@mutmutco/installer-launcher 0.1.11 → 0.1.13

package/dist/launcher.js

@@ -1,10 +1,338 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync5, statSync, mkdtempSync, unlinkSync, rmdirSync } from "node:fs";
+import { randomUUID as randomUUID4 } from "node:crypto";
+
+// src/acquisition.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync, realpathSync as realpathSync2 } from "node:fs";
+import { join as join3, resolve, relative as relative2, isAbsolute as isAbsolute2, dirname } from "node:path";
+
+// src/runtime.ts
+import { createHash, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync, existsSync, renameSync, rmSync, realpathSync } from "node:fs";
+import { join, relative, isAbsolute } from "node:path";
+var NODE_VERSION = "24.20.0";
+var NPM_VERSION = "12.0.2";
+var ARTIFACTS = {
+  "win32-x64": ["node-v24.20.0-win-x64.zip", "6cac9ffbca8f6a47091e4b5c772e0606049c3871cb67d900c0cedde630e545ba"],
+  "win32-arm64": ["node-v24.20.0-win-arm64.zip", "31c6799744de8a54601643098040c68c3697e56c94e407d61d0e5fa5f34191d7"],
+  "darwin-arm64": ["node-v24.20.0-darwin-arm64.tar.gz", "40e5607e5ecb3db9192723776da2d75d966260fc74a7a9e731c1bd67dda96bc8"],
+  "linux-x64": ["node-v24.20.0-linux-x64.tar.gz", "855d581f8a4eb1a8117e3426de25fe02770592febcfb31369aee1ffbfee9e8ec"],
+  "linux-arm64": ["node-v24.20.0-linux-arm64.tar.gz", "3515603e2487879a39bc75716f1a2affd027500c64ba50e845cf72cb33219013"]
+};
+var NPM_INTEGRITY = "uIXokLlBj6FpNUTQX1PmT5pz7BlIN9QlixX+zdaSNHsd0qUXsbDLr50xzY6Sw7cJVr0uzHKDOle0swmPW/p5Qw==";
+async function verifiedDownload(url, path, algorithm, digest, fetchImpl) {
+  const response = await fetchImpl(url);
+  if (!response.ok) throw new Error(`runtime download failed (${response.status})`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (createHash(algorithm).update(bytes).digest(algorithm === "sha512" ? "base64" : "hex") !== digest) throw new Error("runtime archive checksum mismatch");
+  writeFileSync(path, bytes);
+}
+function command(executable, args) {
+  const result = spawnSync(executable, args, { encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) throw new Error(`runtime preparation failed: ${result.error?.message ?? result.stderr.trim()}`);
+  return result.stdout.trim();
+}
+async function acquireRuntime(dir, fetchImpl = fetch) {
+  const platform = `${process.platform}-${process.arch}`;
+  const artifact = ARTIFACTS[platform];
+  if (!artifact) throw new Error(`managed runtime does not support ${platform}`);
+  const runtimeDir = join(dir, "runtimes");
+  mkdirSync(runtimeDir, { recursive: true });
+  const receipt = join(runtimeDir, `node-${NODE_VERSION}-npm-${NPM_VERSION}-${platform}.json`);
+  if (existsSync(receipt)) {
+    const runtime2 = JSON.parse(readFileSync(receipt, "utf8"));
+    for (const executable of [runtime2.node, runtime2.npm]) {
+      const rel = relative(realpathSync(runtimeDir), realpathSync(executable));
+      if (rel.startsWith("..") || isAbsolute(rel)) throw new Error("cached runtime escapes owned directory");
+    }
+    if (command(runtime2.node, ["--version"]) === `v${NODE_VERSION}` && command(runtime2.node, [runtime2.npm, "--version"]) === NPM_VERSION) return runtime2;
+    throw new Error("cached runtime validation failed");
+  }
+  const root = mkdtempSync(join(runtimeDir, "runtime-"));
+  const archive = join(root, artifact[0]);
+  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl);
+  const tar = process.platform === "win32" ? join(process.env.SystemRoot ?? "C:/Windows", "System32", "tar.exe") : "/usr/bin/tar";
+  command(tar, ["-xf", archive, "-C", root]);
+  const unpacked = join(root, artifact[0].replace(/\.(zip|tar\.gz)$/, ""));
+  const node = join(unpacked, process.platform === "win32" ? "node.exe" : "bin/node");
+  const npmArchive = join(root, "npm.tgz");
+  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl);
+  const npmRoot = join(root, "npm");
+  mkdirSync(npmRoot);
+  command(tar, ["-xf", npmArchive, "-C", npmRoot]);
+  const installedNpm = join(unpacked, process.platform === "win32" ? "node_modules/npm" : "lib/node_modules/npm");
+  if (existsSync(installedNpm)) renameSync(installedNpm, join(root, "npm-bundled"));
+  renameSync(join(npmRoot, "package"), installedNpm);
+  const npm = join(installedNpm, "bin/npm-cli.js");
+  if (command(node, ["--version"]) !== `v${NODE_VERSION}` || command(node, [npm, "--version"]) !== NPM_VERSION) throw new Error("downloaded runtime validation failed");
+  const runtime = { node, npm };
+  const temporary = `${receipt}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, JSON.stringify(runtime), { flag: "wx", mode: 384, flush: true });
+    renameSync(temporary, receipt);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+  return runtime;
+}
+
+// src/store.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2, renameSync as renameSync2 } from "node:fs";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join as join2 } from "node:path";
+function defaultProductDir(product) {
+  if (process.platform === "win32") {
+    const base = process.env.LOCALAPPDATA ?? join2(tmpdir(), "launcher-fallback");
+    return join2(base, product);
+  }
+  const home = process.env.HOME ?? tmpdir();
+  return join2(home, `.${product}`);
+}
+function resolveProductDir(product, explicit) {
+  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
+}
+function tokensPath(dir) {
+  return join2(dir, "tokens.json");
+}
+function statePath(dir) {
+  return join2(dir, "state.json");
+}
+function payloadDir(dir) {
+  const acquired = readState(dir)?.acquired;
+  if (acquired) return join2(dir, "candidates", acquired.candidate, "payload");
+  return join2(dir, "payload");
+}
+function readTokens(dir) {
+  try {
+    const data = JSON.parse(readFileSync2(tokensPath(dir), "utf8"));
+    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
+    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
+    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
+    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
+    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
+    return tokens;
+  } catch {
+    return null;
+  }
+}
+function writeTokens(dir, tokens) {
+  mkdirSync2(dir, { recursive: true });
+  try {
+    writeFileSync2(tokensPath(dir), `${JSON.stringify(tokens)}
+`, { mode: 384 });
+  } catch {
+    writeFileSync2(tokensPath(dir), `${JSON.stringify(tokens)}
+`);
+  }
+}
+function clearTokens(dir) {
+  rmSync2(tokensPath(dir), { force: true });
+}
+function readState(dir) {
+  try {
+    const data = JSON.parse(readFileSync2(statePath(dir), "utf8"));
+    if (typeof data.version !== "string" || !data.version) return null;
+    const state = { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
+    if (data.acquired) {
+      if (!/^[a-zA-Z0-9_-]+$/.test(data.acquired.candidate) || typeof data.acquired.node !== "string" || typeof data.acquired.entry !== "string") return null;
+      state.acquired = data.acquired;
+    }
+    return state;
+  } catch {
+    return null;
+  }
+}
+function writeState(dir, state) {
+  mkdirSync2(dir, { recursive: true });
+  const temporary = `${statePath(dir)}.${randomUUID2()}.tmp`;
+  try {
+    writeFileSync2(temporary, `${JSON.stringify(state, null, 2)}
+`, { flag: "wx", mode: 384, flush: true });
+    renameSync2(temporary, statePath(dir));
+  } finally {
+    rmSync2(temporary, { force: true });
+  }
+}
+function wipeProductDir(dir) {
+  const payload = payloadDir(dir);
+  rmSync2(tokensPath(dir), { force: true });
+  rmSync2(statePath(dir), { force: true });
+  rmSync2(payload, { force: true, recursive: true });
+}
+
+// src/acquisition.ts
+function safePath(value) {
+  return typeof value === "string" && value.length > 0 && !/[\\:\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+function argumentsValid(value) {
+  return Array.isArray(value) && value.every((arg) => typeof arg === "string" && !arg.includes("\0") && (!arg.includes("$") || arg === "$prefix" || arg === "$version"));
+}
+function readAcquisition(payload) {
+  const metadata = JSON.parse(readFileSync3(join3(payload, "payload.json"), "utf8"));
+  if (metadata.acquisition === void 0) return null;
+  const a = metadata.acquisition;
+  if (!a || a.schema !== 1 || !/^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(a.package) || !safePath(a.archive) || !a.archive.endsWith(".tgz") || !safePath(a.convergeEntry) || !safePath(a.rollbackEntry) || !safePath(a.runEntry) || !argumentsValid(a.convergeArgs) || !argumentsValid(a.rollbackArgs) || !argumentsValid(a.repairArgs) || !Array.isArray(a.platforms) || !a.platforms.length || a.platforms.some((p) => !["win32-x64", "win32-arm64", "darwin-arm64", "linux-x64", "linux-arm64"].includes(p))) {
+    throw new Error("invalid signed acquisition declaration");
+  }
+  return a;
+}
+function runtimeEnvironment(node, inherited, platform = process.platform) {
+  const env = { ...inherited };
+  let current = env.PATH ?? "";
+  if (platform === "win32") {
+    const keys = Object.keys(env).filter((key) => key.toLowerCase() === "path").sort();
+    current = (keys.length ? env[keys[0]] : "") ?? "";
+    for (const key of keys) delete env[key];
+  }
+  env.PATH = `${dirname(node)}${platform === "win32" ? ";" : ":"}${current}`;
+  return env;
+}
+function lockInstallation(dir) {
+  mkdirSync3(dir, { recursive: true });
+  const path = join3(dir, "installation.lock");
+  const owner = `${process.pid}:${randomUUID3()}`;
+  try {
+    writeFileSync3(path, owner, { flag: "wx", mode: 384 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const recovery = `${path}.recovery`;
+    try {
+      writeFileSync3(recovery, owner, { flag: "wx", mode: 384, flush: true });
+    } catch {
+      throw new Error("installation lock recovery is already pending");
+    }
+    try {
+      const previous = readFileSync3(path, "utf8");
+      const pid = Number(previous.split(":")[0]);
+      if (!Number.isInteger(pid) || pid <= 0) throw new Error("installation lock is malformed; recovery required");
+      try {
+        process.kill(pid, 0);
+        throw new Error("another installer is running");
+      } catch (probe) {
+        if (probe.code !== "ESRCH") throw probe;
+      }
+      unlinkSync(path);
+      writeFileSync3(path, owner, { flag: "wx", mode: 384, flush: true });
+    } finally {
+      unlinkSync(recovery);
+    }
+  }
+  let released = false;
+  return () => {
+    if (!released && readFileSync3(path, "utf8") === owner) unlinkSync(path);
+    released = true;
+  };
+}
+function pendingPath(dir) {
+  return join3(dir, "acquisition-pending.json");
+}
+function candidateRoot(dir, candidate) {
+  if (!/^[a-zA-Z0-9_-]+$/.test(candidate)) throw new Error("invalid acquisition candidate");
+  return join3(dir, "candidates", candidate);
+}
+function packageRoot(prefix, acquisition) {
+  return join3(prefix, "node_modules", acquisition.package);
+}
+function entry(root, path) {
+  const actual = realpathSync2(join3(root, path));
+  const rel = relative2(realpathSync2(root), actual);
+  if (rel.startsWith("..") || isAbsolute2(rel)) throw new Error("acquired entry escapes package");
+  return actual;
+}
+function argv(node, root, file, args, prefix, version) {
+  return [node, entry(root, file), ...args.map((arg) => arg === "$prefix" ? prefix : arg === "$version" ? version : arg)];
+}
+function acquisitionRepairCommand(dir, version) {
+  const state = readState(dir);
+  if (!state?.acquired || state.version !== version) throw new Error("installed acquisition selection is missing");
+  const root = candidateRoot(dir, state.acquired.candidate);
+  const acquisition = readAcquisition(join3(root, "payload"));
+  if (!acquisition) throw new Error("installed acquisition declaration is missing");
+  const prefix = join3(root, "prefix");
+  const productRoot = packageRoot(prefix, acquisition);
+  const pkg = JSON.parse(readFileSync3(join3(productRoot, "package.json"), "utf8"));
+  if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("installed package identity does not match signed release");
+  return argv(realpathSync2(state.acquired.node), productRoot, acquisition.runEntry, acquisition.repairArgs, prefix, version);
+}
+async function recoverAcquisition(dir, run2, env) {
+  if (!existsSync3(pendingPath(dir))) return;
+  const pending = JSON.parse(readFileSync3(pendingPath(dir), "utf8"));
+  if (pending.schema !== 1 || typeof pending.version !== "string" || typeof pending.node !== "string") throw new Error("invalid pending acquisition receipt");
+  const root = candidateRoot(dir, pending.candidate);
+  if (readState(dir)?.acquired?.candidate === pending.candidate) {
+    unlinkSync(pendingPath(dir));
+    return;
+  }
+  const acquisition = readAcquisition(join3(root, "payload"));
+  if (!acquisition) throw new Error("pending acquisition lost its signed declaration");
+  const prefix = join3(root, "prefix");
+  const command2 = argv(pending.node, packageRoot(prefix, acquisition), acquisition.rollbackEntry, acquisition.rollbackArgs, prefix, pending.version);
+  if (!await run2(command2, root, runtimeEnvironment(pending.node, env))) throw new Error("installation recovery is pending; product rollback did not finish");
+  if (pending.previous) writeState(dir, pending.previous);
+  else if (existsSync3(statePath(dir))) unlinkSync(statePath(dir));
+  unlinkSync(pendingPath(dir));
+}
+async function installAcquisition(dir, candidate, version, acquisition, options) {
+  if (!acquisition.platforms.includes(`${process.platform}-${process.arch}`)) throw new Error("this product does not support this platform");
+  const root = candidateRoot(dir, candidate);
+  const payload = join3(root, "payload");
+  const prefix = join3(root, "prefix");
+  mkdirSync3(prefix);
+  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl);
+  const env = runtimeEnvironment(runtime.node, options.env);
+  const npmEnv = { ...env };
+  for (const key of Object.keys(npmEnv)) {
+    if (/^npm_config_/i.test(key) || /^(NPM_TOKEN|NODE_AUTH_TOKEN|MM_INSTALLER_TOKEN)$/i.test(key)) delete npmEnv[key];
+  }
+  const npmrc = join3(root, "public.npmrc");
+  const globalrc = join3(root, "global.npmrc");
+  writeFileSync3(npmrc, "registry=https://registry.npmjs.org/\n");
+  writeFileSync3(globalrc, "");
+  const install = [
+    runtime.node,
+    runtime.npm,
+    "install",
+    "--prefix",
+    prefix,
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+    "--userconfig",
+    npmrc,
+    "--globalconfig",
+    globalrc,
+    "--registry",
+    "https://registry.npmjs.org/",
+    resolve(payload, acquisition.archive)
+  ];
+  if (!await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
+  const productRoot = packageRoot(prefix, acquisition);
+  const pkg = JSON.parse(readFileSync3(join3(productRoot, "package.json"), "utf8"));
+  if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("acquired package identity does not match signed release");
+  const runEntry = entry(productRoot, acquisition.runEntry);
+  const convergence = argv(runtime.node, productRoot, acquisition.convergeEntry, acquisition.convergeArgs, prefix, version);
+  entry(productRoot, acquisition.rollbackEntry);
+  const pending = { schema: 1, candidate, version, node: runtime.node, previous: readState(dir) };
+  writeFileSync3(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
+  try {
+    if (!await options.run(convergence, root, env)) throw new Error("product convergence did not finish");
+    (options.commit ?? writeState)(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), acquired: { candidate, node: runtime.node, entry: runEntry } });
+  } catch (error) {
+    await recoverAcquisition(dir, options.run, env);
+    throw error;
+  }
+  unlinkSync(pendingPath(dir));
+}
+
+// src/index.ts
+import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync7, statSync, mkdtempSync as mkdtempSync2, unlinkSync as unlinkSync2, rmdirSync, mkdirSync as mkdirSync6, renameSync as renameSync4, rmSync as rmSync5 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname2, join as join4, resolve } from "node:path";
+import { dirname as dirname3, join as join6, resolve as resolve2 } from "node:path";
 import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 
 // ../face/src/face.ts
@@ -309,7 +637,7 @@ var ALLOWED = new Set(Object.values(GLYPH));
 import { appendFileSync as appendFileSync2 } from "node:fs";
 
 // ../face/src/outcome.ts
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 var counts = ["total", "updated", "failed"];
 var strings = ["version", "retry", "detail", "logPath"];
 var flags = ["dryRun", "installed", "deferred", "operationFailed"];
@@ -331,12 +659,12 @@ function validateInstallerOutcome(value) {
   return { ...facts };
 }
 function writeInstallerOutcome(path, value) {
-  writeFileSync(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
+  writeFileSync4(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
 }
 function readInstallerOutcome(path) {
   let text;
   try {
-    text = readFileSync(path, "utf8");
+    text = readFileSync4(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -412,7 +740,7 @@ function createInstallerRun(value, options = {}) {
     product: declaration.product,
     columns: options.columns,
     env,
-    color: tty && options.color !== false && env.NO_COLOR === void 0
+    color: tty && options.color !== false && env.NO_COLOR === void 0 && env.TERM !== "dumb"
   });
   const errors = [];
   const write = options.write ? (text, channel) => {
@@ -448,9 +776,13 @@ function createInstallerRun(value, options = {}) {
   const start = () => {
     if (started || finished) return;
     started = true;
+    if (options.quiet) return;
     const welcome = face.welcome();
     if (tty) lines(welcome);
-    else if (welcome.length) lines([`${face.identity.name} \u2014 Mutatis Mutandis`, options.operation === "install" ? face.identity.installWarm : face.identity.warm]);
+    else if (welcome.length) {
+      const warm = options.operation === "install" ? face.identity.installWarm : face.identity.warm;
+      lines([`${face.identity.name} - Mutatis Mutandis`, warm.replaceAll("\u2014", "-").replaceAll("\u2026", "...")]);
+    }
   };
   const durable = (title, measure, kind) => {
     spinner.stop();
@@ -480,12 +812,13 @@ function createInstallerRun(value, options = {}) {
       const surface = declaration.surfaces.find((surface2) => surface2.id === facts.id);
       if (!surface) throw new Error("installer run: undeclared surface");
       start();
-      const versions = facts.to ? facts.from && facts.from !== facts.to ? ` ${facts.from} \u2192 ${facts.to}` : ` ${facts.to}` : "";
+      const versions = facts.to ? facts.from && facts.from !== facts.to ? ` ${facts.from} ${tty ? "\u2192" : "->"} ${facts.to}` : ` ${facts.to}` : "";
       const status = { updated: options.dryRun ? "would update" : "updated", current: "already current", failed: "failed", skipped: "skipped", retry: "retrying", pending: "pending", kept: "kept" }[facts.state];
       if (!status) throw new Error("installer run: unknown surface state");
-      const activation = facts.state === "updated" && surface.activation ? ` \xB7 ${surface.activation}` : "";
+      const separator = tty ? "\xB7" : "-";
+      const activation = facts.state === "updated" && surface.activation ? ` ${separator} ${surface.activation}` : "";
       const completed = ["updated", "current", "kept", "skipped"].includes(facts.state);
-      durable(`${facts.id}${versions} \xB7 ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
+      durable(`${facts.id}${versions} ${separator} ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
       if (facts.detail) run2.relay(facts.detail);
     },
     milestone({ step, state, ms }) {
@@ -512,6 +845,20 @@ function createInstallerRun(value, options = {}) {
 `);
       }
     },
+    cancel() {
+      if (finished) return;
+      if (env.MM_INSTALLER_OUTCOME_FILE) writeInstallerOutcome(
+        env.MM_INSTALLER_OUTCOME_FILE,
+        { total: 0, updated: 0, failed: 0, deferred: true, detail: "Operation cancelled." }
+      );
+      start();
+      spinner.stop();
+      finished = true;
+      if (!face.nested || !env.MM_INSTALLER_OUTCOME_FILE) {
+        lines(tty ? face.receipt(["Operation cancelled."], { ready: false }) : ["Operation cancelled."]);
+      }
+      if (tty) lines([face.signOff()]);
+    },
     finish(facts) {
       if (finished) return;
       validateInstallerOutcome(facts);
@@ -519,6 +866,7 @@ function createInstallerRun(value, options = {}) {
       start();
       spinner.stop();
       finished = true;
+      if (options.quiet && facts.updated === 0 && facts.failed === 0 && !facts.operationFailed) return;
       const changed = !facts.version ? "No release target is available." : facts.dryRun ? `Would update ${facts.updated} of ${facts.total} surfaces to ${facts.version}.` : facts.installed ? `Installed ${facts.version} across ${facts.total} surfaces.` : `Updated ${facts.updated} of ${facts.total} surfaces to ${facts.version}.`;
       const ready = facts.failed === 0 && !facts.dryRun && !facts.deferred && !facts.operationFailed && Boolean(facts.version);
       const body = [
@@ -543,17 +891,17 @@ function createInstallerRun(value, options = {}) {
 }
 
 // src/autoupdate.ts
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join4 } from "node:path";
 function schedulePlatform(override) {
   const platform = override ?? process.platform;
   if (platform === "win32" || platform === "darwin" || platform === "linux") return platform;
   return null;
 }
-function defaultExec(command, args) {
-  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+function defaultExec(command2, args) {
+  const result = spawnSync2(command2, args, { encoding: "utf8", windowsHide: true });
   if (result.error) return { code: 1, stdout: "", stderr: result.error.message };
   return {
     code: typeof result.status === "number" ? result.status : 1,
@@ -563,8 +911,8 @@ function defaultExec(command, args) {
 }
 function homeOf(options) {
   if (options.homeDir) return options.homeDir;
-  if (process.platform === "win32") return process.env.USERPROFILE ?? tmpdir();
-  return process.env.HOME ?? tmpdir();
+  if (process.platform === "win32") return process.env.USERPROFILE ?? tmpdir2();
+  return process.env.HOME ?? tmpdir2();
 }
 function scheduleName(config) {
   return `${config.binName} autoupdate`;
@@ -575,13 +923,13 @@ function scheduleLabel(config) {
 function quoteWindows(arg) {
   return /[\s"&|<>^%]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
 }
-function enableSchedule(config, command, options = {}) {
+function enableSchedule(config, command2, options = {}) {
   const platform = schedulePlatform(options.platform);
   if (!platform) throw new Error(`autoupdate is not supported on ${options.platform ?? process.platform}.`);
   const exec = options.exec ?? defaultExec;
   const home = homeOf(options);
   if (platform === "win32") {
-    const taskLine = command.map(quoteWindows).join(" ");
+    const taskLine = command2.map(quoteWindows).join(" ");
     const result2 = exec("schtasks", ["/Create", "/TN", scheduleName(config), "/TR", taskLine, "/SC", "HOURLY", "/IT", "/F"]);
     if (result2.code !== 0) {
       throw new Error(`could not turn autoupdate on: ${firstLine(result2.stdout || result2.stderr) || `exit ${result2.code}`}`);
@@ -590,10 +938,10 @@ function enableSchedule(config, command, options = {}) {
   }
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
-    const dir2 = join(home, "Library", "LaunchAgents");
-    mkdirSync(dir2, { recursive: true });
-    const plist = join(dir2, `${label2}.plist`);
-    writeFileSync2(plist, darwinPlist(label2, command));
+    const dir2 = join4(home, "Library", "LaunchAgents");
+    mkdirSync4(dir2, { recursive: true });
+    const plist = join4(dir2, `${label2}.plist`);
+    writeFileSync5(plist, darwinPlist(label2, command2));
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
     const result2 = exec("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, plist]);
     if (result2.code !== 0) {
@@ -602,10 +950,10 @@ function enableSchedule(config, command, options = {}) {
     return;
   }
   const label = scheduleLabel(config);
-  const dir = join(home, ".config", "systemd", "user");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync2(join(dir, `${label}.service`), linuxService(command));
-  writeFileSync2(join(dir, `${label}.timer`), linuxTimer(label));
+  const dir = join4(home, ".config", "systemd", "user");
+  mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join4(dir, `${label}.service`), linuxService(command2));
+  writeFileSync5(join4(dir, `${label}.timer`), linuxTimer(label));
   const reload = exec("systemctl", ["--user", "daemon-reload"]);
   if (reload.code !== 0) {
     throw new Error(`could not turn autoupdate on: ${firstLine(reload.stderr || reload.stdout) || `exit ${reload.code}`}`);
@@ -630,14 +978,14 @@ function disableSchedule(config, options = {}) {
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
-    rmSync(join(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
+    rmSync3(join4(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
     return;
   }
   const label = scheduleLabel(config);
-  const dir = join(home, ".config", "systemd", "user");
+  const dir = join4(home, ".config", "systemd", "user");
   exec("systemctl", ["--user", "disable", "--now", `${label}.timer`]);
-  rmSync(join(dir, `${label}.service`), { force: true });
-  rmSync(join(dir, `${label}.timer`), { force: true });
+  rmSync3(join4(dir, `${label}.service`), { force: true });
+  rmSync3(join4(dir, `${label}.timer`), { force: true });
 }
 function querySchedule(config, options = {}) {
   const platform = schedulePlatform(options.platform);
@@ -655,20 +1003,20 @@ function querySchedule(config, options = {}) {
     return state2;
   }
   if (platform === "darwin") {
-    const plist = join(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
-    if (!existsSync(plist)) return { supported: true, enabled: false };
+    const plist = join4(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
+    if (!existsSync4(plist)) return { supported: true, enabled: false };
     return { supported: true, enabled: true, cadence: "hourly" };
   }
-  const timer = join(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
-  if (!existsSync(timer)) return { supported: true, enabled: false };
+  const timer = join4(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
+  if (!existsSync4(timer)) return { supported: true, enabled: false };
   const state = { supported: true, enabled: true, cadence: "hourly" };
   const shown = exec("systemctl", ["--user", "show", `${scheduleLabel(config)}.service`, "-p", "ExecMainStartTimestamp", "--value"]);
   const stamp = (shown.stdout ?? "").trim();
   if (shown.code === 0 && stamp && stamp !== "n/a") state.lastRun = stamp;
   return state;
 }
-function darwinPlist(label, command) {
-  const args = command.map((arg) => `        <string>${xmlEscape(arg)}</string>`).join("\n");
+function darwinPlist(label, command2) {
+  const args = command2.map((arg) => `        <string>${xmlEscape(arg)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -685,8 +1033,8 @@ ${args}
 </plist>
 `;
 }
-function linuxService(command) {
-  const line = command.map((arg) => /[\s"\\]/.test(arg) ? `"${arg.replace(/(["\\])/g, "\\$1")}"` : arg).join(" ");
+function linuxService(command2) {
+  const line = command2.map((arg) => /[\s"\\]/.test(arg) ? `"${arg.replace(/(["\\])/g, "\\$1")}"` : arg).join(" ");
   return `[Unit]
 Description=${"Hourly update check"}
 [Service]
@@ -718,7 +1066,7 @@ function firstLine(text) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { getAsset } from "node:sea";
 
 // src/module-url.ts
@@ -740,10 +1088,10 @@ function loadProductConfig(options = {}) {
   const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
   const devFallback = new URL("../config/product.template.json", moduleUrl());
   if (explicit) {
-    return parseProductConfig(readFileSync3(explicit, "utf8"));
+    return parseProductConfig(readFileSync6(explicit, "utf8"));
   }
   try {
-    return parseProductConfig(readFileSync3(devFallback, "utf8"));
+    return parseProductConfig(readFileSync6(devFallback, "utf8"));
   } catch {
   }
   try {
@@ -799,7 +1147,7 @@ function field(record, key) {
 
 // src/login-github.ts
 import { spawn } from "node:child_process";
-var realSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function openBrowser(url) {
   if (process.env.LAUNCHER_NO_OPEN === "1") return;
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
@@ -919,7 +1267,7 @@ async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
 }
 
 // src/login-google.ts
-import { createHash, randomBytes } from "node:crypto";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 var b64url = (bytes) => bytes.toString("base64url");
 async function loginGoogle(options) {
@@ -927,7 +1275,7 @@ async function loginGoogle(options) {
   const server = options.host.replace(/\/+$/, "");
   const timeoutMs = options.timeoutMs ?? 5 * 6e4;
   const listener = createServer();
-  await new Promise((resolve2) => listener.listen(0, "127.0.0.1", resolve2));
+  await new Promise((resolve3) => listener.listen(0, "127.0.0.1", resolve3));
   const port = listener.address().port;
   const redirectUri = `http://127.0.0.1:${port}/callback`;
   try {
@@ -942,7 +1290,7 @@ async function loginGoogle(options) {
       throw new Error("the sign-in server returned a malformed registration");
     }
     const verifier = b64url(randomBytes(32));
-    const challenge = b64url(createHash("sha256").update(verifier).digest());
+    const challenge = b64url(createHash2("sha256").update(verifier).digest());
     const state = b64url(randomBytes(16));
     const authorize = new URL(`${server}/oauth/authorize`);
     authorize.search = new URLSearchParams({
@@ -954,7 +1302,7 @@ async function loginGoogle(options) {
       code_challenge: challenge,
       code_challenge_method: "S256"
     }).toString();
-    const code = await new Promise((resolve2, reject) => {
+    const code = await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => reject(new Error("sign-in timed out \u2014 run login again.")), timeoutMs);
       listener.on("request", (req, res) => {
         const url = new URL(req.url ?? "/", redirectUri);
@@ -972,7 +1320,7 @@ async function loginGoogle(options) {
         }
         res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(page("Signed in.", "You can close this tab and go back to the terminal."));
         clearTimeout(timer);
-        resolve2(received);
+        resolve3(received);
       });
       const print = options.print ?? ((line) => process.stderr.write(`${line}
 `));
@@ -1032,10 +1380,10 @@ function page(title, body) {
 }
 
 // src/payload.ts
-import { createHash as createHash2, createPublicKey, verify } from "node:crypto";
-import { mkdirSync as mkdirSync2, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname, join as join2 } from "node:path";
+import { createHash as createHash3, createPublicKey, verify } from "node:crypto";
+import { mkdirSync as mkdirSync5, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname2, join as join5 } from "node:path";
 
 // src/canonical.ts
 function canonicalJson(value) {
@@ -1052,7 +1400,7 @@ function encode(value) {
     return JSON.stringify(value);
   }
   if (Array.isArray(value)) {
-    return `[${value.map((entry) => encode(entry)).join(",")}]`;
+    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
   }
   if (typeof value === "object") {
     const record = value;
@@ -1101,9 +1449,9 @@ function verifyManifest(manifest, signature, config) {
     return false;
   }
 }
-function verifyFileBytes(entry, bytes) {
-  if (entry.size !== bytes.length) return false;
-  return createHash2("sha256").update(bytes).digest("hex") === entry.sha256.toLowerCase();
+function verifyFileBytes(entry2, bytes) {
+  if (entry2.size !== bytes.length) return false;
+  return createHash3("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
 }
 async function readErrorCode(response) {
   try {
@@ -1134,8 +1482,8 @@ function parseManifest(json) {
   if (typeof record.signature !== "string" || !record.signature) {
     throw new Error("the release manifest is unsigned");
   }
-  const files = record.files.map((entry) => {
-    const file = entry;
+  const files = record.files.map((entry2) => {
+    const file = entry2;
     if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
       throw new Error("the release manifest lists a malformed file");
     }
@@ -1175,101 +1523,31 @@ async function fetchFileBytes(config, accessToken, path, fetchImpl) {
 }
 async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
-  const staging = join2(tmpdir2(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
-  mkdirSync2(staging, { recursive: true });
+  const staging = join5(tmpdir3(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
+  mkdirSync5(staging, { recursive: true });
   try {
-    for (const entry of manifest.files) {
-      const bytes = await fetchFileBytes(config, accessToken, entry.path, fetchImpl);
-      if (!verifyFileBytes(entry, bytes)) {
-        throw new Error(`file ${entry.path} failed its checksum \u2014 refusing to install anything.`);
+    for (const entry2 of manifest.files) {
+      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl);
+      if (!verifyFileBytes(entry2, bytes)) {
+        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
       }
-      const dest = join2(staging, entry.path);
-      mkdirSync2(dirname(dest), { recursive: true });
-      writeFileSync3(dest, bytes);
+      const dest = join5(staging, entry2.path);
+      mkdirSync5(dirname2(dest), { recursive: true });
+      writeFileSync6(dest, bytes);
     }
-    const target = join2(dir, "payload");
-    mkdirSync2(dir, { recursive: true });
-    rmSync2(target, { force: true, recursive: true });
-    renameSync(staging, target);
+    const target = join5(dir, "payload");
+    mkdirSync5(dir, { recursive: true });
+    rmSync4(target, { force: true, recursive: true });
+    renameSync3(staging, target);
   } catch (error) {
-    rmSync2(staging, { force: true, recursive: true });
+    rmSync4(staging, { force: true, recursive: true });
     throw error;
   }
   return manifest.version;
 }
 
-// src/store.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join3 } from "node:path";
-function defaultProductDir(product) {
-  if (process.platform === "win32") {
-    const base = process.env.LOCALAPPDATA ?? join3(tmpdir3(), "launcher-fallback");
-    return join3(base, product);
-  }
-  const home = process.env.HOME ?? tmpdir3();
-  return join3(home, `.${product}`);
-}
-function resolveProductDir(product, explicit) {
-  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
-}
-function tokensPath(dir) {
-  return join3(dir, "tokens.json");
-}
-function statePath(dir) {
-  return join3(dir, "state.json");
-}
-function payloadDir(dir) {
-  return join3(dir, "payload");
-}
-function readTokens(dir) {
-  try {
-    const data = JSON.parse(readFileSync4(tokensPath(dir), "utf8"));
-    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
-    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
-    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
-    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
-    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
-    return tokens;
-  } catch {
-    return null;
-  }
-}
-function writeTokens(dir, tokens) {
-  mkdirSync3(dir, { recursive: true });
-  try {
-    writeFileSync4(tokensPath(dir), `${JSON.stringify(tokens)}
-`, { mode: 384 });
-  } catch {
-    writeFileSync4(tokensPath(dir), `${JSON.stringify(tokens)}
-`);
-  }
-}
-function clearTokens(dir) {
-  rmSync3(tokensPath(dir), { force: true });
-}
-function readState(dir) {
-  try {
-    const data = JSON.parse(readFileSync4(statePath(dir), "utf8"));
-    if (typeof data.version !== "string" || !data.version) return null;
-    return { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
-  } catch {
-    return null;
-  }
-}
-function writeState(dir, state) {
-  mkdirSync3(dir, { recursive: true });
-  writeFileSync4(statePath(dir), `${JSON.stringify(state, null, 2)}
-`);
-}
-function wipeProductDir(dir) {
-  rmSync3(tokensPath(dir), { force: true });
-  rmSync3(statePath(dir), { force: true });
-  rmSync3(payloadDir(dir), { force: true, recursive: true });
-}
-
 // src/index.ts
-var LAUNCHER_VERSION = true ? "0.1.11" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "0.1.13" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -1281,30 +1559,37 @@ function defaultPrintErr(message) {
 async function run(rawOptions = {}) {
   const print = rawOptions.print ?? defaultPrint;
   const printErr = rawOptions.printErr ?? defaultPrintErr;
-  const argv = rawOptions.argv ?? process.argv.slice(2);
-  const runAt = argv.indexOf("--run");
-  if (runAt >= 0) return runFile(argv[runAt + 1], argv.slice(runAt + 2), printErr);
+  const argv2 = rawOptions.argv ?? process.argv.slice(2);
+  const runAt = argv2.indexOf("--run");
+  if (runAt >= 0) return runFile(argv2[runAt + 1], argv2.slice(runAt + 2), printErr);
   let config;
   try {
-    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv, "--config") });
+    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv2, "--config") });
   } catch (error) {
     print(`cannot start: ${error.message}`);
     return 2;
   }
-  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv, "--dir"));
-  const positional = argv.filter((arg) => !arg.startsWith("-"));
-  if (argv.includes("--version") || argv.includes("-v")) {
+  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv2, "--dir"));
+  const positional = argv2.filter((arg) => !arg.startsWith("-"));
+  if (argv2.includes("--version") || argv2.includes("-v")) {
     print(`${config.binName} launcher ${LAUNCHER_VERSION}`);
     return 0;
   }
-  if (argv.includes("--help") || argv.includes("-h") || positional.length === 0) {
+  if (argv2.includes("--help") || argv2.includes("-h") || positional.length === 0) {
     printUsage(config, print);
     return positional.length === 0 ? 2 : 0;
   }
-  const command = positional[0];
+  const command2 = positional[0];
+  let unlock;
   try {
-    switch (command) {
+    unlock = lockInstallation(dir);
+    await recoverAcquisition(dir, async (command3, cwd, env) => {
+      const result = (rawOptions.runEntry ?? defaultRunEntry)(command3, cwd, env);
+      return result.ok && (result.code === void 0 || result.code === 0);
+    }, payloadEnv(dir) ?? process.env);
+    switch (command2) {
       case "login":
+        unlock();
         await doLogin(config, dir, rawOptions, print);
         return 0;
       case "logout":
@@ -1316,11 +1601,11 @@ async function run(rawOptions = {}) {
       case "update":
         return await doUpdate(config, dir, rawOptions, print);
       case "doctor":
-        return doDoctor(config, dir, rawOptions, print);
+        return doDoctor(config, dir, rawOptions, print, unlock);
       case "autoupdate":
         return doAutoupdate(config, rawOptions, positional.slice(1), print);
       default:
-        return doForward(config, dir, rawOptions, command, argv, print);
+        return doForward(config, dir, rawOptions, command2, argv2, print, unlock);
     }
   } catch (error) {
     if (error instanceof NeedsLoginError) {
@@ -1329,12 +1614,14 @@ async function run(rawOptions = {}) {
     }
     print(`failed: ${error.message}`);
     return 1;
+  } finally {
+    unlock?.();
   }
 }
-function flagValue(argv, flag) {
-  const index = argv.indexOf(flag);
+function flagValue(argv2, flag) {
+  const index = argv2.indexOf(flag);
   if (index < 0) return void 0;
-  const value = argv[index + 1];
+  const value = argv2[index + 1];
   return value && !value.startsWith("-") ? value : void 0;
 }
 function printUsage(config, print) {
@@ -1348,8 +1635,8 @@ async function runFile(file, args, printErr) {
     printErr("launcher --run needs a file to run.");
     return 1;
   }
-  const abs = resolve(process.cwd(), file);
-  if (!existsSync4(abs)) {
+  const abs = resolve2(process.cwd(), file);
+  if (!existsSync6(abs)) {
     printErr(`cannot run ${file}: no such file.`);
     return 1;
   }
@@ -1442,14 +1729,14 @@ async function fetchAccessTokenOrLogin(config, dir, options, print, installer) {
 }
 function readPayloadArgv(dir, key) {
   try {
-    const parsed = JSON.parse(readFileSync5(join4(payloadDir(dir), "payload.json"), "utf8"));
-    const entry = parsed[key];
-    if (typeof entry === "string") {
-      const parts = entry.trim().split(/\s+/).filter(Boolean);
+    const parsed = JSON.parse(readFileSync7(join6(payloadDir(dir), "payload.json"), "utf8"));
+    const entry2 = parsed[key];
+    if (typeof entry2 === "string") {
+      const parts = entry2.trim().split(/\s+/).filter(Boolean);
       return parts.length > 0 ? parts : null;
     }
-    if (Array.isArray(entry) && entry.every((part) => typeof part === "string" && part.length > 0)) {
-      return entry;
+    if (Array.isArray(entry2) && entry2.every((part) => typeof part === "string" && part.length > 0)) {
+      return entry2;
     }
     return null;
   } catch {
@@ -1464,7 +1751,7 @@ function readPayloadRun(dir) {
 }
 function readPayloadVerbs(dir) {
   try {
-    const parsed = JSON.parse(readFileSync5(join4(payloadDir(dir), "payload.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync7(join6(payloadDir(dir), "payload.json"), "utf8"));
     const verbs = parsed.verbs;
     if (verbs === "*") return "*";
     if (Array.isArray(verbs) && verbs.every((v) => typeof v === "string" && v.trim().length > 0)) {
@@ -1475,13 +1762,13 @@ function readPayloadVerbs(dir) {
     return null;
   }
 }
-function resolveEntry(entry) {
-  return entry[0] === "$self" ? [process.execPath, ...entry.slice(1)] : entry;
+function resolveEntry(entry2) {
+  return entry2[0] === "$self" ? [process.execPath, ...entry2.slice(1)] : entry2;
 }
-function needsShell(command) {
+function needsShell(command2) {
   if (process.platform !== "win32") return false;
-  if (/\.(cmd|bat)$/i.test(command)) return true;
-  return !existsSync4(command);
+  if (/\.(cmd|bat)$/i.test(command2)) return true;
+  return !existsSync6(command2);
 }
 function quoteForShell(arg) {
   return /[\s"&|<>^%]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
@@ -1508,11 +1795,11 @@ function parseProgress(raw) {
   }
   return progress;
 }
-function defaultRunEntry(entry, cwd, env) {
-  const [command, ...args] = entry;
-  const shell = needsShell(command);
-  const commandLine = shell ? [command, ...args].map(quoteForShell).join(" ") : command;
-  const spawnEntry = (progress2) => spawnSync2(commandLine, shell ? [] : args, {
+function defaultRunEntry(entry2, cwd, env) {
+  const [command2, ...args] = entry2;
+  const shell = needsShell(command2);
+  const commandLine = shell ? [command2, ...args].map(quoteForShell).join(" ") : command2;
+  const spawnEntry = (progress2) => spawnSync3(commandLine, shell ? [] : args, {
     cwd,
     stdio: progress2 ? ["inherit", "inherit", "inherit", "pipe"] : "inherit",
     shell,
@@ -1570,11 +1857,41 @@ async function installOrUpdate(config, dir, options, print, update) {
     version = manifest.version;
     installer.phase("resolve", { seconds: (Date.now() - started) / 1e3 });
     const current = readState(dir);
-    const unchanged = update && current?.version === version && existsSync4(payloadDir(dir));
+    const unchanged = update && current?.version === version && existsSync6(payloadDir(dir));
+    if (unchanged && current.acquired) {
+      installer.surface({ id: config.product, from: version, to: version, state: "current" });
+      return await finishLastMile(config, dir, options, installer, version, true, acquisitionRepairCommand(dir, version));
+    }
     if (!unchanged) {
       installer.phase("download", { state: "running" });
       started = Date.now();
-      await downloadAndUnpack(config, dir, manifest, accessToken, { fetchImpl });
+      const candidate = randomUUID4();
+      const candidateDir = join6(dir, "candidates", candidate);
+      await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl });
+      const acquisition = existsSync6(join6(candidateDir, "payload", "payload.json")) ? readAcquisition(join6(candidateDir, "payload")) : null;
+      if (acquisition) {
+        installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
+        installer.phase("activate", { state: "running" });
+        let outcome;
+        const env = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
+        await installAcquisition(dir, candidate, version, acquisition, {
+          fetchImpl,
+          env,
+          run: async (command2, cwd, childEnv) => {
+            const result = options.runEntry ? options.runEntry(command2, cwd, childEnv) : await runInstallEntry(command2, cwd, childEnv, installer, readTokens(dir));
+            if (result.outcome) outcome = validateInstallerOutcome(result.outcome);
+            return result.ok && (result.code === void 0 || result.code === 0) && !result.outcome?.operationFailed && !result.outcome?.failed;
+          }
+        });
+        installer.phase("activate");
+        installer.surface({ id: config.product, from: current?.version, to: version, state: "updated" });
+        installer.finish(outcome ?? { version, total: 1, updated: 1, failed: 0, installed: true });
+        return 0;
+      }
+      const target = join6(dir, "payload");
+      mkdirSync6(dir, { recursive: true });
+      rmSync5(target, { recursive: true, force: true });
+      renameSync4(join6(candidateDir, "payload"), target);
       writeState(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
       installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
     }
@@ -1612,12 +1929,12 @@ function payloadEnv(dir) {
   return { ...process.env, MM_INSTALLER_TOKEN: stored.accessToken };
 }
 var NEVER_A_PROGRAM = /\.(tgz|tar|gz|bz2|xz|zip|json|txt|md|lock)$/i;
-function payloadFileAsCommand(entry, payload) {
-  const first = entry[0];
+function payloadFileAsCommand(entry2, payload) {
+  const first = entry2[0];
   if (!first || first === "$self") return null;
   if (first.includes("/") || first.includes("\\")) return null;
-  const candidate = join4(payload, first);
-  if (!existsSync4(candidate)) return null;
+  const candidate = join6(payload, first);
+  if (!existsSync6(candidate)) return null;
   if (NEVER_A_PROGRAM.test(first)) return first;
   if (process.platform === "win32") return null;
   try {
@@ -1626,22 +1943,22 @@ function payloadFileAsCommand(entry, payload) {
     return null;
   }
 }
-async function finishLastMile(config, dir, options, installer, version, unchanged) {
-  const entry = readPayloadEntry(dir);
+async function finishLastMile(config, dir, options, installer, version, unchanged, repairCommand) {
+  const entry2 = repairCommand ?? readPayloadEntry(dir);
   const payload = payloadDir(dir);
-  if (!entry) {
+  if (!entry2) {
     installer.finish({
       version,
       total: 1,
       updated: unchanged ? 0 : 1,
       failed: 0,
       installed: true,
-      detail: `next step: run ${join4(payload, config.binName)} to start ${config.product}.`
+      detail: `next step: run ${join6(payload, config.binName)} to start ${config.product}.`
     });
     return 0;
   }
-  const command = resolveEntry(entry);
-  const dataFile = payloadFileAsCommand(entry, payload);
+  const command2 = resolveEntry(entry2);
+  const dataFile = payloadFileAsCommand(entry2, payload);
   if (dataFile) {
     installer.finish({
       version,
@@ -1654,8 +1971,9 @@ async function finishLastMile(config, dir, options, installer, version, unchange
   }
   installer.phase("activate", { state: "running" });
   const started = Date.now();
-  const env = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
-  const result = options.runEntry ? options.runEntry(command, payload, env) : await runInstallEntry(command, payload, env, installer, readTokens(dir));
+  const inherited = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
+  const env = repairCommand ? runtimeEnvironment(repairCommand[0], inherited) : inherited;
+  const result = options.runEntry ? options.runEntry(command2, payload, env) : await runInstallEntry(command2, payload, env, installer, readTokens(dir));
   for (const progress of result.progress ?? []) installer.milestone(progress);
   const succeeded = result.ok && (result.code === void 0 || result.code === 0);
   const outcome = result.outcome ? validateInstallerOutcome(result.outcome) : void 0;
@@ -1670,18 +1988,18 @@ async function finishLastMile(config, dir, options, installer, version, unchange
     },
     ...!succeeded ? {
       operationFailed: true,
-      detail: result.code === void 0 ? `Arming this machine could not start: ${result.error ?? command[0]}` : `Arming this machine did not finish (exit code ${result.code})${result.error?.startsWith("installer outcome:") ? `: ${result.error}` : ""}`,
-      retry: `(cd ${payload} && ${command.join(" ")})`
+      detail: result.code === void 0 ? `Arming this machine could not start: ${result.error ?? command2[0]}` : `Arming this machine did not finish (exit code ${result.code})${result.error?.startsWith("installer outcome:") ? `: ${result.error}` : ""}`,
+      retry: `(cd ${payload} && ${command2.join(" ")})`
     } : {}
   });
   return succeeded ? outcome?.operationFailed || outcome?.failed ? 1 : 0 : result.code || 1;
 }
-async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
-  const [command, ...args] = entry;
-  const shell = needsShell(command);
+async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
+  const [command2, ...args] = entry2;
+  const shell = needsShell(command2);
   const progress = !(process.platform === "win32" && shell);
-  const outcomeDir = mkdtempSync(join4(tmpdir4(), "mm-installer-outcome-"));
-  const outcomeFile = join4(outcomeDir, "outcome.json");
+  const outcomeDir = mkdtempSync2(join6(tmpdir4(), "mm-installer-outcome-"));
+  const outcomeFile = join6(outcomeDir, "outcome.json");
   const childEnv = { ...env, MM_INSTALLER_OUTCOME_FILE: outcomeFile };
   delete childEnv.MM_FACE_TRANSCRIPT;
   delete childEnv.MM_PROGRESS_FD;
@@ -1690,8 +2008,8 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
   const secrets = [tokens?.accessToken, tokens?.refreshToken].filter((value) => Boolean(value));
   const redact = (text) => secrets.reduce((safe, value) => safe.replaceAll(value, "[redacted]"), text);
   try {
-    const result = await new Promise((resolve2) => {
-      const child = spawn2(shell ? [command, ...args].map(quoteForShell).join(" ") : command, shell ? [] : args, {
+    const result = await new Promise((resolve3) => {
+      const child = spawn2(shell ? [command2, ...args].map(quoteForShell).join(" ") : command2, shell ? [] : args, {
         cwd,
         shell,
         windowsHide: true,
@@ -1727,8 +2045,8 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
           if (pending.length > 65536) pending = "";
         });
       }
-      child.on("error", (error) => resolve2({ ok: false, error: error.message }));
-      child.on("close", (code) => resolve2({
+      child.on("error", (error) => resolve3({ ok: false, error: error.message }));
+      child.on("close", (code) => resolve3({
         ok: code === 0,
         ...code !== null ? { code } : {},
         ...code !== 0 ? { error: `exit code ${code}` } : {}
@@ -1741,25 +2059,30 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
       return { ...result, ok: false, code: result.code || 1, error: "installer outcome: invalid child result" };
     }
   } finally {
-    if (existsSync4(outcomeFile)) unlinkSync(outcomeFile);
+    if (existsSync6(outcomeFile)) unlinkSync2(outcomeFile);
     rmdirSync(outcomeDir);
   }
 }
-function doForward(config, dir, options, command, argv, print) {
-  if (command && existsSync4(command)) {
-    print(`${command} is a file, not a command \u2014 did you mean \`--run ${command}\`?`);
+function doForward(config, dir, options, command2, argv2, print, unlock) {
+  if (command2 && existsSync6(command2)) {
+    print(`${command2} is a file, not a command \u2014 did you mean \`--run ${command2}\`?`);
     return 2;
   }
-  const target = readPayloadRun(dir);
+  const acquired = readState(dir)?.acquired;
+  const target = acquired ? [acquired.node, acquired.entry] : readPayloadRun(dir);
   const verbs = readPayloadVerbs(dir);
-  const declared = verbs === "*" || Array.isArray(verbs) && command !== void 0 && verbs.includes(command);
+  const declared = verbs === "*" || Array.isArray(verbs) && command2 !== void 0 && verbs.includes(command2);
   if (!target || !declared) {
-    print(`unknown command: ${command}`);
+    print(`unknown command: ${command2}`);
     printUsage(config, print);
     return 2;
   }
-  const forwarded = [...resolveEntry(target), ...argv];
-  const result = (options.runEntry ?? defaultRunEntry)(forwarded, payloadDir(dir), payloadEnv(dir));
+  const forwarded = [...resolveEntry(target), ...argv2];
+  const cwd = payloadDir(dir);
+  const inherited = payloadEnv(dir);
+  const env = acquired ? runtimeEnvironment(acquired.node, inherited ?? process.env) : inherited;
+  unlock();
+  const result = (options.runEntry ?? defaultRunEntry)(forwarded, cwd, env);
   if (!result.ok && result.code === void 0) {
     print(`failed: ${result.error ?? `could not run ${forwarded[0]}`}`);
     return 1;
@@ -1769,10 +2092,10 @@ function doForward(config, dir, options, command, argv, print) {
 function doAutoupdate(config, options, args, print) {
   const mode = args[0] ?? "status";
   const scheduleOptions = options.autoupdate ?? {};
-  const command = options.autoupdate?.command ?? [process.execPath, "update"];
+  const command2 = options.autoupdate?.command ?? [process.execPath, "update"];
   if (mode === "on") {
     try {
-      enableSchedule(config, command, scheduleOptions);
+      enableSchedule(config, command2, scheduleOptions);
     } catch (error) {
       print(error.message);
       return 1;
@@ -1804,19 +2127,24 @@ function doAutoupdate(config, options, args, print) {
   if (state.lastRun) print(`last run:    ${state.lastRun}`);
   return 0;
 }
-function doDoctor(config, dir, options, print) {
+function doDoctor(config, dir, options, print, unlock) {
   doLauncherDoctor(config, dir, options, print);
-  const target = readPayloadRun(dir);
+  const acquired = readState(dir)?.acquired;
+  const target = acquired ? [acquired.node, acquired.entry] : readPayloadRun(dir);
   const verbs = readPayloadVerbs(dir);
   const chains = target !== null && (verbs === "*" || Array.isArray(verbs) && verbs.includes("doctor"));
   if (!chains) return 0;
-  const result = (options.runEntry ?? defaultRunEntry)([...resolveEntry(target), "doctor"], payloadDir(dir), payloadEnv(dir));
+  const cwd = payloadDir(dir);
+  const inherited = payloadEnv(dir);
+  const env = acquired ? runtimeEnvironment(acquired.node, inherited ?? process.env) : inherited;
+  unlock();
+  const result = (options.runEntry ?? defaultRunEntry)([...resolveEntry(target), "doctor"], cwd, env);
   return result.code ?? (result.ok ? 0 : 1);
 }
 function doLauncherDoctor(config, dir, options, print) {
   const tokens = readTokens(dir);
   const state = readState(dir);
-  const payloadPresent = existsSync4(payloadDir(dir));
+  const payloadPresent = existsSync6(payloadDir(dir));
   print(`product:  ${config.product}`);
   print(`host:     ${config.host}`);
   print(`login:    ${config.loginKind}`);
@@ -1828,7 +2156,7 @@ function doLauncherDoctor(config, dir, options, print) {
     print("token:    none \u2014 run login first.");
   }
   print(`payload:  ${state ? state.version : "none"}${payloadPresent ? "" : " (not downloaded)"}`);
-  print(`paths:    tokens ${join4(dir, "tokens.json")}, state ${join4(dir, "state.json")}, payload ${payloadDir(dir)}`);
+  print(`paths:    tokens ${join6(dir, "tokens.json")}, state ${join6(dir, "state.json")}, payload ${payloadDir(dir)}`);
   const schedule = querySchedule(config, options.autoupdate ?? {});
   print(
     `auto-update: ${!schedule.supported ? "unsupported on this platform" : schedule.enabled ? `on (${schedule.cadence ?? "hourly"})` : "off"}`