@mutmutco/installer-launcher 0.1.0

package/dist/launcher.sea.cjs

@@ -0,0 +1,855 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  LAUNCHER_VERSION: () => LAUNCHER_VERSION,
+  defaultRunEntry: () => defaultRunEntry,
+  ensureFreshToken: () => ensureFreshToken,
+  readPayloadEntry: () => readPayloadEntry,
+  resolveEntry: () => resolveEntry,
+  run: () => run,
+  runFile: () => runFile
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs4 = require("node:fs");
+var import_node_path3 = require("node:path");
+var import_node_url2 = require("node:url");
+
+// src/config.ts
+var import_node_fs = require("node:fs");
+var import_node_sea = require("node:sea");
+
+// src/module-url.ts
+var import_node_url = require("node:url");
+var import_meta = {};
+function moduleUrl() {
+  if (typeof __filename === "string") return (0, import_node_url.pathToFileURL)(__filename).href;
+  return import_meta.url;
+}
+
+// src/config.ts
+function publicKeyBytes(config) {
+  const raw = Buffer.from(config.publicKey, "base64");
+  if (raw.length !== 32) {
+    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
+  }
+  return raw;
+}
+function loadProductConfig(options = {}) {
+  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
+  const devFallback = new URL("../config/product.template.json", moduleUrl());
+  if (explicit) {
+    return parseProductConfig((0, import_node_fs.readFileSync)(explicit, "utf8"));
+  }
+  try {
+    return parseProductConfig((0, import_node_fs.readFileSync)(devFallback, "utf8"));
+  } catch {
+  }
+  try {
+    const asset = (0, import_node_sea.getAsset)("product.json", "utf8");
+    if (typeof asset === "string") return parseProductConfig(asset);
+  } catch {
+  }
+  throw new Error(
+    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
+  );
+}
+function parseProductConfig(text) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error("product config is not valid JSON");
+  }
+  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
+  const record = data;
+  const product = field(record, "product");
+  const host = field(record, "host").replace(/\/+$/, "");
+  const loginKind = field(record, "loginKind");
+  const binName = field(record, "binName");
+  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
+  if (loginKind !== "github" && loginKind !== "google") {
+    throw new Error('product config loginKind must be "github" or "google"');
+  }
+  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
+  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
+  publicKeyBytes(config);
+  if (loginKind === "github") {
+    const clientId = record.githubClientId;
+    if (typeof clientId !== "string" || clientId.length === 0) {
+      throw new Error("product config needs githubClientId for the github loginKind");
+    }
+    config.githubClientId = clientId;
+  } else if (typeof record.githubClientId === "string") {
+    config.githubClientId = record.githubClientId;
+  }
+  try {
+    const url = new URL(host);
+    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
+  } catch {
+    throw new Error("product config host must be an http(s) URL");
+  }
+  return config;
+}
+function field(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : "";
+}
+
+// src/login-github.ts
+var import_node_child_process = require("node:child_process");
+var realSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+function openBrowser(url) {
+  if (process.env.LAUNCHER_NO_OPEN === "1") return;
+  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : process.platform === "darwin" ? [url] : [url];
+  try {
+    const child = (0, import_node_child_process.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function postJson(url, body, fetchImpl) {
+  return fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+}
+async function requestDeviceCode(config, fetchImpl) {
+  if (!config.githubClientId) throw new Error("this product has no githubClientId configured");
+  const response = await postJson(`${config.host}/gate/device/code`, { client_id: config.githubClientId }, fetchImpl);
+  if (!response.ok) throw new Error(`the sign-in server refused the request (${response.status})`);
+  const data = await response.json();
+  if (typeof data.device_code !== "string" || typeof data.user_code !== "string" || typeof data.verification_uri !== "string" || typeof data.expires_in !== "number" || typeof data.interval !== "number") {
+    throw new Error("the sign-in server returned a malformed device code");
+  }
+  const issued = {
+    device_code: data.device_code,
+    user_code: data.user_code,
+    verification_uri: data.verification_uri,
+    expires_in: data.expires_in,
+    interval: data.interval
+  };
+  if (typeof data.verification_uri_complete === "string") {
+    issued.verification_uri_complete = data.verification_uri_complete;
+  }
+  return issued;
+}
+async function loginGithub(config, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const open = options.open ?? openBrowser;
+  const print = options.print ?? ((message) => process.stdout.write(`${message}
+`));
+  const now = options.now ?? (() => Date.now());
+  const sleep = options.sleep ?? realSleep;
+  const issued = await requestDeviceCode(config, fetchImpl);
+  const openUrl = issued.verification_uri_complete ?? issued.verification_uri;
+  print(`To sign in, open ${issued.verification_uri} and enter the code ${issued.user_code}.`);
+  open(openUrl);
+  const deadline = now() + issued.expires_in * 1e3;
+  let intervalMs = Math.max(1, issued.interval) * 1e3;
+  for (; ; ) {
+    if (now() >= deadline) throw new Error("the sign-in code expired before you approved it \u2014 run login again.");
+    await sleep(intervalMs);
+    const response = await postJson(
+      `${config.host}/gate/device/token`,
+      { client_id: config.githubClientId, device_code: issued.device_code },
+      fetchImpl
+    );
+    if (response.ok) {
+      const data = await response.json();
+      if (typeof data.access_token !== "string" || typeof data.refresh_token !== "string" || typeof data.expires_in !== "number") {
+        throw new Error("the sign-in server returned malformed tokens");
+      }
+      return { accessToken: data.access_token, refreshToken: data.refresh_token, expiresIn: data.expires_in };
+    }
+    let error = "";
+    try {
+      error = (await response.json()).error ?? "";
+    } catch {
+      error = "";
+    }
+    if (error === "authorization_pending") continue;
+    if (error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    if (error === "expired_token") {
+      throw new Error("the sign-in code expired before you approved it \u2014 run login again.");
+    }
+    if (error === "denied") {
+      throw new Error("you declined the sign-in request \u2014 nothing was installed.");
+    }
+    throw new Error(
+      `the sign-in server refused the request (${response.status}${error ? `: ${error}` : ""})`
+    );
+  }
+}
+async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
+  const response = await postJson(`${config.host}/gate/refresh`, { refresh_token: refreshToken }, fetchImpl);
+  if (response.status === 403) return null;
+  if (!response.ok) throw new Error(`the sign-in server refused the refresh (${response.status})`);
+  const data = await response.json();
+  if (typeof data.access_token !== "string" || typeof data.expires_in !== "number") {
+    throw new Error("the sign-in server returned a malformed refresh");
+  }
+  return { accessToken: data.access_token, expiresIn: data.expires_in };
+}
+
+// src/login-google.ts
+var import_node_crypto = require("node:crypto");
+var import_node_http = require("node:http");
+var b64url = (bytes) => bytes.toString("base64url");
+async function loginGoogle(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const server = options.host.replace(/\/+$/, "");
+  const timeoutMs = options.timeoutMs ?? 5 * 6e4;
+  const listener = (0, import_node_http.createServer)();
+  await new Promise((resolve2) => listener.listen(0, "127.0.0.1", resolve2));
+  const port = listener.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  try {
+    const registration = await fetchImpl(`${server}/oauth/register`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ client_name: "launcher", redirect_uris: [redirectUri] })
+    });
+    if (!registration.ok) throw new Error(`the sign-in server refused to register this app (${registration.status})`);
+    const clientId = (await registration.json()).client_id;
+    if (typeof clientId !== "string" || !clientId) {
+      throw new Error("the sign-in server returned a malformed registration");
+    }
+    const verifier = b64url((0, import_node_crypto.randomBytes)(32));
+    const challenge = b64url((0, import_node_crypto.createHash)("sha256").update(verifier).digest());
+    const state = b64url((0, import_node_crypto.randomBytes)(16));
+    const authorize = new URL(`${server}/oauth/authorize`);
+    authorize.search = new URLSearchParams({
+      response_type: "code",
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      scope: "installer",
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    }).toString();
+    const code = await new Promise((resolve2, reject) => {
+      const timer = setTimeout(() => reject(new Error("sign-in timed out \u2014 run login again.")), timeoutMs);
+      listener.on("request", (req, res) => {
+        const url = new URL(req.url ?? "/", redirectUri);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404).end();
+          return;
+        }
+        const error = url.searchParams.get("error");
+        const received = url.searchParams.get("code");
+        if (url.searchParams.get("state") !== state || error || !received) {
+          res.writeHead(400, { "content-type": "text/html; charset=utf-8" }).end(page("Sign-in did not complete.", error ?? "no code"));
+          clearTimeout(timer);
+          reject(new Error(error ?? "sign-in rejected"));
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(page("Signed in.", "You can close this tab and go back to the terminal."));
+        clearTimeout(timer);
+        resolve2(received);
+      });
+      options.open(authorize.toString());
+    });
+    const exchange = await fetchImpl(`${server}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: verifier
+      }).toString()
+    });
+    if (!exchange.ok) throw new Error(`token exchange failed (${exchange.status})`);
+    const tokens = await exchange.json();
+    if (typeof tokens.access_token !== "string" || typeof tokens.refresh_token !== "string" || typeof tokens.expires_in !== "number") {
+      throw new Error("the sign-in server returned malformed tokens");
+    }
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresIn: tokens.expires_in,
+      clientId
+    };
+  } finally {
+    listener.close();
+  }
+}
+async function refreshGoogleToken(host, clientId, refreshToken, fetchImpl = fetch) {
+  const server = host.replace(/\/+$/, "");
+  const response = await fetchImpl(`${server}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: clientId
+    }).toString()
+  });
+  if (!response.ok) return null;
+  const tokens = await response.json();
+  if (typeof tokens.access_token !== "string" || typeof tokens.expires_in !== "number") return null;
+  return {
+    accessToken: tokens.access_token,
+    refreshToken: typeof tokens.refresh_token === "string" ? tokens.refresh_token : refreshToken,
+    expiresIn: tokens.expires_in
+  };
+}
+function page(title, body) {
+  return `<!doctype html><meta charset="utf-8"><title>${title}</title><style>body{font-family:system-ui;margin:0;padding:12vh 1.5rem}main{max-width:32rem;margin:auto}h1{font-size:1.4rem}</style><main><h1>${title}</h1><p>${body}</p></main>`;
+}
+
+// src/payload.ts
+var import_node_crypto2 = require("node:crypto");
+var import_node_fs2 = require("node:fs");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+
+// src/canonical.ts
+function canonicalJson(value) {
+  return encode(value);
+}
+function encode(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("canonicalJson: cannot encode a non-finite number");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => encode(entry)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
+}
+
+// src/payload.ts
+var NeedsLoginError = class extends Error {
+  constructor() {
+    super("signed out \u2014 run login first");
+    this.name = "NeedsLoginError";
+  }
+};
+var ForbiddenError = class extends Error {
+  constructor() {
+    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
+    this.name = "ForbiddenError";
+  }
+};
+function canonicalManifestBytes(manifest) {
+  return Buffer.from(
+    canonicalJson({
+      created: manifest.created,
+      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
+      version: manifest.version
+    }),
+    "utf8"
+  );
+}
+function ed25519PublicKey(config) {
+  const raw = publicKeyBytes(config);
+  return (0, import_node_crypto2.createPublicKey)({
+    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyManifest(manifest, signature, config) {
+  try {
+    const signatureBytes = Buffer.from(signature, "base64");
+    if (signatureBytes.length === 0) return false;
+    return (0, import_node_crypto2.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
+  } catch {
+    return false;
+  }
+}
+function verifyFileBytes(entry, bytes) {
+  if (entry.size !== bytes.length) return false;
+  return (0, import_node_crypto2.createHash)("sha256").update(bytes).digest("hex") === entry.sha256.toLowerCase();
+}
+async function readErrorCode(response) {
+  try {
+    const data = await response.json();
+    return typeof data.error === "string" ? data.error : "";
+  } catch {
+    return "";
+  }
+}
+function throwForStatus(status, errorCode) {
+  if (status === 401) throw new NeedsLoginError();
+  if (status === 403) throw new ForbiddenError();
+  throw new Error(
+    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
+  );
+}
+async function getJson(url, accessToken, fetchImpl) {
+  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
+  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
+  return { status: response.status, json: await response.json() };
+}
+function parseManifest(json) {
+  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
+  const record = json;
+  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
+  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
+  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
+  if (typeof record.signature !== "string" || !record.signature) {
+    throw new Error("the release manifest is unsigned");
+  }
+  const files = record.files.map((entry) => {
+    const file = entry;
+    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
+      throw new Error("the release manifest lists a malformed file");
+    }
+    const safe = safeManifestPath(file.path);
+    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
+    return { path: safe, sha256: file.sha256, size: file.size };
+  });
+  return { version: record.version, created: record.created, files, signature: record.signature };
+}
+function safeManifestPath(rawPath) {
+  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
+  if (rawPath.startsWith("/")) return null;
+  const segments = rawPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") return null;
+  }
+  return segments.join("/");
+}
+async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
+  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
+  const manifest = parseManifest(json);
+  if (!verifyManifest(manifest, manifest.signature, config)) {
+    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
+  }
+  return manifest;
+}
+async function fetchFileBytes(config, accessToken, path, fetchImpl) {
+  const encoded = path.split("/").map(encodeURIComponent).join("/");
+  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!response.ok) {
+    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
+    throwForStatus(response.status, await readErrorCode(response));
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const staging = (0, import_node_path.join)((0, import_node_os.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
+  (0, import_node_fs2.mkdirSync)(staging, { recursive: true });
+  try {
+    for (const entry of manifest.files) {
+      const bytes = await fetchFileBytes(config, accessToken, entry.path, fetchImpl);
+      if (!verifyFileBytes(entry, bytes)) {
+        throw new Error(`file ${entry.path} failed its checksum \u2014 refusing to install anything.`);
+      }
+      const dest = (0, import_node_path.join)(staging, entry.path);
+      (0, import_node_fs2.mkdirSync)((0, import_node_path.dirname)(dest), { recursive: true });
+      (0, import_node_fs2.writeFileSync)(dest, bytes);
+    }
+    const target = (0, import_node_path.join)(dir, "payload");
+    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs2.rmSync)(target, { force: true, recursive: true });
+    (0, import_node_fs2.renameSync)(staging, target);
+  } catch (error) {
+    (0, import_node_fs2.rmSync)(staging, { force: true, recursive: true });
+    throw error;
+  }
+  return manifest.version;
+}
+
+// src/store.ts
+var import_node_fs3 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path2 = require("node:path");
+function defaultProductDir(product) {
+  if (process.platform === "win32") {
+    const base = process.env.LOCALAPPDATA ?? (0, import_node_path2.join)((0, import_node_os2.tmpdir)(), "launcher-fallback");
+    return (0, import_node_path2.join)(base, product);
+  }
+  const home = process.env.HOME ?? (0, import_node_os2.tmpdir)();
+  return (0, import_node_path2.join)(home, `.${product}`);
+}
+function resolveProductDir(product, explicit) {
+  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
+}
+function tokensPath(dir) {
+  return (0, import_node_path2.join)(dir, "tokens.json");
+}
+function statePath(dir) {
+  return (0, import_node_path2.join)(dir, "state.json");
+}
+function payloadDir(dir) {
+  return (0, import_node_path2.join)(dir, "payload");
+}
+function readTokens(dir) {
+  try {
+    const data = JSON.parse((0, import_node_fs3.readFileSync)(tokensPath(dir), "utf8"));
+    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
+    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
+    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
+    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
+    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
+    return tokens;
+  } catch {
+    return null;
+  }
+}
+function writeTokens(dir, tokens) {
+  (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  try {
+    (0, import_node_fs3.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
+`, { mode: 384 });
+  } catch {
+    (0, import_node_fs3.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
+`);
+  }
+}
+function clearTokens(dir) {
+  (0, import_node_fs3.rmSync)(tokensPath(dir), { force: true });
+}
+function readState(dir) {
+  try {
+    const data = JSON.parse((0, import_node_fs3.readFileSync)(statePath(dir), "utf8"));
+    if (typeof data.version !== "string" || !data.version) return null;
+    return { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
+  } catch {
+    return null;
+  }
+}
+function writeState(dir, state) {
+  (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs3.writeFileSync)(statePath(dir), `${JSON.stringify(state, null, 2)}
+`);
+}
+function wipeProductDir(dir) {
+  (0, import_node_fs3.rmSync)(tokensPath(dir), { force: true });
+  (0, import_node_fs3.rmSync)(statePath(dir), { force: true });
+  (0, import_node_fs3.rmSync)(payloadDir(dir), { force: true, recursive: true });
+}
+
+// src/index.ts
+var LAUNCHER_VERSION = "0.1.0";
+function defaultPrint(message) {
+  process.stdout.write(`${message}
+`);
+}
+function defaultPrintErr(message) {
+  process.stderr.write(`${message}
+`);
+}
+async function run(rawOptions = {}) {
+  const print = rawOptions.print ?? defaultPrint;
+  const printErr = rawOptions.printErr ?? defaultPrintErr;
+  const argv = rawOptions.argv ?? process.argv.slice(2);
+  const runAt = argv.indexOf("--run");
+  if (runAt >= 0) return runFile(argv[runAt + 1], argv.slice(runAt + 2), printErr);
+  let config;
+  try {
+    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv, "--config") });
+  } catch (error) {
+    print(`cannot start: ${error.message}`);
+    return 2;
+  }
+  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv, "--dir"));
+  const positional = argv.filter((arg) => !arg.startsWith("-"));
+  if (argv.includes("--version") || argv.includes("-v")) {
+    print(`${config.binName} launcher ${LAUNCHER_VERSION}`);
+    return 0;
+  }
+  if (argv.includes("--help") || argv.includes("-h") || positional.length === 0) {
+    printUsage(config, print);
+    return positional.length === 0 ? 2 : 0;
+  }
+  const command = positional[0];
+  try {
+    switch (command) {
+      case "login":
+        await doLogin(config, dir, rawOptions, print);
+        return 0;
+      case "logout":
+        wipeProductDir(dir);
+        print(`signed out of ${config.product} and removed the downloaded payload.`);
+        return 0;
+      case "install":
+        return await doInstall(config, dir, rawOptions, print);
+      case "update":
+        return await doUpdate(config, dir, rawOptions, print);
+      case "doctor":
+        doDoctor(config, dir, print);
+        return 0;
+      default:
+        print(`unknown command: ${command}`);
+        printUsage(config, print);
+        return 2;
+    }
+  } catch (error) {
+    if (error instanceof NeedsLoginError) {
+      print("you are signed out \u2014 run login first.");
+      return 3;
+    }
+    print(`failed: ${error.message}`);
+    return 1;
+  }
+}
+function flagValue(argv, flag) {
+  const index = argv.indexOf(flag);
+  if (index < 0) return void 0;
+  const value = argv[index + 1];
+  return value && !value.startsWith("-") ? value : void 0;
+}
+function printUsage(config, print) {
+  print(`${config.binName} launcher ${LAUNCHER_VERSION} \u2014 sign in and install ${config.product}.`);
+  print("usage: launcher <login|logout|install|update|doctor> [--config <path>] [--dir <path>]");
+  print("       launcher --run <file> [args\u2026]   (run a payload file with the embedded runtime)");
+}
+async function runFile(file, args, printErr) {
+  if (!file) {
+    printErr("launcher --run needs a file to run.");
+    return 1;
+  }
+  const abs = (0, import_node_path3.resolve)(process.cwd(), file);
+  if (!(0, import_node_fs4.existsSync)(abs)) {
+    printErr(`cannot run ${file}: no such file.`);
+    return 1;
+  }
+  const previousArgv = process.argv;
+  const previousExitCode = process.exitCode;
+  let code;
+  try {
+    process.argv = [process.execPath, abs, ...args];
+    process.exitCode = void 0;
+    await import((0, import_node_url2.pathToFileURL)(abs).href);
+    code = typeof process.exitCode === "number" ? process.exitCode : 0;
+  } catch (error) {
+    printErr(`cannot run ${file}: ${error.message}`);
+    code = 1;
+  } finally {
+    process.argv = previousArgv;
+    process.exitCode = previousExitCode;
+  }
+  return code;
+}
+async function ensureFreshToken(config, dir, fetchImpl = fetch) {
+  const stored = readTokens(dir);
+  if (!stored) return null;
+  if (stored.expiresAt - Date.now() > 6e4) return stored.accessToken;
+  if (!stored.refreshToken) return null;
+  if (config.loginKind === "github") {
+    const refreshed2 = await refreshAccessToken(config, stored.refreshToken, fetchImpl);
+    if (!refreshed2) {
+      clearTokens(dir);
+      return null;
+    }
+    writeTokens(dir, {
+      accessToken: refreshed2.accessToken,
+      refreshToken: stored.refreshToken,
+      expiresAt: Date.now() + refreshed2.expiresIn * 1e3
+    });
+    return refreshed2.accessToken;
+  }
+  if (!stored.clientId) {
+    clearTokens(dir);
+    return null;
+  }
+  const refreshed = await refreshGoogleToken(config.host, stored.clientId, stored.refreshToken, fetchImpl);
+  if (!refreshed) {
+    clearTokens(dir);
+    return null;
+  }
+  writeTokens(dir, {
+    accessToken: refreshed.accessToken,
+    refreshToken: refreshed.refreshToken,
+    expiresAt: Date.now() + refreshed.expiresIn * 1e3,
+    clientId: stored.clientId
+  });
+  return refreshed.accessToken;
+}
+async function doLogin(config, dir, options, print) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const open = options.open ?? openBrowser;
+  if (config.loginKind === "github") {
+    const tokens = await loginGithub(config, { fetchImpl, open, print });
+    writeTokens(dir, {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3
+    });
+  } else {
+    const tokens = await loginGoogle({ host: config.host, open, fetchImpl });
+    writeTokens(dir, {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3,
+      clientId: tokens.clientId
+    });
+  }
+  print(`signed in to ${config.product}.`);
+}
+async function fetchAccessTokenOrLogin(config, dir, options, print) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const fresh = await ensureFreshToken(config, dir, fetchImpl);
+  if (fresh) return fresh;
+  await doLogin(config, dir, options, print);
+  const after = readTokens(dir);
+  if (!after) throw new Error("sign-in did not produce a token");
+  return after.accessToken;
+}
+function readPayloadEntry(dir) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path3.join)(payloadDir(dir), "payload.json"), "utf8"));
+    const entry = parsed.entry;
+    if (typeof entry === "string") {
+      const parts = entry.trim().split(/\s+/).filter(Boolean);
+      return parts.length > 0 ? parts : null;
+    }
+    if (Array.isArray(entry) && entry.every((part) => typeof part === "string" && part.length > 0)) {
+      return entry;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveEntry(entry) {
+  return entry[0] === "$self" ? [process.execPath, ...entry.slice(1)] : entry;
+}
+function needsShell(command) {
+  if (process.platform !== "win32") return false;
+  if (/\.(cmd|bat)$/i.test(command)) return true;
+  return !(0, import_node_fs4.existsSync)(command);
+}
+function defaultRunEntry(entry, cwd) {
+  const [command, ...args] = entry;
+  const result = (0, import_node_child_process2.spawnSync)(command, args, {
+    cwd,
+    stdio: "inherit",
+    shell: needsShell(command),
+    windowsHide: true
+  });
+  if (result.error) return { ok: false, error: result.error.message };
+  return { ok: result.status === 0, error: result.status === 0 ? void 0 : `exit code ${result.status}` };
+}
+async function doInstall(config, dir, options, print) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const accessToken = await fetchAccessTokenOrLogin(config, dir, options, print);
+  const manifest = await fetchVerifiedManifest(config, accessToken, fetchImpl);
+  await downloadAndUnpack(config, dir, manifest, accessToken, { fetchImpl });
+  writeState(dir, { version: manifest.version, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  print(`installed ${config.product} ${manifest.version} into ${dir}.`);
+  const entry = readPayloadEntry(dir);
+  if (!entry) {
+    print(`next step: run ${(0, import_node_path3.join)(payloadDir(dir), config.binName)} to start ${config.product}.`);
+    return 0;
+  }
+  const payload = payloadDir(dir);
+  const command = resolveEntry(entry);
+  const runEntry = options.runEntry ?? defaultRunEntry;
+  const result = runEntry(command, payload);
+  if (result.ok) {
+    print(`${config.product} is ready.`);
+    return 0;
+  }
+  print(`could not finish the last mile automatically${result.error ? ` (${result.error})` : ""}. Run it yourself:`);
+  print(`  (cd ${payload} && ${command.join(" ")})`);
+  return 0;
+}
+async function doUpdate(config, dir, options, print) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const accessToken = await fetchAccessTokenOrLogin(config, dir, options, print);
+  const manifest = await fetchVerifiedManifest(config, accessToken, fetchImpl);
+  const current = readState(dir);
+  if (current && current.version === manifest.version && (0, import_node_fs4.existsSync)(payloadDir(dir))) {
+    print(`${config.product} is already up to date at ${manifest.version}.`);
+    return 0;
+  }
+  await downloadAndUnpack(config, dir, manifest, accessToken, { fetchImpl });
+  writeState(dir, { version: manifest.version, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  print(`updated ${config.product} to ${manifest.version}.`);
+  return 0;
+}
+function doDoctor(config, dir, print) {
+  const tokens = readTokens(dir);
+  const state = readState(dir);
+  const payloadPresent = (0, import_node_fs4.existsSync)(payloadDir(dir));
+  print(`product:  ${config.product}`);
+  print(`host:     ${config.host}`);
+  print(`login:    ${config.loginKind}`);
+  print(`dir:      ${dir}`);
+  if (tokens) {
+    const remaining = Math.max(0, Math.round((tokens.expiresAt - Date.now()) / 1e3));
+    print(`token:    present (expires in ${remaining}s)`);
+  } else {
+    print("token:    none \u2014 run login first.");
+  }
+  print(`payload:  ${state ? state.version : "none"}${payloadPresent ? "" : " (not downloaded)"}`);
+  print(`paths:    tokens ${(0, import_node_path3.join)(dir, "tokens.json")}, state ${(0, import_node_path3.join)(dir, "state.json")}, payload ${payloadDir(dir)}`);
+}
+var invokedAsMain = typeof process.argv[1] === "string" && (() => {
+  try {
+    if (moduleUrl() === (0, import_node_url2.pathToFileURL)(process.argv[1]).href) return true;
+  } catch {
+  }
+  try {
+    return (0, import_node_url2.fileURLToPath)(moduleUrl()).toLowerCase() === process.argv[1].toLowerCase();
+  } catch {
+    return false;
+  }
+})();
+if (invokedAsMain) {
+  run().then(
+    (code) => {
+      process.exitCode = code;
+    },
+    (error) => {
+      process.stderr.write(`failed: ${error.message}
+`);
+      process.exitCode = 1;
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LAUNCHER_VERSION,
+  defaultRunEntry,
+  ensureFreshToken,
+  readPayloadEntry,
+  resolveEntry,
+  run,
+  runFile
+});