +
 template.wxs for MSI builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squirrel's createMsiPackage (msi: true) runs candle.exe/light.exe from its vendor dir and reads
template.wxs there; the squirrel.windows bundle ships neither, so MSI builds failed at
pathToWixTools(). When msi is requested, download the shared WiX 3.11 toolset (wix-4.0.0.5512.2 —
the same candle/light electron-builder's MSI target uses) and merge it into the vendor dir, and ship
Squirrel's template.wxs in the package and copy it alongside. Gated on msi so non-MSI builds skip the
~4MB download.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../package.json                              |  1 +
 .../src/SquirrelWindowsTarget.ts              | 11 +++++-
 .../src/toolset.ts                            | 18 +++++++++
 .../template.wxs                              | 39 +++++++++++++++++++
 4 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 packages/electron-builder-squirrel-windows/template.wxs

diff --git a/packages/electron-builder-squirrel-windows/package.json b/packages/electron-builder-squirrel-windows/package.json
index df59d1f6041..c01c60a75ee 100644
--- a/packages/electron-builder-squirrel-windows/package.json
+++ b/packages/electron-builder-squirrel-windows/package.json
@@ -27,6 +27,7 @@
   "files": [
     "dist",
     "template.nuspectemplate",
+    "template.wxs",
     "install-spinner.gif"
   ],
   "engines": {
diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index 4879b2aa381..a76b8c879dd 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -5,7 +5,7 @@ import { sanitizeFileName } from "builder-util/internal"
 import * as fs from "fs"
 import * as os from "os"
 import * as path from "path"
-import { getSquirrelToolsetPath, prepareNugetExe } from "./toolset.js"
+import { getSquirrelToolsetPath, getWixToolsetPath, prepareNugetExe } from "./toolset.js"
 import { InstallerOptions, convertVersion, createWindowsInstaller } from "./windowsInstaller.js"
 
 export default class SquirrelWindowsTarget extends Target {
@@ -50,6 +50,15 @@ export default class SquirrelWindowsTarget extends Target {
     const rceditExe = process.platform !== "win32" || os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
     await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
 
+    // When building an MSI, Squirrel's createMsiPackage runs candle.exe/light.exe from the vendor dir and
+    // reads template.wxs there. The bundle ships neither, so merge the shared WiX 3.11 toolset (the same
+    // candle/light electron-builder's MSI target uses) into the vendor dir, plus the Squirrel MSI template.
+    if (this.options.msi) {
+      const wixToolset = await getWixToolsetPath()
+      await fs.promises.cp(wixToolset, tmpVendorDirectory, { recursive: true })
+      await fs.promises.copyFile(path.resolve(import.meta.dirname, "..", "template.wxs"), path.join(tmpVendorDirectory, "template.wxs"))
+    }
+
     const files = await fs.promises.readdir(tmpVendorDirectory)
     const squirrelExe = files.find(f => f === "Squirrel.exe")
     if (squirrelExe) {
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index 75d9f36233e..60ed6d8d24b 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -33,6 +33,24 @@ export async function getSquirrelToolsetPath(toolset: ToolsetConfig["squirrel"],
   })
 }
 
+// Squirrel's createMsiPackage (msi: true) runs candle.exe/light.exe with `-ext WixNetFxExtension` from
+// its own vendor dir. The squirrel.windows bundle omits the WiX toolchain, so reuse the shared WiX 3.11
+// toolset (the same candle/light electron-builder's MSI target uses) and merge it into the vendor dir.
+const WIX_TOOLSET_FILE = "wix-4.0.0.5512.2.7z"
+const WIX_TOOLSET_SHA256 = "fe677fcd837b18c9b912985d91636bbd8a1e800c3b3a6a841b6f96e89624e839"
+
+/**
+ * Returns the path to the WiX 3.11 toolset directory (candle.exe, light.exe, WixNetFxExtension.dll, …).
+ * Only needed when building an MSI.
+ */
+export async function getWixToolsetPath(): Promise<string> {
+  return downloadBuilderToolset({
+    releaseName: "wix-4.0.0.5512.2",
+    filenameWithExt: WIX_TOOLSET_FILE,
+    checksums: { [WIX_TOOLSET_FILE]: WIX_TOOLSET_SHA256 },
+  })
+}
+
 // TEMPORARY: nuget.exe override. The published squirrel.windows@1.1.0 bundle ships the Chocolatey
 // shim for nuget.exe, which resolves the real binary relative to its own install path and fails once
 // relocated to a temp vendor directory. Until squirrel.windows bundles the standalone portable exe
diff --git a/packages/electron-builder-squirrel-windows/template.wxs b/packages/electron-builder-squirrel-windows/template.wxs
new file mode 100644
index 00000000000..22d6d69ca93
--- /dev/null
+++ b/packages/electron-builder-squirrel-windows/template.wxs
@@ -0,0 +1,39 @@
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension" xmlns:netfx="http://schemas.microsoft.com/wix/NetFxExtension">
+  <Product Id="*" Name="{{Title}} Deployment Tool" Language="1033" Codepage="{{Codepage}}" Version="!(bind.FileVersion.{{Id}}.exe)" UpgradeCode="{{IdAsGuid1}}" Manufacturer="{{Author}}">
+
+    <Package Description="This package installs a deployment tool for {{Title}}. Not {{Title}} itself. {{Title}} is only installed if a user logs into the machine." InstallScope="perMachine" Comments="Comments" InstallerVersion="200" Compressed="yes" Platform="{{Platform}}"/>
+    <MajorUpgrade AllowSameVersionUpgrades="yes" DowngradeErrorMessage="A later version of this product is already installed. Setup will now exit."/>
+    <Media Id="1" Cabinet="contents.cab" EmbedCab="yes" CompressionLevel="high"/>
+
+    <PropertyRef Id="NETFRAMEWORK45" />
+
+    <Condition Message="This application requires .NET Framework 4.5 or higher. Please install the latest .NET Framework then run this installer again.">
+      <![CDATA[Installed OR NETFRAMEWORK45]]>
+    </Condition>
+
+    <Directory Id="TARGETDIR" Name="SourceDir">
+      <Directory Id="{{ProgramFilesFolder}}">
+        <Directory Id="APPLICATIONROOTDIRECTORY" Name="{{Title}} Deployment" />
+      </Directory>
+    </Directory>
+
+    <DirectoryRef Id="APPLICATIONROOTDIRECTORY">
+      <Component Id="{{Id}}.exe" Guid="{{IdAsGuid2}}" Win64="{{Win64YesNo}}">
+        <File Id="{{Id}}.exe" Name="{{Id}}DeploymentTool.exe" Source="./Setup.exe" KeyPath="yes"/>
+      </Component>
+    </DirectoryRef>
+
+    <DirectoryRef Id="TARGETDIR">
+      <Component Id="RegistryEntries" Guid="{{IdAsGuid3}}" Win64="{{Win64YesNo}}">
+        <RegistryKey Root="HKLM" Key="SOFTWARE\Microsoft\Windows\CurrentVersion\Run">
+          <RegistryValue Type="expandable" Name="{{Id}}Deployment" Value="&quot;[#{{Id}}.exe]&quot; --checkInstall" />
+        </RegistryKey>
+      </Component>
+    </DirectoryRef>
+
+    <Feature Id="MainApplication" Title="Main Application" Level="1">
+      <ComponentRef Id="{{Id}}.exe" />
+      <ComponentRef Id="RegistryEntries" />
+    </Feature>
+  </Product>
+</Wix>

From f4658e7b9f880a51081f3a942dcd2759a3b8f5d3 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 18:35:52 -0700
Subject: [PATCH 19/20] fix(squirrel-windows): host-arch rcedit (arm64 mac
 needs x64); throw on missing Squirrel.exe

- Select rcedit by host arch (x64 for x64/arm64, x86 only for ia32) instead of forcing 32-bit on
  non-Windows: the 32-bit build fails on arm64 macOS even under Rosetta (which translates x64, not x86).
- Throw when Squirrel.exe is absent from the vendor dir instead of warn-and-skip: it always ships in
  the bundle, and skipping signing both produces a broken installer and bypasses the forceCodeSigning
  enforcement in signIf.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/SquirrelWindowsTarget.ts              | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index a76b8c879dd..d8a6839e5d8 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -45,9 +45,10 @@ export default class SquirrelWindowsTarget extends Target {
     // newer toolset regresses: `"0.0.0"` falls back to the legacy winCodeSign-2.6.0 rcedit, a custom
     // toolset object uses their own rcedit, and the default (unset/"latest") pulls rcedit-windows-2_0_0.
     const rcedit = await getRceditBundle(this.packager.config.toolsets?.winCodeSign, this.packager.buildResourcesDir)
-    // On non-Windows, run the 32-bit rcedit under wine (matching the Win32 vendor exes wine already runs);
-    // on Windows pick the host arch.
-    const rceditExe = process.platform !== "win32" || os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
+    // Pick rcedit by host arch (x64 for x64/arm64, x86 only for ia32). On non-Windows it runs under wine:
+    // the 32-bit build fails on arm64 macOS even under Rosetta (which translates x64, not x86), so the x64
+    // build is required there.
+    const rceditExe = os.arch() === "ia32" ? rcedit.x86 : rcedit.x64
     await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
 
     // When building an MSI, Squirrel's createMsiPackage runs candle.exe/light.exe from the vendor dir and
@@ -59,15 +60,17 @@ export default class SquirrelWindowsTarget extends Target {
       await fs.promises.copyFile(path.resolve(import.meta.dirname, "..", "template.wxs"), path.join(tmpVendorDirectory, "template.wxs"))
     }
 
+    // Squirrel.exe is the core updater binary the bundle always ships; a missing one means a broken
+    // vendor toolset. Fail loudly rather than skipping signing — skipping would produce a broken
+    // installer and bypass the forceCodeSigning enforcement inside signIf (its awaited promise rejects
+    // when the file can't be signed and forceCodeSigning is set).
     const files = await fs.promises.readdir(tmpVendorDirectory)
-    const squirrelExe = files.find(f => f === "Squirrel.exe")
-    if (squirrelExe) {
-      const filePath = path.join(tmpVendorDirectory, squirrelExe)
-      log.debug({ file: filePath }, "signing vendor executable")
-      await this.packager.signIf(filePath)
-    } else {
-      log.warn("Squirrel.exe not found in vendor directory, skipping signing")
+    if (!files.includes("Squirrel.exe")) {
+      throw new Error(`Squirrel.exe not found in vendor directory: ${tmpVendorDirectory}`)
     }
+    const squirrelExePath = path.join(tmpVendorDirectory, "Squirrel.exe")
+    log.debug({ file: squirrelExePath }, "signing vendor executable")
+    await this.packager.signIf(squirrelExePath)
     return tmpVendorDirectory
   }
 

From 921b53f5750bc8391ae784dd423ef2a1c2e89843 Mon Sep 17 00:00:00 2001
From: Mike Maietta <mmaietta@outlook.com>
Date: Sat, 20 Jun 2026 20:38:45 -0700
Subject: [PATCH 20/20] fix(squirrel-windows): author Squirrel MSI template
 against the WiX v4 namespace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shared wix-4.0.0.5512.2 toolset (the one electron-builder's MSI target uses) is a transitional
WiX 4: its candle accepts the v3-style element structure but requires the v4 namespace, so Squirrel's
WiX 3 template was rejected with CNDL0199. Swap template.wxs to http://wixtoolset.org/schemas/v4/wxs
(dropping the unused util/netfx namespace decls — only the core <PropertyRef Id="NETFRAMEWORK45"> is
used, supplied by candle's -ext WixNetFxExtension). Structure is unchanged, matching MsiTarget's
template which compiles with the same toolset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/SquirrelWindowsTarget.ts                            | 5 +++--
 packages/electron-builder-squirrel-windows/src/toolset.ts   | 6 ++++--
 packages/electron-builder-squirrel-windows/template.wxs     | 2 +-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
index d8a6839e5d8..7265183ff53 100644
--- a/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
+++ b/packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts
@@ -52,8 +52,9 @@ export default class SquirrelWindowsTarget extends Target {
     await fs.promises.copyFile(rceditExe, path.join(tmpVendorDirectory, "rcedit.exe"))
 
     // When building an MSI, Squirrel's createMsiPackage runs candle.exe/light.exe from the vendor dir and
-    // reads template.wxs there. The bundle ships neither, so merge the shared WiX 3.11 toolset (the same
-    // candle/light electron-builder's MSI target uses) into the vendor dir, plus the Squirrel MSI template.
+    // reads template.wxs there. The bundle ships neither, so merge the shared WiX toolset (the same
+    // candle/light electron-builder's MSI target uses) into the vendor dir, plus the Squirrel MSI template
+    // (authored against the v4 namespace this transitional WiX 4 requires).
     if (this.options.msi) {
       const wixToolset = await getWixToolsetPath()
       await fs.promises.cp(wixToolset, tmpVendorDirectory, { recursive: true })
diff --git a/packages/electron-builder-squirrel-windows/src/toolset.ts b/packages/electron-builder-squirrel-windows/src/toolset.ts
index 60ed6d8d24b..929bdbf0eb3 100644
--- a/packages/electron-builder-squirrel-windows/src/toolset.ts
+++ b/packages/electron-builder-squirrel-windows/src/toolset.ts
@@ -34,13 +34,15 @@ export async function getSquirrelToolsetPath(toolset: ToolsetConfig["squirrel"],
 }
 
 // Squirrel's createMsiPackage (msi: true) runs candle.exe/light.exe with `-ext WixNetFxExtension` from
-// its own vendor dir. The squirrel.windows bundle omits the WiX toolchain, so reuse the shared WiX 3.11
+// its own vendor dir. The squirrel.windows bundle omits the WiX toolchain, so reuse the shared WiX
 // toolset (the same candle/light electron-builder's MSI target uses) and merge it into the vendor dir.
+// This is a transitional WiX 4 (4.0.0.5512): it accepts the v3-style element structure but requires the
+// v4 namespace, so template.wxs is authored against http://wixtoolset.org/schemas/v4/wxs.
 const WIX_TOOLSET_FILE = "wix-4.0.0.5512.2.7z"
 const WIX_TOOLSET_SHA256 = "fe677fcd837b18c9b912985d91636bbd8a1e800c3b3a6a841b6f96e89624e839"
 
 /**
- * Returns the path to the WiX 3.11 toolset directory (candle.exe, light.exe, WixNetFxExtension.dll, …).
+ * Returns the path to the WiX toolset directory (candle.exe, light.exe, WixNetFxExtension.dll, …).
  * Only needed when building an MSI.
  */
 export async function getWixToolsetPath(): Promise<string> {
diff --git a/packages/electron-builder-squirrel-windows/template.wxs b/packages/electron-builder-squirrel-windows/template.wxs
index 22d6d69ca93..d11bd1e1c6d 100644
--- a/packages/electron-builder-squirrel-windows/template.wxs
+++ b/packages/electron-builder-squirrel-windows/template.wxs
@@ -1,4 +1,4 @@
-<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension" xmlns:netfx="http://schemas.microsoft.com/wix/NetFxExtension">
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Product Id="*" Name="{{Title}} Deployment Tool" Language="1033" Codepage="{{Codepage}}" Version="!(bind.FileVersion.{{Id}}.exe)" UpgradeCode="{{IdAsGuid1}}" Manufacturer="{{Author}}">
 
     <Package Description="This package installs a deployment tool for {{Title}}. Not {{Title}} itself. {{Title}} is only installed if a user logs into the machine." InstallScope="perMachine" Comments="Comments" InstallerVersion="200" Compressed="yes" Platform="{{Platform}}"/>