@mutmutco/installer-launcher 0.1.13 → 0.1.14

package/dist/launcher.js

@@ -1,18 +1,39 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { StringDecoder } from "node:string_decoder";
 import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/acquisition.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync, realpathSync as realpathSync2 } from "node:fs";
-import { join as join3, resolve, relative as relative2, isAbsolute as isAbsolute2, dirname } from "node:path";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, realpathSync as realpathSync2 } from "node:fs";
+import { join as join4, resolve, relative as relative2, isAbsolute as isAbsolute2, dirname as dirname2 } from "node:path";
 
 // src/runtime.ts
 import { createHash, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, readFileSync, writeFileSync, existsSync, renameSync, rmSync, realpathSync } from "node:fs";
 import { join, relative, isAbsolute } from "node:path";
+
+// src/download.ts
+async function readDownload(response, onProgress, expectedSize) {
+  const length = expectedSize ?? Number(response.headers.get("content-length"));
+  const total = Number.isSafeInteger(length) && length > 0 ? length : void 0;
+  let done = 0;
+  const report = () => onProgress?.({ done, ...total === void 0 ? {} : { total } });
+  report();
+  const chunks = [];
+  if (response.body) {
+    for await (const chunk of response.body) {
+      chunks.push(chunk);
+      done += chunk.length;
+      report();
+    }
+  }
+  return Buffer.concat(chunks);
+}
+
+// src/runtime.ts
 var NODE_VERSION = "24.20.0";
 var NPM_VERSION = "12.0.2";
 var ARTIFACTS = {
@@ -23,10 +44,10 @@ var ARTIFACTS = {
   "linux-arm64": ["node-v24.20.0-linux-arm64.tar.gz", "3515603e2487879a39bc75716f1a2affd027500c64ba50e845cf72cb33219013"]
 };
 var NPM_INTEGRITY = "uIXokLlBj6FpNUTQX1PmT5pz7BlIN9QlixX+zdaSNHsd0qUXsbDLr50xzY6Sw7cJVr0uzHKDOle0swmPW/p5Qw==";
-async function verifiedDownload(url, path, algorithm, digest, fetchImpl) {
+async function verifiedDownload(url, path, algorithm, digest, fetchImpl, onProgress) {
   const response = await fetchImpl(url);
   if (!response.ok) throw new Error(`runtime download failed (${response.status})`);
-  const bytes = Buffer.from(await response.arrayBuffer());
+  const bytes = await readDownload(response, onProgress);
   if (createHash(algorithm).update(bytes).digest(algorithm === "sha512" ? "base64" : "hex") !== digest) throw new Error("runtime archive checksum mismatch");
   writeFileSync(path, bytes);
 }
@@ -35,7 +56,7 @@ function command(executable, args) {
   if (result.error || result.status !== 0) throw new Error(`runtime preparation failed: ${result.error?.message ?? result.stderr.trim()}`);
   return result.stdout.trim();
 }
-async function acquireRuntime(dir, fetchImpl = fetch) {
+async function acquireRuntime(dir, fetchImpl = fetch, onProgress) {
   const platform = `${process.platform}-${process.arch}`;
   const artifact = ARTIFACTS[platform];
   if (!artifact) throw new Error(`managed runtime does not support ${platform}`);
@@ -53,13 +74,20 @@ async function acquireRuntime(dir, fetchImpl = fetch) {
   }
   const root = mkdtempSync(join(runtimeDir, "runtime-"));
   const archive = join(root, artifact[0]);
-  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl);
+  let downloaded = 0;
+  let currentBytes = 0;
+  const progress = ({ done }) => {
+    currentBytes = done;
+    onProgress?.({ done: downloaded + done });
+  };
+  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl, progress);
+  downloaded += currentBytes;
   const tar = process.platform === "win32" ? join(process.env.SystemRoot ?? "C:/Windows", "System32", "tar.exe") : "/usr/bin/tar";
   command(tar, ["-xf", archive, "-C", root]);
   const unpacked = join(root, artifact[0].replace(/\.(zip|tar\.gz)$/, ""));
   const node = join(unpacked, process.platform === "win32" ? "node.exe" : "bin/node");
   const npmArchive = join(root, "npm.tgz");
-  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl);
+  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl, progress);
   const npmRoot = join(root, "npm");
   mkdirSync(npmRoot);
   command(tar, ["-xf", npmArchive, "-C", npmRoot]);
@@ -164,7 +192,275 @@ function wipeProductDir(dir) {
   rmSync2(payload, { force: true, recursive: true });
 }
 
+// src/payload.ts
+import { createHash as createHash2, createPublicKey, verify } from "node:crypto";
+import { mkdirSync as mkdirSync3, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname, join as join3 } from "node:path";
+
+// src/canonical.ts
+function canonicalJson(value) {
+  return encode(value);
+}
+function encode(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("canonicalJson: cannot encode a non-finite number");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
+}
+
+// src/config.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { getAsset } from "node:sea";
+
+// src/module-url.ts
+import { pathToFileURL } from "node:url";
+function moduleUrl() {
+  if (typeof __filename === "string") return pathToFileURL(__filename).href;
+  return import.meta.url;
+}
+
+// src/config.ts
+function publicKeyBytes(config) {
+  const raw = Buffer.from(config.publicKey, "base64");
+  if (raw.length !== 32) {
+    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
+  }
+  return raw;
+}
+function loadProductConfig(options = {}) {
+  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
+  const devFallback = new URL("../config/product.template.json", moduleUrl());
+  if (explicit) {
+    return parseProductConfig(readFileSync3(explicit, "utf8"));
+  }
+  try {
+    return parseProductConfig(readFileSync3(devFallback, "utf8"));
+  } catch {
+  }
+  try {
+    const asset = getAsset("product.json", "utf8");
+    if (typeof asset === "string") return parseProductConfig(asset);
+  } catch {
+  }
+  throw new Error(
+    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
+  );
+}
+function parseProductConfig(text) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error("product config is not valid JSON");
+  }
+  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
+  const record = data;
+  const product = field(record, "product");
+  const host = field(record, "host").replace(/\/+$/, "");
+  const loginKind = field(record, "loginKind");
+  const binName = field(record, "binName");
+  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
+  if (loginKind !== "github" && loginKind !== "google") {
+    throw new Error('product config loginKind must be "github" or "google"');
+  }
+  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
+  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
+  publicKeyBytes(config);
+  if (loginKind === "github") {
+    const clientId = record.githubClientId;
+    if (typeof clientId !== "string" || clientId.length === 0) {
+      throw new Error("product config needs githubClientId for the github loginKind");
+    }
+    config.githubClientId = clientId;
+  } else if (typeof record.githubClientId === "string") {
+    config.githubClientId = record.githubClientId;
+  }
+  try {
+    const url = new URL(host);
+    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
+  } catch {
+    throw new Error("product config host must be an http(s) URL");
+  }
+  return config;
+}
+function field(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : "";
+}
+
+// src/payload.ts
+var NeedsLoginError = class extends Error {
+  constructor() {
+    super("signed out \u2014 run login first");
+    this.name = "NeedsLoginError";
+  }
+};
+var ForbiddenError = class extends Error {
+  constructor() {
+    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
+    this.name = "ForbiddenError";
+  }
+};
+function canonicalManifestBytes(manifest) {
+  return Buffer.from(
+    canonicalJson({
+      created: manifest.created,
+      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
+      version: manifest.version
+    }),
+    "utf8"
+  );
+}
+function ed25519PublicKey(config) {
+  const raw = publicKeyBytes(config);
+  return createPublicKey({
+    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyManifest(manifest, signature, config) {
+  try {
+    const signatureBytes = Buffer.from(signature, "base64");
+    if (signatureBytes.length === 0) return false;
+    return verify(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
+  } catch {
+    return false;
+  }
+}
+function verifyFileBytes(entry2, bytes) {
+  if (entry2.size !== bytes.length) return false;
+  return createHash2("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
+}
+async function readErrorCode(response) {
+  try {
+    const data = await response.json();
+    return typeof data.error === "string" ? data.error : "";
+  } catch {
+    return "";
+  }
+}
+function throwForStatus(status, errorCode) {
+  if (status === 401) throw new NeedsLoginError();
+  if (status === 403) throw new ForbiddenError();
+  throw new Error(
+    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
+  );
+}
+async function getJson(url, accessToken, fetchImpl) {
+  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
+  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
+  return { status: response.status, json: await response.json() };
+}
+function parseManifest(json) {
+  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
+  const record = json;
+  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
+  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
+  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
+  if (typeof record.signature !== "string" || !record.signature) {
+    throw new Error("the release manifest is unsigned");
+  }
+  const files = record.files.map((entry2) => {
+    const file = entry2;
+    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
+      throw new Error("the release manifest lists a malformed file");
+    }
+    const safe = safeManifestPath(file.path);
+    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
+    return { path: safe, sha256: file.sha256, size: file.size };
+  });
+  return { version: record.version, created: record.created, files, signature: record.signature };
+}
+function safeManifestPath(rawPath) {
+  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
+  if (rawPath.startsWith("/")) return null;
+  const segments = rawPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") return null;
+  }
+  return segments.join("/");
+}
+async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
+  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
+  const manifest = parseManifest(json);
+  if (!verifyManifest(manifest, manifest.signature, config)) {
+    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
+  }
+  return manifest;
+}
+async function fetchFileBytes(config, accessToken, path, fetchImpl, onProgress, expectedSize) {
+  const encoded = path.split("/").map(encodeURIComponent).join("/");
+  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!response.ok) {
+    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
+    throwForStatus(response.status, await readErrorCode(response));
+  }
+  return readDownload(response, onProgress, expectedSize);
+}
+async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const staging = join3(tmpdir2(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
+  mkdirSync3(staging, { recursive: true });
+  try {
+    const total = manifest.files.reduce((sum, entry2) => sum + entry2.size, 0);
+    let downloaded = 0;
+    for (const entry2 of manifest.files) {
+      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl, (progress) => options.onProgress?.({ done: downloaded + progress.done, total }), entry2.size);
+      downloaded += bytes.length;
+      if (!verifyFileBytes(entry2, bytes)) {
+        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
+      }
+      const dest = join3(staging, entry2.path);
+      mkdirSync3(dirname(dest), { recursive: true });
+      writeFileSync3(dest, bytes);
+    }
+    const target = join3(dir, "payload");
+    mkdirSync3(dir, { recursive: true });
+    rmSync3(target, { force: true, recursive: true });
+    renameSync3(staging, target);
+  } catch (error) {
+    rmSync3(staging, { force: true, recursive: true });
+    throw error;
+  }
+  return manifest.version;
+}
+
 // src/acquisition.ts
+function reusableCandidate(dir, manifest) {
+  try {
+    const saved = JSON.parse(readFileSync4(join4(dir, "acquisition-cache.json"), "utf8"));
+    if (saved.signature !== manifest.signature) return null;
+    const root = candidateRoot(dir, saved.candidate);
+    if (!existsSync4(join4(root, "acquired.json"))) return null;
+    for (const file of manifest.files) {
+      if (!safePath(file.path) || !verifyFileBytes(file, readFileSync4(join4(root, "payload", file.path)))) return null;
+    }
+    return saved.candidate;
+  } catch {
+    return null;
+  }
+}
+function rememberCandidate(dir, candidate, manifest) {
+  candidateRoot(dir, candidate);
+  writeFileSync4(join4(dir, "acquisition-cache.json"), JSON.stringify({ candidate, signature: manifest.signature }), { mode: 384 });
+}
 function safePath(value) {
   return typeof value === "string" && value.length > 0 && !/[\\:\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 }
@@ -172,7 +468,7 @@ function argumentsValid(value) {
   return Array.isArray(value) && value.every((arg) => typeof arg === "string" && !arg.includes("\0") && (!arg.includes("$") || arg === "$prefix" || arg === "$version"));
 }
 function readAcquisition(payload) {
-  const metadata = JSON.parse(readFileSync3(join3(payload, "payload.json"), "utf8"));
+  const metadata = JSON.parse(readFileSync4(join4(payload, "payload.json"), "utf8"));
   if (metadata.acquisition === void 0) return null;
   const a = metadata.acquisition;
   if (!a || a.schema !== 1 || !/^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(a.package) || !safePath(a.archive) || !a.archive.endsWith(".tgz") || !safePath(a.convergeEntry) || !safePath(a.rollbackEntry) || !safePath(a.runEntry) || !argumentsValid(a.convergeArgs) || !argumentsValid(a.rollbackArgs) || !argumentsValid(a.repairArgs) || !Array.isArray(a.platforms) || !a.platforms.length || a.platforms.some((p) => !["win32-x64", "win32-arm64", "darwin-arm64", "linux-x64", "linux-arm64"].includes(p))) {
@@ -188,25 +484,25 @@ function runtimeEnvironment(node, inherited, platform = process.platform) {
     current = (keys.length ? env[keys[0]] : "") ?? "";
     for (const key of keys) delete env[key];
   }
-  env.PATH = `${dirname(node)}${platform === "win32" ? ";" : ":"}${current}`;
+  env.PATH = `${dirname2(node)}${platform === "win32" ? ";" : ":"}${current}`;
   return env;
 }
 function lockInstallation(dir) {
-  mkdirSync3(dir, { recursive: true });
-  const path = join3(dir, "installation.lock");
+  mkdirSync4(dir, { recursive: true });
+  const path = join4(dir, "installation.lock");
   const owner = `${process.pid}:${randomUUID3()}`;
   try {
-    writeFileSync3(path, owner, { flag: "wx", mode: 384 });
+    writeFileSync4(path, owner, { flag: "wx", mode: 384 });
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
     const recovery = `${path}.recovery`;
     try {
-      writeFileSync3(recovery, owner, { flag: "wx", mode: 384, flush: true });
+      writeFileSync4(recovery, owner, { flag: "wx", mode: 384, flush: true });
     } catch {
       throw new Error("installation lock recovery is already pending");
     }
     try {
-      const previous = readFileSync3(path, "utf8");
+      const previous = readFileSync4(path, "utf8");
       const pid = Number(previous.split(":")[0]);
       if (!Number.isInteger(pid) || pid <= 0) throw new Error("installation lock is malformed; recovery required");
       try {
@@ -216,29 +512,29 @@ function lockInstallation(dir) {
         if (probe.code !== "ESRCH") throw probe;
       }
       unlinkSync(path);
-      writeFileSync3(path, owner, { flag: "wx", mode: 384, flush: true });
+      writeFileSync4(path, owner, { flag: "wx", mode: 384, flush: true });
     } finally {
       unlinkSync(recovery);
     }
   }
   let released = false;
   return () => {
-    if (!released && readFileSync3(path, "utf8") === owner) unlinkSync(path);
+    if (!released && readFileSync4(path, "utf8") === owner) unlinkSync(path);
     released = true;
   };
 }
 function pendingPath(dir) {
-  return join3(dir, "acquisition-pending.json");
+  return join4(dir, "acquisition-pending.json");
 }
 function candidateRoot(dir, candidate) {
   if (!/^[a-zA-Z0-9_-]+$/.test(candidate)) throw new Error("invalid acquisition candidate");
-  return join3(dir, "candidates", candidate);
+  return join4(dir, "candidates", candidate);
 }
 function packageRoot(prefix, acquisition) {
-  return join3(prefix, "node_modules", acquisition.package);
+  return join4(prefix, "node_modules", acquisition.package);
 }
 function entry(root, path) {
-  const actual = realpathSync2(join3(root, path));
+  const actual = realpathSync2(join4(root, path));
   const rel = relative2(realpathSync2(root), actual);
   if (rel.startsWith("..") || isAbsolute2(rel)) throw new Error("acquired entry escapes package");
   return actual;
@@ -250,54 +546,59 @@ function acquisitionRepairCommand(dir, version) {
   const state = readState(dir);
   if (!state?.acquired || state.version !== version) throw new Error("installed acquisition selection is missing");
   const root = candidateRoot(dir, state.acquired.candidate);
-  const acquisition = readAcquisition(join3(root, "payload"));
+  const acquisition = readAcquisition(join4(root, "payload"));
   if (!acquisition) throw new Error("installed acquisition declaration is missing");
-  const prefix = join3(root, "prefix");
+  const prefix = join4(root, "prefix");
   const productRoot = packageRoot(prefix, acquisition);
-  const pkg = JSON.parse(readFileSync3(join3(productRoot, "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync4(join4(productRoot, "package.json"), "utf8"));
   if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("installed package identity does not match signed release");
   return argv(realpathSync2(state.acquired.node), productRoot, acquisition.runEntry, acquisition.repairArgs, prefix, version);
 }
 async function recoverAcquisition(dir, run2, env) {
-  if (!existsSync3(pendingPath(dir))) return;
-  const pending = JSON.parse(readFileSync3(pendingPath(dir), "utf8"));
+  if (!existsSync4(pendingPath(dir))) return;
+  const pending = JSON.parse(readFileSync4(pendingPath(dir), "utf8"));
   if (pending.schema !== 1 || typeof pending.version !== "string" || typeof pending.node !== "string") throw new Error("invalid pending acquisition receipt");
   const root = candidateRoot(dir, pending.candidate);
   if (readState(dir)?.acquired?.candidate === pending.candidate) {
     unlinkSync(pendingPath(dir));
     return;
   }
-  const acquisition = readAcquisition(join3(root, "payload"));
+  const acquisition = readAcquisition(join4(root, "payload"));
   if (!acquisition) throw new Error("pending acquisition lost its signed declaration");
-  const prefix = join3(root, "prefix");
+  const prefix = join4(root, "prefix");
   const command2 = argv(pending.node, packageRoot(prefix, acquisition), acquisition.rollbackEntry, acquisition.rollbackArgs, prefix, pending.version);
   if (!await run2(command2, root, runtimeEnvironment(pending.node, env))) throw new Error("installation recovery is pending; product rollback did not finish");
   if (pending.previous) writeState(dir, pending.previous);
-  else if (existsSync3(statePath(dir))) unlinkSync(statePath(dir));
+  else if (existsSync4(statePath(dir))) unlinkSync(statePath(dir));
   unlinkSync(pendingPath(dir));
 }
 async function installAcquisition(dir, candidate, version, acquisition, options) {
   if (!acquisition.platforms.includes(`${process.platform}-${process.arch}`)) throw new Error("this product does not support this platform");
   const root = candidateRoot(dir, candidate);
-  const payload = join3(root, "payload");
-  const prefix = join3(root, "prefix");
-  mkdirSync3(prefix);
-  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl);
+  const payload = join4(root, "payload");
+  const prefix = join4(root, "prefix");
+  const prepared = join4(root, "acquired.json");
+  const archiveHash = createHash3("sha256").update(readFileSync4(join4(payload, acquisition.archive))).digest("hex");
+  const reused = existsSync4(prepared);
+  if (reused && JSON.parse(readFileSync4(prepared, "utf8")).archiveHash !== archiveHash) throw new Error("cached acquisition archive changed");
+  if (!reused) mkdirSync4(prefix);
+  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl, options.onProgress);
   const env = runtimeEnvironment(runtime.node, options.env);
   const npmEnv = { ...env };
   for (const key of Object.keys(npmEnv)) {
     if (/^npm_config_/i.test(key) || /^(NPM_TOKEN|NODE_AUTH_TOKEN|MM_INSTALLER_TOKEN)$/i.test(key)) delete npmEnv[key];
   }
-  const npmrc = join3(root, "public.npmrc");
-  const globalrc = join3(root, "global.npmrc");
-  writeFileSync3(npmrc, "registry=https://registry.npmjs.org/\n");
-  writeFileSync3(globalrc, "");
+  const npmrc = join4(root, "public.npmrc");
+  const globalrc = join4(root, "global.npmrc");
+  writeFileSync4(npmrc, "registry=https://registry.npmjs.org/\n");
+  writeFileSync4(globalrc, "");
   const install = [
     runtime.node,
     runtime.npm,
     "install",
     "--prefix",
     prefix,
+    "--install-strategy=shallow",
     "--ignore-scripts",
     "--no-audit",
     "--no-fund",
@@ -309,15 +610,16 @@ async function installAcquisition(dir, candidate, version, acquisition, options)
     "https://registry.npmjs.org/",
     resolve(payload, acquisition.archive)
   ];
-  if (!await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
+  if (!reused && !await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
   const productRoot = packageRoot(prefix, acquisition);
-  const pkg = JSON.parse(readFileSync3(join3(productRoot, "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync4(join4(productRoot, "package.json"), "utf8"));
   if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("acquired package identity does not match signed release");
   const runEntry = entry(productRoot, acquisition.runEntry);
   const convergence = argv(runtime.node, productRoot, acquisition.convergeEntry, acquisition.convergeArgs, prefix, version);
   entry(productRoot, acquisition.rollbackEntry);
+  if (!reused) writeFileSync4(prepared, JSON.stringify({ archiveHash }), { flag: "wx", mode: 384, flush: true });
   const pending = { schema: 1, candidate, version, node: runtime.node, previous: readState(dir) };
-  writeFileSync3(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
+  writeFileSync4(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
   try {
     if (!await options.run(convergence, root, env)) throw new Error("product convergence did not finish");
     (options.commit ?? writeState)(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), acquired: { candidate, node: runtime.node, entry: runEntry } });
@@ -336,36 +638,36 @@ import { dirname as dirname3, join as join6, resolve as resolve2 } from "node:pa
 import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 
 // ../face/src/face.ts
-import { writeSync } from "node:fs";
+import { appendFileSync, writeSync } from "node:fs";
 
 // ../face/src/products.ts
 var PRODUCTS = Object.freeze({
   "mm-strategy": Object.freeze({
     name: "MM Strategy",
-    installWarm: "Welcome. Let's set up MM Strategy \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;249;115;22",
-    warm: "Welcome. Let's set up MM Strategy \u2014 about a minute.",
+    warm: "Welcome back. Checking for updates...",
     doctor: "mm-strategy doctor"
   }),
   "mmi-hub": Object.freeze({
     name: "mmi-hub",
-    installWarm: "Welcome. Setting up mmi-hub \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;125;211;252",
-    warm: "Welcome back. Checking your surfaces\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "mmi doctor"
   }),
   "jerv-hub": Object.freeze({
     name: "jerv-hub",
-    installWarm: "Welcome. Setting up jerv-hub \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;248;113;113",
-    warm: "Welcome back. Checking your surfaces\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "jerv doctor"
   }),
   jervcode: Object.freeze({
     name: "JervCode",
-    installWarm: "Welcome. Setting up JervCode \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;192;132;252",
-    warm: "Welcome back. Keeping JervCode current\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "jervcode doctor"
   })
 });
@@ -379,6 +681,7 @@ function identityFor(product) {
 
 // ../face/src/face.ts
 var GLYPH = Object.freeze({
+  clock: "\u23F0",
   diamond: "\u25C6",
   hollow: "\u25C7",
   bar: "\u2502",
@@ -450,12 +753,16 @@ function createFace({ product, color = false, columns, env = process.env, operat
   const continuesFace = continuedPhases.size > 0;
   const nested = env.MM_OUTER_CONSOLE === "1";
   const progressFd = readProgressFd(env);
+  const progressFile = env.MM_PROGRESS_PROTOCOL === "1" ? env.MM_PROGRESS_FILE : void 0;
   const emitMilestone = (title, measure, kind) => {
-    if (progressFd === null) return false;
+    if (progressFd === null && !progressFile) return false;
     const record = { v: PROGRESS_PROTOCOL, step: stripColor(title), state: kind };
     if (typeof measure === "number") record.ms = Math.max(0, Math.round(measure * 1e3));
+    if (kind === "running" && typeof measure === "string") record.measure = measure;
     try {
-      writeSync(progressFd, `${JSON.stringify(record)}
+      if (progressFile) appendFileSync(progressFile, `${JSON.stringify(record)}
+`);
+      else writeSync(progressFd, `${JSON.stringify(record)}
 `);
       return true;
     } catch {
@@ -474,7 +781,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
   };
   const step = (title, measure = null, kind = "ok") => {
     if (emitMilestone(title, measure, kind)) return "";
-    const glyph = kind === "fail" ? paint(identity.accent, GLYPH.cross) : kind === "note" ? paint(PALETTE.muted, GLYPH.dot) : paint(PALETTE.green, GLYPH.check);
+    const glyph = title === "Armed hourly updates" && kind === "ok" ? GLYPH.clock : kind === "fail" ? paint(identity.accent, GLYPH.cross) : kind === "note" ? paint(PALETTE.muted, GLYPH.dot) : paint(PALETTE.green, GLYPH.check);
     const measured = measure === null || measure === void 0 ? "" : paint(PALETTE.muted, typeof measure === "number" ? `${Math.max(0, Math.round(measure))}s` : String(measure).trim());
     const time = measured;
     const column = Math.min(44, Math.max(0, width - 8));
@@ -484,7 +791,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
     const pad = Math.max(1, column - visibleWidth(head));
     return [time ? `${head}${" ".repeat(pad)}${time}` : head, ...rest.map((line) => `${bar()}${indent}${line}`)].join("\n");
   };
-  const relay = (text) => String(text).split("\n").flatMap((line) => line.trim() === "" ? [bar()] : (visibleWidth(line) <= width - TITLE_COLUMN ? [line] : wrapWords(line, width - TITLE_COLUMN)).map((part) => `${bar()}${indent}${part}`)).join("\n");
+  const relay = (text) => String(text).replace(/\r?\n$/, "").split(/\r?\n/).flatMap((line) => line.trim() === "" ? [bar()] : (visibleWidth(line) <= width - TITLE_COLUMN ? [line] : wrapWords(line, width - TITLE_COLUMN)).map((part) => `${bar()}${indent}${part}`)).join("\n");
   const receipt = (lines, { ready = true } = {}) => {
     if (ready && nested) return [];
     const body = (Array.isArray(lines) ? lines : String(lines).split("\n")).flatMap((raw) => {
@@ -515,14 +822,14 @@ function createFace({ product, color = false, columns, env = process.env, operat
   };
   const signOff = () => nested ? "" : `${paint(identity.accent, GLYPH.diamond)}  ${paint(identity.accent, `${identity.name} \xB7 Mutatis Mutandis`)}`;
   const refusal = (message) => `${bar()}  ${paint(identity.accent, GLYPH.cross)}  ${message}`;
-  return { identity, width, nested, emitsProgress: progressFd !== null, welcome, continues, step, relay, receipt, outcome, signOff, refusal, paint };
+  return { identity, width, nested, emitsProgress: progressFd !== null || Boolean(progressFile), welcome, continues, step, progress: (title, measure = null) => emitMilestone(title, measure, "running"), relay, receipt, outcome, signOff, refusal, paint };
 }
 
 // ../face/src/shell.ts
 var RELAY_INDENT = " ".repeat(TITLE_COLUMN - 1);
 
 // ../face/src/spinner.ts
-import { appendFileSync, writeSync as writeSync2 } from "node:fs";
+import { appendFileSync as appendFileSync2, writeSync as writeSync2 } from "node:fs";
 import { Worker } from "node:worker_threads";
 var FRAMES = ["\u25D2", "\u25D0", "\u25D3", "\u25D1"];
 var WORKER_SOURCE = `
@@ -534,7 +841,7 @@ function draw() {
   if (Atomics.compareExchange(control, 1, 0, 1) !== 0) return;
   try {
     if (Atomics.load(control, 0) || Atomics.load(control, 2) || !frames.length) return;
-    const text = frames[frame++ % frames.length];
+    const text = frames[frame++ % frames.length].replace('__elapsed__', Math.floor((Date.now() - workerData.started) / 1000) + 's');
     writeSync(2, text);
     if (workerData.transcriptPath) appendFileSync(workerData.transcriptPath, JSON.stringify({ channel: 'spinner', text }) + '\\n');
   } finally {
@@ -546,7 +853,6 @@ parentPort.on('message', (next) => {
   if (Atomics.load(control, 2)) return;
   frames = next.frames;
   frame = next.frame;
-  Atomics.store(control, 0, 0);
 });
 setInterval(draw, workerData.intervalMs);
 `;
@@ -557,20 +863,22 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
   let control = null;
   let frames = [];
   let frame = 0;
+  let started = 0;
+  let suspended = false;
   const write = (text) => {
     if (stream) stream.write(text);
     else {
       writeSync2(2, text);
-      if (transcriptPath) appendFileSync(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
+      if (transcriptPath) appendFileSync2(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
 `);
     }
   };
   const render = (text, measure) => {
-    const line = face.step(text, measure, "note").split("\n")[0];
+    const line = face.step(text, measure ?? "__elapsed__", "note").split("\n")[0];
     frames = line ? FRAMES.map((glyph) => `\r\x1B[2K${line.replace(GLYPH.dot, glyph)}`) : [];
   };
   const draw = () => {
-    if (animate && frames.length) write(frames[frame++ % frames.length]);
+    if (animate && !suspended && frames.length) write(frames[frame++ % frames.length].replace("__elapsed__", `${Math.floor((Date.now() - started) / 1e3)}s`));
   };
   const pause = () => {
     if (!control) return;
@@ -590,6 +898,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
     start(text, measure = null) {
       if (!animate) return;
       halt();
+      suspended = false;
+      started = Date.now();
       render(text, measure);
       frame = 0;
       draw();
@@ -603,7 +913,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
             frames,
             frame,
             intervalMs,
-            transcriptPath
+            transcriptPath,
+            started
           } });
           const active = worker;
           worker.on("error", () => {
@@ -621,9 +932,22 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
       render(text, measure);
       draw();
       worker?.postMessage({ frames, frame });
+      if (control && !suspended) Atomics.store(control, 0, 0);
+    },
+    pause() {
+      if (suspended) return;
+      suspended = true;
+      pause();
+      if (animate && frames.length) write("\r\x1B[2K");
+    },
+    resume() {
+      suspended = false;
+      if (control) Atomics.store(control, 0, 0);
+      if (timer || worker) draw();
     },
     stop() {
       halt();
+      frames = [];
       if (animate) write("\r\x1B[2K");
     }
   };
@@ -634,10 +958,10 @@ var SPINNER_FRAMES = Object.freeze([...FRAMES]);
 var ALLOWED = new Set(Object.values(GLYPH));
 
 // ../face/src/run.ts
-import { appendFileSync as appendFileSync2 } from "node:fs";
+import { appendFileSync as appendFileSync3 } from "node:fs";
 
 // ../face/src/outcome.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
 var counts = ["total", "updated", "failed"];
 var strings = ["version", "retry", "detail", "logPath"];
 var flags = ["dryRun", "installed", "deferred", "operationFailed"];
@@ -659,12 +983,12 @@ function validateInstallerOutcome(value) {
   return { ...facts };
 }
 function writeInstallerOutcome(path, value) {
-  writeFileSync4(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
+  writeFileSync5(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
 }
 function readInstallerOutcome(path) {
   let text;
   try {
-    text = readFileSync4(path, "utf8");
+    text = readFileSync5(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -727,6 +1051,7 @@ var PHASES = {
   "verify-release": ["Checking the release version", "Verified the release version"],
   verify: ["Verifying the payload", "Verified the payload"],
   install: ["Installing the product", "Installed the product"],
+  configure: ["Configuring the product", "Configured the product"],
   activate: ["Activating surfaces", "Activated surfaces"],
   doctor: ["Checking health", "Checked health"],
   rollback: ["Restoring the previous version", "Restored the previous version"]
@@ -756,7 +1081,7 @@ function createInstallerRun(value, options = {}) {
     if (!text) return;
     write(text, channel);
     if (env.MM_FACE_TRANSCRIPT) {
-      appendFileSync2(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
+      appendFileSync3(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
 `, "utf8");
     }
   };
@@ -771,6 +1096,17 @@ function createInstallerRun(value, options = {}) {
       return true;
     } } } : { transcriptPath: env.MM_FACE_TRANSCRIPT }
   });
+  let activeTitle;
+  let chunkOpen = false;
+  let chunkChannel = "stdout";
+  let chunkColumn = 0;
+  const trailingCR = /* @__PURE__ */ new Set();
+  let deferredActivity;
+  const closeChunk = () => {
+    if (chunkOpen) emit("\n", chunkChannel);
+    chunkOpen = false;
+    chunkColumn = 0;
+  };
   let started = false;
   let finished = false;
   const start = () => {
@@ -785,6 +1121,9 @@ function createInstallerRun(value, options = {}) {
     }
   };
   const durable = (title, measure, kind) => {
+    closeChunk();
+    activeTitle = void 0;
+    deferredActivity = void 0;
     spinner.stop();
     const rendered = face.step(title, measure, kind);
     if (rendered) lines([tty ? rendered : `${kind === "fail" ? "Failed: " : ""}${title}${measure === null ? "" : ` (${typeof measure === "number" ? `${Math.max(0, Math.round(measure))}s` : measure})`}`]);
@@ -801,7 +1140,12 @@ function createInstallerRun(value, options = {}) {
       const state = facts.state ?? "ok";
       const title = PHASES[id][state === "ok" ? 1 : 0];
       if (state === "running") {
-        spinner.start(title, facts.measure ?? null);
+        if (face.progress(title, facts.measure ?? null)) return;
+        if (activeTitle === title) spinner.say(title, facts.measure ?? null);
+        else {
+          activeTitle = title;
+          spinner.start(title, facts.measure ?? null);
+        }
         return;
       }
       if (!face.continues(id, state)) durable(title, facts.seconds ?? facts.measure ?? null, state);
@@ -821,8 +1165,20 @@ function createInstallerRun(value, options = {}) {
       durable(`${facts.id}${versions} ${separator} ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
       if (facts.detail) run2.relay(facts.detail);
     },
-    milestone({ step, state, ms }) {
+    milestone({ step, state, ms, measure }) {
       start();
+      if (state === "running") {
+        if (chunkOpen) {
+          deferredActivity = { title: step, measure: measure ?? null };
+          return;
+        }
+        if (activeTitle === step) spinner.say(step, measure ?? null);
+        else {
+          activeTitle = step;
+          spinner.start(step, measure ?? null);
+        }
+        return;
+      }
       durable(step, ms === void 0 ? null : ms / 1e3, state);
     },
     signIn({ url, code }) {
@@ -836,7 +1192,8 @@ function createInstallerRun(value, options = {}) {
     },
     // Only pass safe diagnostic text, never authentication output or credentials.
     relay(text, channel = "stdout", record = true) {
-      spinner.stop();
+      closeChunk();
+      spinner.pause();
       const rendered = tty ? face.relay(text) : stripColor(text);
       for (const row of rendered.split("\n")) if (row) {
         emit(`${row}
@@ -844,6 +1201,37 @@ function createInstallerRun(value, options = {}) {
 ` : `${tty ? face.relay("[external output omitted]") : "[external output omitted]"}
 `);
       }
+      spinner.resume();
+    },
+    relayChunk(text, channel = "stdout") {
+      spinner.pause();
+      if (chunkOpen && chunkChannel !== channel) closeChunk();
+      chunkChannel = channel;
+      if (trailingCR.delete(channel) && text.startsWith("\n")) text = text.slice(1);
+      if (text.endsWith("\r")) trailingCR.add(channel);
+      const parts = text.replace(/\r\n|\r/g, "\n").split("\n");
+      for (let i = 0; i < parts.length; i++) {
+        const characters = [...stripColor(parts[i])];
+        while (characters.length) {
+          if (tty && chunkColumn >= face.width - 6) closeChunk();
+          const part = characters.splice(0, tty ? face.width - 6 - chunkColumn : characters.length).join("");
+          emit(tty && !chunkOpen ? face.relay(part) : part, channel, chunkOpen ? "" : tty ? face.relay("[external output omitted]") : "[external output omitted]");
+          chunkColumn += [...part].length;
+          chunkOpen = true;
+        }
+        if (i < parts.length - 1) {
+          emit("\n", channel);
+          chunkOpen = false;
+          chunkColumn = 0;
+        }
+      }
+      if (!chunkOpen) {
+        if (deferredActivity) {
+          activeTitle = deferredActivity.title;
+          spinner.start(deferredActivity.title, deferredActivity.measure);
+          deferredActivity = void 0;
+        } else spinner.resume();
+      }
     },
     cancel() {
       if (finished) return;
@@ -852,6 +1240,8 @@ function createInstallerRun(value, options = {}) {
         { total: 0, updated: 0, failed: 0, deferred: true, detail: "Operation cancelled." }
       );
       start();
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
       finished = true;
       if (!face.nested || !env.MM_INSTALLER_OUTCOME_FILE) {
@@ -864,6 +1254,8 @@ function createInstallerRun(value, options = {}) {
       validateInstallerOutcome(facts);
       if (env.MM_INSTALLER_OUTCOME_FILE) writeInstallerOutcome(env.MM_INSTALLER_OUTCOME_FILE, facts);
       start();
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
       finished = true;
       if (options.quiet && facts.updated === 0 && facts.failed === 0 && !facts.operationFailed) return;
@@ -884,6 +1276,8 @@ function createInstallerRun(value, options = {}) {
       if (tty) lines([face.signOff()]);
     },
     stop() {
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
     }
   };
@@ -892,9 +1286,9 @@ function createInstallerRun(value, options = {}) {
 
 // src/autoupdate.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join5 } from "node:path";
 function schedulePlatform(override) {
   const platform = override ?? process.platform;
   if (platform === "win32" || platform === "darwin" || platform === "linux") return platform;
@@ -911,8 +1305,8 @@ function defaultExec(command2, args) {
 }
 function homeOf(options) {
   if (options.homeDir) return options.homeDir;
-  if (process.platform === "win32") return process.env.USERPROFILE ?? tmpdir2();
-  return process.env.HOME ?? tmpdir2();
+  if (process.platform === "win32") return process.env.USERPROFILE ?? tmpdir3();
+  return process.env.HOME ?? tmpdir3();
 }
 function scheduleName(config) {
   return `${config.binName} autoupdate`;
@@ -938,10 +1332,10 @@ function enableSchedule(config, command2, options = {}) {
   }
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
-    const dir2 = join4(home, "Library", "LaunchAgents");
-    mkdirSync4(dir2, { recursive: true });
-    const plist = join4(dir2, `${label2}.plist`);
-    writeFileSync5(plist, darwinPlist(label2, command2));
+    const dir2 = join5(home, "Library", "LaunchAgents");
+    mkdirSync5(dir2, { recursive: true });
+    const plist = join5(dir2, `${label2}.plist`);
+    writeFileSync6(plist, darwinPlist(label2, command2));
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
     const result2 = exec("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, plist]);
     if (result2.code !== 0) {
@@ -950,10 +1344,10 @@ function enableSchedule(config, command2, options = {}) {
     return;
   }
   const label = scheduleLabel(config);
-  const dir = join4(home, ".config", "systemd", "user");
-  mkdirSync4(dir, { recursive: true });
-  writeFileSync5(join4(dir, `${label}.service`), linuxService(command2));
-  writeFileSync5(join4(dir, `${label}.timer`), linuxTimer(label));
+  const dir = join5(home, ".config", "systemd", "user");
+  mkdirSync5(dir, { recursive: true });
+  writeFileSync6(join5(dir, `${label}.service`), linuxService(command2));
+  writeFileSync6(join5(dir, `${label}.timer`), linuxTimer(label));
   const reload = exec("systemctl", ["--user", "daemon-reload"]);
   if (reload.code !== 0) {
     throw new Error(`could not turn autoupdate on: ${firstLine(reload.stderr || reload.stdout) || `exit ${reload.code}`}`);
@@ -978,14 +1372,14 @@ function disableSchedule(config, options = {}) {
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
-    rmSync3(join4(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
+    rmSync4(join5(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
     return;
   }
   const label = scheduleLabel(config);
-  const dir = join4(home, ".config", "systemd", "user");
+  const dir = join5(home, ".config", "systemd", "user");
   exec("systemctl", ["--user", "disable", "--now", `${label}.timer`]);
-  rmSync3(join4(dir, `${label}.service`), { force: true });
-  rmSync3(join4(dir, `${label}.timer`), { force: true });
+  rmSync4(join5(dir, `${label}.service`), { force: true });
+  rmSync4(join5(dir, `${label}.timer`), { force: true });
 }
 function querySchedule(config, options = {}) {
   const platform = schedulePlatform(options.platform);
@@ -1003,12 +1397,12 @@ function querySchedule(config, options = {}) {
     return state2;
   }
   if (platform === "darwin") {
-    const plist = join4(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
-    if (!existsSync4(plist)) return { supported: true, enabled: false };
+    const plist = join5(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
+    if (!existsSync5(plist)) return { supported: true, enabled: false };
     return { supported: true, enabled: true, cadence: "hourly" };
   }
-  const timer = join4(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
-  if (!existsSync4(timer)) return { supported: true, enabled: false };
+  const timer = join5(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
+  if (!existsSync5(timer)) return { supported: true, enabled: false };
   const state = { supported: true, enabled: true, cadence: "hourly" };
   const shown = exec("systemctl", ["--user", "show", `${scheduleLabel(config)}.service`, "-p", "ExecMainStartTimestamp", "--value"]);
   const stamp = (shown.stdout ?? "").trim();
@@ -1065,86 +1459,6 @@ function firstLine(text) {
   return String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0] ?? "";
 }
 
-// src/config.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import { getAsset } from "node:sea";
-
-// src/module-url.ts
-import { pathToFileURL } from "node:url";
-function moduleUrl() {
-  if (typeof __filename === "string") return pathToFileURL(__filename).href;
-  return import.meta.url;
-}
-
-// src/config.ts
-function publicKeyBytes(config) {
-  const raw = Buffer.from(config.publicKey, "base64");
-  if (raw.length !== 32) {
-    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
-  }
-  return raw;
-}
-function loadProductConfig(options = {}) {
-  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
-  const devFallback = new URL("../config/product.template.json", moduleUrl());
-  if (explicit) {
-    return parseProductConfig(readFileSync6(explicit, "utf8"));
-  }
-  try {
-    return parseProductConfig(readFileSync6(devFallback, "utf8"));
-  } catch {
-  }
-  try {
-    const asset = getAsset("product.json", "utf8");
-    if (typeof asset === "string") return parseProductConfig(asset);
-  } catch {
-  }
-  throw new Error(
-    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
-  );
-}
-function parseProductConfig(text) {
-  let data;
-  try {
-    data = JSON.parse(text);
-  } catch {
-    throw new Error("product config is not valid JSON");
-  }
-  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
-  const record = data;
-  const product = field(record, "product");
-  const host = field(record, "host").replace(/\/+$/, "");
-  const loginKind = field(record, "loginKind");
-  const binName = field(record, "binName");
-  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
-  if (loginKind !== "github" && loginKind !== "google") {
-    throw new Error('product config loginKind must be "github" or "google"');
-  }
-  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
-  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
-  publicKeyBytes(config);
-  if (loginKind === "github") {
-    const clientId = record.githubClientId;
-    if (typeof clientId !== "string" || clientId.length === 0) {
-      throw new Error("product config needs githubClientId for the github loginKind");
-    }
-    config.githubClientId = clientId;
-  } else if (typeof record.githubClientId === "string") {
-    config.githubClientId = record.githubClientId;
-  }
-  try {
-    const url = new URL(host);
-    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
-  } catch {
-    throw new Error("product config host must be an http(s) URL");
-  }
-  return config;
-}
-function field(record, key) {
-  const value = record[key];
-  return typeof value === "string" ? value : "";
-}
-
 // src/login-github.ts
 import { spawn } from "node:child_process";
 var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -1267,7 +1581,7 @@ async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
 }
 
 // src/login-google.ts
-import { createHash as createHash2, randomBytes } from "node:crypto";
+import { createHash as createHash4, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 var b64url = (bytes) => bytes.toString("base64url");
 async function loginGoogle(options) {
@@ -1290,7 +1604,7 @@ async function loginGoogle(options) {
       throw new Error("the sign-in server returned a malformed registration");
     }
     const verifier = b64url(randomBytes(32));
-    const challenge = b64url(createHash2("sha256").update(verifier).digest());
+    const challenge = b64url(createHash4("sha256").update(verifier).digest());
     const state = b64url(randomBytes(16));
     const authorize = new URL(`${server}/oauth/authorize`);
     authorize.search = new URLSearchParams({
@@ -1379,175 +1693,8 @@ function page(title, body) {
   return `<!doctype html><meta charset="utf-8"><meta name="color-scheme" content="dark"><title>${title}</title><style>${style}</style><main><h1>${title}</h1><p>${body}</p></main>`;
 }
 
-// src/payload.ts
-import { createHash as createHash3, createPublicKey, verify } from "node:crypto";
-import { mkdirSync as mkdirSync5, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname2, join as join5 } from "node:path";
-
-// src/canonical.ts
-function canonicalJson(value) {
-  return encode(value);
-}
-function encode(value) {
-  if (value === null) return "null";
-  if (typeof value === "string") return JSON.stringify(value);
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new TypeError("canonicalJson: cannot encode a non-finite number");
-    }
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const record = value;
-    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
-    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
-  }
-  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
-}
-
-// src/payload.ts
-var NeedsLoginError = class extends Error {
-  constructor() {
-    super("signed out \u2014 run login first");
-    this.name = "NeedsLoginError";
-  }
-};
-var ForbiddenError = class extends Error {
-  constructor() {
-    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
-    this.name = "ForbiddenError";
-  }
-};
-function canonicalManifestBytes(manifest) {
-  return Buffer.from(
-    canonicalJson({
-      created: manifest.created,
-      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
-      version: manifest.version
-    }),
-    "utf8"
-  );
-}
-function ed25519PublicKey(config) {
-  const raw = publicKeyBytes(config);
-  return createPublicKey({
-    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
-    format: "jwk"
-  });
-}
-function verifyManifest(manifest, signature, config) {
-  try {
-    const signatureBytes = Buffer.from(signature, "base64");
-    if (signatureBytes.length === 0) return false;
-    return verify(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
-  } catch {
-    return false;
-  }
-}
-function verifyFileBytes(entry2, bytes) {
-  if (entry2.size !== bytes.length) return false;
-  return createHash3("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
-}
-async function readErrorCode(response) {
-  try {
-    const data = await response.json();
-    return typeof data.error === "string" ? data.error : "";
-  } catch {
-    return "";
-  }
-}
-function throwForStatus(status, errorCode) {
-  if (status === 401) throw new NeedsLoginError();
-  if (status === 403) throw new ForbiddenError();
-  throw new Error(
-    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
-  );
-}
-async function getJson(url, accessToken, fetchImpl) {
-  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
-  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
-  return { status: response.status, json: await response.json() };
-}
-function parseManifest(json) {
-  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
-  const record = json;
-  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
-  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
-  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
-  if (typeof record.signature !== "string" || !record.signature) {
-    throw new Error("the release manifest is unsigned");
-  }
-  const files = record.files.map((entry2) => {
-    const file = entry2;
-    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
-      throw new Error("the release manifest lists a malformed file");
-    }
-    const safe = safeManifestPath(file.path);
-    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
-    return { path: safe, sha256: file.sha256, size: file.size };
-  });
-  return { version: record.version, created: record.created, files, signature: record.signature };
-}
-function safeManifestPath(rawPath) {
-  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
-  if (rawPath.startsWith("/")) return null;
-  const segments = rawPath.split("/");
-  for (const segment of segments) {
-    if (segment === "" || segment === "." || segment === "..") return null;
-  }
-  return segments.join("/");
-}
-async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
-  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
-  const manifest = parseManifest(json);
-  if (!verifyManifest(manifest, manifest.signature, config)) {
-    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
-  }
-  return manifest;
-}
-async function fetchFileBytes(config, accessToken, path, fetchImpl) {
-  const encoded = path.split("/").map(encodeURIComponent).join("/");
-  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
-    headers: { authorization: `Bearer ${accessToken}` }
-  });
-  if (!response.ok) {
-    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
-    throwForStatus(response.status, await readErrorCode(response));
-  }
-  return Buffer.from(await response.arrayBuffer());
-}
-async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const staging = join5(tmpdir3(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
-  mkdirSync5(staging, { recursive: true });
-  try {
-    for (const entry2 of manifest.files) {
-      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl);
-      if (!verifyFileBytes(entry2, bytes)) {
-        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
-      }
-      const dest = join5(staging, entry2.path);
-      mkdirSync5(dirname2(dest), { recursive: true });
-      writeFileSync6(dest, bytes);
-    }
-    const target = join5(dir, "payload");
-    mkdirSync5(dir, { recursive: true });
-    rmSync4(target, { force: true, recursive: true });
-    renameSync3(staging, target);
-  } catch (error) {
-    rmSync4(staging, { force: true, recursive: true });
-    throw error;
-  }
-  return manifest.version;
-}
-
 // src/index.ts
-var LAUNCHER_VERSION = true ? "0.1.13" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "0.1.14" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -1783,12 +1930,13 @@ function parseProgress(raw) {
       const message = JSON.parse(line);
       if (!SUPPORTED_PROGRESS_PROTOCOLS.has(message.v) || typeof message.step !== "string") continue;
       const state = message.state ?? "ok";
-      if (state !== "ok" && state !== "fail" && state !== "note") continue;
+      if (state !== "ok" && state !== "fail" && state !== "note" && state !== "running") continue;
       if (message.ms !== void 0 && typeof message.ms !== "number") continue;
       progress.push({
         step: message.step,
         state,
-        ...typeof message.ms === "number" ? { ms: message.ms } : {}
+        ...typeof message.ms === "number" && Number.isFinite(message.ms) && message.ms >= 0 ? { ms: message.ms } : {},
+        ...typeof message.measure === "string" ? { measure: message.measure } : {}
       });
     } catch {
     }
@@ -1857,7 +2005,7 @@ async function installOrUpdate(config, dir, options, print, update) {
     version = manifest.version;
     installer.phase("resolve", { seconds: (Date.now() - started) / 1e3 });
     const current = readState(dir);
-    const unchanged = update && current?.version === version && existsSync6(payloadDir(dir));
+    const unchanged = current?.version === version && existsSync6(payloadDir(dir));
     if (unchanged && current.acquired) {
       installer.surface({ id: config.product, from: version, to: version, state: "current" });
       return await finishLastMile(config, dir, options, installer, version, true, acquisitionRepairCommand(dir, version));
@@ -1865,11 +2013,17 @@ async function installOrUpdate(config, dir, options, print, update) {
     if (!unchanged) {
       installer.phase("download", { state: "running" });
       started = Date.now();
-      const candidate = randomUUID4();
+      const cached = reusableCandidate(dir, manifest);
+      const candidate = cached ?? randomUUID4();
       const candidateDir = join6(dir, "candidates", candidate);
-      await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl });
+      const onProgress = ({ done, total }) => installer.phase("download", {
+        state: "running",
+        measure: total ? `${Math.floor(done / total * 100)}% \xB7 ${done}/${total} B` : `${done} B`
+      });
+      if (!cached) await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl, onProgress });
       const acquisition = existsSync6(join6(candidateDir, "payload", "payload.json")) ? readAcquisition(join6(candidateDir, "payload")) : null;
       if (acquisition) {
+        rememberCandidate(dir, candidate, manifest);
         installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
         installer.phase("activate", { state: "running" });
         let outcome;
@@ -1877,7 +2031,9 @@ async function installOrUpdate(config, dir, options, print, update) {
         await installAcquisition(dir, candidate, version, acquisition, {
           fetchImpl,
           env,
+          onProgress,
           run: async (command2, cwd, childEnv) => {
+            installer.phase(command2.includes("--prefix") ? "install" : "activate", { state: "running" });
             const result = options.runEntry ? options.runEntry(command2, cwd, childEnv) : await runInstallEntry(command2, cwd, childEnv, installer, readTokens(dir));
             if (result.outcome) outcome = validateInstallerOutcome(result.outcome);
             return result.ok && (result.code === void 0 || result.code === 0) && !result.outcome?.operationFailed && !result.outcome?.failed;
@@ -1995,17 +2151,22 @@ async function finishLastMile(config, dir, options, installer, version, unchange
   return succeeded ? outcome?.operationFailed || outcome?.failed ? 1 : 0 : result.code || 1;
 }
 async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
+  installer.start();
   const [command2, ...args] = entry2;
   const shell = needsShell(command2);
   const progress = !(process.platform === "win32" && shell);
   const outcomeDir = mkdtempSync2(join6(tmpdir4(), "mm-installer-outcome-"));
   const outcomeFile = join6(outcomeDir, "outcome.json");
+  const progressFile = join6(outcomeDir, "progress.jsonl");
   const childEnv = { ...env, MM_INSTALLER_OUTCOME_FILE: outcomeFile };
   delete childEnv.MM_FACE_TRANSCRIPT;
+  delete childEnv.MM_PROGRESS_FILE;
   delete childEnv.MM_PROGRESS_FD;
   delete childEnv.MM_PROGRESS_PROTOCOL;
   if (progress) Object.assign(childEnv, { MM_PROGRESS_FD: "3", MM_PROGRESS_PROTOCOL: "1" });
+  else Object.assign(childEnv, { MM_PROGRESS_FILE: progressFile, MM_PROGRESS_PROTOCOL: "1" });
   const secrets = [tokens?.accessToken, tokens?.refreshToken].filter((value) => Boolean(value));
+  let progressError;
   const redact = (text) => secrets.reduce((safe, value) => safe.replaceAll(value, "[redacted]"), text);
   try {
     const result = await new Promise((resolve3) => {
@@ -2026,24 +2187,44 @@ async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
           }
           partial = held ? safe.slice(-held) : "";
           const visible = held ? safe.slice(0, -held) : safe;
-          if (visible) installer.relay(visible, channel2, false);
+          if (visible) installer.relayChunk(visible, channel2);
         }).on("end", () => {
-          if (partial) installer.relay("[redacted]", channel2, false);
+          if (partial) installer.relayChunk("[redacted]", channel2);
         });
       }
       let pending = "";
+      let progressOffset = 0;
+      const progressDecoder = new StringDecoder("utf8");
+      const receive = (text) => {
+        pending += text;
+        const end = pending.lastIndexOf("\n");
+        if (end >= 0) {
+          for (const record of parseProgress(pending.slice(0, end))) installer.milestone({ ...record, step: redact(record.step), ...record.measure ? { measure: redact(record.measure) } : {} });
+          pending = pending.slice(end + 1);
+        }
+        if (pending.length > 65536) pending = "";
+      };
+      const pollProgress = () => {
+        if (progressError) return;
+        try {
+          if (!existsSync6(progressFile)) return;
+          const bytes = readFileSync7(progressFile);
+          receive(progressDecoder.write(bytes.subarray(progressOffset)));
+          progressOffset = bytes.length;
+        } catch {
+          progressError = "installer progress: could not read child progress";
+          if (timer) clearInterval(timer);
+        }
+      };
+      const timer = progress ? void 0 : setInterval(pollProgress, 90);
+      child.once("close", () => {
+        if (timer) clearInterval(timer);
+        pollProgress();
+      });
       const channel = child.stdio[3];
       if (channel && "setEncoding" in channel) {
         channel.setEncoding("utf8");
-        channel.on("data", (text) => {
-          pending += text;
-          const end = pending.lastIndexOf("\n");
-          if (end >= 0) {
-            for (const record of parseProgress(pending.slice(0, end))) installer.milestone({ ...record, step: redact(record.step) });
-            pending = pending.slice(end + 1);
-          }
-          if (pending.length > 65536) pending = "";
-        });
+        channel.on("data", receive);
       }
       child.on("error", (error) => resolve3({ ok: false, error: error.message }));
       child.on("close", (code) => resolve3({
@@ -2052,6 +2233,7 @@ async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
         ...code !== 0 ? { error: `exit code ${code}` } : {}
       }));
     });
+    if (progressError) return { ...result, ok: false, code: result.code || 1, error: progressError };
     try {
       const outcome = readInstallerOutcome(outcomeFile);
       return { ...result, ...outcome ? { outcome } : {} };
@@ -2059,6 +2241,7 @@ async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
       return { ...result, ok: false, code: result.code || 1, error: "installer outcome: invalid child result" };
     }
   } finally {
+    if (existsSync6(progressFile)) unlinkSync2(progressFile);
     if (existsSync6(outcomeFile)) unlinkSync2(outcomeFile);
     rmdirSync(outcomeDir);
   }