@mutmutco/installer-launcher 0.1.13 → 0.1.14

package/dist/launcher.sea.cjs

@@ -32,18 +32,39 @@ __export(index_exports, {
   runInstallEntry: () => runInstallEntry
 });
 module.exports = __toCommonJS(index_exports);
+var import_node_string_decoder = require("node:string_decoder");
 var import_node_crypto6 = require("node:crypto");
 
 // src/acquisition.ts
-var import_node_crypto3 = require("node:crypto");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
+var import_node_path4 = require("node:path");
 
 // src/runtime.ts
 var import_node_crypto = require("node:crypto");
 var import_node_child_process = require("node:child_process");
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
+
+// src/download.ts
+async function readDownload(response, onProgress, expectedSize) {
+  const length = expectedSize ?? Number(response.headers.get("content-length"));
+  const total = Number.isSafeInteger(length) && length > 0 ? length : void 0;
+  let done = 0;
+  const report = () => onProgress?.({ done, ...total === void 0 ? {} : { total } });
+  report();
+  const chunks = [];
+  if (response.body) {
+    for await (const chunk of response.body) {
+      chunks.push(chunk);
+      done += chunk.length;
+      report();
+    }
+  }
+  return Buffer.concat(chunks);
+}
+
+// src/runtime.ts
 var NODE_VERSION = "24.20.0";
 var NPM_VERSION = "12.0.2";
 var ARTIFACTS = {
@@ -54,10 +75,10 @@ var ARTIFACTS = {
   "linux-arm64": ["node-v24.20.0-linux-arm64.tar.gz", "3515603e2487879a39bc75716f1a2affd027500c64ba50e845cf72cb33219013"]
 };
 var NPM_INTEGRITY = "uIXokLlBj6FpNUTQX1PmT5pz7BlIN9QlixX+zdaSNHsd0qUXsbDLr50xzY6Sw7cJVr0uzHKDOle0swmPW/p5Qw==";
-async function verifiedDownload(url, path, algorithm, digest, fetchImpl) {
+async function verifiedDownload(url, path, algorithm, digest, fetchImpl, onProgress) {
   const response = await fetchImpl(url);
   if (!response.ok) throw new Error(`runtime download failed (${response.status})`);
-  const bytes = Buffer.from(await response.arrayBuffer());
+  const bytes = await readDownload(response, onProgress);
   if ((0, import_node_crypto.createHash)(algorithm).update(bytes).digest(algorithm === "sha512" ? "base64" : "hex") !== digest) throw new Error("runtime archive checksum mismatch");
   (0, import_node_fs.writeFileSync)(path, bytes);
 }
@@ -66,7 +87,7 @@ function command(executable, args) {
   if (result.error || result.status !== 0) throw new Error(`runtime preparation failed: ${result.error?.message ?? result.stderr.trim()}`);
   return result.stdout.trim();
 }
-async function acquireRuntime(dir, fetchImpl = fetch) {
+async function acquireRuntime(dir, fetchImpl = fetch, onProgress) {
   const platform = `${process.platform}-${process.arch}`;
   const artifact = ARTIFACTS[platform];
   if (!artifact) throw new Error(`managed runtime does not support ${platform}`);
@@ -84,13 +105,20 @@ async function acquireRuntime(dir, fetchImpl = fetch) {
   }
   const root = (0, import_node_fs.mkdtempSync)((0, import_node_path.join)(runtimeDir, "runtime-"));
   const archive = (0, import_node_path.join)(root, artifact[0]);
-  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl);
+  let downloaded = 0;
+  let currentBytes = 0;
+  const progress = ({ done }) => {
+    currentBytes = done;
+    onProgress?.({ done: downloaded + done });
+  };
+  await verifiedDownload(`https://nodejs.org/dist/v${NODE_VERSION}/${artifact[0]}`, archive, "sha256", artifact[1], fetchImpl, progress);
+  downloaded += currentBytes;
   const tar = process.platform === "win32" ? (0, import_node_path.join)(process.env.SystemRoot ?? "C:/Windows", "System32", "tar.exe") : "/usr/bin/tar";
   command(tar, ["-xf", archive, "-C", root]);
   const unpacked = (0, import_node_path.join)(root, artifact[0].replace(/\.(zip|tar\.gz)$/, ""));
   const node = (0, import_node_path.join)(unpacked, process.platform === "win32" ? "node.exe" : "bin/node");
   const npmArchive = (0, import_node_path.join)(root, "npm.tgz");
-  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl);
+  await verifiedDownload(`https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz`, npmArchive, "sha512", NPM_INTEGRITY, fetchImpl, progress);
   const npmRoot = (0, import_node_path.join)(root, "npm");
   (0, import_node_fs.mkdirSync)(npmRoot);
   command(tar, ["-xf", npmArchive, "-C", npmRoot]);
@@ -195,7 +223,276 @@ function wipeProductDir(dir) {
   (0, import_node_fs2.rmSync)(payload, { force: true, recursive: true });
 }
 
+// src/payload.ts
+var import_node_crypto3 = require("node:crypto");
+var import_node_fs4 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path3 = require("node:path");
+
+// src/canonical.ts
+function canonicalJson(value) {
+  return encode(value);
+}
+function encode(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("canonicalJson: cannot encode a non-finite number");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
+}
+
+// src/config.ts
+var import_node_fs3 = require("node:fs");
+var import_node_sea = require("node:sea");
+
+// src/module-url.ts
+var import_node_url = require("node:url");
+var import_meta = {};
+function moduleUrl() {
+  if (typeof __filename === "string") return (0, import_node_url.pathToFileURL)(__filename).href;
+  return import_meta.url;
+}
+
+// src/config.ts
+function publicKeyBytes(config) {
+  const raw = Buffer.from(config.publicKey, "base64");
+  if (raw.length !== 32) {
+    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
+  }
+  return raw;
+}
+function loadProductConfig(options = {}) {
+  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
+  const devFallback = new URL("../config/product.template.json", moduleUrl());
+  if (explicit) {
+    return parseProductConfig((0, import_node_fs3.readFileSync)(explicit, "utf8"));
+  }
+  try {
+    return parseProductConfig((0, import_node_fs3.readFileSync)(devFallback, "utf8"));
+  } catch {
+  }
+  try {
+    const asset = (0, import_node_sea.getAsset)("product.json", "utf8");
+    if (typeof asset === "string") return parseProductConfig(asset);
+  } catch {
+  }
+  throw new Error(
+    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
+  );
+}
+function parseProductConfig(text) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error("product config is not valid JSON");
+  }
+  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
+  const record = data;
+  const product = field(record, "product");
+  const host = field(record, "host").replace(/\/+$/, "");
+  const loginKind = field(record, "loginKind");
+  const binName = field(record, "binName");
+  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
+  if (loginKind !== "github" && loginKind !== "google") {
+    throw new Error('product config loginKind must be "github" or "google"');
+  }
+  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
+  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
+  publicKeyBytes(config);
+  if (loginKind === "github") {
+    const clientId = record.githubClientId;
+    if (typeof clientId !== "string" || clientId.length === 0) {
+      throw new Error("product config needs githubClientId for the github loginKind");
+    }
+    config.githubClientId = clientId;
+  } else if (typeof record.githubClientId === "string") {
+    config.githubClientId = record.githubClientId;
+  }
+  try {
+    const url = new URL(host);
+    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
+  } catch {
+    throw new Error("product config host must be an http(s) URL");
+  }
+  return config;
+}
+function field(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : "";
+}
+
+// src/payload.ts
+var NeedsLoginError = class extends Error {
+  constructor() {
+    super("signed out \u2014 run login first");
+    this.name = "NeedsLoginError";
+  }
+};
+var ForbiddenError = class extends Error {
+  constructor() {
+    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
+    this.name = "ForbiddenError";
+  }
+};
+function canonicalManifestBytes(manifest) {
+  return Buffer.from(
+    canonicalJson({
+      created: manifest.created,
+      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
+      version: manifest.version
+    }),
+    "utf8"
+  );
+}
+function ed25519PublicKey(config) {
+  const raw = publicKeyBytes(config);
+  return (0, import_node_crypto3.createPublicKey)({
+    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyManifest(manifest, signature, config) {
+  try {
+    const signatureBytes = Buffer.from(signature, "base64");
+    if (signatureBytes.length === 0) return false;
+    return (0, import_node_crypto3.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
+  } catch {
+    return false;
+  }
+}
+function verifyFileBytes(entry2, bytes) {
+  if (entry2.size !== bytes.length) return false;
+  return (0, import_node_crypto3.createHash)("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
+}
+async function readErrorCode(response) {
+  try {
+    const data = await response.json();
+    return typeof data.error === "string" ? data.error : "";
+  } catch {
+    return "";
+  }
+}
+function throwForStatus(status, errorCode) {
+  if (status === 401) throw new NeedsLoginError();
+  if (status === 403) throw new ForbiddenError();
+  throw new Error(
+    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
+  );
+}
+async function getJson(url, accessToken, fetchImpl) {
+  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
+  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
+  return { status: response.status, json: await response.json() };
+}
+function parseManifest(json) {
+  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
+  const record = json;
+  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
+  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
+  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
+  if (typeof record.signature !== "string" || !record.signature) {
+    throw new Error("the release manifest is unsigned");
+  }
+  const files = record.files.map((entry2) => {
+    const file = entry2;
+    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
+      throw new Error("the release manifest lists a malformed file");
+    }
+    const safe = safeManifestPath(file.path);
+    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
+    return { path: safe, sha256: file.sha256, size: file.size };
+  });
+  return { version: record.version, created: record.created, files, signature: record.signature };
+}
+function safeManifestPath(rawPath) {
+  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
+  if (rawPath.startsWith("/")) return null;
+  const segments = rawPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") return null;
+  }
+  return segments.join("/");
+}
+async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
+  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
+  const manifest = parseManifest(json);
+  if (!verifyManifest(manifest, manifest.signature, config)) {
+    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
+  }
+  return manifest;
+}
+async function fetchFileBytes(config, accessToken, path, fetchImpl, onProgress, expectedSize) {
+  const encoded = path.split("/").map(encodeURIComponent).join("/");
+  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!response.ok) {
+    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
+    throwForStatus(response.status, await readErrorCode(response));
+  }
+  return readDownload(response, onProgress, expectedSize);
+}
+async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const staging = (0, import_node_path3.join)((0, import_node_os2.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
+  (0, import_node_fs4.mkdirSync)(staging, { recursive: true });
+  try {
+    const total = manifest.files.reduce((sum, entry2) => sum + entry2.size, 0);
+    let downloaded = 0;
+    for (const entry2 of manifest.files) {
+      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl, (progress) => options.onProgress?.({ done: downloaded + progress.done, total }), entry2.size);
+      downloaded += bytes.length;
+      if (!verifyFileBytes(entry2, bytes)) {
+        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
+      }
+      const dest = (0, import_node_path3.join)(staging, entry2.path);
+      (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(dest), { recursive: true });
+      (0, import_node_fs4.writeFileSync)(dest, bytes);
+    }
+    const target = (0, import_node_path3.join)(dir, "payload");
+    (0, import_node_fs4.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs4.rmSync)(target, { force: true, recursive: true });
+    (0, import_node_fs4.renameSync)(staging, target);
+  } catch (error) {
+    (0, import_node_fs4.rmSync)(staging, { force: true, recursive: true });
+    throw error;
+  }
+  return manifest.version;
+}
+
 // src/acquisition.ts
+function reusableCandidate(dir, manifest) {
+  try {
+    const saved = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(dir, "acquisition-cache.json"), "utf8"));
+    if (saved.signature !== manifest.signature) return null;
+    const root = candidateRoot(dir, saved.candidate);
+    if (!(0, import_node_fs5.existsSync)((0, import_node_path4.join)(root, "acquired.json"))) return null;
+    for (const file of manifest.files) {
+      if (!safePath(file.path) || !verifyFileBytes(file, (0, import_node_fs5.readFileSync)((0, import_node_path4.join)(root, "payload", file.path)))) return null;
+    }
+    return saved.candidate;
+  } catch {
+    return null;
+  }
+}
+function rememberCandidate(dir, candidate, manifest) {
+  candidateRoot(dir, candidate);
+  (0, import_node_fs5.writeFileSync)((0, import_node_path4.join)(dir, "acquisition-cache.json"), JSON.stringify({ candidate, signature: manifest.signature }), { mode: 384 });
+}
 function safePath(value) {
   return typeof value === "string" && value.length > 0 && !/[\\:\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 }
@@ -203,7 +500,7 @@ function argumentsValid(value) {
   return Array.isArray(value) && value.every((arg) => typeof arg === "string" && !arg.includes("\0") && (!arg.includes("$") || arg === "$prefix" || arg === "$version"));
 }
 function readAcquisition(payload) {
-  const metadata = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(payload, "payload.json"), "utf8"));
+  const metadata = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(payload, "payload.json"), "utf8"));
   if (metadata.acquisition === void 0) return null;
   const a = metadata.acquisition;
   if (!a || a.schema !== 1 || !/^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(a.package) || !safePath(a.archive) || !a.archive.endsWith(".tgz") || !safePath(a.convergeEntry) || !safePath(a.rollbackEntry) || !safePath(a.runEntry) || !argumentsValid(a.convergeArgs) || !argumentsValid(a.rollbackArgs) || !argumentsValid(a.repairArgs) || !Array.isArray(a.platforms) || !a.platforms.length || a.platforms.some((p) => !["win32-x64", "win32-arm64", "darwin-arm64", "linux-x64", "linux-arm64"].includes(p))) {
@@ -219,25 +516,25 @@ function runtimeEnvironment(node, inherited, platform = process.platform) {
     current = (keys.length ? env[keys[0]] : "") ?? "";
     for (const key of keys) delete env[key];
   }
-  env.PATH = `${(0, import_node_path3.dirname)(node)}${platform === "win32" ? ";" : ":"}${current}`;
+  env.PATH = `${(0, import_node_path4.dirname)(node)}${platform === "win32" ? ";" : ":"}${current}`;
   return env;
 }
 function lockInstallation(dir) {
-  (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
-  const path = (0, import_node_path3.join)(dir, "installation.lock");
-  const owner = `${process.pid}:${(0, import_node_crypto3.randomUUID)()}`;
+  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+  const path = (0, import_node_path4.join)(dir, "installation.lock");
+  const owner = `${process.pid}:${(0, import_node_crypto4.randomUUID)()}`;
   try {
-    (0, import_node_fs3.writeFileSync)(path, owner, { flag: "wx", mode: 384 });
+    (0, import_node_fs5.writeFileSync)(path, owner, { flag: "wx", mode: 384 });
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
     const recovery = `${path}.recovery`;
     try {
-      (0, import_node_fs3.writeFileSync)(recovery, owner, { flag: "wx", mode: 384, flush: true });
+      (0, import_node_fs5.writeFileSync)(recovery, owner, { flag: "wx", mode: 384, flush: true });
     } catch {
       throw new Error("installation lock recovery is already pending");
     }
     try {
-      const previous = (0, import_node_fs3.readFileSync)(path, "utf8");
+      const previous = (0, import_node_fs5.readFileSync)(path, "utf8");
       const pid = Number(previous.split(":")[0]);
       if (!Number.isInteger(pid) || pid <= 0) throw new Error("installation lock is malformed; recovery required");
       try {
@@ -246,32 +543,32 @@ function lockInstallation(dir) {
       } catch (probe) {
         if (probe.code !== "ESRCH") throw probe;
       }
-      (0, import_node_fs3.unlinkSync)(path);
-      (0, import_node_fs3.writeFileSync)(path, owner, { flag: "wx", mode: 384, flush: true });
+      (0, import_node_fs5.unlinkSync)(path);
+      (0, import_node_fs5.writeFileSync)(path, owner, { flag: "wx", mode: 384, flush: true });
     } finally {
-      (0, import_node_fs3.unlinkSync)(recovery);
+      (0, import_node_fs5.unlinkSync)(recovery);
     }
   }
   let released = false;
   return () => {
-    if (!released && (0, import_node_fs3.readFileSync)(path, "utf8") === owner) (0, import_node_fs3.unlinkSync)(path);
+    if (!released && (0, import_node_fs5.readFileSync)(path, "utf8") === owner) (0, import_node_fs5.unlinkSync)(path);
     released = true;
   };
 }
 function pendingPath(dir) {
-  return (0, import_node_path3.join)(dir, "acquisition-pending.json");
+  return (0, import_node_path4.join)(dir, "acquisition-pending.json");
 }
 function candidateRoot(dir, candidate) {
   if (!/^[a-zA-Z0-9_-]+$/.test(candidate)) throw new Error("invalid acquisition candidate");
-  return (0, import_node_path3.join)(dir, "candidates", candidate);
+  return (0, import_node_path4.join)(dir, "candidates", candidate);
 }
 function packageRoot(prefix, acquisition) {
-  return (0, import_node_path3.join)(prefix, "node_modules", acquisition.package);
+  return (0, import_node_path4.join)(prefix, "node_modules", acquisition.package);
 }
 function entry(root, path) {
-  const actual = (0, import_node_fs3.realpathSync)((0, import_node_path3.join)(root, path));
-  const rel = (0, import_node_path3.relative)((0, import_node_fs3.realpathSync)(root), actual);
-  if (rel.startsWith("..") || (0, import_node_path3.isAbsolute)(rel)) throw new Error("acquired entry escapes package");
+  const actual = (0, import_node_fs5.realpathSync)((0, import_node_path4.join)(root, path));
+  const rel = (0, import_node_path4.relative)((0, import_node_fs5.realpathSync)(root), actual);
+  if (rel.startsWith("..") || (0, import_node_path4.isAbsolute)(rel)) throw new Error("acquired entry escapes package");
   return actual;
 }
 function argv(node, root, file, args, prefix, version) {
@@ -281,54 +578,59 @@ function acquisitionRepairCommand(dir, version) {
   const state = readState(dir);
   if (!state?.acquired || state.version !== version) throw new Error("installed acquisition selection is missing");
   const root = candidateRoot(dir, state.acquired.candidate);
-  const acquisition = readAcquisition((0, import_node_path3.join)(root, "payload"));
+  const acquisition = readAcquisition((0, import_node_path4.join)(root, "payload"));
   if (!acquisition) throw new Error("installed acquisition declaration is missing");
-  const prefix = (0, import_node_path3.join)(root, "prefix");
+  const prefix = (0, import_node_path4.join)(root, "prefix");
   const productRoot = packageRoot(prefix, acquisition);
-  const pkg = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(productRoot, "package.json"), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(productRoot, "package.json"), "utf8"));
   if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("installed package identity does not match signed release");
-  return argv((0, import_node_fs3.realpathSync)(state.acquired.node), productRoot, acquisition.runEntry, acquisition.repairArgs, prefix, version);
+  return argv((0, import_node_fs5.realpathSync)(state.acquired.node), productRoot, acquisition.runEntry, acquisition.repairArgs, prefix, version);
 }
 async function recoverAcquisition(dir, run2, env) {
-  if (!(0, import_node_fs3.existsSync)(pendingPath(dir))) return;
-  const pending = JSON.parse((0, import_node_fs3.readFileSync)(pendingPath(dir), "utf8"));
+  if (!(0, import_node_fs5.existsSync)(pendingPath(dir))) return;
+  const pending = JSON.parse((0, import_node_fs5.readFileSync)(pendingPath(dir), "utf8"));
   if (pending.schema !== 1 || typeof pending.version !== "string" || typeof pending.node !== "string") throw new Error("invalid pending acquisition receipt");
   const root = candidateRoot(dir, pending.candidate);
   if (readState(dir)?.acquired?.candidate === pending.candidate) {
-    (0, import_node_fs3.unlinkSync)(pendingPath(dir));
+    (0, import_node_fs5.unlinkSync)(pendingPath(dir));
     return;
   }
-  const acquisition = readAcquisition((0, import_node_path3.join)(root, "payload"));
+  const acquisition = readAcquisition((0, import_node_path4.join)(root, "payload"));
   if (!acquisition) throw new Error("pending acquisition lost its signed declaration");
-  const prefix = (0, import_node_path3.join)(root, "prefix");
+  const prefix = (0, import_node_path4.join)(root, "prefix");
   const command2 = argv(pending.node, packageRoot(prefix, acquisition), acquisition.rollbackEntry, acquisition.rollbackArgs, prefix, pending.version);
   if (!await run2(command2, root, runtimeEnvironment(pending.node, env))) throw new Error("installation recovery is pending; product rollback did not finish");
   if (pending.previous) writeState(dir, pending.previous);
-  else if ((0, import_node_fs3.existsSync)(statePath(dir))) (0, import_node_fs3.unlinkSync)(statePath(dir));
-  (0, import_node_fs3.unlinkSync)(pendingPath(dir));
+  else if ((0, import_node_fs5.existsSync)(statePath(dir))) (0, import_node_fs5.unlinkSync)(statePath(dir));
+  (0, import_node_fs5.unlinkSync)(pendingPath(dir));
 }
 async function installAcquisition(dir, candidate, version, acquisition, options) {
   if (!acquisition.platforms.includes(`${process.platform}-${process.arch}`)) throw new Error("this product does not support this platform");
   const root = candidateRoot(dir, candidate);
-  const payload = (0, import_node_path3.join)(root, "payload");
-  const prefix = (0, import_node_path3.join)(root, "prefix");
-  (0, import_node_fs3.mkdirSync)(prefix);
-  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl);
+  const payload = (0, import_node_path4.join)(root, "payload");
+  const prefix = (0, import_node_path4.join)(root, "prefix");
+  const prepared = (0, import_node_path4.join)(root, "acquired.json");
+  const archiveHash = (0, import_node_crypto4.createHash)("sha256").update((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(payload, acquisition.archive))).digest("hex");
+  const reused = (0, import_node_fs5.existsSync)(prepared);
+  if (reused && JSON.parse((0, import_node_fs5.readFileSync)(prepared, "utf8")).archiveHash !== archiveHash) throw new Error("cached acquisition archive changed");
+  if (!reused) (0, import_node_fs5.mkdirSync)(prefix);
+  const runtime = await (options.runtime ?? acquireRuntime)(dir, options.fetchImpl, options.onProgress);
   const env = runtimeEnvironment(runtime.node, options.env);
   const npmEnv = { ...env };
   for (const key of Object.keys(npmEnv)) {
     if (/^npm_config_/i.test(key) || /^(NPM_TOKEN|NODE_AUTH_TOKEN|MM_INSTALLER_TOKEN)$/i.test(key)) delete npmEnv[key];
   }
-  const npmrc = (0, import_node_path3.join)(root, "public.npmrc");
-  const globalrc = (0, import_node_path3.join)(root, "global.npmrc");
-  (0, import_node_fs3.writeFileSync)(npmrc, "registry=https://registry.npmjs.org/\n");
-  (0, import_node_fs3.writeFileSync)(globalrc, "");
+  const npmrc = (0, import_node_path4.join)(root, "public.npmrc");
+  const globalrc = (0, import_node_path4.join)(root, "global.npmrc");
+  (0, import_node_fs5.writeFileSync)(npmrc, "registry=https://registry.npmjs.org/\n");
+  (0, import_node_fs5.writeFileSync)(globalrc, "");
   const install = [
     runtime.node,
     runtime.npm,
     "install",
     "--prefix",
     prefix,
+    "--install-strategy=shallow",
     "--ignore-scripts",
     "--no-audit",
     "--no-fund",
@@ -338,17 +640,18 @@ async function installAcquisition(dir, candidate, version, acquisition, options)
     globalrc,
     "--registry",
     "https://registry.npmjs.org/",
-    (0, import_node_path3.resolve)(payload, acquisition.archive)
+    (0, import_node_path4.resolve)(payload, acquisition.archive)
   ];
-  if (!await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
+  if (!reused && !await options.run(install, prefix, npmEnv)) throw new Error("local product archive installation failed");
   const productRoot = packageRoot(prefix, acquisition);
-  const pkg = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(productRoot, "package.json"), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(productRoot, "package.json"), "utf8"));
   if (pkg.name !== acquisition.package || pkg.version !== version) throw new Error("acquired package identity does not match signed release");
   const runEntry = entry(productRoot, acquisition.runEntry);
   const convergence = argv(runtime.node, productRoot, acquisition.convergeEntry, acquisition.convergeArgs, prefix, version);
   entry(productRoot, acquisition.rollbackEntry);
+  if (!reused) (0, import_node_fs5.writeFileSync)(prepared, JSON.stringify({ archiveHash }), { flag: "wx", mode: 384, flush: true });
   const pending = { schema: 1, candidate, version, node: runtime.node, previous: readState(dir) };
-  (0, import_node_fs3.writeFileSync)(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
+  (0, import_node_fs5.writeFileSync)(pendingPath(dir), JSON.stringify(pending), { flag: "wx", mode: 384, flush: true });
   try {
     if (!await options.run(convergence, root, env)) throw new Error("product convergence did not finish");
     (options.commit ?? writeState)(dir, { version, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), acquired: { candidate, node: runtime.node, entry: runEntry } });
@@ -356,7 +659,7 @@ async function installAcquisition(dir, candidate, version, acquisition, options)
     await recoverAcquisition(dir, options.run, env);
     throw error;
   }
-  (0, import_node_fs3.unlinkSync)(pendingPath(dir));
+  (0, import_node_fs5.unlinkSync)(pendingPath(dir));
 }
 
 // src/index.ts
@@ -367,36 +670,36 @@ var import_node_path6 = require("node:path");
 var import_node_url2 = require("node:url");
 
 // ../face/src/face.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 
 // ../face/src/products.ts
 var PRODUCTS = Object.freeze({
   "mm-strategy": Object.freeze({
     name: "MM Strategy",
-    installWarm: "Welcome. Let's set up MM Strategy \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;249;115;22",
-    warm: "Welcome. Let's set up MM Strategy \u2014 about a minute.",
+    warm: "Welcome back. Checking for updates...",
     doctor: "mm-strategy doctor"
   }),
   "mmi-hub": Object.freeze({
     name: "mmi-hub",
-    installWarm: "Welcome. Setting up mmi-hub \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;125;211;252",
-    warm: "Welcome back. Checking your surfaces\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "mmi doctor"
   }),
   "jerv-hub": Object.freeze({
     name: "jerv-hub",
-    installWarm: "Welcome. Setting up jerv-hub \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;248;113;113",
-    warm: "Welcome back. Checking your surfaces\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "jerv doctor"
   }),
   jervcode: Object.freeze({
     name: "JervCode",
-    installWarm: "Welcome. Setting up JervCode \u2014 about a minute.",
+    installWarm: "Welcome. Let's get you ready.",
     accent: "38;2;192;132;252",
-    warm: "Welcome back. Keeping JervCode current\u2026",
+    warm: "Welcome back. Checking for updates...",
     doctor: "jervcode doctor"
   })
 });
@@ -410,6 +713,7 @@ function identityFor(product) {
 
 // ../face/src/face.ts
 var GLYPH = Object.freeze({
+  clock: "\u23F0",
   diamond: "\u25C6",
   hollow: "\u25C7",
   bar: "\u2502",
@@ -481,12 +785,16 @@ function createFace({ product, color = false, columns, env = process.env, operat
   const continuesFace = continuedPhases.size > 0;
   const nested = env.MM_OUTER_CONSOLE === "1";
   const progressFd = readProgressFd(env);
+  const progressFile = env.MM_PROGRESS_PROTOCOL === "1" ? env.MM_PROGRESS_FILE : void 0;
   const emitMilestone = (title, measure, kind) => {
-    if (progressFd === null) return false;
+    if (progressFd === null && !progressFile) return false;
     const record = { v: PROGRESS_PROTOCOL, step: stripColor(title), state: kind };
     if (typeof measure === "number") record.ms = Math.max(0, Math.round(measure * 1e3));
+    if (kind === "running" && typeof measure === "string") record.measure = measure;
     try {
-      (0, import_node_fs4.writeSync)(progressFd, `${JSON.stringify(record)}
+      if (progressFile) (0, import_node_fs6.appendFileSync)(progressFile, `${JSON.stringify(record)}
+`);
+      else (0, import_node_fs6.writeSync)(progressFd, `${JSON.stringify(record)}
 `);
       return true;
     } catch {
@@ -505,7 +813,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
   };
   const step = (title, measure = null, kind = "ok") => {
     if (emitMilestone(title, measure, kind)) return "";
-    const glyph = kind === "fail" ? paint(identity.accent, GLYPH.cross) : kind === "note" ? paint(PALETTE.muted, GLYPH.dot) : paint(PALETTE.green, GLYPH.check);
+    const glyph = title === "Armed hourly updates" && kind === "ok" ? GLYPH.clock : kind === "fail" ? paint(identity.accent, GLYPH.cross) : kind === "note" ? paint(PALETTE.muted, GLYPH.dot) : paint(PALETTE.green, GLYPH.check);
     const measured = measure === null || measure === void 0 ? "" : paint(PALETTE.muted, typeof measure === "number" ? `${Math.max(0, Math.round(measure))}s` : String(measure).trim());
     const time = measured;
     const column = Math.min(44, Math.max(0, width - 8));
@@ -515,7 +823,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
     const pad = Math.max(1, column - visibleWidth(head));
     return [time ? `${head}${" ".repeat(pad)}${time}` : head, ...rest.map((line) => `${bar()}${indent}${line}`)].join("\n");
   };
-  const relay = (text) => String(text).split("\n").flatMap((line) => line.trim() === "" ? [bar()] : (visibleWidth(line) <= width - TITLE_COLUMN ? [line] : wrapWords(line, width - TITLE_COLUMN)).map((part) => `${bar()}${indent}${part}`)).join("\n");
+  const relay = (text) => String(text).replace(/\r?\n$/, "").split(/\r?\n/).flatMap((line) => line.trim() === "" ? [bar()] : (visibleWidth(line) <= width - TITLE_COLUMN ? [line] : wrapWords(line, width - TITLE_COLUMN)).map((part) => `${bar()}${indent}${part}`)).join("\n");
   const receipt = (lines, { ready = true } = {}) => {
     if (ready && nested) return [];
     const body = (Array.isArray(lines) ? lines : String(lines).split("\n")).flatMap((raw) => {
@@ -546,14 +854,14 @@ function createFace({ product, color = false, columns, env = process.env, operat
   };
   const signOff = () => nested ? "" : `${paint(identity.accent, GLYPH.diamond)}  ${paint(identity.accent, `${identity.name} \xB7 Mutatis Mutandis`)}`;
   const refusal = (message) => `${bar()}  ${paint(identity.accent, GLYPH.cross)}  ${message}`;
-  return { identity, width, nested, emitsProgress: progressFd !== null, welcome, continues, step, relay, receipt, outcome, signOff, refusal, paint };
+  return { identity, width, nested, emitsProgress: progressFd !== null || Boolean(progressFile), welcome, continues, step, progress: (title, measure = null) => emitMilestone(title, measure, "running"), relay, receipt, outcome, signOff, refusal, paint };
 }
 
 // ../face/src/shell.ts
 var RELAY_INDENT = " ".repeat(TITLE_COLUMN - 1);
 
 // ../face/src/spinner.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_worker_threads = require("node:worker_threads");
 var FRAMES = ["\u25D2", "\u25D0", "\u25D3", "\u25D1"];
 var WORKER_SOURCE = `
@@ -565,7 +873,7 @@ function draw() {
   if (Atomics.compareExchange(control, 1, 0, 1) !== 0) return;
   try {
     if (Atomics.load(control, 0) || Atomics.load(control, 2) || !frames.length) return;
-    const text = frames[frame++ % frames.length];
+    const text = frames[frame++ % frames.length].replace('__elapsed__', Math.floor((Date.now() - workerData.started) / 1000) + 's');
     writeSync(2, text);
     if (workerData.transcriptPath) appendFileSync(workerData.transcriptPath, JSON.stringify({ channel: 'spinner', text }) + '\\n');
   } finally {
@@ -577,7 +885,6 @@ parentPort.on('message', (next) => {
   if (Atomics.load(control, 2)) return;
   frames = next.frames;
   frame = next.frame;
-  Atomics.store(control, 0, 0);
 });
 setInterval(draw, workerData.intervalMs);
 `;
@@ -588,20 +895,22 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
   let control = null;
   let frames = [];
   let frame = 0;
+  let started = 0;
+  let suspended = false;
   const write = (text) => {
     if (stream) stream.write(text);
     else {
-      (0, import_node_fs5.writeSync)(2, text);
-      if (transcriptPath) (0, import_node_fs5.appendFileSync)(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
+      (0, import_node_fs7.writeSync)(2, text);
+      if (transcriptPath) (0, import_node_fs7.appendFileSync)(transcriptPath, `${JSON.stringify({ channel: "spinner", text })}
 `);
     }
   };
   const render = (text, measure) => {
-    const line = face.step(text, measure, "note").split("\n")[0];
+    const line = face.step(text, measure ?? "__elapsed__", "note").split("\n")[0];
     frames = line ? FRAMES.map((glyph) => `\r\x1B[2K${line.replace(GLYPH.dot, glyph)}`) : [];
   };
   const draw = () => {
-    if (animate && frames.length) write(frames[frame++ % frames.length]);
+    if (animate && !suspended && frames.length) write(frames[frame++ % frames.length].replace("__elapsed__", `${Math.floor((Date.now() - started) / 1e3)}s`));
   };
   const pause = () => {
     if (!control) return;
@@ -621,6 +930,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
     start(text, measure = null) {
       if (!animate) return;
       halt();
+      suspended = false;
+      started = Date.now();
       render(text, measure);
       frame = 0;
       draw();
@@ -634,7 +945,8 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
             frames,
             frame,
             intervalMs,
-            transcriptPath
+            transcriptPath,
+            started
           } });
           const active = worker;
           worker.on("error", () => {
@@ -652,9 +964,22 @@ function createSpinner(face, { animate, stream, intervalMs = 90, transcriptPath
       render(text, measure);
       draw();
       worker?.postMessage({ frames, frame });
+      if (control && !suspended) Atomics.store(control, 0, 0);
+    },
+    pause() {
+      if (suspended) return;
+      suspended = true;
+      pause();
+      if (animate && frames.length) write("\r\x1B[2K");
+    },
+    resume() {
+      suspended = false;
+      if (control) Atomics.store(control, 0, 0);
+      if (timer || worker) draw();
     },
     stop() {
       halt();
+      frames = [];
       if (animate) write("\r\x1B[2K");
     }
   };
@@ -665,10 +990,10 @@ var SPINNER_FRAMES = Object.freeze([...FRAMES]);
 var ALLOWED = new Set(Object.values(GLYPH));
 
 // ../face/src/run.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 
 // ../face/src/outcome.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var counts = ["total", "updated", "failed"];
 var strings = ["version", "retry", "detail", "logPath"];
 var flags = ["dryRun", "installed", "deferred", "operationFailed"];
@@ -690,12 +1015,12 @@ function validateInstallerOutcome(value) {
   return { ...facts };
 }
 function writeInstallerOutcome(path, value) {
-  (0, import_node_fs6.writeFileSync)(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
+  (0, import_node_fs8.writeFileSync)(path, JSON.stringify(validateInstallerOutcome(value)), { encoding: "utf8", mode: 384 });
 }
 function readInstallerOutcome(path) {
   let text;
   try {
-    text = (0, import_node_fs6.readFileSync)(path, "utf8");
+    text = (0, import_node_fs8.readFileSync)(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -758,6 +1083,7 @@ var PHASES = {
   "verify-release": ["Checking the release version", "Verified the release version"],
   verify: ["Verifying the payload", "Verified the payload"],
   install: ["Installing the product", "Installed the product"],
+  configure: ["Configuring the product", "Configured the product"],
   activate: ["Activating surfaces", "Activated surfaces"],
   doctor: ["Checking health", "Checked health"],
   rollback: ["Restoring the previous version", "Restored the previous version"]
@@ -787,7 +1113,7 @@ function createInstallerRun(value, options = {}) {
     if (!text) return;
     write(text, channel);
     if (env.MM_FACE_TRANSCRIPT) {
-      (0, import_node_fs7.appendFileSync)(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
+      (0, import_node_fs9.appendFileSync)(env.MM_FACE_TRANSCRIPT, `${JSON.stringify({ channel, text: recorded })}
 `, "utf8");
     }
   };
@@ -802,6 +1128,17 @@ function createInstallerRun(value, options = {}) {
       return true;
     } } } : { transcriptPath: env.MM_FACE_TRANSCRIPT }
   });
+  let activeTitle;
+  let chunkOpen = false;
+  let chunkChannel = "stdout";
+  let chunkColumn = 0;
+  const trailingCR = /* @__PURE__ */ new Set();
+  let deferredActivity;
+  const closeChunk = () => {
+    if (chunkOpen) emit("\n", chunkChannel);
+    chunkOpen = false;
+    chunkColumn = 0;
+  };
   let started = false;
   let finished = false;
   const start = () => {
@@ -816,6 +1153,9 @@ function createInstallerRun(value, options = {}) {
     }
   };
   const durable = (title, measure, kind) => {
+    closeChunk();
+    activeTitle = void 0;
+    deferredActivity = void 0;
     spinner.stop();
     const rendered = face.step(title, measure, kind);
     if (rendered) lines([tty ? rendered : `${kind === "fail" ? "Failed: " : ""}${title}${measure === null ? "" : ` (${typeof measure === "number" ? `${Math.max(0, Math.round(measure))}s` : measure})`}`]);
@@ -832,7 +1172,12 @@ function createInstallerRun(value, options = {}) {
       const state = facts.state ?? "ok";
       const title = PHASES[id][state === "ok" ? 1 : 0];
       if (state === "running") {
-        spinner.start(title, facts.measure ?? null);
+        if (face.progress(title, facts.measure ?? null)) return;
+        if (activeTitle === title) spinner.say(title, facts.measure ?? null);
+        else {
+          activeTitle = title;
+          spinner.start(title, facts.measure ?? null);
+        }
         return;
       }
       if (!face.continues(id, state)) durable(title, facts.seconds ?? facts.measure ?? null, state);
@@ -852,8 +1197,20 @@ function createInstallerRun(value, options = {}) {
       durable(`${facts.id}${versions} ${separator} ${status}${activation}`, completed ? facts.seconds ?? null : null, facts.state === "failed" ? "fail" : facts.state === "updated" ? "ok" : "note");
       if (facts.detail) run2.relay(facts.detail);
     },
-    milestone({ step, state, ms }) {
+    milestone({ step, state, ms, measure }) {
       start();
+      if (state === "running") {
+        if (chunkOpen) {
+          deferredActivity = { title: step, measure: measure ?? null };
+          return;
+        }
+        if (activeTitle === step) spinner.say(step, measure ?? null);
+        else {
+          activeTitle = step;
+          spinner.start(step, measure ?? null);
+        }
+        return;
+      }
       durable(step, ms === void 0 ? null : ms / 1e3, state);
     },
     signIn({ url, code }) {
@@ -867,7 +1224,8 @@ function createInstallerRun(value, options = {}) {
     },
     // Only pass safe diagnostic text, never authentication output or credentials.
     relay(text, channel = "stdout", record = true) {
-      spinner.stop();
+      closeChunk();
+      spinner.pause();
       const rendered = tty ? face.relay(text) : stripColor(text);
       for (const row of rendered.split("\n")) if (row) {
         emit(`${row}
@@ -875,6 +1233,37 @@ function createInstallerRun(value, options = {}) {
 ` : `${tty ? face.relay("[external output omitted]") : "[external output omitted]"}
 `);
       }
+      spinner.resume();
+    },
+    relayChunk(text, channel = "stdout") {
+      spinner.pause();
+      if (chunkOpen && chunkChannel !== channel) closeChunk();
+      chunkChannel = channel;
+      if (trailingCR.delete(channel) && text.startsWith("\n")) text = text.slice(1);
+      if (text.endsWith("\r")) trailingCR.add(channel);
+      const parts = text.replace(/\r\n|\r/g, "\n").split("\n");
+      for (let i = 0; i < parts.length; i++) {
+        const characters = [...stripColor(parts[i])];
+        while (characters.length) {
+          if (tty && chunkColumn >= face.width - 6) closeChunk();
+          const part = characters.splice(0, tty ? face.width - 6 - chunkColumn : characters.length).join("");
+          emit(tty && !chunkOpen ? face.relay(part) : part, channel, chunkOpen ? "" : tty ? face.relay("[external output omitted]") : "[external output omitted]");
+          chunkColumn += [...part].length;
+          chunkOpen = true;
+        }
+        if (i < parts.length - 1) {
+          emit("\n", channel);
+          chunkOpen = false;
+          chunkColumn = 0;
+        }
+      }
+      if (!chunkOpen) {
+        if (deferredActivity) {
+          activeTitle = deferredActivity.title;
+          spinner.start(deferredActivity.title, deferredActivity.measure);
+          deferredActivity = void 0;
+        } else spinner.resume();
+      }
     },
     cancel() {
       if (finished) return;
@@ -883,6 +1272,8 @@ function createInstallerRun(value, options = {}) {
         { total: 0, updated: 0, failed: 0, deferred: true, detail: "Operation cancelled." }
       );
       start();
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
       finished = true;
       if (!face.nested || !env.MM_INSTALLER_OUTCOME_FILE) {
@@ -895,6 +1286,8 @@ function createInstallerRun(value, options = {}) {
       validateInstallerOutcome(facts);
       if (env.MM_INSTALLER_OUTCOME_FILE) writeInstallerOutcome(env.MM_INSTALLER_OUTCOME_FILE, facts);
       start();
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
       finished = true;
       if (options.quiet && facts.updated === 0 && facts.failed === 0 && !facts.operationFailed) return;
@@ -915,6 +1308,8 @@ function createInstallerRun(value, options = {}) {
       if (tty) lines([face.signOff()]);
     },
     stop() {
+      closeChunk();
+      activeTitle = void 0;
       spinner.stop();
     }
   };
@@ -923,9 +1318,9 @@ function createInstallerRun(value, options = {}) {
 
 // src/autoupdate.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_fs8 = require("node:fs");
-var import_node_os2 = require("node:os");
-var import_node_path4 = require("node:path");
+var import_node_fs10 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path5 = require("node:path");
 function schedulePlatform(override) {
   const platform = override ?? process.platform;
   if (platform === "win32" || platform === "darwin" || platform === "linux") return platform;
@@ -942,8 +1337,8 @@ function defaultExec(command2, args) {
 }
 function homeOf(options) {
   if (options.homeDir) return options.homeDir;
-  if (process.platform === "win32") return process.env.USERPROFILE ?? (0, import_node_os2.tmpdir)();
-  return process.env.HOME ?? (0, import_node_os2.tmpdir)();
+  if (process.platform === "win32") return process.env.USERPROFILE ?? (0, import_node_os3.tmpdir)();
+  return process.env.HOME ?? (0, import_node_os3.tmpdir)();
 }
 function scheduleName(config) {
   return `${config.binName} autoupdate`;
@@ -969,10 +1364,10 @@ function enableSchedule(config, command2, options = {}) {
   }
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
-    const dir2 = (0, import_node_path4.join)(home, "Library", "LaunchAgents");
-    (0, import_node_fs8.mkdirSync)(dir2, { recursive: true });
-    const plist = (0, import_node_path4.join)(dir2, `${label2}.plist`);
-    (0, import_node_fs8.writeFileSync)(plist, darwinPlist(label2, command2));
+    const dir2 = (0, import_node_path5.join)(home, "Library", "LaunchAgents");
+    (0, import_node_fs10.mkdirSync)(dir2, { recursive: true });
+    const plist = (0, import_node_path5.join)(dir2, `${label2}.plist`);
+    (0, import_node_fs10.writeFileSync)(plist, darwinPlist(label2, command2));
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
     const result2 = exec("launchctl", ["bootstrap", `gui/${process.getuid?.() ?? 501}`, plist]);
     if (result2.code !== 0) {
@@ -981,10 +1376,10 @@ function enableSchedule(config, command2, options = {}) {
     return;
   }
   const label = scheduleLabel(config);
-  const dir = (0, import_node_path4.join)(home, ".config", "systemd", "user");
-  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs8.writeFileSync)((0, import_node_path4.join)(dir, `${label}.service`), linuxService(command2));
-  (0, import_node_fs8.writeFileSync)((0, import_node_path4.join)(dir, `${label}.timer`), linuxTimer(label));
+  const dir = (0, import_node_path5.join)(home, ".config", "systemd", "user");
+  (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs10.writeFileSync)((0, import_node_path5.join)(dir, `${label}.service`), linuxService(command2));
+  (0, import_node_fs10.writeFileSync)((0, import_node_path5.join)(dir, `${label}.timer`), linuxTimer(label));
   const reload = exec("systemctl", ["--user", "daemon-reload"]);
   if (reload.code !== 0) {
     throw new Error(`could not turn autoupdate on: ${firstLine(reload.stderr || reload.stdout) || `exit ${reload.code}`}`);
@@ -1009,14 +1404,14 @@ function disableSchedule(config, options = {}) {
   if (platform === "darwin") {
     const label2 = scheduleLabel(config);
     exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${label2}`]);
-    (0, import_node_fs8.rmSync)((0, import_node_path4.join)(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
+    (0, import_node_fs10.rmSync)((0, import_node_path5.join)(home, "Library", "LaunchAgents", `${label2}.plist`), { force: true });
     return;
   }
   const label = scheduleLabel(config);
-  const dir = (0, import_node_path4.join)(home, ".config", "systemd", "user");
+  const dir = (0, import_node_path5.join)(home, ".config", "systemd", "user");
   exec("systemctl", ["--user", "disable", "--now", `${label}.timer`]);
-  (0, import_node_fs8.rmSync)((0, import_node_path4.join)(dir, `${label}.service`), { force: true });
-  (0, import_node_fs8.rmSync)((0, import_node_path4.join)(dir, `${label}.timer`), { force: true });
+  (0, import_node_fs10.rmSync)((0, import_node_path5.join)(dir, `${label}.service`), { force: true });
+  (0, import_node_fs10.rmSync)((0, import_node_path5.join)(dir, `${label}.timer`), { force: true });
 }
 function querySchedule(config, options = {}) {
   const platform = schedulePlatform(options.platform);
@@ -1034,12 +1429,12 @@ function querySchedule(config, options = {}) {
     return state2;
   }
   if (platform === "darwin") {
-    const plist = (0, import_node_path4.join)(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
-    if (!(0, import_node_fs8.existsSync)(plist)) return { supported: true, enabled: false };
+    const plist = (0, import_node_path5.join)(home, "Library", "LaunchAgents", `${scheduleLabel(config)}.plist`);
+    if (!(0, import_node_fs10.existsSync)(plist)) return { supported: true, enabled: false };
     return { supported: true, enabled: true, cadence: "hourly" };
   }
-  const timer = (0, import_node_path4.join)(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
-  if (!(0, import_node_fs8.existsSync)(timer)) return { supported: true, enabled: false };
+  const timer = (0, import_node_path5.join)(home, ".config", "systemd", "user", `${scheduleLabel(config)}.timer`);
+  if (!(0, import_node_fs10.existsSync)(timer)) return { supported: true, enabled: false };
   const state = { supported: true, enabled: true, cadence: "hourly" };
   const shown = exec("systemctl", ["--user", "show", `${scheduleLabel(config)}.service`, "-p", "ExecMainStartTimestamp", "--value"]);
   const stamp = (shown.stdout ?? "").trim();
@@ -1096,87 +1491,6 @@ function firstLine(text) {
   return String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0] ?? "";
 }
 
-// src/config.ts
-var import_node_fs9 = require("node:fs");
-var import_node_sea = require("node:sea");
-
-// src/module-url.ts
-var import_node_url = require("node:url");
-var import_meta = {};
-function moduleUrl() {
-  if (typeof __filename === "string") return (0, import_node_url.pathToFileURL)(__filename).href;
-  return import_meta.url;
-}
-
-// src/config.ts
-function publicKeyBytes(config) {
-  const raw = Buffer.from(config.publicKey, "base64");
-  if (raw.length !== 32) {
-    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
-  }
-  return raw;
-}
-function loadProductConfig(options = {}) {
-  const explicit = options.configPath ?? process.env.LAUNCHER_CONFIG;
-  const devFallback = new URL("../config/product.template.json", moduleUrl());
-  if (explicit) {
-    return parseProductConfig((0, import_node_fs9.readFileSync)(explicit, "utf8"));
-  }
-  try {
-    return parseProductConfig((0, import_node_fs9.readFileSync)(devFallback, "utf8"));
-  } catch {
-  }
-  try {
-    const asset = (0, import_node_sea.getAsset)("product.json", "utf8");
-    if (typeof asset === "string") return parseProductConfig(asset);
-  } catch {
-  }
-  throw new Error(
-    "no product config found (pass --config <path>, set LAUNCHER_CONFIG, or bake product.json into the SEA binary)"
-  );
-}
-function parseProductConfig(text) {
-  let data;
-  try {
-    data = JSON.parse(text);
-  } catch {
-    throw new Error("product config is not valid JSON");
-  }
-  if (typeof data !== "object" || data === null) throw new Error("product config must be an object");
-  const record = data;
-  const product = field(record, "product");
-  const host = field(record, "host").replace(/\/+$/, "");
-  const loginKind = field(record, "loginKind");
-  const binName = field(record, "binName");
-  if (!product || !host || !binName) throw new Error("product config needs product, host and binName");
-  if (loginKind !== "github" && loginKind !== "google") {
-    throw new Error('product config loginKind must be "github" or "google"');
-  }
-  const config = { product, host, loginKind, publicKey: field(record, "publicKey"), binName };
-  if (!config.publicKey) throw new Error("product config needs publicKey (base64 raw Ed25519)");
-  publicKeyBytes(config);
-  if (loginKind === "github") {
-    const clientId = record.githubClientId;
-    if (typeof clientId !== "string" || clientId.length === 0) {
-      throw new Error("product config needs githubClientId for the github loginKind");
-    }
-    config.githubClientId = clientId;
-  } else if (typeof record.githubClientId === "string") {
-    config.githubClientId = record.githubClientId;
-  }
-  try {
-    const url = new URL(host);
-    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error();
-  } catch {
-    throw new Error("product config host must be an http(s) URL");
-  }
-  return config;
-}
-function field(record, key) {
-  const value = record[key];
-  return typeof value === "string" ? value : "";
-}
-
 // src/login-github.ts
 var import_node_child_process3 = require("node:child_process");
 var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -1299,7 +1613,7 @@ async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
 }
 
 // src/login-google.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_http = require("node:http");
 var b64url = (bytes) => bytes.toString("base64url");
 async function loginGoogle(options) {
@@ -1321,9 +1635,9 @@ async function loginGoogle(options) {
     if (typeof clientId !== "string" || !clientId) {
       throw new Error("the sign-in server returned a malformed registration");
     }
-    const verifier = b64url((0, import_node_crypto4.randomBytes)(32));
-    const challenge = b64url((0, import_node_crypto4.createHash)("sha256").update(verifier).digest());
-    const state = b64url((0, import_node_crypto4.randomBytes)(16));
+    const verifier = b64url((0, import_node_crypto5.randomBytes)(32));
+    const challenge = b64url((0, import_node_crypto5.createHash)("sha256").update(verifier).digest());
+    const state = b64url((0, import_node_crypto5.randomBytes)(16));
     const authorize = new URL(`${server}/oauth/authorize`);
     authorize.search = new URLSearchParams({
       response_type: "code",
@@ -1411,175 +1725,8 @@ function page(title, body) {
   return `<!doctype html><meta charset="utf-8"><meta name="color-scheme" content="dark"><title>${title}</title><style>${style}</style><main><h1>${title}</h1><p>${body}</p></main>`;
 }
 
-// src/payload.ts
-var import_node_crypto5 = require("node:crypto");
-var import_node_fs10 = require("node:fs");
-var import_node_os3 = require("node:os");
-var import_node_path5 = require("node:path");
-
-// src/canonical.ts
-function canonicalJson(value) {
-  return encode(value);
-}
-function encode(value) {
-  if (value === null) return "null";
-  if (typeof value === "string") return JSON.stringify(value);
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new TypeError("canonicalJson: cannot encode a non-finite number");
-    }
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((entry2) => encode(entry2)).join(",")}]`;
-  }
-  if (typeof value === "object") {
-    const record = value;
-    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
-    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
-  }
-  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
-}
-
-// src/payload.ts
-var NeedsLoginError = class extends Error {
-  constructor() {
-    super("signed out \u2014 run login first");
-    this.name = "NeedsLoginError";
-  }
-};
-var ForbiddenError = class extends Error {
-  constructor() {
-    super("this install is not allowed for your account \u2014 access was revoked or never granted.");
-    this.name = "ForbiddenError";
-  }
-};
-function canonicalManifestBytes(manifest) {
-  return Buffer.from(
-    canonicalJson({
-      created: manifest.created,
-      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
-      version: manifest.version
-    }),
-    "utf8"
-  );
-}
-function ed25519PublicKey(config) {
-  const raw = publicKeyBytes(config);
-  return (0, import_node_crypto5.createPublicKey)({
-    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
-    format: "jwk"
-  });
-}
-function verifyManifest(manifest, signature, config) {
-  try {
-    const signatureBytes = Buffer.from(signature, "base64");
-    if (signatureBytes.length === 0) return false;
-    return (0, import_node_crypto5.verify)(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
-  } catch {
-    return false;
-  }
-}
-function verifyFileBytes(entry2, bytes) {
-  if (entry2.size !== bytes.length) return false;
-  return (0, import_node_crypto5.createHash)("sha256").update(bytes).digest("hex") === entry2.sha256.toLowerCase();
-}
-async function readErrorCode(response) {
-  try {
-    const data = await response.json();
-    return typeof data.error === "string" ? data.error : "";
-  } catch {
-    return "";
-  }
-}
-function throwForStatus(status, errorCode) {
-  if (status === 401) throw new NeedsLoginError();
-  if (status === 403) throw new ForbiddenError();
-  throw new Error(
-    errorCode ? `the release server refused the request (${status}: ${errorCode})` : `the release server refused the request (${status})`
-  );
-}
-async function getJson(url, accessToken, fetchImpl) {
-  const response = await fetchImpl(url, { headers: { authorization: `Bearer ${accessToken}` } });
-  if (!response.ok) throwForStatus(response.status, await readErrorCode(response));
-  return { status: response.status, json: await response.json() };
-}
-function parseManifest(json) {
-  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
-  const record = json;
-  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
-  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
-  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
-  if (typeof record.signature !== "string" || !record.signature) {
-    throw new Error("the release manifest is unsigned");
-  }
-  const files = record.files.map((entry2) => {
-    const file = entry2;
-    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
-      throw new Error("the release manifest lists a malformed file");
-    }
-    const safe = safeManifestPath(file.path);
-    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
-    return { path: safe, sha256: file.sha256, size: file.size };
-  });
-  return { version: record.version, created: record.created, files, signature: record.signature };
-}
-function safeManifestPath(rawPath) {
-  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
-  if (rawPath.startsWith("/")) return null;
-  const segments = rawPath.split("/");
-  for (const segment of segments) {
-    if (segment === "" || segment === "." || segment === "..") return null;
-  }
-  return segments.join("/");
-}
-async function fetchVerifiedManifest(config, accessToken, fetchImpl = fetch) {
-  const { json } = await getJson(`${config.host}/release/manifest`, accessToken, fetchImpl);
-  const manifest = parseManifest(json);
-  if (!verifyManifest(manifest, manifest.signature, config)) {
-    throw new Error("the release manifest signature is invalid \u2014 refusing to install anything.");
-  }
-  return manifest;
-}
-async function fetchFileBytes(config, accessToken, path, fetchImpl) {
-  const encoded = path.split("/").map(encodeURIComponent).join("/");
-  const response = await fetchImpl(`${config.host}/release/${encoded}`, {
-    headers: { authorization: `Bearer ${accessToken}` }
-  });
-  if (!response.ok) {
-    if (response.status === 404) throw new Error(`the release server has no file at ${path}`);
-    throwForStatus(response.status, await readErrorCode(response));
-  }
-  return Buffer.from(await response.arrayBuffer());
-}
-async function downloadAndUnpack(config, dir, manifest, accessToken, options = {}) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const staging = (0, import_node_path5.join)((0, import_node_os3.tmpdir)(), `launcher-${config.product}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`);
-  (0, import_node_fs10.mkdirSync)(staging, { recursive: true });
-  try {
-    for (const entry2 of manifest.files) {
-      const bytes = await fetchFileBytes(config, accessToken, entry2.path, fetchImpl);
-      if (!verifyFileBytes(entry2, bytes)) {
-        throw new Error(`file ${entry2.path} failed its checksum \u2014 refusing to install anything.`);
-      }
-      const dest = (0, import_node_path5.join)(staging, entry2.path);
-      (0, import_node_fs10.mkdirSync)((0, import_node_path5.dirname)(dest), { recursive: true });
-      (0, import_node_fs10.writeFileSync)(dest, bytes);
-    }
-    const target = (0, import_node_path5.join)(dir, "payload");
-    (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs10.rmSync)(target, { force: true, recursive: true });
-    (0, import_node_fs10.renameSync)(staging, target);
-  } catch (error) {
-    (0, import_node_fs10.rmSync)(staging, { force: true, recursive: true });
-    throw error;
-  }
-  return manifest.version;
-}
-
 // src/index.ts
-var LAUNCHER_VERSION = true ? "0.1.13" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "0.1.14" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -1815,12 +1962,13 @@ function parseProgress(raw) {
       const message = JSON.parse(line);
       if (!SUPPORTED_PROGRESS_PROTOCOLS.has(message.v) || typeof message.step !== "string") continue;
       const state = message.state ?? "ok";
-      if (state !== "ok" && state !== "fail" && state !== "note") continue;
+      if (state !== "ok" && state !== "fail" && state !== "note" && state !== "running") continue;
       if (message.ms !== void 0 && typeof message.ms !== "number") continue;
       progress.push({
         step: message.step,
         state,
-        ...typeof message.ms === "number" ? { ms: message.ms } : {}
+        ...typeof message.ms === "number" && Number.isFinite(message.ms) && message.ms >= 0 ? { ms: message.ms } : {},
+        ...typeof message.measure === "string" ? { measure: message.measure } : {}
       });
     } catch {
     }
@@ -1889,7 +2037,7 @@ async function installOrUpdate(config, dir, options, print, update) {
     version = manifest.version;
     installer.phase("resolve", { seconds: (Date.now() - started) / 1e3 });
     const current = readState(dir);
-    const unchanged = update && current?.version === version && (0, import_node_fs11.existsSync)(payloadDir(dir));
+    const unchanged = current?.version === version && (0, import_node_fs11.existsSync)(payloadDir(dir));
     if (unchanged && current.acquired) {
       installer.surface({ id: config.product, from: version, to: version, state: "current" });
       return await finishLastMile(config, dir, options, installer, version, true, acquisitionRepairCommand(dir, version));
@@ -1897,11 +2045,17 @@ async function installOrUpdate(config, dir, options, print, update) {
     if (!unchanged) {
       installer.phase("download", { state: "running" });
       started = Date.now();
-      const candidate = (0, import_node_crypto6.randomUUID)();
+      const cached = reusableCandidate(dir, manifest);
+      const candidate = cached ?? (0, import_node_crypto6.randomUUID)();
       const candidateDir = (0, import_node_path6.join)(dir, "candidates", candidate);
-      await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl });
+      const onProgress = ({ done, total }) => installer.phase("download", {
+        state: "running",
+        measure: total ? `${Math.floor(done / total * 100)}% \xB7 ${done}/${total} B` : `${done} B`
+      });
+      if (!cached) await downloadAndUnpack(config, candidateDir, manifest, accessToken, { fetchImpl, onProgress });
       const acquisition = (0, import_node_fs11.existsSync)((0, import_node_path6.join)(candidateDir, "payload", "payload.json")) ? readAcquisition((0, import_node_path6.join)(candidateDir, "payload")) : null;
       if (acquisition) {
+        rememberCandidate(dir, candidate, manifest);
         installer.phase("download", { seconds: (Date.now() - started) / 1e3 });
         installer.phase("activate", { state: "running" });
         let outcome;
@@ -1909,7 +2063,9 @@ async function installOrUpdate(config, dir, options, print, update) {
         await installAcquisition(dir, candidate, version, acquisition, {
           fetchImpl,
           env,
+          onProgress,
           run: async (command2, cwd, childEnv) => {
+            installer.phase(command2.includes("--prefix") ? "install" : "activate", { state: "running" });
             const result = options.runEntry ? options.runEntry(command2, cwd, childEnv) : await runInstallEntry(command2, cwd, childEnv, installer, readTokens(dir));
             if (result.outcome) outcome = validateInstallerOutcome(result.outcome);
             return result.ok && (result.code === void 0 || result.code === 0) && !result.outcome?.operationFailed && !result.outcome?.failed;
@@ -2027,17 +2183,22 @@ async function finishLastMile(config, dir, options, installer, version, unchange
   return succeeded ? outcome?.operationFailed || outcome?.failed ? 1 : 0 : result.code || 1;
 }
 async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
+  installer.start();
   const [command2, ...args] = entry2;
   const shell = needsShell(command2);
   const progress = !(process.platform === "win32" && shell);
   const outcomeDir = (0, import_node_fs11.mkdtempSync)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "mm-installer-outcome-"));
   const outcomeFile = (0, import_node_path6.join)(outcomeDir, "outcome.json");
+  const progressFile = (0, import_node_path6.join)(outcomeDir, "progress.jsonl");
   const childEnv = { ...env, MM_INSTALLER_OUTCOME_FILE: outcomeFile };
   delete childEnv.MM_FACE_TRANSCRIPT;
+  delete childEnv.MM_PROGRESS_FILE;
   delete childEnv.MM_PROGRESS_FD;
   delete childEnv.MM_PROGRESS_PROTOCOL;
   if (progress) Object.assign(childEnv, { MM_PROGRESS_FD: "3", MM_PROGRESS_PROTOCOL: "1" });
+  else Object.assign(childEnv, { MM_PROGRESS_FILE: progressFile, MM_PROGRESS_PROTOCOL: "1" });
   const secrets = [tokens?.accessToken, tokens?.refreshToken].filter((value) => Boolean(value));
+  let progressError;
   const redact = (text) => secrets.reduce((safe, value) => safe.replaceAll(value, "[redacted]"), text);
   try {
     const result = await new Promise((resolve3) => {
@@ -2058,24 +2219,44 @@ async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
           }
           partial = held ? safe.slice(-held) : "";
           const visible = held ? safe.slice(0, -held) : safe;
-          if (visible) installer.relay(visible, channel2, false);
+          if (visible) installer.relayChunk(visible, channel2);
         }).on("end", () => {
-          if (partial) installer.relay("[redacted]", channel2, false);
+          if (partial) installer.relayChunk("[redacted]", channel2);
         });
       }
       let pending = "";
+      let progressOffset = 0;
+      const progressDecoder = new import_node_string_decoder.StringDecoder("utf8");
+      const receive = (text) => {
+        pending += text;
+        const end = pending.lastIndexOf("\n");
+        if (end >= 0) {
+          for (const record of parseProgress(pending.slice(0, end))) installer.milestone({ ...record, step: redact(record.step), ...record.measure ? { measure: redact(record.measure) } : {} });
+          pending = pending.slice(end + 1);
+        }
+        if (pending.length > 65536) pending = "";
+      };
+      const pollProgress = () => {
+        if (progressError) return;
+        try {
+          if (!(0, import_node_fs11.existsSync)(progressFile)) return;
+          const bytes = (0, import_node_fs11.readFileSync)(progressFile);
+          receive(progressDecoder.write(bytes.subarray(progressOffset)));
+          progressOffset = bytes.length;
+        } catch {
+          progressError = "installer progress: could not read child progress";
+          if (timer) clearInterval(timer);
+        }
+      };
+      const timer = progress ? void 0 : setInterval(pollProgress, 90);
+      child.once("close", () => {
+        if (timer) clearInterval(timer);
+        pollProgress();
+      });
       const channel = child.stdio[3];
       if (channel && "setEncoding" in channel) {
         channel.setEncoding("utf8");
-        channel.on("data", (text) => {
-          pending += text;
-          const end = pending.lastIndexOf("\n");
-          if (end >= 0) {
-            for (const record of parseProgress(pending.slice(0, end))) installer.milestone({ ...record, step: redact(record.step) });
-            pending = pending.slice(end + 1);
-          }
-          if (pending.length > 65536) pending = "";
-        });
+        channel.on("data", receive);
       }
       child.on("error", (error) => resolve3({ ok: false, error: error.message }));
       child.on("close", (code) => resolve3({
@@ -2084,6 +2265,7 @@ async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
         ...code !== 0 ? { error: `exit code ${code}` } : {}
       }));
     });
+    if (progressError) return { ...result, ok: false, code: result.code || 1, error: progressError };
     try {
       const outcome = readInstallerOutcome(outcomeFile);
       return { ...result, ...outcome ? { outcome } : {} };
@@ -2091,6 +2273,7 @@ async function runInstallEntry(entry2, cwd, env, installer, tokens = null) {
       return { ...result, ok: false, code: result.code || 1, error: "installer outcome: invalid child result" };
     }
   } finally {
+    if ((0, import_node_fs11.existsSync)(progressFile)) (0, import_node_fs11.unlinkSync)(progressFile);
     if ((0, import_node_fs11.existsSync)(outcomeFile)) (0, import_node_fs11.unlinkSync)(outcomeFile);
     (0, import_node_fs11.rmdirSync)(outcomeDir);
   }