@mutmutco/installer-launcher 1.2.3 → 1.2.5

package/dist/launcher.js

@@ -687,6 +687,9 @@ import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 import { appendFileSync, writeSync } from "node:fs";
 
 // ../face/src/products.ts
+function closingLine(identity) {
+  return identity.open ? `Open it any time:  ${identity.open}` : `Check health any time:  ${identity.doctor}`;
+}
 var PRODUCTS = Object.freeze({
   "mm-strategy": Object.freeze({
     name: "MM Strategy",
@@ -712,6 +715,16 @@ var PRODUCTS = Object.freeze({
     warm: "Welcome back. Checking for updates...",
     doctor: "jerv doctor"
   }),
+  // #7318: the MM-Work desktop app (a signed setup, not a launcher). Accent: owner pick 2026-09-25 (indigo).
+  "mm-work": Object.freeze({
+    name: "MM-Work",
+    installWarm: "Welcome. Let's get you ready.",
+    checkWarm: "Here's where things stand.",
+    accent: "38;2;129;140;248",
+    warm: "Welcome back. Checking for updates...",
+    doctor: "",
+    open: "Start menu > MM-Work"
+  }),
   jervcode: Object.freeze({
     name: "JervCode",
     installWarm: "Welcome. Let's get you ready.",
@@ -880,7 +893,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
     return receipt([
       `${GLYPH.check}  ${identity.name} is ready.`,
       fact,
-      `Check health any time:  ${identity.doctor}`
+      closingLine(identity)
     ], options);
   };
   const signOff = () => nested ? "" : `${paint(identity.accent, GLYPH.diamond)}  ${paint(identity.accent, `${identity.name} \xB7 Mutatis Mutandis`)}`;
@@ -1729,162 +1742,6 @@ function firstLine(text) {
   return String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0] ?? "";
 }
 
-// src/refresh.ts
-import { execFile } from "node:child_process";
-import { chmodSync, existsSync as existsSync7, lstatSync, readdirSync, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir } from "node:os";
-import { basename, dirname as dirname3, join as join6 } from "node:path";
-var LAUNCHER_RECORD_FILE = "launcher.json";
-var RECORD_TIMEOUT_MS = 1e4;
-function platformKey(platform, arch) {
-  if (platform === "win32") return arch === "x64" || arch === "arm64" ? `win-${arch}` : null;
-  return platform === "darwin" && arch === "arm64" ? "darwin-arm64" : null;
-}
-function verifierFor(target) {
-  return { product: target.product, host: target.host, loginKind: "github", publicKey: target.key, binName: target.bin };
-}
-async function fetchRecord(target, options) {
-  let json;
-  try {
-    const response = await (options.fetch ?? fetch)(
-      `${target.host.replace(/\/+$/u, "")}/release/launcher`,
-      { signal: AbortSignal.timeout(options.timeoutMs ?? RECORD_TIMEOUT_MS) }
-    );
-    if (!response.ok) return null;
-    json = await response.json();
-  } catch {
-    return null;
-  }
-  let record;
-  try {
-    record = parseManifest(json);
-  } catch {
-    return null;
-  }
-  if (!verifyManifest(record, record.signature, verifierFor(target))) return "bad-signature";
-  return { version: record.version, files: record.files };
-}
-async function readLauncherRecord(target, options = {}) {
-  const record = await fetchRecord(target, options);
-  return record === "bad-signature" ? null : record;
-}
-function compareVersions(a, b) {
-  const split = (v) => {
-    const [core, pre = ""] = v.split("-", 2);
-    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
-  };
-  const x = split(a);
-  const y = split(b);
-  for (let i = 0; i < 3; i++) if ((x.nums[i] ?? 0) !== (y.nums[i] ?? 0)) return (x.nums[i] ?? 0) > (y.nums[i] ?? 0) ? 1 : -1;
-  if (x.pre === y.pre) return 0;
-  if (!x.pre) return 1;
-  if (!y.pre) return -1;
-  return x.pre > y.pre ? 1 : -1;
-}
-function recordedPath(productDir) {
-  try {
-    const saved = JSON.parse(readFileSync7(join6(productDir, LAUNCHER_RECORD_FILE), "utf8"));
-    return typeof saved.path === "string" && saved.path ? saved.path : null;
-  } catch {
-    return null;
-  }
-}
-function installedPath(target, productDir, platform) {
-  return platform === "win32" ? join6(productDir, "bin", `${target.bin}.exe`) : join6(homedir(), ".local", "bin", target.bin);
-}
-function parseLauncherVersion(stdout, bin) {
-  const text = String(stdout).trim();
-  if (!text.startsWith(`${bin} `)) return null;
-  return text.match(/launcher (\d+\.\d+\.\d+[^\s)]*)/u)?.[1] ?? null;
-}
-function runVersion(path, bin) {
-  return new Promise((resolve3) => {
-    execFile(path, ["--version"], { timeout: 3e4, windowsHide: true, encoding: "utf8" }, (error, stdout) => {
-      resolve3(error ? null : parseLauncherVersion(stdout, bin));
-    });
-  });
-}
-function removeStale(file) {
-  const prefix = `${basename(file)}.old-`;
-  let names;
-  try {
-    names = readdirSync(dirname3(file));
-  } catch {
-    return;
-  }
-  for (const name of names) {
-    if (!name.startsWith(prefix)) continue;
-    try {
-      rmSync5(join6(dirname3(file), name), { force: true });
-    } catch {
-    }
-  }
-}
-async function refreshLauncher(target, options = {}) {
-  const started = Date.now();
-  const platform = options.platform ?? process.platform;
-  const key = platformKey(platform, options.arch ?? process.arch);
-  if (!key) return null;
-  const productDir = options.productDir ?? defaultProductDir(target.product);
-  const recorded = recordedPath(productDir);
-  const file = options.path ?? (recorded && existsSync7(recorded) ? recorded : installedPath(target, productDir, platform));
-  if (!existsSync7(file) || lstatSync(file).isSymbolicLink()) return null;
-  if (!options.dryRun) removeStale(file);
-  const from = await (options.readVersion ?? ((path) => runVersion(path, target.bin)))(file);
-  if (!from) return null;
-  const arm = (verdict, to, detail) => ({ surface: "launcher", from, to, verdict, detail, durationMs: Date.now() - started });
-  const record = await fetchRecord(target, options);
-  if (record === "bad-signature") return arm("fail", from, "The launcher record failed its signature check.");
-  const entry2 = record?.files.find((candidate) => candidate.path === key);
-  if (!record || !entry2) return arm("skip", from, "No launcher update is offered yet.");
-  if (compareVersions(record.version, from) <= 0) return arm("ok", from, "");
-  if (options.dryRun) return arm("ok", record.version, "");
-  let unlock;
-  const lockHeld = options.lockHeld ?? process.env.MM_OUTER_CONSOLE === "1";
-  if (!lockHeld) {
-    try {
-      unlock = lockInstallation(productDir);
-    } catch {
-      return arm("defer", from, "Another install is running; the launcher updates next time.");
-    }
-  }
-  const next = `${file}.new-${process.pid}`;
-  let moved;
-  try {
-    let bytes;
-    try {
-      const response = await (options.fetch ?? fetch)(
-        `${(target.dl ?? target.host).replace(/\/+$/u, "")}/dl/${target.product}/${key}`,
-        { signal: AbortSignal.timeout(3e5) }
-      );
-      if (!response.ok) return arm("defer", from, "The launcher download did not complete; it retries next time.");
-      bytes = await readDownload(response, void 0, entry2.size);
-    } catch {
-      return arm("defer", from, "The launcher download did not complete; it retries next time.");
-    }
-    if (!verifyFileBytes(entry2, bytes)) return arm("fail", from, "The downloaded launcher failed its checksum.");
-    try {
-      writeFileSync7(next, bytes, { mode: 493 });
-      if (platform !== "win32") chmodSync(next, 493);
-      if (platform === "win32") {
-        moved = `${file}.old-${process.pid}-${Date.now()}`;
-        renameSync4(file, moved);
-      }
-      renameSync4(next, file);
-    } catch {
-      try {
-        if (moved && !existsSync7(file)) renameSync4(moved, file);
-      } catch {
-      }
-      rmSync5(next, { force: true });
-      return arm("fail", from, "The launcher could not be replaced.");
-    }
-    return arm("ok", record.version, "");
-  } finally {
-    unlock?.();
-  }
-}
-
 // src/login-github.ts
 import { spawn, spawnSync as spawnSync3 } from "node:child_process";
 var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -2145,8 +2002,201 @@ function page(title, body) {
   return `<!doctype html><meta charset="utf-8"><meta name="color-scheme" content="dark"><title>${title}</title><style>${style}</style><main><h1>${title}</h1><p>${body}</p></main>`;
 }
 
+// src/tokens.ts
+async function ensureFreshToken(config, dir, fetchImpl = fetch) {
+  const stored = readTokens(dir);
+  if (!stored) return null;
+  if (stored.expiresAt - Date.now() > 6e4) return stored.accessToken;
+  if (!stored.refreshToken) return null;
+  if (config.loginKind === "github") {
+    const refreshed2 = await refreshAccessToken(config, stored.refreshToken, fetchImpl);
+    if (!refreshed2) {
+      clearTokens(dir);
+      return null;
+    }
+    writeTokens(dir, {
+      accessToken: refreshed2.accessToken,
+      refreshToken: refreshed2.refreshToken ?? stored.refreshToken,
+      expiresAt: Date.now() + refreshed2.expiresIn * 1e3
+    });
+    return refreshed2.accessToken;
+  }
+  if (!stored.clientId) {
+    clearTokens(dir);
+    return null;
+  }
+  const refreshed = await refreshGoogleToken(config.host, stored.clientId, stored.refreshToken, fetchImpl);
+  if (!refreshed) {
+    clearTokens(dir);
+    return null;
+  }
+  writeTokens(dir, {
+    accessToken: refreshed.accessToken,
+    refreshToken: refreshed.refreshToken,
+    expiresAt: Date.now() + refreshed.expiresIn * 1e3,
+    clientId: stored.clientId
+  });
+  return refreshed.accessToken;
+}
+
+// src/refresh.ts
+import { execFile } from "node:child_process";
+import { chmodSync, existsSync as existsSync7, lstatSync, readdirSync, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname as dirname3, join as join6 } from "node:path";
+var LAUNCHER_RECORD_FILE = "launcher.json";
+var RECORD_TIMEOUT_MS = 1e4;
+function platformKey(platform, arch) {
+  if (platform === "win32") return arch === "x64" || arch === "arm64" ? `win-${arch}` : null;
+  return platform === "darwin" && arch === "arm64" ? "darwin-arm64" : null;
+}
+function verifierFor(target) {
+  return { product: target.product, host: target.host, loginKind: "github", publicKey: target.key, binName: target.bin };
+}
+async function fetchRecord(target, options) {
+  let json;
+  try {
+    const response = await (options.fetch ?? fetch)(
+      `${target.host.replace(/\/+$/u, "")}/release/launcher`,
+      { signal: AbortSignal.timeout(options.timeoutMs ?? RECORD_TIMEOUT_MS) }
+    );
+    if (!response.ok) return null;
+    json = await response.json();
+  } catch {
+    return null;
+  }
+  let record;
+  try {
+    record = parseManifest(json);
+  } catch {
+    return null;
+  }
+  if (!verifyManifest(record, record.signature, verifierFor(target))) return "bad-signature";
+  return { version: record.version, files: record.files };
+}
+async function readLauncherRecord(target, options = {}) {
+  const record = await fetchRecord(target, options);
+  return record === "bad-signature" ? null : record;
+}
+function compareVersions(a, b) {
+  const split = (v) => {
+    const [core, pre = ""] = v.split("-", 2);
+    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
+  };
+  const x = split(a);
+  const y = split(b);
+  for (let i = 0; i < 3; i++) if ((x.nums[i] ?? 0) !== (y.nums[i] ?? 0)) return (x.nums[i] ?? 0) > (y.nums[i] ?? 0) ? 1 : -1;
+  if (x.pre === y.pre) return 0;
+  if (!x.pre) return 1;
+  if (!y.pre) return -1;
+  return x.pre > y.pre ? 1 : -1;
+}
+function recordedPath(productDir) {
+  try {
+    const saved = JSON.parse(readFileSync7(join6(productDir, LAUNCHER_RECORD_FILE), "utf8"));
+    return typeof saved.path === "string" && saved.path ? saved.path : null;
+  } catch {
+    return null;
+  }
+}
+function installedPath(target, productDir, platform) {
+  return platform === "win32" ? join6(productDir, "bin", `${target.bin}.exe`) : join6(homedir(), ".local", "bin", target.bin);
+}
+function parseLauncherVersion(stdout, bin) {
+  const text = String(stdout).trim();
+  if (!text.startsWith(`${bin} `)) return null;
+  return text.match(/launcher (\d+\.\d+\.\d+[^\s)]*)/u)?.[1] ?? null;
+}
+function runVersion(path, bin) {
+  return new Promise((resolve3) => {
+    execFile(path, ["--version"], { timeout: 3e4, windowsHide: true, encoding: "utf8" }, (error, stdout) => {
+      resolve3(error ? null : parseLauncherVersion(stdout, bin));
+    });
+  });
+}
+function removeStale(file) {
+  const prefix = `${basename(file)}.old-`;
+  let names;
+  try {
+    names = readdirSync(dirname3(file));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (!name.startsWith(prefix)) continue;
+    try {
+      rmSync5(join6(dirname3(file), name), { force: true });
+    } catch {
+    }
+  }
+}
+async function refreshLauncher(target, options = {}) {
+  const started = Date.now();
+  const platform = options.platform ?? process.platform;
+  const key = platformKey(platform, options.arch ?? process.arch);
+  if (!key) return null;
+  const productDir = options.productDir ?? defaultProductDir(target.product);
+  const recorded = recordedPath(productDir);
+  const file = options.path ?? (recorded && existsSync7(recorded) ? recorded : installedPath(target, productDir, platform));
+  if (!existsSync7(file) || lstatSync(file).isSymbolicLink()) return null;
+  if (!options.dryRun) removeStale(file);
+  const from = await (options.readVersion ?? ((path) => runVersion(path, target.bin)))(file);
+  if (!from) return null;
+  const arm = (verdict, to, detail) => ({ surface: "launcher", from, to, verdict, detail, durationMs: Date.now() - started });
+  const record = await fetchRecord(target, options);
+  if (record === "bad-signature") return arm("fail", from, "The launcher record failed its signature check.");
+  const entry2 = record?.files.find((candidate) => candidate.path === key);
+  if (!record || !entry2) return arm("skip", from, "No launcher update is offered yet.");
+  if (compareVersions(record.version, from) <= 0) return arm("ok", from, "");
+  if (options.dryRun) return arm("ok", record.version, "");
+  let unlock;
+  const lockHeld = options.lockHeld ?? process.env.MM_OUTER_CONSOLE === "1";
+  if (!lockHeld) {
+    try {
+      unlock = lockInstallation(productDir);
+    } catch {
+      return arm("defer", from, "Another install is running; the launcher updates next time.");
+    }
+  }
+  const next = `${file}.new-${process.pid}`;
+  let moved;
+  try {
+    let bytes;
+    try {
+      const response = await (options.fetch ?? fetch)(
+        `${(target.dl ?? target.host).replace(/\/+$/u, "")}/dl/${target.product}/${key}`,
+        { signal: AbortSignal.timeout(3e5) }
+      );
+      if (!response.ok) return arm("defer", from, "The launcher download did not complete; it retries next time.");
+      bytes = await readDownload(response, void 0, entry2.size);
+    } catch {
+      return arm("defer", from, "The launcher download did not complete; it retries next time.");
+    }
+    if (!verifyFileBytes(entry2, bytes)) return arm("fail", from, "The downloaded launcher failed its checksum.");
+    try {
+      writeFileSync7(next, bytes, { mode: 493 });
+      if (platform !== "win32") chmodSync(next, 493);
+      if (platform === "win32") {
+        moved = `${file}.old-${process.pid}-${Date.now()}`;
+        renameSync4(file, moved);
+      }
+      renameSync4(next, file);
+    } catch {
+      try {
+        if (moved && !existsSync7(file)) renameSync4(moved, file);
+      } catch {
+      }
+      rmSync5(next, { force: true });
+      return arm("fail", from, "The launcher could not be replaced.");
+    }
+    return arm("ok", record.version, "");
+  } finally {
+    unlock?.();
+  }
+}
+
 // src/index.ts
-var LAUNCHER_VERSION = true ? "1.2.3" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "1.2.5" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -2369,41 +2419,6 @@ async function runFile(file, args, printErr) {
   }
   return code;
 }
-async function ensureFreshToken(config, dir, fetchImpl = fetch) {
-  const stored = readTokens(dir);
-  if (!stored) return null;
-  if (stored.expiresAt - Date.now() > 6e4) return stored.accessToken;
-  if (!stored.refreshToken) return null;
-  if (config.loginKind === "github") {
-    const refreshed2 = await refreshAccessToken(config, stored.refreshToken, fetchImpl);
-    if (!refreshed2) {
-      clearTokens(dir);
-      return null;
-    }
-    writeTokens(dir, {
-      accessToken: refreshed2.accessToken,
-      refreshToken: refreshed2.refreshToken ?? stored.refreshToken,
-      expiresAt: Date.now() + refreshed2.expiresIn * 1e3
-    });
-    return refreshed2.accessToken;
-  }
-  if (!stored.clientId) {
-    clearTokens(dir);
-    return null;
-  }
-  const refreshed = await refreshGoogleToken(config.host, stored.clientId, stored.refreshToken, fetchImpl);
-  if (!refreshed) {
-    clearTokens(dir);
-    return null;
-  }
-  writeTokens(dir, {
-    accessToken: refreshed.accessToken,
-    refreshToken: refreshed.refreshToken,
-    expiresAt: Date.now() + refreshed.expiresIn * 1e3,
-    clientId: stored.clientId
-  });
-  return refreshed.accessToken;
-}
 async function doLogin(config, dir, options, prompt, installer) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const open = options.open ?? openBrowser;
@@ -3051,7 +3066,6 @@ if (invokedAsMain) {
 export {
   LAUNCHER_VERSION,
   defaultRunEntry,
-  ensureFreshToken,
   formatMb,
   parseArgv,
   readPayloadEntry,

package/dist/launcher.sea.cjs

@@ -22,7 +22,6 @@ var index_exports = {};
 __export(index_exports, {
   LAUNCHER_VERSION: () => LAUNCHER_VERSION,
   defaultRunEntry: () => defaultRunEntry,
-  ensureFreshToken: () => ensureFreshToken,
   formatMb: () => formatMb,
   parseArgv: () => parseArgv,
   readPayloadEntry: () => readPayloadEntry,
@@ -721,6 +720,9 @@ var import_node_url2 = require("node:url");
 var import_node_fs6 = require("node:fs");
 
 // ../face/src/products.ts
+function closingLine(identity) {
+  return identity.open ? `Open it any time:  ${identity.open}` : `Check health any time:  ${identity.doctor}`;
+}
 var PRODUCTS = Object.freeze({
   "mm-strategy": Object.freeze({
     name: "MM Strategy",
@@ -746,6 +748,16 @@ var PRODUCTS = Object.freeze({
     warm: "Welcome back. Checking for updates...",
     doctor: "jerv doctor"
   }),
+  // #7318: the MM-Work desktop app (a signed setup, not a launcher). Accent: owner pick 2026-09-25 (indigo).
+  "mm-work": Object.freeze({
+    name: "MM-Work",
+    installWarm: "Welcome. Let's get you ready.",
+    checkWarm: "Here's where things stand.",
+    accent: "38;2;129;140;248",
+    warm: "Welcome back. Checking for updates...",
+    doctor: "",
+    open: "Start menu > MM-Work"
+  }),
   jervcode: Object.freeze({
     name: "JervCode",
     installWarm: "Welcome. Let's get you ready.",
@@ -914,7 +926,7 @@ function createFace({ product, color = false, columns, env = process.env, operat
     return receipt([
       `${GLYPH.check}  ${identity.name} is ready.`,
       fact,
-      `Check health any time:  ${identity.doctor}`
+      closingLine(identity)
     ], options);
   };
   const signOff = () => nested ? "" : `${paint(identity.accent, GLYPH.diamond)}  ${paint(identity.accent, `${identity.name} \xB7 Mutatis Mutandis`)}`;
@@ -1763,171 +1775,15 @@ function firstLine(text) {
   return String(text).split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0] ?? "";
 }
 
-// src/refresh.ts
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs11 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path6 = require("node:path");
-var LAUNCHER_RECORD_FILE = "launcher.json";
-var RECORD_TIMEOUT_MS = 1e4;
-function platformKey(platform, arch) {
-  if (platform === "win32") return arch === "x64" || arch === "arm64" ? `win-${arch}` : null;
-  return platform === "darwin" && arch === "arm64" ? "darwin-arm64" : null;
-}
-function verifierFor(target) {
-  return { product: target.product, host: target.host, loginKind: "github", publicKey: target.key, binName: target.bin };
-}
-async function fetchRecord(target, options) {
-  let json;
-  try {
-    const response = await (options.fetch ?? fetch)(
-      `${target.host.replace(/\/+$/u, "")}/release/launcher`,
-      { signal: AbortSignal.timeout(options.timeoutMs ?? RECORD_TIMEOUT_MS) }
-    );
-    if (!response.ok) return null;
-    json = await response.json();
-  } catch {
-    return null;
-  }
-  let record;
-  try {
-    record = parseManifest(json);
-  } catch {
-    return null;
-  }
-  if (!verifyManifest(record, record.signature, verifierFor(target))) return "bad-signature";
-  return { version: record.version, files: record.files };
-}
-async function readLauncherRecord(target, options = {}) {
-  const record = await fetchRecord(target, options);
-  return record === "bad-signature" ? null : record;
-}
-function compareVersions(a, b) {
-  const split = (v) => {
-    const [core, pre = ""] = v.split("-", 2);
-    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
-  };
-  const x = split(a);
-  const y = split(b);
-  for (let i = 0; i < 3; i++) if ((x.nums[i] ?? 0) !== (y.nums[i] ?? 0)) return (x.nums[i] ?? 0) > (y.nums[i] ?? 0) ? 1 : -1;
-  if (x.pre === y.pre) return 0;
-  if (!x.pre) return 1;
-  if (!y.pre) return -1;
-  return x.pre > y.pre ? 1 : -1;
-}
-function recordedPath(productDir) {
-  try {
-    const saved = JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path6.join)(productDir, LAUNCHER_RECORD_FILE), "utf8"));
-    return typeof saved.path === "string" && saved.path ? saved.path : null;
-  } catch {
-    return null;
-  }
-}
-function installedPath(target, productDir, platform) {
-  return platform === "win32" ? (0, import_node_path6.join)(productDir, "bin", `${target.bin}.exe`) : (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".local", "bin", target.bin);
-}
-function parseLauncherVersion(stdout, bin) {
-  const text = String(stdout).trim();
-  if (!text.startsWith(`${bin} `)) return null;
-  return text.match(/launcher (\d+\.\d+\.\d+[^\s)]*)/u)?.[1] ?? null;
-}
-function runVersion(path, bin) {
-  return new Promise((resolve3) => {
-    (0, import_node_child_process3.execFile)(path, ["--version"], { timeout: 3e4, windowsHide: true, encoding: "utf8" }, (error, stdout) => {
-      resolve3(error ? null : parseLauncherVersion(stdout, bin));
-    });
-  });
-}
-function removeStale(file) {
-  const prefix = `${(0, import_node_path6.basename)(file)}.old-`;
-  let names;
-  try {
-    names = (0, import_node_fs11.readdirSync)((0, import_node_path6.dirname)(file));
-  } catch {
-    return;
-  }
-  for (const name of names) {
-    if (!name.startsWith(prefix)) continue;
-    try {
-      (0, import_node_fs11.rmSync)((0, import_node_path6.join)((0, import_node_path6.dirname)(file), name), { force: true });
-    } catch {
-    }
-  }
-}
-async function refreshLauncher(target, options = {}) {
-  const started = Date.now();
-  const platform = options.platform ?? process.platform;
-  const key = platformKey(platform, options.arch ?? process.arch);
-  if (!key) return null;
-  const productDir = options.productDir ?? defaultProductDir(target.product);
-  const recorded = recordedPath(productDir);
-  const file = options.path ?? (recorded && (0, import_node_fs11.existsSync)(recorded) ? recorded : installedPath(target, productDir, platform));
-  if (!(0, import_node_fs11.existsSync)(file) || (0, import_node_fs11.lstatSync)(file).isSymbolicLink()) return null;
-  if (!options.dryRun) removeStale(file);
-  const from = await (options.readVersion ?? ((path) => runVersion(path, target.bin)))(file);
-  if (!from) return null;
-  const arm = (verdict, to, detail) => ({ surface: "launcher", from, to, verdict, detail, durationMs: Date.now() - started });
-  const record = await fetchRecord(target, options);
-  if (record === "bad-signature") return arm("fail", from, "The launcher record failed its signature check.");
-  const entry2 = record?.files.find((candidate) => candidate.path === key);
-  if (!record || !entry2) return arm("skip", from, "No launcher update is offered yet.");
-  if (compareVersions(record.version, from) <= 0) return arm("ok", from, "");
-  if (options.dryRun) return arm("ok", record.version, "");
-  let unlock;
-  const lockHeld = options.lockHeld ?? process.env.MM_OUTER_CONSOLE === "1";
-  if (!lockHeld) {
-    try {
-      unlock = lockInstallation(productDir);
-    } catch {
-      return arm("defer", from, "Another install is running; the launcher updates next time.");
-    }
-  }
-  const next = `${file}.new-${process.pid}`;
-  let moved;
-  try {
-    let bytes;
-    try {
-      const response = await (options.fetch ?? fetch)(
-        `${(target.dl ?? target.host).replace(/\/+$/u, "")}/dl/${target.product}/${key}`,
-        { signal: AbortSignal.timeout(3e5) }
-      );
-      if (!response.ok) return arm("defer", from, "The launcher download did not complete; it retries next time.");
-      bytes = await readDownload(response, void 0, entry2.size);
-    } catch {
-      return arm("defer", from, "The launcher download did not complete; it retries next time.");
-    }
-    if (!verifyFileBytes(entry2, bytes)) return arm("fail", from, "The downloaded launcher failed its checksum.");
-    try {
-      (0, import_node_fs11.writeFileSync)(next, bytes, { mode: 493 });
-      if (platform !== "win32") (0, import_node_fs11.chmodSync)(next, 493);
-      if (platform === "win32") {
-        moved = `${file}.old-${process.pid}-${Date.now()}`;
-        (0, import_node_fs11.renameSync)(file, moved);
-      }
-      (0, import_node_fs11.renameSync)(next, file);
-    } catch {
-      try {
-        if (moved && !(0, import_node_fs11.existsSync)(file)) (0, import_node_fs11.renameSync)(moved, file);
-      } catch {
-      }
-      (0, import_node_fs11.rmSync)(next, { force: true });
-      return arm("fail", from, "The launcher could not be replaced.");
-    }
-    return arm("ok", record.version, "");
-  } finally {
-    unlock?.();
-  }
-}
-
 // src/login-github.ts
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process3 = require("node:child_process");
 var realSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function openBrowser(url) {
   if (process.env.LAUNCHER_NO_OPEN === "1") return;
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
   const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
   try {
-    const child = (0, import_node_child_process4.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
+    const child = (0, import_node_child_process3.spawn)(opener, args, { detached: true, stdio: "ignore", windowsHide: true });
     child.on("error", () => {
     });
     child.unref();
@@ -2045,7 +1901,7 @@ async function refreshAccessToken(config, refreshToken, fetchImpl = fetch) {
 }
 function readGhToken() {
   try {
-    const result = (0, import_node_child_process4.spawnSync)("gh", ["auth", "token", "--hostname", "github.com"], { encoding: "utf8", timeout: 1e4, windowsHide: true });
+    const result = (0, import_node_child_process3.spawnSync)("gh", ["auth", "token", "--hostname", "github.com"], { encoding: "utf8", timeout: 1e4, windowsHide: true });
     const token = result.status === 0 ? String(result.stdout).trim() : "";
     return token && !/\s/u.test(token) ? token : null;
   } catch {
@@ -2179,8 +2035,201 @@ function page(title, body) {
   return `<!doctype html><meta charset="utf-8"><meta name="color-scheme" content="dark"><title>${title}</title><style>${style}</style><main><h1>${title}</h1><p>${body}</p></main>`;
 }
 
+// src/tokens.ts
+async function ensureFreshToken(config, dir, fetchImpl = fetch) {
+  const stored = readTokens(dir);
+  if (!stored) return null;
+  if (stored.expiresAt - Date.now() > 6e4) return stored.accessToken;
+  if (!stored.refreshToken) return null;
+  if (config.loginKind === "github") {
+    const refreshed2 = await refreshAccessToken(config, stored.refreshToken, fetchImpl);
+    if (!refreshed2) {
+      clearTokens(dir);
+      return null;
+    }
+    writeTokens(dir, {
+      accessToken: refreshed2.accessToken,
+      refreshToken: refreshed2.refreshToken ?? stored.refreshToken,
+      expiresAt: Date.now() + refreshed2.expiresIn * 1e3
+    });
+    return refreshed2.accessToken;
+  }
+  if (!stored.clientId) {
+    clearTokens(dir);
+    return null;
+  }
+  const refreshed = await refreshGoogleToken(config.host, stored.clientId, stored.refreshToken, fetchImpl);
+  if (!refreshed) {
+    clearTokens(dir);
+    return null;
+  }
+  writeTokens(dir, {
+    accessToken: refreshed.accessToken,
+    refreshToken: refreshed.refreshToken,
+    expiresAt: Date.now() + refreshed.expiresIn * 1e3,
+    clientId: stored.clientId
+  });
+  return refreshed.accessToken;
+}
+
+// src/refresh.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_fs11 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path6 = require("node:path");
+var LAUNCHER_RECORD_FILE = "launcher.json";
+var RECORD_TIMEOUT_MS = 1e4;
+function platformKey(platform, arch) {
+  if (platform === "win32") return arch === "x64" || arch === "arm64" ? `win-${arch}` : null;
+  return platform === "darwin" && arch === "arm64" ? "darwin-arm64" : null;
+}
+function verifierFor(target) {
+  return { product: target.product, host: target.host, loginKind: "github", publicKey: target.key, binName: target.bin };
+}
+async function fetchRecord(target, options) {
+  let json;
+  try {
+    const response = await (options.fetch ?? fetch)(
+      `${target.host.replace(/\/+$/u, "")}/release/launcher`,
+      { signal: AbortSignal.timeout(options.timeoutMs ?? RECORD_TIMEOUT_MS) }
+    );
+    if (!response.ok) return null;
+    json = await response.json();
+  } catch {
+    return null;
+  }
+  let record;
+  try {
+    record = parseManifest(json);
+  } catch {
+    return null;
+  }
+  if (!verifyManifest(record, record.signature, verifierFor(target))) return "bad-signature";
+  return { version: record.version, files: record.files };
+}
+async function readLauncherRecord(target, options = {}) {
+  const record = await fetchRecord(target, options);
+  return record === "bad-signature" ? null : record;
+}
+function compareVersions(a, b) {
+  const split = (v) => {
+    const [core, pre = ""] = v.split("-", 2);
+    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
+  };
+  const x = split(a);
+  const y = split(b);
+  for (let i = 0; i < 3; i++) if ((x.nums[i] ?? 0) !== (y.nums[i] ?? 0)) return (x.nums[i] ?? 0) > (y.nums[i] ?? 0) ? 1 : -1;
+  if (x.pre === y.pre) return 0;
+  if (!x.pre) return 1;
+  if (!y.pre) return -1;
+  return x.pre > y.pre ? 1 : -1;
+}
+function recordedPath(productDir) {
+  try {
+    const saved = JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path6.join)(productDir, LAUNCHER_RECORD_FILE), "utf8"));
+    return typeof saved.path === "string" && saved.path ? saved.path : null;
+  } catch {
+    return null;
+  }
+}
+function installedPath(target, productDir, platform) {
+  return platform === "win32" ? (0, import_node_path6.join)(productDir, "bin", `${target.bin}.exe`) : (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".local", "bin", target.bin);
+}
+function parseLauncherVersion(stdout, bin) {
+  const text = String(stdout).trim();
+  if (!text.startsWith(`${bin} `)) return null;
+  return text.match(/launcher (\d+\.\d+\.\d+[^\s)]*)/u)?.[1] ?? null;
+}
+function runVersion(path, bin) {
+  return new Promise((resolve3) => {
+    (0, import_node_child_process4.execFile)(path, ["--version"], { timeout: 3e4, windowsHide: true, encoding: "utf8" }, (error, stdout) => {
+      resolve3(error ? null : parseLauncherVersion(stdout, bin));
+    });
+  });
+}
+function removeStale(file) {
+  const prefix = `${(0, import_node_path6.basename)(file)}.old-`;
+  let names;
+  try {
+    names = (0, import_node_fs11.readdirSync)((0, import_node_path6.dirname)(file));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (!name.startsWith(prefix)) continue;
+    try {
+      (0, import_node_fs11.rmSync)((0, import_node_path6.join)((0, import_node_path6.dirname)(file), name), { force: true });
+    } catch {
+    }
+  }
+}
+async function refreshLauncher(target, options = {}) {
+  const started = Date.now();
+  const platform = options.platform ?? process.platform;
+  const key = platformKey(platform, options.arch ?? process.arch);
+  if (!key) return null;
+  const productDir = options.productDir ?? defaultProductDir(target.product);
+  const recorded = recordedPath(productDir);
+  const file = options.path ?? (recorded && (0, import_node_fs11.existsSync)(recorded) ? recorded : installedPath(target, productDir, platform));
+  if (!(0, import_node_fs11.existsSync)(file) || (0, import_node_fs11.lstatSync)(file).isSymbolicLink()) return null;
+  if (!options.dryRun) removeStale(file);
+  const from = await (options.readVersion ?? ((path) => runVersion(path, target.bin)))(file);
+  if (!from) return null;
+  const arm = (verdict, to, detail) => ({ surface: "launcher", from, to, verdict, detail, durationMs: Date.now() - started });
+  const record = await fetchRecord(target, options);
+  if (record === "bad-signature") return arm("fail", from, "The launcher record failed its signature check.");
+  const entry2 = record?.files.find((candidate) => candidate.path === key);
+  if (!record || !entry2) return arm("skip", from, "No launcher update is offered yet.");
+  if (compareVersions(record.version, from) <= 0) return arm("ok", from, "");
+  if (options.dryRun) return arm("ok", record.version, "");
+  let unlock;
+  const lockHeld = options.lockHeld ?? process.env.MM_OUTER_CONSOLE === "1";
+  if (!lockHeld) {
+    try {
+      unlock = lockInstallation(productDir);
+    } catch {
+      return arm("defer", from, "Another install is running; the launcher updates next time.");
+    }
+  }
+  const next = `${file}.new-${process.pid}`;
+  let moved;
+  try {
+    let bytes;
+    try {
+      const response = await (options.fetch ?? fetch)(
+        `${(target.dl ?? target.host).replace(/\/+$/u, "")}/dl/${target.product}/${key}`,
+        { signal: AbortSignal.timeout(3e5) }
+      );
+      if (!response.ok) return arm("defer", from, "The launcher download did not complete; it retries next time.");
+      bytes = await readDownload(response, void 0, entry2.size);
+    } catch {
+      return arm("defer", from, "The launcher download did not complete; it retries next time.");
+    }
+    if (!verifyFileBytes(entry2, bytes)) return arm("fail", from, "The downloaded launcher failed its checksum.");
+    try {
+      (0, import_node_fs11.writeFileSync)(next, bytes, { mode: 493 });
+      if (platform !== "win32") (0, import_node_fs11.chmodSync)(next, 493);
+      if (platform === "win32") {
+        moved = `${file}.old-${process.pid}-${Date.now()}`;
+        (0, import_node_fs11.renameSync)(file, moved);
+      }
+      (0, import_node_fs11.renameSync)(next, file);
+    } catch {
+      try {
+        if (moved && !(0, import_node_fs11.existsSync)(file)) (0, import_node_fs11.renameSync)(moved, file);
+      } catch {
+      }
+      (0, import_node_fs11.rmSync)(next, { force: true });
+      return arm("fail", from, "The launcher could not be replaced.");
+    }
+    return arm("ok", record.version, "");
+  } finally {
+    unlock?.();
+  }
+}
+
 // src/index.ts
-var LAUNCHER_VERSION = true ? "1.2.3" : readVersionFromPackage();
+var LAUNCHER_VERSION = true ? "1.2.5" : readVersionFromPackage();
 function defaultPrint(message) {
   process.stdout.write(`${message}
 `);
@@ -2403,41 +2452,6 @@ async function runFile(file, args, printErr) {
   }
   return code;
 }
-async function ensureFreshToken(config, dir, fetchImpl = fetch) {
-  const stored = readTokens(dir);
-  if (!stored) return null;
-  if (stored.expiresAt - Date.now() > 6e4) return stored.accessToken;
-  if (!stored.refreshToken) return null;
-  if (config.loginKind === "github") {
-    const refreshed2 = await refreshAccessToken(config, stored.refreshToken, fetchImpl);
-    if (!refreshed2) {
-      clearTokens(dir);
-      return null;
-    }
-    writeTokens(dir, {
-      accessToken: refreshed2.accessToken,
-      refreshToken: refreshed2.refreshToken ?? stored.refreshToken,
-      expiresAt: Date.now() + refreshed2.expiresIn * 1e3
-    });
-    return refreshed2.accessToken;
-  }
-  if (!stored.clientId) {
-    clearTokens(dir);
-    return null;
-  }
-  const refreshed = await refreshGoogleToken(config.host, stored.clientId, stored.refreshToken, fetchImpl);
-  if (!refreshed) {
-    clearTokens(dir);
-    return null;
-  }
-  writeTokens(dir, {
-    accessToken: refreshed.accessToken,
-    refreshToken: refreshed.refreshToken,
-    expiresAt: Date.now() + refreshed.expiresIn * 1e3,
-    clientId: stored.clientId
-  });
-  return refreshed.accessToken;
-}
 async function doLogin(config, dir, options, prompt, installer) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const open = options.open ?? openBrowser;
@@ -3086,7 +3100,6 @@ if (invokedAsMain) {
 0 && (module.exports = {
   LAUNCHER_VERSION,
   defaultRunEntry,
-  ensureFreshToken,
   formatMb,
   parseArgv,
   readPayloadEntry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/installer-launcher",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "Single-executable (SEA) launcher: sign-in, gated payload fetch, self-update. One copy ships per product.",
   "type": "module",
   "license": "UNLICENSED",