@mutmutco/installer-launcher 0.1.12 → 0.1.14

package/dist/launcher.sea.cjs

@@ -32,43 +32,674 @@ __export(index_exports, {
   runInstallEntry: () => runInstallEntry
 });
 module.exports = __toCommonJS(index_exports);
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs9 = require("node:fs");
-var import_node_os4 = require("node:os");
+var import_node_string_decoder = require("node:string_decoder");
+var import_node_crypto6 = require("node:crypto");
+
+// src/acquisition.ts
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
 var import_node_path4 = require("node:path");
+
+// src/runtime.ts
+var import_node_crypto = require("node:crypto");
+var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+
+// src/download.ts
+async function readDownload(response, onProgress, expectedSize) {
+  const length = expectedSize ?? Number(response.headers.get("content-length"));
+  const total = Number.isSafeInteger(length) && length > 0 ? length : void 0;
+  let done = 0;
+  const report = () => onProgress?.({ done, ...total === void 0 ? {} : { total } });
+  report();
+  const chunks = [];
+  if (response.body) {
+    for await (const chunk of response.body) {
+      chunks.push(chunk);
+      done += chunk.length;
+      report();
+    }
+  }
+  return Buffer.concat(chunks);
+}
+
+// src/runtime.ts
+var NODE_VERSION = "24.20.0";
+var NPM_VERSION = "12.0.2";
+var ARTIFACTS = {
+  "win32-x64": ["node-v24.20.0-win-x64.zip", "6cac9ffbca8f6a47091e4b5c772e0606049c3871cb67d900c0cedde630e545ba"],
+  "win32-arm64": ["node-v24.20.0-win-arm64.zip", "31c6799744de8a54601643098040c68c3697e56c94e407d61d0e5fa5f34191d7"],
+  "darwin-arm64": ["node-v24.20.0-darwin-arm64.tar.gz", "40e5607e5ecb3db9192723776da2d75d966260fc74a7a9e731c1bd67dda96bc8"],
+  "linux-x64": ["node-v24.20.0-linux-x64.tar.gz", "855d581f8a4eb1a8117e3426de25fe02770592febcfb31369aee1ffbfee9e8ec"],
+  "linux-arm64": ["node-v24.20.0-linux-arm64.tar.gz", "3515603e2487879a39bc75716f1a2affd027500c64ba50e845cf72cb33219013"]
+};
+var NPM_INTEGRITY = "uIXokLlBj6FpNUTQX1PmT5pz7BlIN9QlixX+zdaSNHsd0qUXsbDLr50xzY6Sw7cJVr0uzHKDOle0swmPW/p5Qw==";
+async function verifiedDownload(url, path, algorithm, digest, fetchImpl, onProgress) {
+  const response = await fetchImpl(url);
+  if (!response.ok) throw new Error(`runtime download failed (${response.status})`);
+  const bytes = await readDownload(response, onProgress);
+  if ((0, import_node_crypto.createHash)(algorithm).update(bytes).digest(algorithm === "sha512" ? "base64" : "hex") !== digest) throw new Error("runtime archive checksum mismatch");
+  (0, import_node_fs.writeFileSync)(path, bytes);
+}
+function command(executable, args) {
+  const result = (0, import_node_child_process.spawnSync)(executable, args, { encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) throw new Error(`runtime preparation failed: ${result.error?.message ?? result.stderr.trim()}`);
+  return result.stdout.trim();
+}
+async function acquireRuntime(dir, fetchImpl = fetch, onProgress) {
+  const platform = `${process.platform}-${process.arch}`;
+  const artifact = ARTIFACTS[platform];
+  if (!artifact) throw new Error(`managed runtime does not support ${platform}`);
+  const runtimeDir = (0, import_node_path.join)(dir, "runtimes");
+  (0, import_node_fs.mkdirSync)(runtimeDir, { recursive: true });
+  const receipt = (0, import_node_path.join)(runtimeDir, `node-${NODE_VERSION}-npm-${NPM_VERSION}-${platform}.json`);
+  if ((0, import_node_fs.existsSync)(receipt)) {
+    const runtime2 = JSON.parse((0, import_node_fs.readFileSync)(receipt, "utf8"));
+    for (const executable of [runtime2.node, runtime2.npm]) {
+      const rel = (0, import_node_path.relative)((0, import_node_fs.realpathSync)(runtimeDir), (0, import_node_fs.realpathSync)(executable));
+      if (rel.startsWith("..") || (0, import_node_path.isAbsolute)(rel)) throw new Error("cached runtime escapes owned directory");
+    }
+    if (command(runtime2.node, ["--version"]) === `v${NODE_VERSION}` && command(runtime2.node, [runtime2.npm, "--version"]) === NPM_VERSION) return runtime2;
+    throw new Error("cached runtime validation failed");
+  }
+  const root = (0, import_node_fs.mkdtempSync)((0, import_node_path.join)(runtimeDir, "runtime-"));
+  const archive = (0, import_node_path.join)(root, artifact[0]);
+  let downloaded = 0;
+  let currentBytes = 0;
+  const progress = ({ done }) => {
+    currentBytes = done;
+    onProgress?.({ done: downloaded + done });
+  };
+  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl, progress);
+  downloaded += currentBytes;
+  const tar = process.platform === "win32" ? (0, import_node_path.join)(process.env.SystemRoot ?? "C:/Windows", "System32", "tar.exe") : "/usr/bin/tar";
+  command(tar, ["-xf", archive, "-C", root]);
+  const unpacked = (0, import_node_path.join)(root, artifact[0].replace(/\.(zip|tar\.gz)$/, ""));
+  const node = (0, import_node_path.join)(unpacked, process.platform === "win32" ? "node.exe" : "bin/node");
+  const npmArchive = (0, import_node_path.join)(root, "npm.tgz");
+  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl, progress);
+  const npmRoot = (0, import_node_path.join)(root, "npm");
+  (0, import_node_fs.mkdirSync)(npmRoot);
+  command(tar, ["-xf", npmArchive, "-C", npmRoot]);
+  const installedNpm = (0, import_node_path.join)(unpacked, process.platform === "win32" ? "node_modules/npm" : "lib/node_modules/npm");
+  if ((0, import_node_fs.existsSync)(installedNpm)) (0, import_node_fs.renameSync)(installedNpm, (0, import_node_path.join)(root, "npm-bundled"));
+  (0, import_node_fs.renameSync)((0, import_node_path.join)(npmRoot, "package"), installedNpm);
+  const npm = (0, import_node_path.join)(installedNpm, "bin/npm-cli.js");
+  if (command(node, ["--version"]) !== `v${NODE_VERSION}` || command(node, [npm, "--version"]) !== NPM_VERSION) throw new Error("downloaded runtime validation failed");
+  const runtime = { node, npm };
+  const temporary = `${receipt}.${(0, import_node_crypto.randomUUID)()}.tmp`;
+  try {
+    (0, import_node_fs.writeFileSync)(temporary, JSON.stringify(runtime), { flag: "wx", mode: 384, flush: true });
+    (0, import_node_fs.renameSync)(temporary, receipt);
+  } finally {
+    (0, import_node_fs.rmSync)(temporary, { force: true });
+  }
+  return runtime;
+}
+
+// src/store.ts
+var import_node_fs2 = require("node:fs");
+var import_node_crypto2 = require("node:crypto");
+var import_node_os = require("node:os");
+var import_node_path2 = require("node:path");
+function defaultProductDir(product) {
+  if (process.platform === "win32") {
+    const base = process.env.LOCALAPPDATA ?? (0, import_node_path2.join)((0, import_node_os.tmpdir)(), "launcher-fallback");
+    return (0, import_node_path2.join)(base, product);
+  }
+  const home = process.env.HOME ?? (0, import_node_os.tmpdir)();
+  return (0, import_node_path2.join)(home, `.${product}`);
+}
+function resolveProductDir(product, explicit) {
+  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
+}
+function tokensPath(dir) {
+  return (0, import_node_path2.join)(dir, "tokens.json");
+}
+function statePath(dir) {
+  return (0, import_node_path2.join)(dir, "state.json");
+}
+function payloadDir(dir) {
+  const acquired = readState(dir)?.acquired;
+  if (acquired) return (0, import_node_path2.join)(dir, "candidates", acquired.candidate, "payload");
+  return (0, import_node_path2.join)(dir, "payload");
+}
+function readTokens(dir) {
+  try {
+    const data = JSON.parse((0, import_node_fs2.readFileSync)(tokensPath(dir), "utf8"));
+    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
+    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
+    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
+    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
+    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
+    return tokens;
+  } catch {
+    return null;
+  }
+}
+function writeTokens(dir, tokens) {
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  try {
+    (0, import_node_fs2.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
+`, { mode: 384 });
+  } catch {
+    (0, import_node_fs2.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
+`);
+  }
+}
+function clearTokens(dir) {
+  (0, import_node_fs2.rmSync)(tokensPath(dir), { force: true });
+}
+function readState(dir) {
+  try {
+    const data = JSON.parse((0, import_node_fs2.readFileSync)(statePath(dir), "utf8"));
+    if (typeof data.version !== "string" || !data.version) return null;
+    const state = { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
+    if (data.acquired) {
+      if (!/^[a-zA-Z0-9_-]+$/.test(data.acquired.candidate) || typeof data.acquired.node !== "string" || typeof data.acquired.entry !== "string") return null;
+      state.acquired = data.acquired;
+    }
+    return state;
+  } catch {
+    return null;
+  }
+}
+function writeState(dir, state) {
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  const temporary = `${statePath(dir)}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
+  try {
+    (0, import_node_fs2.writeFileSync)(temporary, `${JSON.stringify(state, null, 2)}
+`, { flag: "wx", mode: 384, flush: true });
+    (0, import_node_fs2.renameSync)(temporary, statePath(dir));
+  } finally {
+    (0, import_node_fs2.rmSync)(temporary, { force: true });
+  }
+}
+function wipeProductDir(dir) {
+  const payload = payloadDir(dir);
+  (0, import_node_fs2.rmSync)(tokensPath(dir), { force: true });
+  (0, import_node_fs2.rmSync)(statePath(dir), { force: true });
+  (0, import_node_fs2.rmSync)(payload, { force: true, recursive: true });
+}
+
+// src/payload.ts
+var import_node_crypto3 = require("node:crypto");
+var import_node_fs4 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path3 = require("node:path");
+
+// src/canonical.ts
+function canonicalJson(value) {
+  return encode(value);
+}
+function encode(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("canonicalJson: cannot encode a non-finite number");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
+}
+
+// src/config.ts
+var import_node_fs3 = require("node:fs");
+var import_node_sea = require("node:sea");
+
+// src/module-url.ts
+var import_node_url = require("node:url");
+var import_meta = {};
+function moduleUrl() {
+  if (typeof __filename === "string") return (0, import_node_url.pathToFileURL)(__filename).href;
+  return import_meta.url;
+}
+
+// src/config.ts
+function publicKeyBytes(config) {
+  const raw = Buffer.from(config.publicKey, "base64");
+  if (raw.length !== 32) {
+    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
+  }
+  return raw;
+}
+function loadProductConfig(options = {}) {
+  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
+  const devFallback = new URL("../config/product.template.json", moduleUrl());
+  if (explicit) {
+    return parseProductConfig((0, import_node_fs3.readFileSync)(explicit, "utf8"));
+  }
+  try {
+    return parseProductConfig((0, import_node_fs3.readFileSync)(devFallback, "utf8"));
+  } catch {
+  }
+  try {
+    const asset = (0, import_node_sea.getAsset)("product.json", "utf8");
+    if (typeof asset === "string") return parseProductConfig(asset);
+  } catch {
+  }
+  throw new Error(
+    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
+  );
+}
+function parseProductConfig(text) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error("product config is not valid JSON");
+  }
+  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
+  const record = data;
+  const product = field(record, "product");
+  const host = field(record, "host").replace(/\/+$/, "");
+  const loginKind = field(record, "loginKind");
+  const binName = field(record, "binName");
+  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
+  if (loginKind !== "github" && loginKind !== "google") {
+    throw new Error('product config loginKind must be "github" or "google"');
+  }
+  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
+  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
+  publicKeyBytes(config);
+  if (loginKind === "github") {
+    const clientId = record.githubClientId;
+    if (typeof clientId !== "string" || clientId.length === 0) {
+      throw new Error("product config needs githubClientId for the github loginKind");
+    }
+    config.githubClientId = clientId;
+  } else if (typeof record.githubClientId === "string") {
+    config.githubClientId = record.githubClientId;
+  }
+  try {
+    const url = new URL(host);
+    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
+  } catch {
+    throw new Error("product config host must be an http(s) URL");
+  }
+  return config;
+}
+function field(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : "";
+}
+
+// src/payload.ts
+var NeedsLoginError = class extends Error {
+  constructor() {
+    super("signed out \u2014 run login first");
+    this.name = "NeedsLoginError";
+  }
+};
+var ForbiddenError = class extends Error {
+  constructor() {
+    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
+    this.name = "ForbiddenError";
+  }
+};
+function canonicalManifestBytes(manifest) {
+  return Buffer.from(
+    canonicalJson({
+      created: manifest.created,
+      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
+      version: manifest.version
+    }),
+    "utf8"
+  );
+}
+function ed25519PublicKey(config) {
+  const raw = publicKeyBytes(config);
+  return (0, import_node_crypto3.createPublicKey)({
+    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyManifest(manifest, signature, config) {
+  try {
+    const signatureBytes = Buffer.from(signature, "base64");
+    if (signatureBytes.length === 0) return false;
+    return (0, import_node_crypto3.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
+  } catch {
+    return false;
+  }
+}
+function verifyFileBytes(entry2, bytes) {
+  if (entry2.size !== bytes.length) return false;
+  return (0, import_node_crypto3.createHash)("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
+}
+async function readErrorCode(response) {
+  try {
+    const data = await response.json();
+    return typeof data.error === "string" ? data.error : "";
+  } catch {
+    return "";
+  }
+}
+function throwForStatus(status, errorCode) {
+  if (status === 401) throw new NeedsLoginError();
+  if (status === 403) throw new ForbiddenError();
+  throw new Error(
+    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
+  );
+}
+async function getJson(url, accessToken, fetchImpl) {
+  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
+  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
+  return { status: response.status, json: await response.json() };
+}
+function parseManifest(json) {
+  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
+  const record = json;
+  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
+  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
+  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
+  if (typeof record.signature !== "string" || !record.signature) {
+    throw new Error("the release manifest is unsigned");
+  }
+  const files = record.files.map((entry2) => {
+    const file = entry2;
+    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
+      throw new Error("the release manifest lists a malformed file");
+    }
+    const safe = safeManifestPath(file.path);
+    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
+    return { path: safe, sha256: file.sha256, size: file.size };
+  });
+  return { version: record.version, created: record.created, files, signature: record.signature };
+}
+function safeManifestPath(rawPath) {
+  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
+  if (rawPath.startsWith("/")) return null;
+  const segments = rawPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") return null;
+  }
+  return segments.join("/");
+}
+async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
+  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
+  const manifest = parseManifest(json);
+  if (!verifyManifest(manifest, manifest.signature, config)) {
+    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
+  }
+  return manifest;
+}
+async function fetchFileBytes(config, accessToken, path, fetchImpl, onProgress, expectedSize) {
+  const encoded = path.split("/").map(encodeURIComponent).join("/");
+  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!response.ok) {
+    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
+    throwForStatus(response.status, await readErrorCode(response));
+  }
+  return readDownload(response, onProgress, expectedSize);
+}
+async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const staging = (0, import_node_path3.join)((0, import_node_os2.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
+  (0, import_node_fs4.mkdirSync)(staging, { recursive: true });
+  try {
+    const total = manifest.files.reduce((sum, entry2) => sum + entry2.size, 0);
+    let downloaded = 0;
+    for (const entry2 of manifest.files) {
+      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl, (progress) => options.onProgress?.({ done: downloaded + progress.done, total }), entry2.size);
+      downloaded += bytes.length;
+      if (!verifyFileBytes(entry2, bytes)) {
+        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
+      }
+      const dest = (0, import_node_path3.join)(staging, entry2.path);
+      (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(dest), { recursive: true });
+      (0, import_node_fs4.writeFileSync)(dest, bytes);
+    }
+    const target = (0, import_node_path3.join)(dir, "payload");
+    (0, import_node_fs4.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs4.rmSync)(target, { force: true, recursive: true });
+    (0, import_node_fs4.renameSync)(staging, target);
+  } catch (error) {
+    (0, import_node_fs4.rmSync)(staging, { force: true, recursive: true });
+    throw error;
+  }
+  return manifest.version;
+}
+
+// src/acquisition.ts
+function reusableCandidate(dir, manifest) {
+  try {
+    const saved = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(dir, "acquisition-cache.json"), "utf8"));
+    if (saved.signature !== manifest.signature) return null;
+    const root = candidateRoot(dir, saved.candidate);
+    if (!(0, import_node_fs5.existsSync)((0, import_node_path4.join)(root, "acquired.json"))) return null;
+    for (const file of manifest.files) {
+      if (!safePath(file.path) || !verifyFileBytes(file, (0, import_node_fs5.readFileSync)((0, import_node_path4.join)(root, "payload", file.path)))) return null;
+    }
+    return saved.candidate;
+  } catch {
+    return null;
+  }
+}
+function rememberCandidate(dir, candidate, manifest) {
+  candidateRoot(dir, candidate);
+  (0, import_node_fs5.writeFileSync)((0, import_node_path4.join)(dir, "acquisition-cache.json"), JSON.stringify({ candidate, signature: manifest.signature }), { mode: 384 });
+}
+function safePath(value) {
+  return typeof value === "string" && value.length > 0 && !/[\\:\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+function argumentsValid(value) {
+  return Array.isArray(value) && value.every((arg) => typeof arg === "string" && !arg.includes("\0") && (!arg.includes("$") || arg === "$prefix" || arg === "$version"));
+}
+function readAcquisition(payload) {
+  const metadata = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(payload, "payload.json"), "utf8"));
+  if (metadata.acquisition === void 0) return null;
+  const a = metadata.acquisition;
+  if (!a || a.schema !== 1 || !/^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(a.package) || !safePath(a.archive) || !a.archive.endsWith(".tgz") || !safePath(a.convergeEntry) || !safePath(a.rollbackEntry) || !safePath(a.runEntry) || !argumentsValid(a.convergeArgs) || !argumentsValid(a.rollbackArgs) || !argumentsValid(a.repairArgs) || !Array.isArray(a.platforms) || !a.platforms.length || a.platforms.some((p) => !["win32-x64", "win32-arm64", "darwin-arm64", "linux-x64", "linux-arm64"].includes(p))) {
+    throw new Error("invalid signed acquisition declaration");
+  }
+  return a;
+}
+function runtimeEnvironment(node, inherited, platform = process.platform) {
+  const env = { ...inherited };
+  let current = env.PATH ?? "";
+  if (platform === "win32") {
+    const keys = Object.keys(env).filter((key) => key.toLowerCase() === "path").sort();
+    current = (keys.length ? env[keys[0]] : "") ?? "";
+    for (const key of keys) delete env[key];
+  }
+  env.PATH = `${(0, import_node_path4.dirname)(node)}${platform === "win32" ? ";" : ":"}${current}`;
+  return env;
+}
+function lockInstallation(dir) {
+  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+  const path = (0, import_node_path4.join)(dir, "installation.lock");
+  const owner = `${process.pid}:${(0, import_node_crypto4.randomUUID)()}`;
+  try {
+    (0, import_node_fs5.writeFileSync)(path, owner, { flag: "wx", mode: 384 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const recovery = `${path}.recovery`;
+    try {
+      (0, import_node_fs5.writeFileSync)(recovery, owner, { flag: "wx", mode: 384, flush: true });
+    } catch {
+      throw new Error("installation lock recovery is already pending");
+    }
+    try {
+      const previous = (0, import_node_fs5.readFileSync)(path, "utf8");
+      const pid = Number(previous.split(":")[0]);
+      if (!Number.isInteger(pid) || pid <= 0) throw new Error("installation lock is malformed; recovery required");
+      try {
+        process.kill(pid, 0);
+        throw new Error("another installer is running");
+      } catch (probe) {
+        if (probe.code !== "ESRCH") throw probe;
+      }
+      (0, import_node_fs5.unlinkSync)(path);
+      (0, import_node_fs5.writeFileSync)(path, owner, { flag: "wx", mode: 384, flush: true });
+    } finally {
+      (0, import_node_fs5.unlinkSync)(recovery);
+    }
+  }
+  let released = false;
+  return () => {
+    if (!released && (0, import_node_fs5.readFileSync)(path, "utf8") === owner) (0, import_node_fs5.unlinkSync)(path);
+    released = true;
+  };
+}
+function pendingPath(dir) {
+  return (0, import_node_path4.join)(dir, "acquisition-pending.json");
+}
+function candidateRoot(dir, candidate) {
+  if (!/^[a-zA-Z0-9_-]+$/.test(candidate)) throw new Error("invalid acquisition candidate");
+  return (0, import_node_path4.join)(dir, "candidates", candidate);
+}
+function packageRoot(prefix, acquisition) {
+  return (0, import_node_path4.join)(prefix, "node_modules", acquisition.package);
+}
+function entry(root, path) {
+  const actual = (0, import_node_fs5.realpathSync)((0, import_node_path4.join)(root, path));
+  const rel = (0, import_node_path4.relative)((0, import_node_fs5.realpathSync)(root), actual);
+  if (rel.startsWith("..") || (0, import_node_path4.isAbsolute)(rel)) throw new Error("acquired entry escapes package");
+  return actual;
+}
+function argv(node, root, file, args, prefix, version) {
+  return [node, entry(root, file), ...args.map((arg) => arg === "$prefix" ? prefix : arg === "$version" ? version : arg)];
+}
+function acquisitionRepairCommand(dir, version) {
+  const state = readState(dir);
+  if (!state?.acquired || state.version !== version) throw new Error("installed acquisition selection is missing");
+  const root = candidateRoot(dir, state.acquired.candidate);
+  const acquisition = readAcquisition((0, import_node_path4.join)(root, "payload"));
+  if (!acquisition) throw new Error("installed acquisition declaration is missing");
+  const prefix = (0, import_node_path4.join)(root, "prefix");
+  const productRoot = packageRoot(prefix, acquisition);
+  const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(productRoot, "package.json"), "utf8"));
+  if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("installed package identity does not match signed release");
+  return argv((0, import_node_fs5.realpathSync)(state.acquired.node), productRoot, acquisition.runEntry, acquisition.repairArgs, prefix, version);
+}
+async function recoverAcquisition(dir, run2, env) {
+  if (!(0, import_node_fs5.existsSync)(pendingPath(dir))) return;
+  const pending = JSON.parse((0, import_node_fs5.readFileSync)(pendingPath(dir), "utf8"));
+  if (pending.schema !== 1 || typeof pending.version !== "string" || typeof pending.node !== "string") throw new Error("invalid pending acquisition receipt");
+  const root = candidateRoot(dir, pending.candidate);
+  if (readState(dir)?.acquired?.candidate === pending.candidate) {
+    (0, import_node_fs5.unlinkSync)(pendingPath(dir));
+    return;
+  }
+  const acquisition = readAcquisition((0, import_node_path4.join)(root, "payload"));
+  if (!acquisition) throw new Error("pending acquisition lost its signed declaration");
+  const prefix = (0, import_node_path4.join)(root, "prefix");
+  const command2 = argv(pending.node, packageRoot(prefix, acquisition), acquisition.rollbackEntry, acquisition.rollbackArgs, prefix, pending.version);
+  if (!await run2(command2, root, runtimeEnvironment(pending.node, env))) throw new Error("installation recovery is pending; product rollback did not finish");
+  if (pending.previous) writeState(dir, pending.previous);
+  else if ((0, import_node_fs5.existsSync)(statePath(dir))) (0, import_node_fs5.unlinkSync)(statePath(dir));
+  (0, import_node_fs5.unlinkSync)(pendingPath(dir));
+}
+async function installAcquisition(dir, candidate, version, acquisition, options) {
+  if (!acquisition.platforms.includes(`${process.platform}-${process.arch}`)) throw new Error("this product does not support this platform");
+  const root = candidateRoot(dir, candidate);
+  const payload = (0, import_node_path4.join)(root, "payload");
+  const prefix = (0, import_node_path4.join)(root, "prefix");
+  const prepared = (0, import_node_path4.join)(root, "acquired.json");
+  const archiveHash = (0, import_node_crypto4.createHash)("sha256").update((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(payload, acquisition.archive))).digest("hex");
+  const reused = (0, import_node_fs5.existsSync)(prepared);
+  if (reused && JSON.parse((0, import_node_fs5.readFileSync)(prepared, "utf8")).archiveHash !== archiveHash) throw new Error("cached acquisition archive changed");
+  if (!reused) (0, import_node_fs5.mkdirSync)(prefix);
+  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl, options.onProgress);
+  const env = runtimeEnvironment(runtime.node, options.env);
+  const npmEnv = { ...env };
+  for (const key of Object.keys(npmEnv)) {
+    if (/^npm_config_/i.test(key) || /^(NPM_TOKEN|NODE_AUTH_TOKEN|MM_INSTALLER_TOKEN)$/i.test(key)) delete npmEnv[key];
+  }
+  const npmrc = (0, import_node_path4.join)(root, "public.npmrc");
+  const globalrc = (0, import_node_path4.join)(root, "global.npmrc");
+  (0, import_node_fs5.writeFileSync)(npmrc, "registry=https://registry.npmjs.org/\n");
+  (0, import_node_fs5.writeFileSync)(globalrc, "");
+  const install = [
+    runtime.node,
+    runtime.npm,
+    "install",
+    "--prefix",
+    prefix,
+    "--install-strategy=shallow",
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+    "--userconfig",
+    npmrc,
+    "--globalconfig",
+    globalrc,
+    "--registry",
+    "https://registry.npmjs.org/",
+    (0, import_node_path4.resolve)(payload, acquisition.archive)
+  ];
+  if (!reused && !await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
+  const productRoot = packageRoot(prefix, acquisition);
+  const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(productRoot, "package.json"), "utf8"));
+  if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("acquired package identity does not match signed release");
+  const runEntry = entry(productRoot, acquisition.runEntry);
+  const convergence = argv(runtime.node, productRoot, acquisition.convergeEntry, acquisition.convergeArgs, prefix, version);
+  entry(productRoot, acquisition.rollbackEntry);
+  if (!reused) (0, import_node_fs5.writeFileSync)(prepared, JSON.stringify({ archiveHash }), { flag: "wx", mode: 384, flush: true });
+  const pending = { schema: 1, candidate, version, node: runtime.node, previous: readState(dir) };
+  (0, import_node_fs5.writeFileSync)(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
+  try {
+    if (!await options.run(convergence, root, env)) throw new Error("product convergence did not finish");
+    (options.commit ?? writeState)(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), acquired: { candidate, node: runtime.node, entry: runEntry } });
+  } catch (error) {
+    await recoverAcquisition(dir, options.run, env);
+    throw error;
+  }
+  (0, import_node_fs5.unlinkSync)(pendingPath(dir));
+}
+
+// src/index.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_fs11 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path6 = require("node:path");
 var import_node_url2 = require("node:url");
 
 // ../face/src/face.ts
-var import_node_fs = require("node:fs");
+var import_node_fs6 = require("node:fs");
 
 // ../face/src/products.ts
 var PRODUCTS = Object.freeze({
   "mm-strategy": Object.freeze({
     name: "MM Strategy",
-    installWarm: "Welcome. Let's set up MM Strategy \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;249;115;22",
-    warm: "Welcome. Let's set up MM Strategy \u2014 about a minute.",
+    warm: "Welcome back. Checking for updates...",
     doctor: "mm-strategy doctor"
   }),
   "mmi-hub": Object.freeze({
     name: "mmi-hub",
-    installWarm: "Welcome. Setting up mmi-hub \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;125;211;252",
-    warm: "Welcome back. Checking your surfaces\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "mmi doctor"
   }),
   "jerv-hub": Object.freeze({
     name: "jerv-hub",
-    installWarm: "Welcome. Setting up jerv-hub \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;248;113;113",
-    warm: "Welcome back. Checking your surfaces\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "jerv doctor"
   }),
   jervcode: Object.freeze({
     name: "JervCode",
-    installWarm: "Welcome. Setting up JervCode \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;192;132;252",
-    warm: "Welcome back. Keeping JervCode current\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "jervcode doctor"
   })
 });
@@ -82,6 +713,7 @@ function identityFor(product) {
 
 // ../face/src/face.ts
 var GLYPH = Object.freeze({
+  clock: "\u23F0",
   diamond: "\u25C6",
   hollow: "\u25C7",
   bar: "\u2502",
@@ -153,12 +785,16 @@ function createFace({ product, color = false, columns, env = process.env, operat
   const continuesFace = continuedPhases.size > 0;
   const nested = env.MM_OUTER_CONSOLE === "1";
   const progressFd = readProgressFd(env);
+  const progressFile = env.MM_PROGRESS_PROTOCOL === "1" ? env.MM_PROGRESS_FILE : void 0;
   const emitMilestone = (title, measure, kind) => {
-    if (progressFd === null) return false;
+    if (progressFd === null && !progressFile) return false;
     const record = { v: PROGRESS_PROTOCOL, step: stripColor(title), state: kind };
     if (typeof measure === "number") record.ms = Math.max(0, Math.round(measure * 1e3));
+    if (kind === "running" && typeof measure === "string") record.measure = measure;
     try {
-      (0, import_node_fs.writeSync)(progressFd, `${JSON.stringify(record)}
+      if (progressFile) (0, import_node_fs6.appendFileSync)(progressFile, `${JSON.stringify(record)}
+`);
+      else (0, import_node_fs6.writeSync)(progressFd, `${JSON.stringify(record)}
 `);
       return true;
     } catch {
@@ -177,7 +813,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
   };
   const step = (title, measure = null, kind = "ok") => {
     if (emitMilestone(title, measure, kind)) return "";
-    const glyph = kind === "fail" ? paint(identity.accent, GLYPH.cross) : kind === "note" ? paint(PALETTE.muted, GLYPH.dot) : paint(PALETTE.green, GLYPH.check);
+    const glyph = title === "Armed hourly updates" && kind === "ok" ? GLYPH.clock : kind === "fail" ? paint(identity.accent, GLYPH.cross) : kind === "note" ? paint(PALETTE.muted, GLYPH.dot) : paint(PALETTE.green, GLYPH.check);
     const measured = measure === null || measure === void 0 ? "" : paint(PALETTE.muted, typeof measure === "number" ? `${Math.max(0, Math.round(measure))}s` : String(measure).trim());
     const time = measured;
     const column = Math.min(44, Math.max(0, width - 8));
@@ -187,7 +823,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
     const pad = Math.max(1, column - visibleWidth(head));
     return [time ? `${head}${" ".repeat(pad)}${time}` : head, ...rest.map((line) => `${bar()}${indent}${line}`)].join("\n");
   };
-  const relay = (text) => String(text).split("\n").flatMap((line) => line.trim() === "" ? [bar()] : (visibleWidth(line) <= width - TITLE_COLUMN ? [line] : wrapWords(line, width - TITLE_COLUMN)).map((part) => `${bar()}${indent}${part}`)).join("\n");
+  const relay = (text) => String(text).replace(/\r?\n$/, "").split(/\r?\n/).flatMap((line) => line.trim() === "" ? [bar()] : (visibleWidth(line) <= width - TITLE_COLUMN ? [line] : wrapWords(line, width - TITLE_COLUMN)).map((part) => `${bar()}${indent}${part}`)).join("\n");
   const receipt = (lines, { ready = true } = {}) => {
     if (ready && nested) return [];
     const body = (Array.isArray(lines) ? lines : String(lines).split("\n")).flatMap((raw) => {
@@ -218,14 +854,14 @@ function createFace({ product, color = false, columns, env = process.env, operat
   };
   const signOff = () => nested ? "" : `${paint(identity.accent, GLYPH.diamond)}  ${paint(identity.accent, `${identity.name} \xB7 Mutatis Mutandis`)}`;
   const refusal = (message) => `${bar()}  ${paint(identity.accent, GLYPH.cross)}  ${message}`;
-  return { identity, width, nested, emitsProgress: progressFd !== null, welcome, continues, step, relay, receipt, outcome, signOff, refusal, paint };
+  return { identity, width, nested, emitsProgress: progressFd !== null || Boolean(progressFile), welcome, continues, step, progress: (title, measure = null) => emitMilestone(title, measure, "running"), relay, receipt, outcome, signOff, refusal, paint };
 }
 
 // ../face/src/shell.ts
 var RELAY_INDENT = " ".repeat(TITLE_COLUMN - 1);
 
 // ../face/src/spinner.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_worker_threads = require("node:worker_threads");
 var FRAMES = ["\u25D2", "\u25D0", "\u25D3", "\u25D1"];
 var WORKER_SOURCE = `
@@ -237,7 +873,7 @@ function draw() {
   if (Atomics.compareExchange(control, 1, 0, 1) !== 0) return;
   try {
     if (Atomics.load(control, 0) || Atomics.load(control, 2) || !frames.length) return;
-    const text = frames[frame++ % frames.length];
+    const text = frames[frame++ % frames.length].replace('__elapsed__', Math.floor((Date.now() - workerData.started) / 1000) + 's');
     writeSync(2, text);
     if (workerData.transcriptPath) appendFileSync(workerData.transcriptPath, JSON.stringify({ channel: 'spinner', text }) + '\\n');
   } finally {
@@ -249,7 +885,6 @@ parentPort.on('message', (next) => {
   if (Atomics.load(control, 2)) return;
   frames = next.frames;
   frame = next.frame;
-  Atomics.store(control, 0, 0);
 });
 setInterval(draw, workerData.intervalMs);
 `;
@@ -260,20 +895,22 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
   let control = null;
   let frames = [];
   let frame = 0;
+  let started = 0;
+  let suspended = false;
   const write = (text) => {
     if (stream) stream.write(text);
     else {
-      (0, import_node_fs2.writeSync)(2, text);
-      if (transcriptPath) (0, import_node_fs2.appendFileSync)(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
+      (0, import_node_fs7.writeSync)(2, text);
+      if (transcriptPath) (0, import_node_fs7.appendFileSync)(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
 `);
     }
   };
   const render = (text, measure) => {
-    const line = face.step(text, measure, "note").split("\n")[0];
+    const line = face.step(text, measure ?? "__elapsed__", "note").split("\n")[0];
     frames = line ? FRAMES.map((glyph) => `\r\x1B[2K${line.replace(GLYPH.dot, glyph)}`) : [];
   };
   const draw = () => {
-    if (animate && frames.length) write(frames[frame++ % frames.length]);
+    if (animate && !suspended && frames.length) write(frames[frame++ % frames.length].replace("__elapsed__", `${Math.floor((Date.now() - started) / 1e3)}s`));
   };
   const pause = () => {
     if (!control) return;
@@ -293,6 +930,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
     start(text, measure = null) {
       if (!animate) return;
       halt();
+      suspended = false;
+      started = Date.now();
       render(text, measure);
       frame = 0;
       draw();
@@ -306,7 +945,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
             frames,
             frame,
             intervalMs,
-            transcriptPath
+            transcriptPath,
+            started
           } });
           const active = worker;
           worker.on("error", () => {
@@ -324,9 +964,22 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
       render(text, measure);
       draw();
       worker?.postMessage({ frames, frame });
+      if (control && !suspended) Atomics.store(control, 0, 0);
+    },
+    pause() {
+      if (suspended) return;
+      suspended = true;
+      pause();
+      if (animate && frames.length) write("\r\x1B[2K");
+    },
+    resume() {
+      suspended = false;
+      if (control) Atomics.store(control, 0, 0);
+      if (timer || worker) draw();
     },
     stop() {
       halt();
+      frames = [];
       if (animate) write("\r\x1B[2K");
     }
   };
@@ -337,10 +990,10 @@ var SPINNER_FRAMES = Object.freeze([...FRAMES]);
 var ALLOWED = new Set(Object.values(GLYPH));
 
 // ../face/src/run.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 
 // ../face/src/outcome.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var counts = ["total", "updated", "failed"];
 var strings = ["version", "retry", "detail", "logPath"];
 var flags = ["dryRun", "installed", "deferred", "operationFailed"];
@@ -362,12 +1015,12 @@ function validateInstallerOutcome(value) {
   return { ...facts };
 }
 function writeInstallerOutcome(path, value) {
-  (0, import_node_fs3.writeFileSync)(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
+  (0, import_node_fs8.writeFileSync)(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
 }
 function readInstallerOutcome(path) {
   let text;
   try {
-    text = (0, import_node_fs3.readFileSync)(path, "utf8");
+    text = (0, import_node_fs8.readFileSync)(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -430,6 +1083,7 @@ var PHASES = {
   "verify-release": ["Checking the release version", "Verified the release version"],
   verify: ["Verifying the payload", "Verified the payload"],
   install: ["Installing the product", "Installed the product"],
+  configure: ["Configuring the product", "Configured the product"],
   activate: ["Activating surfaces", "Activated surfaces"],
   doctor: ["Checking health", "Checked health"],
   rollback: ["Restoring the previous version", "Restored the previous version"]
@@ -459,7 +1113,7 @@ function createInstallerRun(value, options = {}) {
     if (!text) return;
     write(text, channel);
     if (env.MM_FACE_TRANSCRIPT) {
-      (0, import_node_fs4.appendFileSync)(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
+      (0, import_node_fs9.appendFileSync)(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
 `, "utf8");
     }
   };
@@ -474,6 +1128,17 @@ function createInstallerRun(value, options = {}) {
       return true;
     } } } : { transcriptPath: env.MM_FACE_TRANSCRIPT }
   });
+  let activeTitle;
+  let chunkOpen = false;
+  let chunkChannel = "stdout";
+  let chunkColumn = 0;
+  const trailingCR = /* @__PURE__ */ new Set();
+  let deferredActivity;
+  const closeChunk = () => {
+    if (chunkOpen) emit("\n", chunkChannel);
+    chunkOpen = false;
+    chunkColumn = 0;
+  };
   let started = false;
   let finished = false;
   const start = () => {
@@ -488,6 +1153,9 @@ function createInstallerRun(value, options = {}) {
     }
   };
   const durable = (title, measure, kind) => {
+    closeChunk();
+    activeTitle = void 0;
+    deferredActivity = void 0;
     spinner.stop();
     const rendered = face.step(title, measure, kind);
     if (rendered) lines([tty ? rendered : `${kind === "fail" ? "Failed: " : ""}${title}${measure === null ? "" : ` (${typeof measure === "number" ? `${Math.max(0, Math.round(measure))}s` : measure})`}`]);
@@ -504,7 +1172,12 @@ function createInstallerRun(value, options = {}) {
       const state = facts.state ?? "ok";
       const title = PHASES[id][state === "ok" ? 1 : 0];
       if (state === "running") {
-        spinner.start(title, facts.measure ?? null);
+        if (face.progress(title, facts.measure ?? null)) return;
+        if (activeTitle === title) spinner.say(title, facts.measure ?? null);
+        else {
+          activeTitle = title;
+          spinner.start(title, facts.measure ?? null);
+        }
         return;
       }
       if (!face.continues(id, state)) durable(title, facts.seconds ?? facts.measure ?? null, state);
@@ -524,8 +1197,20 @@ function createInstallerRun(value, options = {}) {
       durable(`${facts.id}${versions} ${separator} ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
       if (facts.detail) run2.relay(facts.detail);
     },
-    milestone({ step, state, ms }) {
+    milestone({ step, state, ms, measure }) {
       start();
+      if (state === "running") {
+        if (chunkOpen) {
+          deferredActivity = { title: step, measure: measure ?? null };
+          return;
+        }
+        if (activeTitle === step) spinner.say(step, measure ?? null);
+        else {
+          activeTitle = step;
+          spinner.start(step, measure ?? null);
+        }
+        return;
+      }
       durable(step, ms === void 0 ? null : ms / 1e3, state);
     },
     signIn({ url, code }) {
@@ -539,7 +1224,8 @@ function createInstallerRun(value, options = {}) {
     },
     // Only pass safe diagnostic text, never authentication output or credentials.
     relay(text, channel = "stdout", record = true) {
-      spinner.stop();
+      closeChunk();
+      spinner.pause();
       const rendered = tty ? face.relay(text) : stripColor(text);
       for (const row of rendered.split("\n")) if (row) {
         emit(`${row}
@@ -547,6 +1233,37 @@ function createInstallerRun(value, options = {}) {
 ` : `${tty ? face.relay("[external output omitted]") : "[external output omitted]"}
 `);
       }
+      spinner.resume();
+    },
+    relayChunk(text, channel = "stdout") {
+      spinner.pause();
+      if (chunkOpen && chunkChannel !== channel) closeChunk();
+      chunkChannel = channel;
+      if (trailingCR.delete(channel) && text.startsWith("\n")) text = text.slice(1);
+      if (text.endsWith("\r")) trailingCR.add(channel);
+      const parts = text.replace(/\r\n|\r/g, "\n").split("\n");
+      for (let i = 0; i < parts.length; i++) {
+        const characters = [...stripColor(parts[i])];
+        while (characters.length) {
+          if (tty && chunkColumn >= face.width - 6) closeChunk();
+          const part = characters.splice(0, tty ? face.width - 6 - chunkColumn : characters.length).join("");
+          emit(tty && !chunkOpen ? face.relay(part) : part, channel, chunkOpen ? "" : tty ? face.relay("[external output omitted]") : "[external output omitted]");
+          chunkColumn += [...part].length;
+          chunkOpen = true;
+        }
+        if (i < parts.length - 1) {
+          emit("\n", channel);
+          chunkOpen = false;
+          chunkColumn = 0;
+        }
+      }
+      if (!chunkOpen) {
+        if (deferredActivity) {
+          activeTitle = deferredActivity.title;
+          spinner.start(deferredActivity.title, deferredActivity.measure);
+          deferredActivity = void 0;
+        } else spinner.resume();
+      }
     },
     cancel() {
       if (finished) return;
@@ -555,6 +1272,8 @@ function createInstallerRun(value, options = {}) {
         { total: 0, updated: 0, failed: 0, deferred: true, detail: "Operation cancelled." }
       );
       start();
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
       finished = true;
       if (!face.nested || !env.MM_INSTALLER_OUTCOME_FILE) {
@@ -567,6 +1286,8 @@ function createInstallerRun(value, options = {}) {
       validateInstallerOutcome(facts);
       if (env.MM_INSTALLER_OUTCOME_FILE) writeInstallerOutcome(env.MM_INSTALLER_OUTCOME_FILE, facts);
       start();
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
       finished = true;
       if (options.quiet && facts.updated === 0 && facts.failed === 0 && !facts.operationFailed) return;
@@ -587,6 +1308,8 @@ function createInstallerRun(value, options = {}) {
       if (tty) lines([face.signOff()]);
     },
     stop() {
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
     }
   };
@@ -594,17 +1317,17 @@ function createInstallerRun(value, options = {}) {
 }
 
 // src/autoupdate.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs5 = require("node:fs");
-var import_node_os = require("node:os");
-var import_node_path = require("node:path");
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs10 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path5 = require("node:path");
 function schedulePlatform(override) {
   const platform = override ?? process.platform;
   if (platform === "win32" || platform === "darwin" || platform === "linux") return platform;
   return null;
 }
-function defaultExec(command, args) {
-  const result = (0, import_node_child_process.spawnSync)(command, args, { encoding: "utf8", windowsHide: true });
+function defaultExec(command2, args) {
+  const result = (0, import_node_child_process2.spawnSync)(command2, args, { encoding: "utf8", windowsHide: true });
   if (result.error) return { code: 1, stdout: "", stderr: result.error.message };
   return {
     code: typeof result.status === "number" ? result.status : 1,
@@ -614,8 +1337,8 @@ function defaultExec(command, args) {
 }
 function homeOf(options) {
   if (options.homeDir) return options.homeDir;
-  if (process.platform === "win32") return process.env.USERPROFILE ?? (0, import_node_os.tmpdir)();
-  return process.env.HOME ?? (0, import_node_os.tmpdir)();
+  if (process.platform === "win32") return process.env.USERPROFILE ?? (0, import_node_os3.tmpdir)();
+  return process.env.HOME ?? (0, import_node_os3.tmpdir)();
 }
 function scheduleName(config) {
   return `${config.binName} autoupdate`;
@@ -626,13 +1349,13 @@ function scheduleLabel(config) {
 function quoteWindows(arg) {
   return /[\s"&|<>^%]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
 }
-function enableSchedule(config, command, options = {}) {
+function enableSchedule(config, command2, options = {}) {
   const platform = schedulePlatform(options.platform);
   if (!platform) throw new Error(`autoupdate is not supported on ${options.platform ?? process.platform}.`);
   const exec = options.exec ?? defaultExec;
   const home = homeOf(options);
   if (platform === "win32") {
-    const taskLine = command.map(quoteWindows).join(" ");
+    const taskLine = command2.map(quoteWindows).join(" ");
     const result2 = exec("schtasks", ["/Create", "/TN", scheduleName(config), "/TR", taskLine, "/SC", "HOURLY", "/IT", "/F"]);
     if (result2.code !== 0) {
       throw new Error(`could not turn autoupdate on: ${firstLine(result2.stdout || result2.stderr) || `exit ${result2.code}`}`);
@@ -641,10 +1364,10 @@ function enableSchedule(config, command, options = {}) {
   }
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
-    const dir2 = (0, import_node_path.join)(home, "Library", "LaunchAgents");
-    (0, import_node_fs5.mkdirSync)(dir2, { recursive: true });
-    const plist = (0, import_node_path.join)(dir2, `${label2}.plist`);
-    (0, import_node_fs5.writeFileSync)(plist, darwinPlist(label2, command));
+    const dir2 = (0, import_node_path5.join)(home, "Library", "LaunchAgents");
+    (0, import_node_fs10.mkdirSync)(dir2, { recursive: true });
+    const plist = (0, import_node_path5.join)(dir2, `${label2}.plist`);
+    (0, import_node_fs10.writeFileSync)(plist, darwinPlist(label2, command2));
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
     const result2 = exec("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, plist]);
     if (result2.code !== 0) {
@@ -653,10 +1376,10 @@ function enableSchedule(config, command, options = {}) {
     return;
   }
   const label = scheduleLabel(config);
-  const dir = (0, import_node_path.join)(home, ".config", "systemd", "user");
-  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs5.writeFileSync)((0, import_node_path.join)(dir, `${label}.service`), linuxService(command));
-  (0, import_node_fs5.writeFileSync)((0, import_node_path.join)(dir, `${label}.timer`), linuxTimer(label));
+  const dir = (0, import_node_path5.join)(home, ".config", "systemd", "user");
+  (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs10.writeFileSync)((0, import_node_path5.join)(dir, `${label}.service`), linuxService(command2));
+  (0, import_node_fs10.writeFileSync)((0, import_node_path5.join)(dir, `${label}.timer`), linuxTimer(label));
   const reload = exec("systemctl", ["--user", "daemon-reload"]);
   if (reload.code !== 0) {
     throw new Error(`could not turn autoupdate on: ${firstLine(reload.stderr || reload.stdout) || `exit ${reload.code}`}`);
@@ -681,14 +1404,14 @@ function disableSchedule(config, options = {}) {
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
-    (0, import_node_fs5.rmSync)((0, import_node_path.join)(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
+    (0, import_node_fs10.rmSync)((0, import_node_path5.join)(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
     return;
   }
   const label = scheduleLabel(config);
-  const dir = (0, import_node_path.join)(home, ".config", "systemd", "user");
+  const dir = (0, import_node_path5.join)(home, ".config", "systemd", "user");
   exec("systemctl", ["--user", "disable", "--now", `${label}.timer`]);
-  (0, import_node_fs5.rmSync)((0, import_node_path.join)(dir, `${label}.service`), { force: true });
-  (0, import_node_fs5.rmSync)((0, import_node_path.join)(dir, `${label}.timer`), { force: true });
+  (0, import_node_fs10.rmSync)((0, import_node_path5.join)(dir, `${label}.service`), { force: true });
+  (0, import_node_fs10.rmSync)((0, import_node_path5.join)(dir, `${label}.timer`), { force: true });
 }
 function querySchedule(config, options = {}) {
   const platform = schedulePlatform(options.platform);
@@ -706,158 +1429,77 @@ function querySchedule(config, options = {}) {
     return state2;
   }
   if (platform === "darwin") {
-    const plist = (0, import_node_path.join)(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
-    if (!(0, import_node_fs5.existsSync)(plist)) return { supported: true, enabled: false };
+    const plist = (0, import_node_path5.join)(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
+    if (!(0, import_node_fs10.existsSync)(plist)) return { supported: true, enabled: false };
     return { supported: true, enabled: true, cadence: "hourly" };
   }
-  const timer = (0, import_node_path.join)(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
-  if (!(0, import_node_fs5.existsSync)(timer)) return { supported: true, enabled: false };
+  const timer = (0, import_node_path5.join)(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
+  if (!(0, import_node_fs10.existsSync)(timer)) return { supported: true, enabled: false };
   const state = { supported: true, enabled: true, cadence: "hourly" };
   const shown = exec("systemctl", ["--user", "show", `${scheduleLabel(config)}.service`, "-p", "ExecMainStartTimestamp", "--value"]);
   const stamp = (shown.stdout ?? "").trim();
   if (shown.code === 0 && stamp && stamp !== "n/a") state.lastRun = stamp;
   return state;
 }
-function darwinPlist(label, command) {
-  const args = command.map((arg) => `        <string>${xmlEscape(arg)}</string>`).join("\n");
+function darwinPlist(label, command2) {
+  const args = command2.map((arg) => `        <string>${xmlEscape(arg)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-  <dict>
-    <key>Label</key>
-    <string>${xmlEscape(label)}</string>
-    <key>ProgramArguments</key>
-    <array>
-${args}
-    </array>
-    <key>StartInterval</key>
-    <integer>3600</integer>
-  </dict>
-</plist>
-`;
-}
-function linuxService(command) {
-  const line = command.map((arg) => /[\s"\\]/.test(arg) ? `"${arg.replace(/(["\\])/g, "\\$1")}"` : arg).join(" ");
-  return `[Unit]
-Description=${"Hourly update check"}
-[Service]
-Type=oneshot
-ExecStart=${line}
-`;
-}
-function linuxTimer(label) {
-  return `[Unit]
-Description=Hourly update check for ${label}
-[Timer]
-OnCalendar=hourly
-Persistent=true
-[Install]
-WantedBy=timers.target
-`;
-}
-function xmlEscape(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function valueOf(output, key) {
-  const line = output.split(/\r?\n/).find((candidate) => candidate.trimStart().startsWith(key));
-  if (!line) return null;
-  const value = line.slice(line.indexOf(key) + key.length).trim();
-  return value ? value : null;
-}
-function firstLine(text) {
-  return String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0] ?? "";
-}
-
-// src/config.ts
-var import_node_fs6 = require("node:fs");
-var import_node_sea = require("node:sea");
-
-// src/module-url.ts
-var import_node_url = require("node:url");
-var import_meta = {};
-function moduleUrl() {
-  if (typeof __filename === "string") return (0, import_node_url.pathToFileURL)(__filename).href;
-  return import_meta.url;
-}
-
-// src/config.ts
-function publicKeyBytes(config) {
-  const raw = Buffer.from(config.publicKey, "base64");
-  if (raw.length !== 32) {
-    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
-  }
-  return raw;
-}
-function loadProductConfig(options = {}) {
-  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
-  const devFallback = new URL("../config/product.template.json", moduleUrl());
-  if (explicit) {
-    return parseProductConfig((0, import_node_fs6.readFileSync)(explicit, "utf8"));
-  }
-  try {
-    return parseProductConfig((0, import_node_fs6.readFileSync)(devFallback, "utf8"));
-  } catch {
-  }
-  try {
-    const asset = (0, import_node_sea.getAsset)("product.json", "utf8");
-    if (typeof asset === "string") return parseProductConfig(asset);
-  } catch {
-  }
-  throw new Error(
-    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
-  );
-}
-function parseProductConfig(text) {
-  let data;
-  try {
-    data = JSON.parse(text);
-  } catch {
-    throw new Error("product config is not valid JSON");
-  }
-  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
-  const record = data;
-  const product = field(record, "product");
-  const host = field(record, "host").replace(/\/+$/, "");
-  const loginKind = field(record, "loginKind");
-  const binName = field(record, "binName");
-  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
-  if (loginKind !== "github" && loginKind !== "google") {
-    throw new Error('product config loginKind must be "github" or "google"');
-  }
-  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
-  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
-  publicKeyBytes(config);
-  if (loginKind === "github") {
-    const clientId = record.githubClientId;
-    if (typeof clientId !== "string" || clientId.length === 0) {
-      throw new Error("product config needs githubClientId for the github loginKind");
-    }
-    config.githubClientId = clientId;
-  } else if (typeof record.githubClientId === "string") {
-    config.githubClientId = record.githubClientId;
-  }
-  try {
-    const url = new URL(host);
-    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
-  } catch {
-    throw new Error("product config host must be an http(s) URL");
-  }
-  return config;
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${xmlEscape(label)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${args}
+    </array>
+    <key>StartInterval</key>
+    <integer>3600</integer>
+  </dict>
+</plist>
+`;
 }
-function field(record, key) {
-  const value = record[key];
-  return typeof value === "string" ? value : "";
+function linuxService(command2) {
+  const line = command2.map((arg) => /[\s"\\]/.test(arg) ? `"${arg.replace(/(["\\])/g, "\\$1")}"` : arg).join(" ");
+  return `[Unit]
+Description=${"Hourly update check"}
+[Service]
+Type=oneshot
+ExecStart=${line}
+`;
+}
+function linuxTimer(label) {
+  return `[Unit]
+Description=Hourly update check for ${label}
+[Timer]
+OnCalendar=hourly
+Persistent=true
+[Install]
+WantedBy=timers.target
+`;
+}
+function xmlEscape(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function valueOf(output, key) {
+  const line = output.split(/\r?\n/).find((candidate) => candidate.trimStart().startsWith(key));
+  if (!line) return null;
+  const value = line.slice(line.indexOf(key) + key.length).trim();
+  return value ? value : null;
+}
+function firstLine(text) {
+  return String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0] ?? "";
 }
 
 // src/login-github.ts
-var import_node_child_process2 = require("node:child_process");
-var realSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var import_node_child_process3 = require("node:child_process");
+var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function openBrowser(url) {
   if (process.env.LAUNCHER_NO_OPEN === "1") return;
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
   const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
   try {
-    const child = (0, import_node_child_process2.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
+    const child = (0, import_node_child_process3.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
     child.on("error", () => {
     });
     child.unref();
@@ -971,7 +1613,7 @@ async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
 }
 
 // src/login-google.ts
-var import_node_crypto = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_http = require("node:http");
 var b64url = (bytes) => bytes.toString("base64url");
 async function loginGoogle(options) {
@@ -979,7 +1621,7 @@ async function loginGoogle(options) {
   const server = options.host.replace(/\/+$/, "");
   const timeoutMs = options.timeoutMs ?? 5 * 6e4;
   const listener = (0, import_node_http.createServer)();
-  await new Promise((resolve2) => listener.listen(0, "127.0.0.1", resolve2));
+  await new Promise((resolve3) => listener.listen(0, "127.0.0.1", resolve3));
   const port = listener.address().port;
   const redirectUri = `http://127.0.0.1:${port}/callback`;
   try {
@@ -993,9 +1635,9 @@ async function loginGoogle(options) {
     if (typeof clientId !== "string" || !clientId) {
       throw new Error("the sign-in server returned a malformed registration");
     }
-    const verifier = b64url((0, import_node_crypto.randomBytes)(32));
-    const challenge = b64url((0, import_node_crypto.createHash)("sha256").update(verifier).digest());
-    const state = b64url((0, import_node_crypto.randomBytes)(16));
+    const verifier = b64url((0, import_node_crypto5.randomBytes)(32));
+    const challenge = b64url((0, import_node_crypto5.createHash)("sha256").update(verifier).digest());
+    const state = b64url((0, import_node_crypto5.randomBytes)(16));
     const authorize = new URL(`${server}/oauth/authorize`);
     authorize.search = new URLSearchParams({
       response_type: "code",
@@ -1006,7 +1648,7 @@ async function loginGoogle(options) {
       code_challenge: challenge,
       code_challenge_method: "S256"
     }).toString();
-    const code = await new Promise((resolve2, reject) => {
+    const code = await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => reject(new Error("sign-in timed out \u2014 run login again.")), timeoutMs);
       listener.on("request", (req, res) => {
         const url = new URL(req.url ?? "/", redirectUri);
@@ -1024,7 +1666,7 @@ async function loginGoogle(options) {
         }
         res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(page("Signed in.", "You can close this tab and go back to the terminal."));
         clearTimeout(timer);
-        resolve2(received);
+        resolve3(received);
       });
       const print = options.print ?? ((line) => process.stderr.write(`${line}
 `));
@@ -1083,245 +1725,8 @@ function page(title, body) {
   return `<!doctype html><meta charset="utf-8"><meta name="color-scheme" content="dark"><title>${title}</title><style>${style}</style><main><h1>${title}</h1><p>${body}</p></main>`;
 }
 
-// src/payload.ts
-var import_node_crypto2 = require("node:crypto");
-var import_node_fs7 = require("node:fs");
-var import_node_os2 = require("node:os");
-var import_node_path2 = require("node:path");
-
-// src/canonical.ts
-function canonicalJson(value) {
-  return encode(value);
-}
-function encode(value) {
-  if (value === null) return "null";
-  if (typeof value === "string") return JSON.stringify(value);
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new TypeError("canonicalJson: cannot encode a non-finite number");
-    }
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((entry) => encode(entry)).join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const record = value;
-    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
-    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
-  }
-  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
-}
-
-// src/payload.ts
-var NeedsLoginError = class extends Error {
-  constructor() {
-    super("signed out \u2014 run login first");
-    this.name = "NeedsLoginError";
-  }
-};
-var ForbiddenError = class extends Error {
-  constructor() {
-    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
-    this.name = "ForbiddenError";
-  }
-};
-function canonicalManifestBytes(manifest) {
-  return Buffer.from(
-    canonicalJson({
-      created: manifest.created,
-      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
-      version: manifest.version
-    }),
-    "utf8"
-  );
-}
-function ed25519PublicKey(config) {
-  const raw = publicKeyBytes(config);
-  return (0, import_node_crypto2.createPublicKey)({
-    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
-    format: "jwk"
-  });
-}
-function verifyManifest(manifest, signature, config) {
-  try {
-    const signatureBytes = Buffer.from(signature, "base64");
-    if (signatureBytes.length === 0) return false;
-    return (0, import_node_crypto2.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
-  } catch {
-    return false;
-  }
-}
-function verifyFileBytes(entry, bytes) {
-  if (entry.size !== bytes.length) return false;
-  return (0, import_node_crypto2.createHash)("sha256").update(bytes).digest("hex") === entry.sha256.toLowerCase();
-}
-async function readErrorCode(response) {
-  try {
-    const data = await response.json();
-    return typeof data.error === "string" ? data.error : "";
-  } catch {
-    return "";
-  }
-}
-function throwForStatus(status, errorCode) {
-  if (status === 401) throw new NeedsLoginError();
-  if (status === 403) throw new ForbiddenError();
-  throw new Error(
-    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
-  );
-}
-async function getJson(url, accessToken, fetchImpl) {
-  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
-  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
-  return { status: response.status, json: await response.json() };
-}
-function parseManifest(json) {
-  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
-  const record = json;
-  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
-  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
-  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
-  if (typeof record.signature !== "string" || !record.signature) {
-    throw new Error("the release manifest is unsigned");
-  }
-  const files = record.files.map((entry) => {
-    const file = entry;
-    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
-      throw new Error("the release manifest lists a malformed file");
-    }
-    const safe = safeManifestPath(file.path);
-    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
-    return { path: safe, sha256: file.sha256, size: file.size };
-  });
-  return { version: record.version, created: record.created, files, signature: record.signature };
-}
-function safeManifestPath(rawPath) {
-  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
-  if (rawPath.startsWith("/")) return null;
-  const segments = rawPath.split("/");
-  for (const segment of segments) {
-    if (segment === "" || segment === "." || segment === "..") return null;
-  }
-  return segments.join("/");
-}
-async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
-  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
-  const manifest = parseManifest(json);
-  if (!verifyManifest(manifest, manifest.signature, config)) {
-    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
-  }
-  return manifest;
-}
-async function fetchFileBytes(config, accessToken, path, fetchImpl) {
-  const encoded = path.split("/").map(encodeURIComponent).join("/");
-  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
-    headers: { authorization: `Bearer ${accessToken}` }
-  });
-  if (!response.ok) {
-    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
-    throwForStatus(response.status, await readErrorCode(response));
-  }
-  return Buffer.from(await response.arrayBuffer());
-}
-async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const staging = (0, import_node_path2.join)((0, import_node_os2.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
-  (0, import_node_fs7.mkdirSync)(staging, { recursive: true });
-  try {
-    for (const entry of manifest.files) {
-      const bytes = await fetchFileBytes(config, accessToken, entry.path, fetchImpl);
-      if (!verifyFileBytes(entry, bytes)) {
-        throw new Error(`file ${entry.path} failed its checksum \u2014 refusing to install anything.`);
-      }
-      const dest = (0, import_node_path2.join)(staging, entry.path);
-      (0, import_node_fs7.mkdirSync)((0, import_node_path2.dirname)(dest), { recursive: true });
-      (0, import_node_fs7.writeFileSync)(dest, bytes);
-    }
-    const target = (0, import_node_path2.join)(dir, "payload");
-    (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs7.rmSync)(target, { force: true, recursive: true });
-    (0, import_node_fs7.renameSync)(staging, target);
-  } catch (error) {
-    (0, import_node_fs7.rmSync)(staging, { force: true, recursive: true });
-    throw error;
-  }
-  return manifest.version;
-}
-
-// src/store.ts
-var import_node_fs8 = require("node:fs");
-var import_node_os3 = require("node:os");
-var import_node_path3 = require("node:path");
-function defaultProductDir(product) {
-  if (process.platform === "win32") {
-    const base = process.env.LOCALAPPDATA ?? (0, import_node_path3.join)((0, import_node_os3.tmpdir)(), "launcher-fallback");
-    return (0, import_node_path3.join)(base, product);
-  }
-  const home = process.env.HOME ?? (0, import_node_os3.tmpdir)();
-  return (0, import_node_path3.join)(home, `.${product}`);
-}
-function resolveProductDir(product, explicit) {
-  return explicit ?? process.env.LAUNCHER_DIR ?? defaultProductDir(product);
-}
-function tokensPath(dir) {
-  return (0, import_node_path3.join)(dir, "tokens.json");
-}
-function statePath(dir) {
-  return (0, import_node_path3.join)(dir, "state.json");
-}
-function payloadDir(dir) {
-  return (0, import_node_path3.join)(dir, "payload");
-}
-function readTokens(dir) {
-  try {
-    const data = JSON.parse((0, import_node_fs8.readFileSync)(tokensPath(dir), "utf8"));
-    if (typeof data.accessToken !== "string" || !data.accessToken) return null;
-    if (typeof data.expiresAt !== "number" || !Number.isFinite(data.expiresAt)) return null;
-    const tokens = { accessToken: data.accessToken, expiresAt: data.expiresAt };
-    if (typeof data.refreshToken === "string" && data.refreshToken) tokens.refreshToken = data.refreshToken;
-    if (typeof data.clientId === "string" && data.clientId) tokens.clientId = data.clientId;
-    return tokens;
-  } catch {
-    return null;
-  }
-}
-function writeTokens(dir, tokens) {
-  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
-  try {
-    (0, import_node_fs8.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
-`, { mode: 384 });
-  } catch {
-    (0, import_node_fs8.writeFileSync)(tokensPath(dir), `${JSON.stringify(tokens)}
-`);
-  }
-}
-function clearTokens(dir) {
-  (0, import_node_fs8.rmSync)(tokensPath(dir), { force: true });
-}
-function readState(dir) {
-  try {
-    const data = JSON.parse((0, import_node_fs8.readFileSync)(statePath(dir), "utf8"));
-    if (typeof data.version !== "string" || !data.version) return null;
-    return { version: data.version, updatedAt: typeof data.updatedAt === "string" ? data.updatedAt : "" };
-  } catch {
-    return null;
-  }
-}
-function writeState(dir, state) {
-  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs8.writeFileSync)(statePath(dir), `${JSON.stringify(state, null, 2)}
-`);
-}
-function wipeProductDir(dir) {
-  (0, import_node_fs8.rmSync)(tokensPath(dir), { force: true });
-  (0, import_node_fs8.rmSync)(statePath(dir), { force: true });
-  (0, import_node_fs8.rmSync)(payloadDir(dir), { force: true, recursive: true });
-}
-
 // src/index.ts
-var LAUNCHER_VERSION = true ? "0.1.12" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "0.1.14" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -1333,30 +1738,37 @@ function defaultPrintErr(message) {
 async function run(rawOptions = {}) {
   const print = rawOptions.print ?? defaultPrint;
   const printErr = rawOptions.printErr ?? defaultPrintErr;
-  const argv = rawOptions.argv ?? process.argv.slice(2);
-  const runAt = argv.indexOf("--run");
-  if (runAt >= 0) return runFile(argv[runAt + 1], argv.slice(runAt + 2), printErr);
+  const argv2 = rawOptions.argv ?? process.argv.slice(2);
+  const runAt = argv2.indexOf("--run");
+  if (runAt >= 0) return runFile(argv2[runAt + 1], argv2.slice(runAt + 2), printErr);
   let config;
   try {
-    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv, "--config") });
+    config = loadProductConfig({ configPath: rawOptions.configPath ?? flagValue(argv2, "--config") });
   } catch (error) {
     print(`cannot start: ${error.message}`);
     return 2;
   }
-  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv, "--dir"));
-  const positional = argv.filter((arg) => !arg.startsWith("-"));
-  if (argv.includes("--version") || argv.includes("-v")) {
+  const dir = resolveProductDir(config.product, rawOptions.dir ?? flagValue(argv2, "--dir"));
+  const positional = argv2.filter((arg) => !arg.startsWith("-"));
+  if (argv2.includes("--version") || argv2.includes("-v")) {
     print(`${config.binName} launcher ${LAUNCHER_VERSION}`);
     return 0;
   }
-  if (argv.includes("--help") || argv.includes("-h") || positional.length === 0) {
+  if (argv2.includes("--help") || argv2.includes("-h") || positional.length === 0) {
     printUsage(config, print);
     return positional.length === 0 ? 2 : 0;
   }
-  const command = positional[0];
+  const command2 = positional[0];
+  let unlock;
   try {
-    switch (command) {
+    unlock = lockInstallation(dir);
+    await recoverAcquisition(dir, async (command3, cwd, env) => {
+      const result = (rawOptions.runEntry ?? defaultRunEntry)(command3, cwd, env);
+      return result.ok && (result.code === void 0 || result.code === 0);
+    }, payloadEnv(dir) ?? process.env);
+    switch (command2) {
       case "login":
+        unlock();
         await doLogin(config, dir, rawOptions, print);
         return 0;
       case "logout":
@@ -1368,11 +1780,11 @@ async function run(rawOptions = {}) {
       case "update":
         return await doUpdate(config, dir, rawOptions, print);
       case "doctor":
-        return doDoctor(config, dir, rawOptions, print);
+        return doDoctor(config, dir, rawOptions, print, unlock);
       case "autoupdate":
         return doAutoupdate(config, rawOptions, positional.slice(1), print);
       default:
-        return doForward(config, dir, rawOptions, command, argv, print);
+        return doForward(config, dir, rawOptions, command2, argv2, print, unlock);
     }
   } catch (error) {
     if (error instanceof NeedsLoginError) {
@@ -1381,12 +1793,14 @@ async function run(rawOptions = {}) {
     }
     print(`failed: ${error.message}`);
     return 1;
+  } finally {
+    unlock?.();
   }
 }
-function flagValue(argv, flag) {
-  const index = argv.indexOf(flag);
+function flagValue(argv2, flag) {
+  const index = argv2.indexOf(flag);
   if (index < 0) return void 0;
-  const value = argv[index + 1];
+  const value = argv2[index + 1];
   return value && !value.startsWith("-") ? value : void 0;
 }
 function printUsage(config, print) {
@@ -1400,8 +1814,8 @@ async function runFile(file, args, printErr) {
     printErr("launcher --run needs a file to run.");
     return 1;
   }
-  const abs = (0, import_node_path4.resolve)(process.cwd(), file);
-  if (!(0, import_node_fs9.existsSync)(abs)) {
+  const abs = (0, import_node_path6.resolve)(process.cwd(), file);
+  if (!(0, import_node_fs11.existsSync)(abs)) {
     printErr(`cannot run ${file}: no such file.`);
     return 1;
   }
@@ -1494,14 +1908,14 @@ async function fetchAccessTokenOrLogin(config, dir, options, print, installer) {
 }
 function readPayloadArgv(dir, key) {
   try {
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path4.join)(payloadDir(dir), "payload.json"), "utf8"));
-    const entry = parsed[key];
-    if (typeof entry === "string") {
-      const parts = entry.trim().split(/\s+/).filter(Boolean);
+    const parsed = JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path6.join)(payloadDir(dir), "payload.json"), "utf8"));
+    const entry2 = parsed[key];
+    if (typeof entry2 === "string") {
+      const parts = entry2.trim().split(/\s+/).filter(Boolean);
       return parts.length > 0 ? parts : null;
     }
-    if (Array.isArray(entry) && entry.every((part) => typeof part === "string" && part.length > 0)) {
-      return entry;
+    if (Array.isArray(entry2) && entry2.every((part) => typeof part === "string" && part.length > 0)) {
+      return entry2;
     }
     return null;
   } catch {
@@ -1516,7 +1930,7 @@ function readPayloadRun(dir) {
 }
 function readPayloadVerbs(dir) {
   try {
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path4.join)(payloadDir(dir), "payload.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path6.join)(payloadDir(dir), "payload.json"), "utf8"));
     const verbs = parsed.verbs;
     if (verbs === "*") return "*";
     if (Array.isArray(verbs) && verbs.every((v) => typeof v === "string" && v.trim().length > 0)) {
@@ -1527,13 +1941,13 @@ function readPayloadVerbs(dir) {
     return null;
   }
 }
-function resolveEntry(entry) {
-  return entry[0] === "$self" ? [process.execPath, ...entry.slice(1)] : entry;
+function resolveEntry(entry2) {
+  return entry2[0] === "$self" ? [process.execPath, ...entry2.slice(1)] : entry2;
 }
-function needsShell(command) {
+function needsShell(command2) {
   if (process.platform !== "win32") return false;
-  if (/\.(cmd|bat)$/i.test(command)) return true;
-  return !(0, import_node_fs9.existsSync)(command);
+  if (/\.(cmd|bat)$/i.test(command2)) return true;
+  return !(0, import_node_fs11.existsSync)(command2);
 }
 function quoteForShell(arg) {
   return /[\s"&|<>^%]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
@@ -1548,23 +1962,24 @@ function parseProgress(raw) {
       const message = JSON.parse(line);
       if (!SUPPORTED_PROGRESS_PROTOCOLS.has(message.v) || typeof message.step !== "string") continue;
       const state = message.state ?? "ok";
-      if (state !== "ok" && state !== "fail" && state !== "note") continue;
+      if (state !== "ok" && state !== "fail" && state !== "note" && state !== "running") continue;
       if (message.ms !== void 0 && typeof message.ms !== "number") continue;
       progress.push({
         step: message.step,
         state,
-        ...typeof message.ms === "number" ? { ms: message.ms } : {}
+        ...typeof message.ms === "number" && Number.isFinite(message.ms) && message.ms >= 0 ? { ms: message.ms } : {},
+        ...typeof message.measure === "string" ? { measure: message.measure } : {}
       });
     } catch {
     }
   }
   return progress;
 }
-function defaultRunEntry(entry, cwd, env) {
-  const [command, ...args] = entry;
-  const shell = needsShell(command);
-  const commandLine = shell ? [command, ...args].map(quoteForShell).join(" ") : command;
-  const spawnEntry = (progress2) => (0, import_node_child_process3.spawnSync)(commandLine, shell ? [] : args, {
+function defaultRunEntry(entry2, cwd, env) {
+  const [command2, ...args] = entry2;
+  const shell = needsShell(command2);
+  const commandLine = shell ? [command2, ...args].map(quoteForShell).join(" ") : command2;
+  const spawnEntry = (progress2) => (0, import_node_child_process4.spawnSync)(commandLine, shell ? [] : args, {
     cwd,
     stdio: progress2 ? ["inherit", "inherit", "inherit", "pipe"] : "inherit",
     shell,
@@ -1622,11 +2037,49 @@ async function installOrUpdate(config, dir, options, print, update) {
     version = manifest.version;
     installer.phase("resolve", { seconds: (Date.now() - started) / 1e3 });
     const current = readState(dir);
-    const unchanged = update && current?.version === version && (0, import_node_fs9.existsSync)(payloadDir(dir));
+    const unchanged = current?.version === version && (0, import_node_fs11.existsSync)(payloadDir(dir));
+    if (unchanged && current.acquired) {
+      installer.surface({ id: config.product, from: version, to: version, state: "current" });
+      return await finishLastMile(config, dir, options, installer, version, true, acquisitionRepairCommand(dir, version));
+    }
     if (!unchanged) {
       installer.phase("download", { state: "running" });
       started = Date.now();
-      await downloadAndUnpack(config, dir, manifest, accessToken, { fetchImpl });
+      const cached = reusableCandidate(dir, manifest);
+      const candidate = cached ?? (0, import_node_crypto6.randomUUID)();
+      const candidateDir = (0, import_node_path6.join)(dir, "candidates", candidate);
+      const onProgress = ({ done, total }) => installer.phase("download", {
+        state: "running",
+        measure: total ? `${Math.floor(done / total * 100)}% \xB7 ${done}/${total} B` : `${done} B`
+      });
+      if (!cached) await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl, onProgress });
+      const acquisition = (0, import_node_fs11.existsSync)((0, import_node_path6.join)(candidateDir, "payload", "payload.json")) ? readAcquisition((0, import_node_path6.join)(candidateDir, "payload")) : null;
+      if (acquisition) {
+        rememberCandidate(dir, candidate, manifest);
+        installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
+        installer.phase("activate", { state: "running" });
+        let outcome;
+        const env = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
+        await installAcquisition(dir, candidate, version, acquisition, {
+          fetchImpl,
+          env,
+          onProgress,
+          run: async (command2, cwd, childEnv) => {
+            installer.phase(command2.includes("--prefix") ? "install" : "activate", { state: "running" });
+            const result = options.runEntry ? options.runEntry(command2, cwd, childEnv) : await runInstallEntry(command2, cwd, childEnv, installer, readTokens(dir));
+            if (result.outcome) outcome = validateInstallerOutcome(result.outcome);
+            return result.ok && (result.code === void 0 || result.code === 0) && !result.outcome?.operationFailed && !result.outcome?.failed;
+          }
+        });
+        installer.phase("activate");
+        installer.surface({ id: config.product, from: current?.version, to: version, state: "updated" });
+        installer.finish(outcome ?? { version, total: 1, updated: 1, failed: 0, installed: true });
+        return 0;
+      }
+      const target = (0, import_node_path6.join)(dir, "payload");
+      (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs11.rmSync)(target, { recursive: true, force: true });
+      (0, import_node_fs11.renameSync)((0, import_node_path6.join)(candidateDir, "payload"), target);
       writeState(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
       installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
     }
@@ -1664,36 +2117,36 @@ function payloadEnv(dir) {
   return { ...process.env, MM_INSTALLER_TOKEN: stored.accessToken };
 }
 var NEVER_A_PROGRAM = /\.(tgz|tar|gz|bz2|xz|zip|json|txt|md|lock)$/i;
-function payloadFileAsCommand(entry, payload) {
-  const first = entry[0];
+function payloadFileAsCommand(entry2, payload) {
+  const first = entry2[0];
   if (!first || first === "$self") return null;
   if (first.includes("/") || first.includes("\\")) return null;
-  const candidate = (0, import_node_path4.join)(payload, first);
-  if (!(0, import_node_fs9.existsSync)(candidate)) return null;
+  const candidate = (0, import_node_path6.join)(payload, first);
+  if (!(0, import_node_fs11.existsSync)(candidate)) return null;
   if (NEVER_A_PROGRAM.test(first)) return first;
   if (process.platform === "win32") return null;
   try {
-    return ((0, import_node_fs9.statSync)(candidate).mode & 73) === 0 ? first : null;
+    return ((0, import_node_fs11.statSync)(candidate).mode & 73) === 0 ? first : null;
   } catch {
     return null;
   }
 }
-async function finishLastMile(config, dir, options, installer, version, unchanged) {
-  const entry = readPayloadEntry(dir);
+async function finishLastMile(config, dir, options, installer, version, unchanged, repairCommand) {
+  const entry2 = repairCommand ?? readPayloadEntry(dir);
   const payload = payloadDir(dir);
-  if (!entry) {
+  if (!entry2) {
     installer.finish({
       version,
       total: 1,
       updated: unchanged ? 0 : 1,
       failed: 0,
       installed: true,
-      detail: `next step: run ${(0, import_node_path4.join)(payload, config.binName)} to start ${config.product}.`
+      detail: `next step: run ${(0, import_node_path6.join)(payload, config.binName)} to start ${config.product}.`
     });
     return 0;
   }
-  const command = resolveEntry(entry);
-  const dataFile = payloadFileAsCommand(entry, payload);
+  const command2 = resolveEntry(entry2);
+  const dataFile = payloadFileAsCommand(entry2, payload);
   if (dataFile) {
     installer.finish({
       version,
@@ -1706,8 +2159,9 @@ async function finishLastMile(config, dir, options, installer, version, unchange
   }
   installer.phase("activate", { state: "running" });
   const started = Date.now();
-  const env = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
-  const result = options.runEntry ? options.runEntry(command, payload, env) : await runInstallEntry(command, payload, env, installer, readTokens(dir));
+  const inherited = { ...payloadEnv(dir) ?? process.env, MM_OUTER_CONSOLE: "1" };
+  const env = repairCommand ? runtimeEnvironment(repairCommand[0], inherited) : inherited;
+  const result = options.runEntry ? options.runEntry(command2, payload, env) : await runInstallEntry(command2, payload, env, installer, readTokens(dir));
   for (const progress of result.progress ?? []) installer.milestone(progress);
   const succeeded = result.ok && (result.code === void 0 || result.code === 0);
   const outcome = result.outcome ? validateInstallerOutcome(result.outcome) : void 0;
@@ -1722,28 +2176,33 @@ async function finishLastMile(config, dir, options, installer, version, unchange
     },
     ...!succeeded ? {
       operationFailed: true,
-      detail: result.code === void 0 ? `Arming this machine could not start: ${result.error ?? command[0]}` : `Arming this machine did not finish (exit code ${result.code})${result.error?.startsWith("installer outcome:") ? `: ${result.error}` : ""}`,
-      retry: `(cd ${payload} && ${command.join(" ")})`
+      detail: result.code === void 0 ? `Arming this machine could not start: ${result.error ?? command2[0]}` : `Arming this machine did not finish (exit code ${result.code})${result.error?.startsWith("installer outcome:") ? `: ${result.error}` : ""}`,
+      retry: `(cd ${payload} && ${command2.join(" ")})`
     } : {}
   });
   return succeeded ? outcome?.operationFailed || outcome?.failed ? 1 : 0 : result.code || 1;
 }
-async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
-  const [command, ...args] = entry;
-  const shell = needsShell(command);
+async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
+  installer.start();
+  const [command2, ...args] = entry2;
+  const shell = needsShell(command2);
   const progress = !(process.platform === "win32" && shell);
-  const outcomeDir = (0, import_node_fs9.mkdtempSync)((0, import_node_path4.join)((0, import_node_os4.tmpdir)(), "mm-installer-outcome-"));
-  const outcomeFile = (0, import_node_path4.join)(outcomeDir, "outcome.json");
+  const outcomeDir = (0, import_node_fs11.mkdtempSync)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "mm-installer-outcome-"));
+  const outcomeFile = (0, import_node_path6.join)(outcomeDir, "outcome.json");
+  const progressFile = (0, import_node_path6.join)(outcomeDir, "progress.jsonl");
   const childEnv = { ...env, MM_INSTALLER_OUTCOME_FILE: outcomeFile };
   delete childEnv.MM_FACE_TRANSCRIPT;
+  delete childEnv.MM_PROGRESS_FILE;
   delete childEnv.MM_PROGRESS_FD;
   delete childEnv.MM_PROGRESS_PROTOCOL;
   if (progress) Object.assign(childEnv, { MM_PROGRESS_FD: "3", MM_PROGRESS_PROTOCOL: "1" });
+  else Object.assign(childEnv, { MM_PROGRESS_FILE: progressFile, MM_PROGRESS_PROTOCOL: "1" });
   const secrets = [tokens?.accessToken, tokens?.refreshToken].filter((value) => Boolean(value));
+  let progressError;
   const redact = (text) => secrets.reduce((safe, value) => safe.replaceAll(value, "[redacted]"), text);
   try {
-    const result = await new Promise((resolve2) => {
-      const child = (0, import_node_child_process3.spawn)(shell ? [command, ...args].map(quoteForShell).join(" ") : command, shell ? [] : args, {
+    const result = await new Promise((resolve3) => {
+      const child = (0, import_node_child_process4.spawn)(shell ? [command2, ...args].map(quoteForShell).join(" ") : command2, shell ? [] : args, {
         cwd,
         shell,
         windowsHide: true,
@@ -1760,32 +2219,53 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
           }
           partial = held ? safe.slice(-held) : "";
           const visible = held ? safe.slice(0, -held) : safe;
-          if (visible) installer.relay(visible, channel2, false);
+          if (visible) installer.relayChunk(visible, channel2);
         }).on("end", () => {
-          if (partial) installer.relay("[redacted]", channel2, false);
+          if (partial) installer.relayChunk("[redacted]", channel2);
         });
       }
       let pending = "";
+      let progressOffset = 0;
+      const progressDecoder = new import_node_string_decoder.StringDecoder("utf8");
+      const receive = (text) => {
+        pending += text;
+        const end = pending.lastIndexOf("\n");
+        if (end >= 0) {
+          for (const record of parseProgress(pending.slice(0, end))) installer.milestone({ ...record, step: redact(record.step), ...record.measure ? { measure: redact(record.measure) } : {} });
+          pending = pending.slice(end + 1);
+        }
+        if (pending.length > 65536) pending = "";
+      };
+      const pollProgress = () => {
+        if (progressError) return;
+        try {
+          if (!(0, import_node_fs11.existsSync)(progressFile)) return;
+          const bytes = (0, import_node_fs11.readFileSync)(progressFile);
+          receive(progressDecoder.write(bytes.subarray(progressOffset)));
+          progressOffset = bytes.length;
+        } catch {
+          progressError = "installer progress: could not read child progress";
+          if (timer) clearInterval(timer);
+        }
+      };
+      const timer = progress ? void 0 : setInterval(pollProgress, 90);
+      child.once("close", () => {
+        if (timer) clearInterval(timer);
+        pollProgress();
+      });
       const channel = child.stdio[3];
       if (channel && "setEncoding" in channel) {
         channel.setEncoding("utf8");
-        channel.on("data", (text) => {
-          pending += text;
-          const end = pending.lastIndexOf("\n");
-          if (end >= 0) {
-            for (const record of parseProgress(pending.slice(0, end))) installer.milestone({ ...record, step: redact(record.step) });
-            pending = pending.slice(end + 1);
-          }
-          if (pending.length > 65536) pending = "";
-        });
+        channel.on("data", receive);
       }
-      child.on("error", (error) => resolve2({ ok: false, error: error.message }));
-      child.on("close", (code) => resolve2({
+      child.on("error", (error) => resolve3({ ok: false, error: error.message }));
+      child.on("close", (code) => resolve3({
         ok: code === 0,
         ...code !== null ? { code } : {},
         ...code !== 0 ? { error: `exit code ${code}` } : {}
       }));
     });
+    if (progressError) return { ...result, ok: false, code: result.code || 1, error: progressError };
     try {
       const outcome = readInstallerOutcome(outcomeFile);
       return { ...result, ...outcome ? { outcome } : {} };
@@ -1793,25 +2273,31 @@ async function runInstallEntry(entry, cwd, env, installer, tokens = null) {
       return { ...result, ok: false, code: result.code || 1, error: "installer outcome: invalid child result" };
     }
   } finally {
-    if ((0, import_node_fs9.existsSync)(outcomeFile)) (0, import_node_fs9.unlinkSync)(outcomeFile);
-    (0, import_node_fs9.rmdirSync)(outcomeDir);
+    if ((0, import_node_fs11.existsSync)(progressFile)) (0, import_node_fs11.unlinkSync)(progressFile);
+    if ((0, import_node_fs11.existsSync)(outcomeFile)) (0, import_node_fs11.unlinkSync)(outcomeFile);
+    (0, import_node_fs11.rmdirSync)(outcomeDir);
   }
 }
-function doForward(config, dir, options, command, argv, print) {
-  if (command && (0, import_node_fs9.existsSync)(command)) {
-    print(`${command} is a file, not a command \u2014 did you mean \`--run ${command}\`?`);
+function doForward(config, dir, options, command2, argv2, print, unlock) {
+  if (command2 && (0, import_node_fs11.existsSync)(command2)) {
+    print(`${command2} is a file, not a command \u2014 did you mean \`--run ${command2}\`?`);
     return 2;
   }
-  const target = readPayloadRun(dir);
+  const acquired = readState(dir)?.acquired;
+  const target = acquired ? [acquired.node, acquired.entry] : readPayloadRun(dir);
   const verbs = readPayloadVerbs(dir);
-  const declared = verbs === "*" || Array.isArray(verbs) && command !== void 0 && verbs.includes(command);
+  const declared = verbs === "*" || Array.isArray(verbs) && command2 !== void 0 && verbs.includes(command2);
   if (!target || !declared) {
-    print(`unknown command: ${command}`);
+    print(`unknown command: ${command2}`);
     printUsage(config, print);
     return 2;
   }
-  const forwarded = [...resolveEntry(target), ...argv];
-  const result = (options.runEntry ?? defaultRunEntry)(forwarded, payloadDir(dir), payloadEnv(dir));
+  const forwarded = [...resolveEntry(target), ...argv2];
+  const cwd = payloadDir(dir);
+  const inherited = payloadEnv(dir);
+  const env = acquired ? runtimeEnvironment(acquired.node, inherited ?? process.env) : inherited;
+  unlock();
+  const result = (options.runEntry ?? defaultRunEntry)(forwarded, cwd, env);
   if (!result.ok && result.code === void 0) {
     print(`failed: ${result.error ?? `could not run ${forwarded[0]}`}`);
     return 1;
@@ -1821,10 +2307,10 @@ function doForward(config, dir, options, command, argv, print) {
 function doAutoupdate(config, options, args, print) {
   const mode = args[0] ?? "status";
   const scheduleOptions = options.autoupdate ?? {};
-  const command = options.autoupdate?.command ?? [process.execPath, "update"];
+  const command2 = options.autoupdate?.command ?? [process.execPath, "update"];
   if (mode === "on") {
     try {
-      enableSchedule(config, command, scheduleOptions);
+      enableSchedule(config, command2, scheduleOptions);
     } catch (error) {
       print(error.message);
       return 1;
@@ -1856,19 +2342,24 @@ function doAutoupdate(config, options, args, print) {
   if (state.lastRun) print(`last run:    ${state.lastRun}`);
   return 0;
 }
-function doDoctor(config, dir, options, print) {
+function doDoctor(config, dir, options, print, unlock) {
   doLauncherDoctor(config, dir, options, print);
-  const target = readPayloadRun(dir);
+  const acquired = readState(dir)?.acquired;
+  const target = acquired ? [acquired.node, acquired.entry] : readPayloadRun(dir);
   const verbs = readPayloadVerbs(dir);
   const chains = target !== null && (verbs === "*" || Array.isArray(verbs) && verbs.includes("doctor"));
   if (!chains) return 0;
-  const result = (options.runEntry ?? defaultRunEntry)([...resolveEntry(target), "doctor"], payloadDir(dir), payloadEnv(dir));
+  const cwd = payloadDir(dir);
+  const inherited = payloadEnv(dir);
+  const env = acquired ? runtimeEnvironment(acquired.node, inherited ?? process.env) : inherited;
+  unlock();
+  const result = (options.runEntry ?? defaultRunEntry)([...resolveEntry(target), "doctor"], cwd, env);
   return result.code ?? (result.ok ? 0 : 1);
 }
 function doLauncherDoctor(config, dir, options, print) {
   const tokens = readTokens(dir);
   const state = readState(dir);
-  const payloadPresent = (0, import_node_fs9.existsSync)(payloadDir(dir));
+  const payloadPresent = (0, import_node_fs11.existsSync)(payloadDir(dir));
   print(`product:  ${config.product}`);
   print(`host:     ${config.host}`);
   print(`login:    ${config.loginKind}`);
@@ -1880,7 +2371,7 @@ function doLauncherDoctor(config, dir, options, print) {
     print("token:    none \u2014 run login first.");
   }
   print(`payload:  ${state ? state.version : "none"}${payloadPresent ? "" : " (not downloaded)"}`);
-  print(`paths:    tokens ${(0, import_node_path4.join)(dir, "tokens.json")}, state ${(0, import_node_path4.join)(dir, "state.json")}, payload ${payloadDir(dir)}`);
+  print(`paths:    tokens ${(0, import_node_path6.join)(dir, "tokens.json")}, state ${(0, import_node_path6.join)(dir, "state.json")}, payload ${payloadDir(dir)}`);
   const schedule = querySchedule(config, options.autoupdate ?? {});
   print(
     `auto-update: ${!schedule.supported ? "unsupported on this platform" : schedule.enabled ? `on (${schedule.cadence ?? "hourly"})` : "off"}`