@mutmutco/installer-launcher 0.1.11 → 0.1.13

package/dist/launcher.sea.cjs

@@ -32,14 +32,342 @@ __export(index_exports, {
   runInstallEntry: () => runInstallEntry
 });
 module.exports = __toCommonJS(index_exports);
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs9 = require("node:fs");
+var import_node_crypto6 = require("node:crypto");
+
+// src/acquisition.ts
+var import_node_crypto3 = require("node:crypto");
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+
+// src/runtime.ts
+var import_node_crypto = require("node:crypto");
+var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+var NODE_VERSION = "24.20.0";
+var NPM_VERSION = "12.0.2";
+var ARTIFACTS = {
+  "win32-x64": ["node-v24.20.0-win-x64.zip", "6cac9ffbca8f6a47091e4b5c772e0606049c3871cb67d900c0cedde630e545ba"],
+  "win32-arm64": ["node-v24.20.0-win-arm64.zip", "31c6799744de8a54601643098040c68c3697e56c94e407d61d0e5fa5f34191d7"],
+  "darwin-arm64": ["node-v24.20.0-darwin-arm64.tar.gz", "40e5607e5ecb3db9192723776da2d75d966260fc74a7a9e731c1bd67dda96bc8"],
+  "linux-x64": ["node-v24.20.0-linux-x64.tar.gz", "855d581f8a4eb1a8117e3426de25fe02770592febcfb31369aee1ffbfee9e8ec"],
+  "linux-arm64": ["node-v24.20.0-linux-arm64.tar.gz", "3515603e2487879a39bc75716f1a2affd027500c64ba50e845cf72cb33219013"]
+};
+var NPM_INTEGRITY = "uIXokLlBj6FpNUTQX1PmT5pz7BlIN9QlixX+zdaSNHsd0qUXsbDLr50xzY6Sw7cJVr0uzHKDOle0swmPW/p5Qw==";
+async function verifiedDownload(url, path, algorithm, digest, fetchImpl) {
+  const response = await fetchImpl(url);
+  if (!response.ok) throw new Error(`runtime download failed (${response.status})`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if ((0, import_node_crypto.createHash)(algorithm).update(bytes).digest(algorithm === "sha512" ? "base64" : "hex") !== digest) throw new Error("runtime archive checksum mismatch");
+  (0, import_node_fs.writeFileSync)(path, bytes);
+}
+function command(executable, args) {
+  const result = (0, import_node_child_process.spawnSync)(executable, args, { encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) throw new Error(`runtime preparation failed: ${result.error?.message ?? result.stderr.trim()}`);
+  return result.stdout.trim();
+}
+async function acquireRuntime(dir, fetchImpl = fetch) {
+  const platform = `${process.platform}-${process.arch}`;
+  const artifact = ARTIFACTS[platform];
+  if (!artifact) throw new Error(`managed runtime does not support ${platform}`);
+  const runtimeDir = (0, import_node_path.join)(dir, "runtimes");
+  (0, import_node_fs.mkdirSync)(runtimeDir, { recursive: true });
+  const receipt = (0, import_node_path.join)(runtimeDir, `node-${NODE_VERSION}-npm-${NPM_VERSION}-${platform}.json`);
+  if ((0, import_node_fs.existsSync)(receipt)) {
+    const runtime2 = JSON.parse((0, import_node_fs.readFileSync)(receipt, "utf8"));
+    for (const executable of [runtime2.node, runtime2.npm]) {
+      const rel = (0, import_node_path.relative)((0, import_node_fs.realpathSync)(runtimeDir), (0, import_node_fs.realpathSync)(executable));
+      if (rel.startsWith("..") || (0, import_node_path.isAbsolute)(rel)) throw new Error("cached runtime escapes owned directory");
+    }
+    if (command(runtime2.node, ["--version"]) === `v${NODE_VERSION}` && command(runtime2.node, [runtime2.npm, "--version"]) === NPM_VERSION) return runtime2;
+    throw new Error("cached runtime validation failed");
+  }
+  const root = (0, import_node_fs.mkdtempSync)((0, import_node_path.join)(runtimeDir, "runtime-"));
+  const archive = (0, import_node_path.join)(root, artifact[0]);
+  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl);
+  const tar = process.platform === "win32" ? (0, import_node_path.join)(process.env.SystemRoot ?? "C:/Windows", "System32", "tar.exe") : "/usr/bin/tar";
+  command(tar, ["-xf", archive, "-C", root]);
+  const unpacked = (0, import_node_path.join)(root, artifact[0].replace(/\.(zip|tar\.gz)$/, ""));
+  const node = (0, import_node_path.join)(unpacked, process.platform === "win32" ? "node.exe" : "bin/node");
+  const npmArchive = (0, import_node_path.join)(root, "npm.tgz");
+  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl);
+  const npmRoot = (0, import_node_path.join)(root, "npm");
+  (0, import_node_fs.mkdirSync)(npmRoot);
+  command(tar, ["-xf", npmArchive, "-C", npmRoot]);
+  const installedNpm = (0, import_node_path.join)(unpacked, process.platform === "win32" ? "node_modules/npm" : "lib/node_modules/npm");
+  if ((0, import_node_fs.existsSync)(installedNpm)) (0, import_node_fs.renameSync)(installedNpm, (0, import_node_path.join)(root, "npm-bundled"));
+  (0, import_node_fs.renameSync)((0, import_node_path.join)(npmRoot, "package"), installedNpm);
+  const npm = (0, import_node_path.join)(installedNpm, "bin/npm-cli.js");
+  if (command(node, ["--version"]) !== `v${NODE_VERSION}` || command(node, [npm, "--version"]) !== NPM_VERSION) throw new Error("downloaded runtime validation failed");
+  const runtime = { node, npm };
+  const temporary = `${receipt}.${(0, import_node_crypto.randomUUID)()}.tmp`;
+  try {
+    (0, import_node_fs.writeFileSync)(temporary, JSON.stringify(runtime), { flag: "wx", mode: 384, flush: true });
+    (0, import_node_fs.renameSync)(temporary, receipt);
+  } finally {
+    (0, import_node_fs.rmSync)(temporary, { force: true });
+  }
+  return runtime;
+}
+
+// src/store.ts
+var import_node_fs2 = require("node:fs");
+var import_node_crypto2 = require("node:crypto");
+var import_node_os = require("node:os");
+var import_node_path2 = require("node:path");
+function defaultProductDir(product) {
+  if (process.platform === "win32") {
+    const base = process.env.LOCALAPPDATA ?? (0, import_node_path2.join)((0, import_node_os.tmpdir)(), "launcher-fallback");
+    return (0, import_node_path2.join)(base, product);
+  }
+  const home = process.env.HOME ?? (0, import_node_os.tmpdir)();
+  return (0, import_node_path2.join)(home, `.${product}`);
+}
+function resolveProductDir(product, explicit) {
+  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
+}
+function tokensPath(dir) {
+  return (0, import_node_path2.join)(dir, "tokens.json");
+}
+function statePath(dir) {
+  return (0, import_node_path2.join)(dir, "state.json");
+}
+function payloadDir(dir) {
+  const acquired = readState(dir)?.acquired;
+  if (acquired) return (0, import_node_path2.join)(dir, "candidates", acquired.candidate, "payload");
+  return (0, import_node_path2.join)(dir, "payload");
+}
+function readTokens(dir) {
+  try {
+    const data = JSON.parse((0, import_node_fs2.readFileSync)(tokensPath(dir), "utf8"));
+    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
+    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
+    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
+    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
+    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
+    return tokens;
+  } catch {
+    return null;
+  }
+}
+function writeTokens(dir, tokens) {
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  try {
+    (0, import_node_fs2.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
+`, { mode: 384 });
+  } catch {
+    (0, import_node_fs2.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
+`);
+  }
+}
+function clearTokens(dir) {
+  (0, import_node_fs2.rmSync)(tokensPath(dir), { force: true });
+}
+function readState(dir) {
+  try {
+    const data = JSON.parse((0, import_node_fs2.readFileSync)(statePath(dir), "utf8"));
+    if (typeof data.version !== "string" || !data.version) return null;
+    const state = { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
+    if (data.acquired) {
+      if (!/^[a-zA-Z0-9_-]+$/.test(data.acquired.candidate) || typeof data.acquired.node !== "string" || typeof data.acquired.entry !== "string") return null;
+      state.acquired = data.acquired;
+    }
+    return state;
+  } catch {
+    return null;
+  }
+}
+function writeState(dir, state) {
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  const temporary = `${statePath(dir)}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
+  try {
+    (0, import_node_fs2.writeFileSync)(temporary, `${JSON.stringify(state, null, 2)}
+`, { flag: "wx", mode: 384, flush: true });
+    (0, import_node_fs2.renameSync)(temporary, statePath(dir));
+  } finally {
+    (0, import_node_fs2.rmSync)(temporary, { force: true });
+  }
+}
+function wipeProductDir(dir) {
+  const payload = payloadDir(dir);
+  (0, import_node_fs2.rmSync)(tokensPath(dir), { force: true });
+  (0, import_node_fs2.rmSync)(statePath(dir), { force: true });
+  (0, import_node_fs2.rmSync)(payload, { force: true, recursive: true });
+}
+
+// src/acquisition.ts
+function safePath(value) {
+  return typeof value === "string" && value.length > 0 && !/[\\:\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+function argumentsValid(value) {
+  return Array.isArray(value) && value.every((arg) => typeof arg === "string" && !arg.includes("\0") && (!arg.includes("$") || arg === "$prefix" || arg === "$version"));
+}
+function readAcquisition(payload) {
+  const metadata = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(payload, "payload.json"), "utf8"));
+  if (metadata.acquisition === void 0) return null;
+  const a = metadata.acquisition;
+  if (!a || a.schema !== 1 || !/^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(a.package) || !safePath(a.archive) || !a.archive.endsWith(".tgz") || !safePath(a.convergeEntry) || !safePath(a.rollbackEntry) || !safePath(a.runEntry) || !argumentsValid(a.convergeArgs) || !argumentsValid(a.rollbackArgs) || !argumentsValid(a.repairArgs) || !Array.isArray(a.platforms) || !a.platforms.length || a.platforms.some((p) => !["win32-x64", "win32-arm64", "darwin-arm64", "linux-x64", "linux-arm64"].includes(p))) {
+    throw new Error("invalid signed acquisition declaration");
+  }
+  return a;
+}
+function runtimeEnvironment(node, inherited, platform = process.platform) {
+  const env = { ...inherited };
+  let current = env.PATH ?? "";
+  if (platform === "win32") {
+    const keys = Object.keys(env).filter((key) => key.toLowerCase() === "path").sort();
+    current = (keys.length ? env[keys[0]] : "") ?? "";
+    for (const key of keys) delete env[key];
+  }
+  env.PATH = `${(0, import_node_path3.dirname)(node)}${platform === "win32" ? ";" : ":"}${current}`;
+  return env;
+}
+function lockInstallation(dir) {
+  (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  const path = (0, import_node_path3.join)(dir, "installation.lock");
+  const owner = `${process.pid}:${(0, import_node_crypto3.randomUUID)()}`;
+  try {
+    (0, import_node_fs3.writeFileSync)(path, owner, { flag: "wx", mode: 384 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const recovery = `${path}.recovery`;
+    try {
+      (0, import_node_fs3.writeFileSync)(recovery, owner, { flag: "wx", mode: 384, flush: true });
+    } catch {
+      throw new Error("installation lock recovery is already pending");
+    }
+    try {
+      const previous = (0, import_node_fs3.readFileSync)(path, "utf8");
+      const pid = Number(previous.split(":")[0]);
+      if (!Number.isInteger(pid) || pid <= 0) throw new Error("installation lock is malformed; recovery required");
+      try {
+        process.kill(pid, 0);
+        throw new Error("another installer is running");
+      } catch (probe) {
+        if (probe.code !== "ESRCH") throw probe;
+      }
+      (0, import_node_fs3.unlinkSync)(path);
+      (0, import_node_fs3.writeFileSync)(path, owner, { flag: "wx", mode: 384, flush: true });
+    } finally {
+      (0, import_node_fs3.unlinkSync)(recovery);
+    }
+  }
+  let released = false;
+  return () => {
+    if (!released && (0, import_node_fs3.readFileSync)(path, "utf8") === owner) (0, import_node_fs3.unlinkSync)(path);
+    released = true;
+  };
+}
+function pendingPath(dir) {
+  return (0, import_node_path3.join)(dir, "acquisition-pending.json");
+}
+function candidateRoot(dir, candidate) {
+  if (!/^[a-zA-Z0-9_-]+$/.test(candidate)) throw new Error("invalid acquisition candidate");
+  return (0, import_node_path3.join)(dir, "candidates", candidate);
+}
+function packageRoot(prefix, acquisition) {
+  return (0, import_node_path3.join)(prefix, "node_modules", acquisition.package);
+}
+function entry(root, path) {
+  const actual = (0, import_node_fs3.realpathSync)((0, import_node_path3.join)(root, path));
+  const rel = (0, import_node_path3.relative)((0, import_node_fs3.realpathSync)(root), actual);
+  if (rel.startsWith("..") || (0, import_node_path3.isAbsolute)(rel)) throw new Error("acquired entry escapes package");
+  return actual;
+}
+function argv(node, root, file, args, prefix, version) {
+  return [node, entry(root, file), ...args.map((arg) => arg === "$prefix" ? prefix : arg === "$version" ? version : arg)];
+}
+function acquisitionRepairCommand(dir, version) {
+  const state = readState(dir);
+  if (!state?.acquired || state.version !== version) throw new Error("installed acquisition selection is missing");
+  const root = candidateRoot(dir, state.acquired.candidate);
+  const acquisition = readAcquisition((0, import_node_path3.join)(root, "payload"));
+  if (!acquisition) throw new Error("installed acquisition declaration is missing");
+  const prefix = (0, import_node_path3.join)(root, "prefix");
+  const productRoot = packageRoot(prefix, acquisition);
+  const pkg = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(productRoot, "package.json"), "utf8"));
+  if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("installed package identity does not match signed release");
+  return argv((0, import_node_fs3.realpathSync)(state.acquired.node), productRoot, acquisition.runEntry, acquisition.repairArgs, prefix, version);
+}
+async function recoverAcquisition(dir, run2, env) {
+  if (!(0, import_node_fs3.existsSync)(pendingPath(dir))) return;
+  const pending = JSON.parse((0, import_node_fs3.readFileSync)(pendingPath(dir), "utf8"));
+  if (pending.schema !== 1 || typeof pending.version !== "string" || typeof pending.node !== "string") throw new Error("invalid pending acquisition receipt");
+  const root = candidateRoot(dir, pending.candidate);
+  if (readState(dir)?.acquired?.candidate === pending.candidate) {
+    (0, import_node_fs3.unlinkSync)(pendingPath(dir));
+    return;
+  }
+  const acquisition = readAcquisition((0, import_node_path3.join)(root, "payload"));
+  if (!acquisition) throw new Error("pending acquisition lost its signed declaration");
+  const prefix = (0, import_node_path3.join)(root, "prefix");
+  const command2 = argv(pending.node, packageRoot(prefix, acquisition), acquisition.rollbackEntry, acquisition.rollbackArgs, prefix, pending.version);
+  if (!await run2(command2, root, runtimeEnvironment(pending.node, env))) throw new Error("installation recovery is pending; product rollback did not finish");
+  if (pending.previous) writeState(dir, pending.previous);
+  else if ((0, import_node_fs3.existsSync)(statePath(dir))) (0, import_node_fs3.unlinkSync)(statePath(dir));
+  (0, import_node_fs3.unlinkSync)(pendingPath(dir));
+}
+async function installAcquisition(dir, candidate, version, acquisition, options) {
+  if (!acquisition.platforms.includes(`${process.platform}-${process.arch}`)) throw new Error("this product does not support this platform");
+  const root = candidateRoot(dir, candidate);
+  const payload = (0, import_node_path3.join)(root, "payload");
+  const prefix = (0, import_node_path3.join)(root, "prefix");
+  (0, import_node_fs3.mkdirSync)(prefix);
+  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl);
+  const env = runtimeEnvironment(runtime.node, options.env);
+  const npmEnv = { ...env };
+  for (const key of Object.keys(npmEnv)) {
+    if (/^npm_config_/i.test(key) || /^(NPM_TOKEN|NODE_AUTH_TOKEN|MM_INSTALLER_TOKEN)$/i.test(key)) delete npmEnv[key];
+  }
+  const npmrc = (0, import_node_path3.join)(root, "public.npmrc");
+  const globalrc = (0, import_node_path3.join)(root, "global.npmrc");
+  (0, import_node_fs3.writeFileSync)(npmrc, "registry=https://registry.npmjs.org/\n");
+  (0, import_node_fs3.writeFileSync)(globalrc, "");
+  const install = [
+    runtime.node,
+    runtime.npm,
+    "install",
+    "--prefix",
+    prefix,
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+    "--userconfig",
+    npmrc,
+    "--globalconfig",
+    globalrc,
+    "--registry",
+    "https://registry.npmjs.org/",
+    (0, import_node_path3.resolve)(payload, acquisition.archive)
+  ];
+  if (!await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
+  const productRoot = packageRoot(prefix, acquisition);
+  const pkg = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(productRoot, "package.json"), "utf8"));
+  if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("acquired package identity does not match signed release");
+  const runEntry = entry(productRoot, acquisition.runEntry);
+  const convergence = argv(runtime.node, productRoot, acquisition.convergeEntry, acquisition.convergeArgs, prefix, version);
+  entry(productRoot, acquisition.rollbackEntry);
+  const pending = { schema: 1, candidate, version, node: runtime.node, previous: readState(dir) };
+  (0, import_node_fs3.writeFileSync)(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
+  try {
+    if (!await options.run(convergence, root, env)) throw new Error("product convergence did not finish");
+    (options.commit ?? writeState)(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), acquired: { candidate, node: runtime.node, entry: runEntry } });
+  } catch (error) {
+    await recoverAcquisition(dir, options.run, env);
+    throw error;
+  }
+  (0, import_node_fs3.unlinkSync)(pendingPath(dir));
+}
+
+// src/index.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_fs11 = require("node:fs");
 var import_node_os4 = require("node:os");
-var import_node_path4 = require("node:path");
+var import_node_path6 = require("node:path");
 var import_node_url2 = require("node:url");
 
 // ../face/src/face.ts
-var import_node_fs = require("node:fs");
+var import_node_fs4 = require("node:fs");
 
 // ../face/src/products.ts
 var PRODUCTS = Object.freeze({
@@ -158,7 +486,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
     const record = { v: PROGRESS_PROTOCOL, step: stripColor(title), state: kind };
     if (typeof measure === "number") record.ms = Math.max(0, Math.round(measure * 1e3));
     try {
-      (0, import_node_fs.writeSync)(progressFd, `${JSON.stringify(record)}
+      (0, import_node_fs4.writeSync)(progressFd, `${JSON.stringify(record)}
 `);
       return true;
     } catch {
@@ -225,7 +553,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
 var RELAY_INDENT = " ".repeat(TITLE_COLUMN - 1);
 
 // ../face/src/spinner.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var import_node_worker_threads = require("node:worker_threads");
 var FRAMES = ["\u25D2", "\u25D0", "\u25D3", "\u25D1"];
 var WORKER_SOURCE = `
@@ -263,8 +591,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
   const write = (text) => {
     if (stream) stream.write(text);
     else {
-      (0, import_node_fs2.writeSync)(2, text);
-      if (transcriptPath) (0, import_node_fs2.appendFileSync)(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
+      (0, import_node_fs5.writeSync)(2, text);
+      if (transcriptPath) (0, import_node_fs5.appendFileSync)(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
 `);
     }
   };
@@ -337,10 +665,10 @@ var SPINNER_FRAMES = Object.freeze([...FRAMES]);
 var ALLOWED = new Set(Object.values(GLYPH));
 
 // ../face/src/run.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 
 // ../face/src/outcome.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var counts = ["total", "updated", "failed"];
 var strings = ["version", "retry", "detail", "logPath"];
 var flags = ["dryRun", "installed", "deferred", "operationFailed"];
@@ -362,12 +690,12 @@ function validateInstallerOutcome(value) {
   return { ...facts };
 }
 function writeInstallerOutcome(path, value) {
-  (0, import_node_fs3.writeFileSync)(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
+  (0, import_node_fs6.writeFileSync)(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
 }
 function readInstallerOutcome(path) {
   let text;
   try {
-    text = (0, import_node_fs3.readFileSync)(path, "utf8");
+    text = (0, import_node_fs6.readFileSync)(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -443,7 +771,7 @@ function createInstallerRun(value, options = {}) {
     product: declaration.product,
     columns: options.columns,
     env,
-    color: tty && options.color !== false && env.NO_COLOR === void 0
+    color: tty && options.color !== false && env.NO_COLOR === void 0 && env.TERM !== "dumb"
   });
   const errors = [];
   const write = options.write ? (text, channel) => {
@@ -459,7 +787,7 @@ function createInstallerRun(value, options = {}) {
     if (!text) return;
     write(text, channel);
     if (env.MM_FACE_TRANSCRIPT) {
-      (0, import_node_fs4.appendFileSync)(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
+      (0, import_node_fs7.appendFileSync)(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
 `, "utf8");
     }
   };
@@ -479,9 +807,13 @@ function createInstallerRun(value, options = {}) {
   const start = () => {
     if (started || finished) return;
     started = true;
+    if (options.quiet) return;
     const welcome = face.welcome();
     if (tty) lines(welcome);
-    else if (welcome.length) lines([`${face.identity.name} \u2014 Mutatis Mutandis`, options.operation === "install" ? face.identity.installWarm : face.identity.warm]);
+    else if (welcome.length) {
+      const warm = options.operation === "install" ? face.identity.installWarm : face.identity.warm;
+      lines([`${face.identity.name} - Mutatis Mutandis`, warm.replaceAll("\u2014", "-").replaceAll("\u2026", "...")]);
+    }
   };
   const durable = (title, measure, kind) => {
     spinner.stop();
@@ -511,12 +843,13 @@ function createInstallerRun(value, options = {}) {
       const surface = declaration.surfaces.find((surface2) => surface2.id === facts.id);
       if (!surface) throw new Error("installer run: undeclared surface");
       start();
-      const versions = facts.to ? facts.from && facts.from !== facts.to ? ` ${facts.from} \u2192 ${facts.to}` : ` ${facts.to}` : "";
+      const versions = facts.to ? facts.from && facts.from !== facts.to ? ` ${facts.from} ${tty ? "\u2192" : "->"} ${facts.to}` : ` ${facts.to}` : "";
       const status = { updated: options.dryRun ? "would update" : "updated", current: "already current", failed: "failed", skipped: "skipped", retry: "retrying", pending: "pending", kept: "kept" }[facts.state];
       if (!status) throw new Error("installer run: unknown surface state");
-      const activation = facts.state === "updated" && surface.activation ? ` \xB7 ${surface.activation}` : "";
+      const separator = tty ? "\xB7" : "-";
+      const activation = facts.state === "updated" && surface.activation ? ` ${separator} ${surface.activation}` : "";
       const completed = ["updated", "current", "kept", "skipped"].includes(facts.state);
-      durable(`${facts.id}${versions} \xB7 ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
+      durable(`${facts.id}${versions} ${separator} ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
       if (facts.detail) run2.relay(facts.detail);
     },
     milestone({ step, state, ms }) {
@@ -543,6 +876,20 @@ function createInstallerRun(value, options = {}) {
 `);
       }
     },
+    cancel() {
+      if (finished) return;
+      if (env.MM_INSTALLER_OUTCOME_FILE) writeInstallerOutcome(
+        env.MM_INSTALLER_OUTCOME_FILE,
+        { total: 0, updated: 0, failed: 0, deferred: true, detail: "Operation cancelled." }
+      );
+      start();
+      spinner.stop();
+      finished = true;
+      if (!face.nested || !env.MM_INSTALLER_OUTCOME_FILE) {
+        lines(tty ? face.receipt(["Operation cancelled."], { ready: false }) : ["Operation cancelled."]);
+      }
+      if (tty) lines([face.signOff()]);
+    },
     finish(facts) {
       if (finished) return;
       validateInstallerOutcome(facts);
@@ -550,6 +897,7 @@ function createInstallerRun(value, options = {}) {
       start();
       spinner.stop();
       finished = true;
+      if (options.quiet && facts.updated === 0 && facts.failed === 0 && !facts.operationFailed) return;
       const changed = !facts.version ? "No release target is available." : facts.dryRun ? `Would update ${facts.updated} of ${facts.total} surfaces to ${facts.version}.` : facts.installed ? `Installed ${facts.version} across ${facts.total} surfaces.` : `Updated ${facts.updated} of ${facts.total} surfaces to ${facts.version}.`;
       const ready = facts.failed === 0 && !facts.dryRun && !facts.deferred && !facts.operationFailed && Boolean(facts.version);
       const body = [
@@ -574,17 +922,17 @@ function createInstallerRun(value, options = {}) {
 }
 
 // src/autoupdate.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs5 = require("node:fs");
-var import_node_os = require("node:os");
-var import_node_path = require("node:path");
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs8 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path4 = require("node:path");
 function schedulePlatform(override) {
   const platform = override ?? process.platform;
   if (platform === "win32" || platform === "darwin" || platform === "linux") return platform;
   return null;
 }
-function defaultExec(command, args) {
-  const result = (0, import_node_child_process.spawnSync)(command, args, { encoding: "utf8", windowsHide: true });
+function defaultExec(command2, args) {
+  const result = (0, import_node_child_process2.spawnSync)(command2, args, { encoding: "utf8", windowsHide: true });
   if (result.error) return { code: 1, stdout: "", stderr: result.error.message };
   return {
     code: typeof result.status === "number" ? result.status : 1,
@@ -594,8 +942,8 @@ function defaultExec(command, args) {
 }
 function homeOf(options) {
   if (options.homeDir) return options.homeDir;
-  if (process.platform === "win32") return process.env.USERPROFILE ?? (0, import_node_os.tmpdir)();
-  return process.env.HOME ?? (0, import_node_os.tmpdir)();
+  if (process.platform === "win32") return process.env.USERPROFILE ?? (0, import_node_os2.tmpdir)();
+  return process.env.HOME ?? (0, import_node_os2.tmpdir)();
 }
 function scheduleName(config) {
   return `${config.binName} autoupdate`;
@@ -606,13 +954,13 @@ function scheduleLabel(config) {
 function quoteWindows(arg) {
   return /[\s"&|<>^%]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
 }
-function enableSchedule(config, command, options = {}) {
+function enableSchedule(config, command2, options = {}) {
   const platform = schedulePlatform(options.platform);
   if (!platform) throw new Error(`autoupdate is not supported on ${options.platform ?? process.platform}.`);
   const exec = options.exec ?? defaultExec;
   const home = homeOf(options);
   if (platform === "win32") {
-    const taskLine = command.map(quoteWindows).join(" ");
+    const taskLine = command2.map(quoteWindows).join(" ");
     const result2 = exec("schtasks", ["/Create", "/TN", scheduleName(config), "/TR", taskLine, "/SC", "HOURLY", "/IT", "/F"]);
     if (result2.code !== 0) {
       throw new Error(`could not turn autoupdate on: ${firstLine(result2.stdout || result2.stderr) || `exit ${result2.code}`}`);
@@ -621,10 +969,10 @@ function enableSchedule(config, command, options = {}) {
   }
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
-    const dir2 = (0, import_node_path.join)(home, "Library", "LaunchAgents");
-    (0, import_node_fs5.mkdirSync)(dir2, { recursive: true });
-    const plist = (0, import_node_path.join)(dir2, `${label2}.plist`);
-    (0, import_node_fs5.writeFileSync)(plist, darwinPlist(label2, command));
+    const dir2 = (0, import_node_path4.join)(home, "Library", "LaunchAgents");
+    (0, import_node_fs8.mkdirSync)(dir2, { recursive: true });
+    const plist = (0, import_node_path4.join)(dir2, `${label2}.plist`);
+    (0, import_node_fs8.writeFileSync)(plist, darwinPlist(label2, command2));
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
     const result2 = exec("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, plist]);
     if (result2.code !== 0) {
@@ -633,10 +981,10 @@ function enableSchedule(config, command, options = {}) {
     return;
   }
   const label = scheduleLabel(config);
-  const dir = (0, import_node_path.join)(home, ".config", "systemd", "user");
-  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs5.writeFileSync)((0, import_node_path.join)(dir, `${label}.service`), linuxService(command));
-  (0, import_node_fs5.writeFileSync)((0, import_node_path.join)(dir, `${label}.timer`), linuxTimer(label));
+  const dir = (0, import_node_path4.join)(home, ".config", "systemd", "user");
+  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs8.writeFileSync)((0, import_node_path4.join)(dir, `${label}.service`), linuxService(command2));
+  (0, import_node_fs8.writeFileSync)((0, import_node_path4.join)(dir, `${label}.timer`), linuxTimer(label));
   const reload = exec("systemctl", ["--user", "daemon-reload"]);
   if (reload.code !== 0) {
     throw new Error(`could not turn autoupdate on: ${firstLine(reload.stderr || reload.stdout) || `exit ${reload.code}`}`);
@@ -661,14 +1009,14 @@ function disableSchedule(config, options = {}) {
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
-    (0, import_node_fs5.rmSync)((0, import_node_path.join)(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
+    (0, import_node_fs8.rmSync)((0, import_node_path4.join)(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
     return;
   }
   const label = scheduleLabel(config);
-  const dir = (0, import_node_path.join)(home, ".config", "systemd", "user");
+  const dir = (0, import_node_path4.join)(home, ".config", "systemd", "user");
   exec("systemctl", ["--user", "disable", "--now", `${label}.timer`]);
-  (0, import_node_fs5.rmSync)((0, import_node_path.join)(dir, `${label}.service`), { force: true });
-  (0, import_node_fs5.rmSync)((0, import_node_path.join)(dir, `${label}.timer`), { force: true });
+  (0, import_node_fs8.rmSync)((0, import_node_path4.join)(dir, `${label}.service`), { force: true });
+  (0, import_node_fs8.rmSync)((0, import_node_path4.join)(dir, `${label}.timer`), { force: true });
 }
 function querySchedule(config, options = {}) {
   const platform = schedulePlatform(options.platform);
@@ -686,20 +1034,20 @@ function querySchedule(config, options = {}) {
     return state2;
   }
   if (platform === "darwin") {
-    const plist = (0, import_node_path.join)(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
-    if (!(0, import_node_fs5.existsSync)(plist)) return { supported: true, enabled: false };
+    const plist = (0, import_node_path4.join)(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
+    if (!(0, import_node_fs8.existsSync)(plist)) return { supported: true, enabled: false };
     return { supported: true, enabled: true, cadence: "hourly" };
   }
-  const timer = (0, import_node_path.join)(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
-  if (!(0, import_node_fs5.existsSync)(timer)) return { supported: true, enabled: false };
+  const timer = (0, import_node_path4.join)(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
+  if (!(0, import_node_fs8.existsSync)(timer)) return { supported: true, enabled: false };
   const state = { supported: true, enabled: true, cadence: "hourly" };
   const shown = exec("systemctl", ["--user", "show", `${scheduleLabel(config)}.service`, "-p", "ExecMainStartTimestamp", "--value"]);
   const stamp = (shown.stdout ?? "").trim();
   if (shown.code === 0 && stamp && stamp !== "n/a") state.lastRun = stamp;
   return state;
 }
-function darwinPlist(label, command) {
-  const args = command.map((arg) => `        <string>${xmlEscape(arg)}</string>`).join("\n");
+function darwinPlist(label, command2) {
+  const args = command2.map((arg) => `        <string>${xmlEscape(arg)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -716,8 +1064,8 @@ ${args}
 </plist>
 `;
 }
-function linuxService(command) {
-  const line = command.map((arg) => /[\s"\\]/.test(arg) ? `"${arg.replace(/(["\\])/g, "\\$1")}"` : arg).join(" ");
+function linuxService(command2) {
+  const line = command2.map((arg) => /[\s"\\]/.test(arg) ? `"${arg.replace(/(["\\])/g, "\\$1")}"` : arg).join(" ");
   return `[Unit]
 Description=${"Hourly update check"}
 [Service]
@@ -749,7 +1097,7 @@ function firstLine(text) {
 }
 
 // src/config.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_sea = require("node:sea");
 
 // src/module-url.ts
@@ -772,10 +1120,10 @@ function loadProductConfig(options = {}) {
   const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
   const devFallback = new URL("../config/product.template.json", moduleUrl());
   if (explicit) {
-    return parseProductConfig((0, import_node_fs6.readFileSync)(explicit, "utf8"));
+    return parseProductConfig((0, import_node_fs9.readFileSync)(explicit, "utf8"));
   }
   try {
-    return parseProductConfig((0, import_node_fs6.readFileSync)(devFallback, "utf8"));
+    return parseProductConfig((0, import_node_fs9.readFileSync)(devFallback, "utf8"));
   } catch {
   }
   try {
@@ -830,14 +1178,14 @@ function field(record, key) {
 }
 
 // src/login-github.ts
-var import_node_child_process2 = require("node:child_process");
-var realSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var import_node_child_process3 = require("node:child_process");
+var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function openBrowser(url) {
   if (process.env.LAUNCHER_NO_OPEN === "1") return;
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
   const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
   try {
-    const child = (0, import_node_child_process2.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
+    const child = (0, import_node_child_process3.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
     child.on("error", () => {
     });
     child.unref();
@@ -951,7 +1299,7 @@ async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
 }
 
 // src/login-google.ts
-var import_node_crypto = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var import_node_http = require("node:http");
 var b64url = (bytes) => bytes.toString("base64url");
 async function loginGoogle(options) {
@@ -959,7 +1307,7 @@ async function loginGoogle(options) {
   const server = options.host.replace(/\/+$/, "");
   const timeoutMs = options.timeoutMs ?? 5 * 6e4;
   const listener = (0, import_node_http.createServer)();
-  await new Promise((resolve2) => listener.listen(0, "127.0.0.1", resolve2));
+  await new Promise((resolve3) => listener.listen(0, "127.0.0.1", resolve3));
   const port = listener.address().port;
   const redirectUri = `http://127.0.0.1:${port}/callback`;
   try {
@@ -973,9 +1321,9 @@ async function loginGoogle(options) {
     if (typeof clientId !== "string" || !clientId) {
       throw new Error("the sign-in server returned a malformed registration");
     }
-    const verifier = b64url((0, import_node_crypto.randomBytes)(32));
-    const challenge = b64url((0, import_node_crypto.createHash)("sha256").update(verifier).digest());
-    const state = b64url((0, import_node_crypto.randomBytes)(16));
+    const verifier = b64url((0, import_node_crypto4.randomBytes)(32));
+    const challenge = b64url((0, import_node_crypto4.createHash)("sha256").update(verifier).digest());
+    const state = b64url((0, import_node_crypto4.randomBytes)(16));
     const authorize = new URL(`${server}/oauth/authorize`);
     authorize.search = new URLSearchParams({
       response_type: "code",
@@ -986,7 +1334,7 @@ async function loginGoogle(options) {
       code_challenge: challenge,
       code_challenge_method: "S256"
     }).toString();
-    const code = await new Promise((resolve2, reject) => {
+    const code = await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => reject(new Error("sign-in timed out \u2014 run login again.")), timeoutMs);
       listener.on("request", (req, res) => {
         const url = new URL(req.url ?? "/", redirectUri);
@@ -1004,7 +1352,7 @@ async function loginGoogle(options) {
         }
         res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(page("Signed in.", "You can close this tab and go back to the terminal."));
         clearTimeout(timer);
-        resolve2(received);
+        resolve3(received);
       });
       const print = options.print ?? ((line) => process.stderr.write(`${line}
 `));
@@ -1064,10 +1412,10 @@ function page(title, body) {
 }
 
 // src/payload.ts
-var import_node_crypto2 = require("node:crypto");
-var import_node_fs7 = require("node:fs");
-var import_node_os2 = require("node:os");
-var import_node_path2 = require("node:path");
+var import_node_crypto5 = require("node:crypto");
+var import_node_fs10 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path5 = require("node:path");
 
 // src/canonical.ts
 function canonicalJson(value) {
@@ -1084,7 +1432,7 @@ function encode(value) {
     return JSON.stringify(value);
   }
   if (Array.isArray(value)) {
-    return `[${value.map((entry) => encode(entry)).join(",")}]`;
+    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
   }
   if (typeof value === "object") {
     const record = value;
@@ -1119,7 +1467,7 @@ function canonicalManifestBytes(manifest) {
 }
 function ed25519PublicKey(config) {
   const raw = publicKeyBytes(config);
-  return (0, import_node_crypto2.createPublicKey)({
+  return (0, import_node_crypto5.createPublicKey)({
     key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
     format: "jwk"
   });
@@ -1128,14 +1476,14 @@ function verifyManifest(manifest, signature, config) {
   try {
     const signatureBytes = Buffer.from(signature, "base64");
     if (signatureBytes.length === 0) return false;
-    return (0, import_node_crypto2.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
+    return (0, import_node_crypto5.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
   } catch {
     return false;
   }
 }
-function verifyFileBytes(entry, bytes) {
-  if (entry.size !== bytes.length) return false;
-  return (0, import_node_crypto2.createHash)("sha256").update(bytes).digest("hex") === entry.sha256.toLowerCase();
+function verifyFileBytes(entry2, bytes) {
+  if (entry2.size !== bytes.length) return false;
+  return (0, import_node_crypto5.createHash)("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
 }
 async function readErrorCode(response) {
   try {
@@ -1166,8 +1514,8 @@ function parseManifest(json) {
   if (typeof record.signature !== "string" || !record.signature) {
     throw new Error("the release manifest is unsigned");
   }
-  const files = record.files.map((entry) => {
-    const file = entry;
+  const files = record.files.map((entry2) => {
+    const file = entry2;
     if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
       throw new Error("the release manifest lists a malformed file");
     }
@@ -1207,101 +1555,31 @@ async function fetchFileBytes(config, accessToken, path, fetchImpl) {
 }
 async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
-  const staging = (0, import_node_path2.join)((0, import_node_os2.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
-  (0, import_node_fs7.mkdirSync)(staging, { recursive: true });
+  const staging = (0, import_node_path5.join)((0, import_node_os3.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
+  (0, import_node_fs10.mkdirSync)(staging, { recursive: true });
   try {
-    for (const entry of manifest.files) {
-      const bytes = await fetchFileBytes(config, accessToken, entry.path, fetchImpl);
-      if (!verifyFileBytes(entry, bytes)) {
-        throw new Error(`file ${entry.path} failed its checksum \u2014 refusing to install anything.`);
+    for (const entry2 of manifest.files) {
+      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl);
+      if (!verifyFileBytes(entry2, bytes)) {
+        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
       }
-      const dest = (0, import_node_path2.join)(staging, entry.path);
-      (0, import_node_fs7.mkdirSync)((0, import_node_path2.dirname)(dest), { recursive: true });
-      (0, import_node_fs7.writeFileSync)(dest, bytes);
+      const dest = (0, import_node_path5.join)(staging, entry2.path);
+      (0, import_node_fs10.mkdirSync)((0, import_node_path5.dirname)(dest), { recursive: true });
+      (0, import_node_fs10.writeFileSync)(dest, bytes);
     }
-    const target = (0, import_node_path2.join)(dir, "payload");
-    (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs7.rmSync)(target, { force: true, recursive: true });
-    (0, import_node_fs7.renameSync)(staging, target);
+    const target = (0, import_node_path5.join)(dir, "payload");
+    (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs10.rmSync)(target, { force: true, recursive: true });
+    (0, import_node_fs10.renameSync)(staging, target);
   } catch (error) {
-    (0, import_node_fs7.rmSync)(staging, { force: true, recursive: true });
+    (0, import_node_fs10.rmSync)(staging, { force: true, recursive: true });
     throw error;
   }
   return manifest.version;
 }
 
-// src/store.ts
-var import_node_fs8 = require("node:fs");
-var import_node_os3 = require("node:os");
-var import_node_path3 = require("node:path");
-function defaultProductDir(product) {
-  if (process.platform === "win32") {
-    const base = process.env.LOCALAPPDATA ?? (0, import_node_path3.join)((0, import_node_os3.tmpdir)(), "launcher-fallback");
-    return (0, import_node_path3.join)(base, product);
-  }
-  const home = process.env.HOME ?? (0, import_node_os3.tmpdir)();
-  return (0, import_node_path3.join)(home, `.${product}`);
-}
-function resolveProductDir(product, explicit) {
-  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
-}
-function tokensPath(dir) {
-  return (0, import_node_path3.join)(dir, "tokens.json");
-}
-function statePath(dir) {
-  return (0, import_node_path3.join)(dir, "state.json");
-}
-function payloadDir(dir) {
-  return (0, import_node_path3.join)(dir, "payload");
-}
-function readTokens(dir) {
-  try {
-    const data = JSON.parse((0, import_node_fs8.readFileSync)(tokensPath(dir), "utf8"));
-    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
-    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
-    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
-    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
-    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
-    return tokens;
-  } catch {
-    return null;
-  }
-}
-function writeTokens(dir, tokens) {
-  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
-  try {
-    (0, import_node_fs8.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
-`, { mode: 384 });
-  } catch {
-    (0, import_node_fs8.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
-`);
-  }
-}
-function clearTokens(dir) {
-  (0, import_node_fs8.rmSync)(tokensPath(dir), { force: true });
-}
-function readState(dir) {
-  try {
-    const data = JSON.parse((0, import_node_fs8.readFileSync)(statePath(dir), "utf8"));
-    if (typeof data.version !== "string" || !data.version) return null;
-    return { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
-  } catch {
-    return null;
-  }
-}
-function writeState(dir, state) {
-  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs8.writeFileSync)(statePath(dir), `${JSON.stringify(state, null, 2)}
-`);
-}
-function wipeProductDir(dir) {
-  (0, import_node_fs8.rmSync)(tokensPath(dir), { force: true });
-  (0, import_node_fs8.rmSync)(statePath(dir), { force: true });
-  (0, import_node_fs8.rmSync)(payloadDir(dir), { force: true, recursive: true });
-}
-
 // src/index.ts
-var LAUNCHER_VERSION = true ? "0.1.11" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "0.1.13" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -1313,30 +1591,37 @@ function defaultPrintErr(message) {
 async function run(rawOptions = {}) {
   const print = rawOptions.print ?? defaultPrint;
   const printErr = rawOptions.printErr ?? defaultPrintErr;
-  const argv = rawOptions.argv ?? process.argv.slice(2);
-  const runAt = argv.indexOf("--run");
-  if (runAt >= 0) return runFile(argv[runAt + 1], argv.slice(runAt + 2), printErr);
+  const argv2 = rawOptions.argv ?? process.argv.slice(2);
+  const runAt = argv2.indexOf("--run");
+  if (runAt >= 0) return runFile(argv2[runAt + 1], argv2.slice(runAt + 2), printErr);
   let config;
   try {
-    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv, "--config") });
+    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv2, "--config") });
   } catch (error) {
     print(`cannot start: ${error.message}`);
     return 2;
   }
-  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv, "--dir"));
-  const positional = argv.filter((arg) => !arg.startsWith("-"));
-  if (argv.includes("--version") || argv.includes("-v")) {
+  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv2, "--dir"));
+  const positional = argv2.filter((arg) => !arg.startsWith("-"));
+  if (argv2.includes("--version") || argv2.includes("-v")) {
     print(`${config.binName} launcher ${LAUNCHER_VERSION}`);
     return 0;
   }
-  if (argv.includes("--help") || argv.includes("-h") || positional.length === 0) {
+  if (argv2.includes("--help") || argv2.includes("-h") || positional.length === 0) {
     printUsage(config, print);
     return positional.length === 0 ? 2 : 0;
   }
-  const command = positional[0];
+  const command2 = positional[0];
+  let unlock;
   try {
-    switch (command) {
+    unlock = lockInstallation(dir);
+    await recoverAcquisition(dir, async (command3, cwd, env) => {
+      const result = (rawOptions.runEntry ?? defaultRunEntry)(command3, cwd, env);
+      return result.ok && (result.code === void 0 || result.code === 0);
+    }, payloadEnv(dir) ?? process.env);
+    switch (command2) {
       case "login":
+        unlock();
         await doLogin(config, dir, rawOptions, print);
         return 0;
       case "logout":
@@ -1348,11 +1633,11 @@ async function run(rawOptions = {}) {
       case "update":
         return await doUpdate(config, dir, rawOptions, print);
       case "doctor":
-        return doDoctor(config, dir, rawOptions, print);
+        return doDoctor(config, dir, rawOptions, print, unlock);
       case "autoupdate":
         return doAutoupdate(config, rawOptions, positional.slice(1), print);
       default:
-        return doForward(config, dir, rawOptions, command, argv, print);
+        return doForward(config, dir, rawOptions, command2, argv2, print, unlock);
     }
   } catch (error) {
     if (error instanceof NeedsLoginError) {
@@ -1361,12 +1646,14 @@ async function run(rawOptions = {}) {
     }
     print(`failed: ${error.message}`);
     return 1;
+  } finally {
+    unlock?.();
   }
 }
-function flagValue(argv, flag) {
-  const index = argv.indexOf(flag);
+function flagValue(argv2, flag) {
+  const index = argv2.indexOf(flag);
   if (index < 0) return void 0;
-  const value = argv[index + 1];
+  const value = argv2[index + 1];
   return value && !value.startsWith("-") ? value : void 0;
 }
 function printUsage(config, print) {
@@ -1380,8 +1667,8 @@ async function runFile(file, args, printErr) {
     printErr("launcher --run needs a file to run.");
     return 1;
   }
-  const abs = (0, import_node_path4.resolve)(process.cwd(), file);
-  if (!(0, import_node_fs9.existsSync)(abs)) {
+  const abs = (0, import_node_path6.resolve)(process.cwd(), file);
+  if (!(0, import_node_fs11.existsSync)(abs)) {
     printErr(`cannot run ${file}: no such file.`);
     return 1;
   }
@@ -1474,14 +1761,14 @@ async function fetchAccessTokenOrLogin(config, dir, options, print, installer) {
 }
 function readPayloadArgv(dir, key) {
   try {
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path4.join)(payloadDir(dir), "payload.json"), "utf8"));
-    const entry = parsed[key];
-    if (typeof entry === "string") {
-      const parts = entry.trim().split(/\s+/).filter(Boolean);
+    const parsed = JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path6.join)(payloadDir(dir), "payload.json"), "utf8"));
+    const entry2 = parsed[key];
+    if (typeof entry2 === "string") {
+      const parts = entry2.trim().split(/\s+/).filter(Boolean);
       return parts.length > 0 ? parts : null;
     }
-    if (Array.isArray(entry) && entry.every((part) => typeof part === "string" && part.length > 0)) {
-      return entry;
+    if (Array.isArray(entry2) && entry2.every((part) => typeof part === "string" && part.length > 0)) {
+      return entry2;
     }
     return null;
   } catch {
@@ -1496,7 +1783,7 @@ function readPayloadRun(dir) {
 }
 function readPayloadVerbs(dir) {
   try {
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path4.join)(payloadDir(dir), "payload.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path6.join)(payloadDir(dir), "payload.json"), "utf8"));
     const verbs = parsed.verbs;
     if (verbs === "*") return "*";
     if (Array.isArray(verbs) && verbs.every((v) => typeof v === "string" && v.trim().length > 0)) {
@@ -1507,13 +1794,13 @@ function readPayloadVerbs(dir) {
     return null;
   }
 }
-function resolveEntry(entry) {
-  return entry[0] === "$self" ? [process.execPath, ...entry.slice(1)] : entry;
+function resolveEntry(entry2) {
+  return entry2[0] === "$self" ? [process.execPath, ...entry2.slice(1)] : entry2;
 }
-function needsShell(command) {
+function needsShell(command2) {
   if (process.platform !== "win32") return false;
-  if (/\.(cmd|bat)$/i.test(command)) return true;
-  return !(0, import_node_fs9.existsSync)(command);
+  if (/\.(cmd|bat)$/i.test(command2)) return true;
+  return !(0, import_node_fs11.existsSync)(command2);
 }
 function quoteForShell(arg) {
   return /[\s"&|<>^%]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
@@ -1540,11 +1827,11 @@ function parseProgress(raw) {
   }
   return progress;
 }
-function defaultRunEntry(entry, cwd, env) {
-  const [command, ...args] = entry;
-  const shell = needsShell(command);
-  const commandLine = shell ? [command, ...args].map(quoteForShell).join(" ") : command;
-  const spawnEntry = (progress2) => (0, import_node_child_process3.spawnSync)(commandLine, shell ? [] : args, {
+function defaultRunEntry(entry2, cwd, env) {
+  const [command2, ...args] = entry2;
+  const shell = needsShell(command2);
+  const commandLine = shell ? [command2, ...args].map(quoteForShell).join(" ") : command2;
+  const spawnEntry = (progress2) => (0, import_node_child_process4.spawnSync)(commandLine, shell ? [] : args, {
     cwd,
     stdio: progress2 ? ["inherit", "inherit", "inherit", "pipe"] : "inherit",
     shell,
@@ -1602,11 +1889,41 @@ async function installOrUpdate(config, dir, options, print, update) {
     version = manifest.version;
     installer.phase("resolve", { seconds: (Date.now() - started) / 1e3 });
     const current = readState(dir);
-    const unchanged = update && current?.version === version && (0, import_node_fs9.existsSync)(payloadDir(dir));
+    const unchanged = update && current?.version === version && (0, import_node_fs11.existsSync)(payloadDir(dir));
+    if (unchanged && current.acquired) {
+      installer.surface({ id: config.product, from: version, to: version, state: "current" });
+      return await finishLastMile(config, dir, options, installer, version, true, acquisitionRepairCommand(dir, version));
+    }
     if (!unchanged) {
       installer.phase("download", { state: "running" });
       started = Date.now();
-      await downloadAndUnpack(config, dir, manifest, accessToken, { fetchImpl });
+      const candidate = (0, import_node_crypto6.randomUUID)();
+      const candidateDir = (0, import_node_path6.join)(dir, "candidates", candidate);
+      await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl });
+      const acquisition = (0, import_node_fs11.existsSync)((0, import_node_path6.join)(candidateDir, "payload", "payload.json")) ? readAcquisition((0, import_node_path6.join)(candidateDir, "payload")) : null;
+      if (acquisition) {
+        installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
+        installer.phase("activate", { state: "running" });
+        let outcome;
+        const env = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
+        await installAcquisition(dir, candidate, version, acquisition, {
+          fetchImpl,
+          env,
+          run: async (command2, cwd, childEnv) => {
+            const result = options.runEntry ? options.runEntry(command2, cwd, childEnv) : await runInstallEntry(command2, cwd, childEnv, installer, readTokens(dir));
+            if (result.outcome) outcome = validateInstallerOutcome(result.outcome);
+            return result.ok && (result.code === void 0 || result.code === 0) && !result.outcome?.operationFailed && !result.outcome?.failed;
+          }
+        });
+        installer.phase("activate");
+        installer.surface({ id: config.product, from: current?.version, to: version, state: "updated" });
+        installer.finish(outcome ?? { version, total: 1, updated: 1, failed: 0, installed: true });
+        return 0;
+      }
+      const target = (0, import_node_path6.join)(dir, "payload");
+      (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs11.rmSync)(target, { recursive: true, force: true });
+      (0, import_node_fs11.renameSync)((0, import_node_path6.join)(candidateDir, "payload"), target);
       writeState(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
       installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
     }
@@ -1644,36 +1961,36 @@ function payloadEnv(dir) {
   return { ...process.env, MM_INSTALLER_TOKEN: stored.accessToken };
 }
 var NEVER_A_PROGRAM = /\.(tgz|tar|gz|bz2|xz|zip|json|txt|md|lock)$/i;
-function payloadFileAsCommand(entry, payload) {
-  const first = entry[0];
+function payloadFileAsCommand(entry2, payload) {
+  const first = entry2[0];
   if (!first || first === "$self") return null;
   if (first.includes("/") || first.includes("\\")) return null;
-  const candidate = (0, import_node_path4.join)(payload, first);
-  if (!(0, import_node_fs9.existsSync)(candidate)) return null;
+  const candidate = (0, import_node_path6.join)(payload, first);
+  if (!(0, import_node_fs11.existsSync)(candidate)) return null;
   if (NEVER_A_PROGRAM.test(first)) return first;
   if (process.platform === "win32") return null;
   try {
-    return ((0, import_node_fs9.statSync)(candidate).mode & 73) === 0 ? first : null;
+    return ((0, import_node_fs11.statSync)(candidate).mode & 73) === 0 ? first : null;
   } catch {
     return null;
   }
 }
-async function finishLastMile(config, dir, options, installer, version, unchanged) {
-  const entry = readPayloadEntry(dir);
+async function finishLastMile(config, dir, options, installer, version, unchanged, repairCommand) {
+  const entry2 = repairCommand ?? readPayloadEntry(dir);
   const payload = payloadDir(dir);
-  if (!entry) {
+  if (!entry2) {
     installer.finish({
       version,
       total: 1,
       updated: unchanged ? 0 : 1,
       failed: 0,
       installed: true,
-      detail: `next step: run ${(0, import_node_path4.join)(payload, config.binName)} to start ${config.product}.`
+      detail: `next step: run ${(0, import_node_path6.join)(payload, config.binName)} to start ${config.product}.`
     });
     return 0;
   }
-  const command = resolveEntry(entry);
-  const dataFile = payloadFileAsCommand(entry, payload);
+  const command2 = resolveEntry(entry2);
+  const dataFile = payloadFileAsCommand(entry2, payload);
   if (dataFile) {
     installer.finish({
       version,
@@ -1686,8 +2003,9 @@ async function finishLastMile(config, dir, options, installer, version, unchange
   }
   installer.phase("activate", { state: "running" });
   const started = Date.now();
-  const env = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
-  const result = options.runEntry ? options.runEntry(command, payload, env) : await runInstallEntry(command, payload, env, installer, readTokens(dir));
+  const inherited = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
+  const env = repairCommand ? runtimeEnvironment(repairCommand[0], inherited) : inherited;
+  const result = options.runEntry ? options.runEntry(command2, payload, env) : await runInstallEntry(command2, payload, env, installer, readTokens(dir));
   for (const progress of result.progress ?? []) installer.milestone(progress);
   const succeeded = result.ok && (result.code === void 0 || result.code === 0);
   const outcome = result.outcome ? validateInstallerOutcome(result.outcome) : void 0;
@@ -1702,18 +2020,18 @@ async function finishLastMile(config, dir, options, installer, version, unchange
     },
     ...!succeeded ? {
       operationFailed: true,
-      detail: result.code === void 0 ? `Arming this machine could not start: ${result.error ?? command[0]}` : `Arming this machine did not finish (exit code ${result.code})${result.error?.startsWith("installer outcome:") ? `: ${result.error}` : ""}`,
-      retry: `(cd ${payload} && ${command.join(" ")})`
+      detail: result.code === void 0 ? `Arming this machine could not start: ${result.error ?? command2[0]}` : `Arming this machine did not finish (exit code ${result.code})${result.error?.startsWith("installer outcome:") ? `: ${result.error}` : ""}`,
+      retry: `(cd ${payload} && ${command2.join(" ")})`
     } : {}
   });
   return succeeded ? outcome?.operationFailed || outcome?.failed ? 1 : 0 : result.code || 1;
 }
-async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
-  const [command, ...args] = entry;
-  const shell = needsShell(command);
+async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
+  const [command2, ...args] = entry2;
+  const shell = needsShell(command2);
   const progress = !(process.platform === "win32" && shell);
-  const outcomeDir = (0, import_node_fs9.mkdtempSync)((0, import_node_path4.join)((0, import_node_os4.tmpdir)(), "mm-installer-outcome-"));
-  const outcomeFile = (0, import_node_path4.join)(outcomeDir, "outcome.json");
+  const outcomeDir = (0, import_node_fs11.mkdtempSync)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "mm-installer-outcome-"));
+  const outcomeFile = (0, import_node_path6.join)(outcomeDir, "outcome.json");
   const childEnv = { ...env, MM_INSTALLER_OUTCOME_FILE: outcomeFile };
   delete childEnv.MM_FACE_TRANSCRIPT;
   delete childEnv.MM_PROGRESS_FD;
@@ -1722,8 +2040,8 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
   const secrets = [tokens?.accessToken, tokens?.refreshToken].filter((value) => Boolean(value));
   const redact = (text) => secrets.reduce((safe, value) => safe.replaceAll(value, "[redacted]"), text);
   try {
-    const result = await new Promise((resolve2) => {
-      const child = (0, import_node_child_process3.spawn)(shell ? [command, ...args].map(quoteForShell).join(" ") : command, shell ? [] : args, {
+    const result = await new Promise((resolve3) => {
+      const child = (0, import_node_child_process4.spawn)(shell ? [command2, ...args].map(quoteForShell).join(" ") : command2, shell ? [] : args, {
         cwd,
         shell,
         windowsHide: true,
@@ -1759,8 +2077,8 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
           if (pending.length > 65536) pending = "";
         });
       }
-      child.on("error", (error) => resolve2({ ok: false, error: error.message }));
-      child.on("close", (code) => resolve2({
+      child.on("error", (error) => resolve3({ ok: false, error: error.message }));
+      child.on("close", (code) => resolve3({
         ok: code === 0,
         ...code !== null ? { code } : {},
         ...code !== 0 ? { error: `exit code ${code}` } : {}
@@ -1773,25 +2091,30 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
       return { ...result, ok: false, code: result.code || 1, error: "installer outcome: invalid child result" };
     }
   } finally {
-    if ((0, import_node_fs9.existsSync)(outcomeFile)) (0, import_node_fs9.unlinkSync)(outcomeFile);
-    (0, import_node_fs9.rmdirSync)(outcomeDir);
+    if ((0, import_node_fs11.existsSync)(outcomeFile)) (0, import_node_fs11.unlinkSync)(outcomeFile);
+    (0, import_node_fs11.rmdirSync)(outcomeDir);
   }
 }
-function doForward(config, dir, options, command, argv, print) {
-  if (command && (0, import_node_fs9.existsSync)(command)) {
-    print(`${command} is a file, not a command \u2014 did you mean \`--run ${command}\`?`);
+function doForward(config, dir, options, command2, argv2, print, unlock) {
+  if (command2 && (0, import_node_fs11.existsSync)(command2)) {
+    print(`${command2} is a file, not a command \u2014 did you mean \`--run ${command2}\`?`);
     return 2;
   }
-  const target = readPayloadRun(dir);
+  const acquired = readState(dir)?.acquired;
+  const target = acquired ? [acquired.node, acquired.entry] : readPayloadRun(dir);
   const verbs = readPayloadVerbs(dir);
-  const declared = verbs === "*" || Array.isArray(verbs) && command !== void 0 && verbs.includes(command);
+  const declared = verbs === "*" || Array.isArray(verbs) && command2 !== void 0 && verbs.includes(command2);
   if (!target || !declared) {
-    print(`unknown command: ${command}`);
+    print(`unknown command: ${command2}`);
     printUsage(config, print);
     return 2;
   }
-  const forwarded = [...resolveEntry(target), ...argv];
-  const result = (options.runEntry ?? defaultRunEntry)(forwarded, payloadDir(dir), payloadEnv(dir));
+  const forwarded = [...resolveEntry(target), ...argv2];
+  const cwd = payloadDir(dir);
+  const inherited = payloadEnv(dir);
+  const env = acquired ? runtimeEnvironment(acquired.node, inherited ?? process.env) : inherited;
+  unlock();
+  const result = (options.runEntry ?? defaultRunEntry)(forwarded, cwd, env);
   if (!result.ok && result.code === void 0) {
     print(`failed: ${result.error ?? `could not run ${forwarded[0]}`}`);
     return 1;
@@ -1801,10 +2124,10 @@ function doForward(config, dir, options, command, argv, print) {
 function doAutoupdate(config, options, args, print) {
   const mode = args[0] ?? "status";
   const scheduleOptions = options.autoupdate ?? {};
-  const command = options.autoupdate?.command ?? [process.execPath, "update"];
+  const command2 = options.autoupdate?.command ?? [process.execPath, "update"];
   if (mode === "on") {
     try {
-      enableSchedule(config, command, scheduleOptions);
+      enableSchedule(config, command2, scheduleOptions);
     } catch (error) {
       print(error.message);
       return 1;
@@ -1836,19 +2159,24 @@ function doAutoupdate(config, options, args, print) {
   if (state.lastRun) print(`last run:    ${state.lastRun}`);
   return 0;
 }
-function doDoctor(config, dir, options, print) {
+function doDoctor(config, dir, options, print, unlock) {
   doLauncherDoctor(config, dir, options, print);
-  const target = readPayloadRun(dir);
+  const acquired = readState(dir)?.acquired;
+  const target = acquired ? [acquired.node, acquired.entry] : readPayloadRun(dir);
   const verbs = readPayloadVerbs(dir);
   const chains = target !== null && (verbs === "*" || Array.isArray(verbs) && verbs.includes("doctor"));
   if (!chains) return 0;
-  const result = (options.runEntry ?? defaultRunEntry)([...resolveEntry(target), "doctor"], payloadDir(dir), payloadEnv(dir));
+  const cwd = payloadDir(dir);
+  const inherited = payloadEnv(dir);
+  const env = acquired ? runtimeEnvironment(acquired.node, inherited ?? process.env) : inherited;
+  unlock();
+  const result = (options.runEntry ?? defaultRunEntry)([...resolveEntry(target), "doctor"], cwd, env);
   return result.code ?? (result.ok ? 0 : 1);
 }
 function doLauncherDoctor(config, dir, options, print) {
   const tokens = readTokens(dir);
   const state = readState(dir);
-  const payloadPresent = (0, import_node_fs9.existsSync)(payloadDir(dir));
+  const payloadPresent = (0, import_node_fs11.existsSync)(payloadDir(dir));
   print(`product:  ${config.product}`);
   print(`host:     ${config.host}`);
   print(`login:    ${config.loginKind}`);
@@ -1860,7 +2188,7 @@ function doLauncherDoctor(config, dir, options, print) {
     print("token:    none \u2014 run login first.");
   }
   print(`payload:  ${state ? state.version : "none"}${payloadPresent ? "" : " (not downloaded)"}`);
-  print(`paths:    tokens ${(0, import_node_path4.join)(dir, "tokens.json")}, state ${(0, import_node_path4.join)(dir, "state.json")}, payload ${payloadDir(dir)}`);
+  print(`paths:    tokens ${(0, import_node_path6.join)(dir, "tokens.json")}, state ${(0, import_node_path6.join)(dir, "state.json")}, payload ${payloadDir(dir)}`);
   const schedule = querySchedule(config, options.autoupdate ?? {});
   print(
     `auto-update: ${!schedule.supported ? "unsupported on this platform" : schedule.enabled ? `on (${schedule.cadence ?? "hourly"})` : "off"}`