@driftengine/package 3.61.0

package/dist/runtime.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Whether the Electron runtime a desktop build packages is actually on this machine.
+ *
+ * **Because the package being installed proves nothing about the runtime, and `build` could not
+ * tell the difference.** `installedElectronVersion()` in `build.ts` resolves
+ * `electron/package.json` and reads its `version`. That file is in the npm tarball. The binary is
+ * not: a postinstall downloads it into `node_modules/electron/dist` and writes `path.txt` beside
+ * it. So a version always resolves, a build always proceeds, and electron-builder fails several
+ * steps later with a sentence about packaging rather than about a missing runtime.
+ *
+ * **Measured in this repository on 2026-08-29**, npm 10.9.8, Node 22.23.2:
+ * `installedElectronVersion()` answered `43.4.1` while `dist` did not exist — with
+ * `npm config get ignore-scripts` answering `false`. So this is not only npm refusing to run
+ * scripts, which is the case a consumer hit and reported: it is the plainer fact that a postinstall
+ * which downloads something can fail to finish, for a proxy, a slow link, a sandbox or a CI image,
+ * and nothing downstream is told.
+ *
+ * **Both files, not just the directory.** `path.txt` is what Electron's own resolution reads, and a
+ * download interrupted after creating `dist` would otherwise read as present.
+ */
+export declare function electronRuntimeState(packageDir: string): 'present' | 'missing';
+/**
+ * Fetch the Electron runtime if it is not here, before a build spends its minutes.
+ *
+ * **It runs the installer instead of telling somebody to.** The first version of this refusal, in a
+ * consumer's own wrapper, printed the command and stopped; they watched a person read it and re-run
+ * the script unchanged, three times, and changed it to do the thing. A check that knows the remedy,
+ * and whose remedy has no alternatives, should apply it.
+ *
+ * `install.js` is `__dirname`-based, so the working directory does not matter, and it returns
+ * immediately when the binary is already there — so this costs nothing on every run after the
+ * first. It is the same script npm would have run.
+ *
+ * **What would make it wrong** is a consumer who deliberately packages against a runtime they
+ * supply themselves, which nothing here supports today and which would want a flag rather than a
+ * removal.
+ */
+export declare function ensureElectronRuntime(): Promise<void>;

package/dist/runtime.js

@@ -0,0 +1,80 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+/**
+ * Whether the Electron runtime a desktop build packages is actually on this machine.
+ *
+ * **Because the package being installed proves nothing about the runtime, and `build` could not
+ * tell the difference.** `installedElectronVersion()` in `build.ts` resolves
+ * `electron/package.json` and reads its `version`. That file is in the npm tarball. The binary is
+ * not: a postinstall downloads it into `node_modules/electron/dist` and writes `path.txt` beside
+ * it. So a version always resolves, a build always proceeds, and electron-builder fails several
+ * steps later with a sentence about packaging rather than about a missing runtime.
+ *
+ * **Measured in this repository on 2026-08-29**, npm 10.9.8, Node 22.23.2:
+ * `installedElectronVersion()` answered `43.4.1` while `dist` did not exist — with
+ * `npm config get ignore-scripts` answering `false`. So this is not only npm refusing to run
+ * scripts, which is the case a consumer hit and reported: it is the plainer fact that a postinstall
+ * which downloads something can fail to finish, for a proxy, a slow link, a sandbox or a CI image,
+ * and nothing downstream is told.
+ *
+ * **Both files, not just the directory.** `path.txt` is what Electron's own resolution reads, and a
+ * download interrupted after creating `dist` would otherwise read as present.
+ */
+export function electronRuntimeState(packageDir) {
+    const hasDist = existsSync(join(packageDir, 'dist'));
+    const hasPath = existsSync(join(packageDir, 'path.txt'));
+    return hasDist && hasPath ? 'present' : 'missing';
+}
+/**
+ * Fetch the Electron runtime if it is not here, before a build spends its minutes.
+ *
+ * **It runs the installer instead of telling somebody to.** The first version of this refusal, in a
+ * consumer's own wrapper, printed the command and stopped; they watched a person read it and re-run
+ * the script unchanged, three times, and changed it to do the thing. A check that knows the remedy,
+ * and whose remedy has no alternatives, should apply it.
+ *
+ * `install.js` is `__dirname`-based, so the working directory does not matter, and it returns
+ * immediately when the binary is already there — so this costs nothing on every run after the
+ * first. It is the same script npm would have run.
+ *
+ * **What would make it wrong** is a consumer who deliberately packages against a runtime they
+ * supply themselves, which nothing here supports today and which would want a flag rather than a
+ * removal.
+ */
+export async function ensureElectronRuntime() {
+    const require = createRequire(import.meta.url);
+    let installer;
+    try {
+        installer = require.resolve('electron/install.js');
+    }
+    catch {
+        throw new Error('electron is not installed, so there is no runtime to package a desktop build against. ' +
+            'Run `npm install` in the project being packaged.');
+    }
+    const packageDir = dirname(installer);
+    if (electronRuntimeState(packageDir) === 'present')
+        return;
+    console.log('[drift-package] the Electron package is here and its runtime is not, which is what a ' +
+        'postinstall that did not finish leaves behind. Fetching it.');
+    await new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [installer], { stdio: 'inherit' });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`electron's installer exited ${String(code)}`));
+        });
+    });
+    if (electronRuntimeState(packageDir) === 'missing') {
+        throw new Error(`The Electron installer ran and ${join(packageDir, 'path.txt')} is still missing, so there ` +
+            'is no runtime to package and no point going on.\n\n' +
+            'If it printed a download error, it is the network: a proxy, or the ELECTRON_MIRROR and ' +
+            'ELECTRON_CUSTOM_DIR variables if this machine needs them.\n' +
+            'If npm is blocking install scripts, let it run this one: ' +
+            '`npm install-scripts approve electron`.');
+    }
+    console.log('[drift-package] ok: the Electron runtime is present');
+}

package/dist/runtimeVersion.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The major version of an Electron, from whatever the runtime or the installed package says it is.
+ *
+ * **A tiny module of its own because both callers need the same answer and neither can be trusted
+ * to parse it in passing.** The build reads a version out of `electron/package.json`, which may
+ * carry a prerelease suffix; the main process reads `process.versions.electron`, which is a plain
+ * triple. `null` for anything that is not a version at all, because a plan that guesses a major it
+ * could not read is worse than one that says it does not know.
+ */
+export declare function electronMajor(version: string | undefined | null): number | null;

package/dist/runtimeVersion.js

@@ -0,0 +1,18 @@
+/**
+ * The major version of an Electron, from whatever the runtime or the installed package says it is.
+ *
+ * **A tiny module of its own because both callers need the same answer and neither can be trusted
+ * to parse it in passing.** The build reads a version out of `electron/package.json`, which may
+ * carry a prerelease suffix; the main process reads `process.versions.electron`, which is a plain
+ * triple. `null` for anything that is not a version at all, because a plan that guesses a major it
+ * could not read is worse than one that says it does not know.
+ */
+export function electronMajor(version) {
+    if (typeof version !== 'string')
+        return null;
+    const match = /^(\d+)\./.exec(version.trim());
+    if (match === null)
+        return null;
+    const major = Number(match[1]);
+    return Number.isSafeInteger(major) && major > 0 ? major : null;
+}

package/dist/signing.d.ts

@@ -0,0 +1,49 @@
+import type { Target } from './manifest.ts';
+/**
+ * Whether this build is signed, ad-hoc signed, or not signed at all — and why.
+ *
+ * **Three modes rather than a boolean**, because the middle one is load-bearing: Apple Silicon's
+ * loader refuses to execute an unsigned binary outright, which is not Gatekeeper and which no user
+ * gesture works around. A macOS build with no certificate must therefore carry *a* signature, and
+ * `codesign --sign -` is the one available for free. It is not a substitute for a Developer ID: a
+ * downloaded `.dmg` carries `com.apple.quarantine`, an ad-hoc signature does not satisfy
+ * Gatekeeper, and the first launch is refused until the flag is cleared.
+ *
+ * **Everything is read from the environment and nothing from `drift.package.json`.** The manifest
+ * is committed; a certificate and its password are not, and a packager that read them from a
+ * committed file would be teaching people to commit them. The variable names are
+ * `electron-builder`'s own, so there is no translation layer to maintain.
+ *
+ * **`reason` is printed on every build.** An artifact whose signature status was not stated is the
+ * failure this module exists to prevent: the person who built it finds out from a player.
+ */
+export type SigningMode = 'none' | 'adhoc' | 'real';
+export interface SigningPlan {
+    readonly mode: SigningMode;
+    /** Notarisation is a separate credential from signing, and needs a paid Developer ID. */
+    readonly notarise: boolean;
+    /** What was decided and what it costs, in words a build log should carry. */
+    readonly reason: string;
+    /**
+     * Whether this build applies the macOS signature itself, because electron-builder will not.
+     *
+     * True exactly when a Mac target is built somewhere that is not a Mac. `isSignAllowed()` returns
+     * false off darwin, and electron-builder then packs on regardless: it logs one warning and
+     * produces an unsigned `.app`, which is the artifact Apple Silicon's loader refuses. `rcodesign`
+     * puts the signature on afterwards, and this is the flag that says somebody still has to.
+     */
+    readonly crossSign: boolean;
+    /** Non-null means refuse to build, and this is what to print. */
+    readonly refusal: string | null;
+}
+/**
+ * The machine a build is running on, spelled the way `process.platform` spells it.
+ *
+ * **Passed in rather than read**, and that is this half of the package's rule rather than a
+ * preference: `signing.ts` is typechecked with no ambient Node types — see the `exclude` list in
+ * `tsconfig.json` — because a consumer bundles this source for a browser, and a `process` reaching
+ * one of their bundles is the failure that config exists to prevent. Taking it as an argument also
+ * makes every test name the host it means instead of inheriting whichever machine ran it.
+ */
+export type BuildHost = string;
+export declare function planSigning(target: Target, env: Readonly<Record<string, string | undefined>>, platform: BuildHost): SigningPlan;

package/dist/signing.js

@@ -0,0 +1,135 @@
+/** The ordinary case: the host signs for itself, with its own signer, and nothing is refused. */
+const HOST_SIGNED = { crossSign: false, refusal: null };
+function has(env, name) {
+    const value = env[name];
+    return typeof value === 'string' && value.length > 0;
+}
+export function planSigning(target, env, platform) {
+    if (target === 'linux-x64') {
+        return {
+            ...HOST_SIGNED,
+            mode: 'none',
+            notarise: false,
+            /* No signature is expected of a Linux artifact by anything that runs one. An AppImage can
+               carry a detached GPG signature and nothing checks it by default, so producing one would be
+               ceremony rather than protection. */
+            reason: 'Linux artifacts are not signed; nothing on the platform checks one',
+        };
+    }
+    if (target === 'android') {
+        /*
+         * **Android is the one platform with no unsigned option to offer**: it refuses to install an
+         * unsigned APK outright, so a build always signs and the only question is with whose key.
+         */
+        if (has(env, 'DRIFT_ANDROID_KEYSTORE')) {
+            return {
+                ...HOST_SIGNED,
+                mode: 'real',
+                notarise: false,
+                reason: 'signed with the keystore in DRIFT_ANDROID_KEYSTORE',
+            };
+        }
+        return {
+            ...HOST_SIGNED,
+            mode: 'adhoc',
+            notarise: false,
+            reason: 'a generated throwaway key: installs on a device with developer mode on, cannot be ' +
+                'published to the Play Store, and an upgrade signed with a different generated key is ' +
+                'refused by the device as an impostor — which is why the generated one is kept',
+        };
+    }
+    if (target === 'ios') {
+        if (has(env, 'APPLE_TEAM_ID')) {
+            return {
+                ...HOST_SIGNED,
+                mode: 'real',
+                notarise: false,
+                reason: 'signed with the Apple team in APPLE_TEAM_ID',
+            };
+        }
+        return {
+            ...HOST_SIGNED,
+            mode: 'adhoc',
+            notarise: false,
+            reason: 'free provisioning: a build installs to your own device and stops running after seven ' +
+                'days, which is the Apple ID path rather than the paid Developer Program',
+        };
+    }
+    if (target === 'win-x64') {
+        if (has(env, 'WIN_CSC_LINK') || has(env, 'CSC_LINK')) {
+            return {
+                ...HOST_SIGNED,
+                mode: 'real',
+                notarise: false,
+                reason: 'Authenticode signing from the certificate in the environment',
+            };
+        }
+        return {
+            ...HOST_SIGNED,
+            mode: 'none',
+            notarise: false,
+            reason: 'unsigned: Windows will run it and SmartScreen will warn on first launch. A Steam depot ' +
+                'raises no warning, because the client delivering it is signed',
+        };
+    }
+    const real = has(env, 'CSC_LINK') || has(env, 'CSC_NAME');
+    /*
+     * **macOS from somewhere that is not macOS.** electron-builder's own refusal fires on Windows
+     * alone, so a Mac target packs here and comes out unsigned unless this build signs it — see
+     * `crossSign` above for why that is fatal rather than cosmetic.
+     */
+    if (platform !== 'darwin') {
+        /*
+         * **A certificate in the environment is refused rather than ignored.** `CSC_NAME` names an
+         * identity in a keychain and there is no keychain here; `CSC_LINK` is a `.p12`, which
+         * rcodesign can use in principle and this build does not wire. Either way the artifact would
+         * come out ad-hoc — and an ad-hoc build whose author believes it carries a Developer ID is
+         * worse than no build, because that is the one they ship to strangers.
+         */
+        if (real) {
+            return {
+                mode: 'adhoc',
+                notarise: false,
+                crossSign: true,
+                reason: 'refused before signing; see the refusal',
+                refusal: `a Developer ID certificate is in the environment and this is ${platform}, which ` +
+                    'cannot use one: CSC_NAME is a keychain identity and there is no keychain here, and ' +
+                    'the .p12 route is not wired. The build would be ad-hoc while reporting a certificate. ' +
+                    'Build it on a Mac, or unset CSC_LINK and CSC_NAME to get an ad-hoc build on purpose',
+            };
+        }
+        return {
+            mode: 'adhoc',
+            notarise: false,
+            crossSign: true,
+            refusal: null,
+            reason: 'ad-hoc signed by rcodesign, because electron-builder skips signing off a Mac and an ' +
+                'unsigned binary is refused by the loader on Apple Silicon. The artifact is a .zip: a ' +
+                '.dmg is built by hdiutil, which exists only on macOS. A downloaded copy is still ' +
+                'refused by Gatekeeper until `xattr -dr com.apple.quarantine` clears the flag, and ' +
+                'nothing on this host can prove the result launches — open it on a Mac before it ships',
+        };
+    }
+    const notarise = real &&
+        has(env, 'APPLE_ID') &&
+        has(env, 'APPLE_APP_SPECIFIC_PASSWORD') &&
+        has(env, 'APPLE_TEAM_ID');
+    if (real) {
+        return {
+            ...HOST_SIGNED,
+            mode: 'real',
+            notarise,
+            reason: notarise
+                ? 'Developer ID signing and notarisation from the environment'
+                : 'Developer ID signing; not notarised, so a download is still refused until it is',
+        };
+    }
+    return {
+        ...HOST_SIGNED,
+        mode: 'adhoc',
+        notarise: false,
+        reason: 'ad-hoc signed: an unsigned binary is refused by the loader on Apple Silicon, so this is ' +
+            'the minimum that runs. A downloaded copy is still refused by Gatekeeper until ' +
+            '`xattr -dr com.apple.quarantine` clears the flag',
+    };
+}

package/dist/stage.d.ts

@@ -0,0 +1,22 @@
+import type { Identity } from './identity.ts';
+import type { PackageManifest } from './manifest.ts';
+import type { ResourceOptions } from './resources.ts';
+export declare function stageApp(manifest: PackageManifest, projectDir: string, stageDir: string, options?: {
+    readonly development: boolean;
+    /**
+     * How a path's filesystem identity is read, for the refusal below.
+     *
+     * The same seam `refuseLyingFilesystem` carries and for the same reason: the condition cannot be
+     * reproduced on any filesystem this suite can create, so without it the refusal would ship
+     * having never been seen to fire. The default is `statSync` and no caller passes anything else.
+     */
+    readonly look?: (path: string) => Identity;
+} & ResourceOptions): Promise<void>;
+/**
+ * The version the artifact carries, taken from the consumer's own manifest.
+ *
+ * A packaged application needs one — installers key upgrades on it — and inventing one here would
+ * put a number on a release that matches nothing. Absent, it is `0.0.0`, which is visibly not a
+ * release rather than plausibly one.
+ */
+export declare function consumerVersion(projectDir: string): Promise<string>;

package/dist/stage.js

@@ -0,0 +1,138 @@
+import { build as esbuild } from 'esbuild';
+import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { refuseLyingFilesystem } from './identity.js';
+import { resourceDir } from './resources.js';
+/**
+ * Everything the shell needs, laid out the way `main/entry.ts` expects to find it.
+ *
+ * **This exists because the workspace ships TypeScript and Electron runs JavaScript.** There is no
+ * build step anywhere else here — a consumer bundles `src/index.ts` themselves — but a main
+ * process is not bundled by anybody downstream, so the packager bundles its own two entry points
+ * and nothing else. esbuild rather than tsc: it is already a dependency of this repository, it
+ * emits CommonJS in one call, and a preload script has to be CommonJS whatever its source is.
+ *
+ * The layout is the contract between this file, `main/entry.ts` and `main/window.ts`:
+ *
+ *     main.cjs               the main process
+ *     preload.cjs            the bridge, loaded before the game
+ *     drift.package.json     the manifest, read at startup
+ *     build.json             whether this is a development run or a shipped artifact
+ *     shell/                 the packager's own assets, served as drift://shell/
+ *     app/                   the game, served as drift://app/
+ *
+ * **Electron is external to both bundles.** It is resolved from the application's `node_modules`
+ * at run time by the runtime itself; bundling it would be bundling a native module.
+ */
+const HERE = dirname(fileURLToPath(import.meta.url));
+export async function stageApp(manifest, projectDir, stageDir, options = { development: false }) {
+    /*
+     * **Before the first copy, and before anything is deleted, because this is where the copy is.**
+     *
+     * `doctor` refuses this too and does it earlier, which is the right place for a person's time: a
+     * build that cannot succeed should stop before it downloads a runtime. But that is a guarantee
+     * about the order of two calls, and this package's `exports` map is `"./*": "./*"` — so
+     * `stageApp` is importable directly, and a route that never passes through `doctor` is a route
+     * where a `cp` explains itself in terms of subdirectories of itself. The check is two `stat`s.
+     * It belongs to the copy rather than to the command that usually precedes it.
+     */
+    refuseLyingFilesystem(projectDir, stageDir, options.look);
+    await rm(stageDir, { recursive: true, force: true });
+    await mkdir(stageDir, { recursive: true });
+    /* Two calls with explicit outfiles rather than one with two entry points: both entries are
+       named `entry.ts`, so a shared `entryNames` would have them collide on the way out — and the
+       two names are a contract `main/entry.ts` and `window.ts` both read. */
+    for (const [from, to] of [
+        [join(HERE, 'main', 'entry.ts'), join(stageDir, 'main.cjs')],
+        [join(HERE, 'preload', 'entry.ts'), join(stageDir, 'preload.cjs')],
+    ]) {
+        await esbuild({
+            entryPoints: [from],
+            outfile: to,
+            bundle: true,
+            platform: 'node',
+            format: 'cjs',
+            target: 'node22',
+            external: ['electron'],
+            logLevel: 'warning',
+        });
+    }
+    const version = await consumerVersion(projectDir);
+    await writeFile(join(stageDir, 'package.json'), `${JSON.stringify({
+        name: manifest.id.split('.').pop() ?? 'app',
+        productName: manifest.name,
+        version,
+        main: 'main.cjs',
+        /* Both are read by installers rather than by code: electron-builder warns without them,
+           and a Windows installer with no publisher is the one a person is asked to trust. */
+        description: manifest.name,
+        author: manifest.publisher,
+        /* No dependencies: both entry points are bundled, and Electron is supplied by the
+           runtime that is executing them. */
+    }, null, 2)}\n`);
+    await cp(join(projectDir, 'drift.package.json'), join(stageDir, 'drift.package.json'));
+    /*
+     * **Which kind of build this is, written into the artifact rather than read from an
+     * environment variable.** A player's machine has whatever variables it has, and a game that
+     * decided whether to expose developer tools from one of them would be a game somebody could
+     * turn inside out by exporting a name. The file is written by the packager and is absent from
+     * nothing: `entry.ts` treats a missing one as production, which is the safe direction.
+     */
+    await writeFile(join(stageDir, 'build.json'), `${JSON.stringify({ development: options.development }, null, 2)}\n`);
+    if (manifest.steam.appId !== null) {
+        /*
+         * **The store SDK is copied in, or the build says it is not there.**
+         *
+         * The staged application has no `node_modules` — both entry points are bundled — and
+         * `steamworks.js` is a native module that cannot be bundled at all. So it is copied from the
+         * consumer's own tree, which is also what makes it opt-in: a game that never installs it never
+         * ships one, and this says so rather than producing a build whose achievements silently do
+         * nothing.
+         */
+        const sdk = join(projectDir, 'node_modules', 'steamworks.js');
+        try {
+            await cp(sdk, join(stageDir, 'node_modules', 'steamworks.js'), { recursive: true });
+            await writeFile(join(stageDir, 'node_modules', '.keep'), 'the store SDK lives here; nothing else does\n', 'utf8');
+        }
+        catch {
+            console.warn(`[drift-package] steam.appId is ${manifest.steam.appId} and steamworks.js is not ` +
+                `installed in ${projectDir}. The build will run with no store: achievements, presence ` +
+                'and cloud saves are absent. `npm install steamworks.js` in the game to change that.');
+        }
+    }
+    if (manifest.steam.appId !== null) {
+        /*
+         * **Steam looks for this file beside the executable** when a build is run outside its client,
+         * which is every run during development. Without it `SteamAPI_Init` fails and a game that
+         * degrades correctly reports no achievements — so the integration looks broken exactly while
+         * somebody is building it, and works only after upload.
+         */
+        await writeFile(join(stageDir, 'steam_appid.txt'), `${manifest.steam.appId}\n`, 'utf8');
+    }
+    /* Through `resourceDir`, which is the one place that knows where this package's own three
+       directories are and the only place a caller can move them. See `resources.ts`. */
+    await cp(await resourceDir('assets', options.resourceRoot), join(stageDir, 'shell'), {
+        recursive: true,
+    });
+    await cp(resolve(projectDir, dirname(manifest.entry)), join(stageDir, 'app'), {
+        recursive: true,
+    });
+}
+/**
+ * The version the artifact carries, taken from the consumer's own manifest.
+ *
+ * A packaged application needs one — installers key upgrades on it — and inventing one here would
+ * put a number on a release that matches nothing. Absent, it is `0.0.0`, which is visibly not a
+ * release rather than plausibly one.
+ */
+export async function consumerVersion(projectDir) {
+    try {
+        const raw = JSON.parse(await readFile(join(projectDir, 'package.json'), 'utf8'));
+        const version = raw.version;
+        return typeof version === 'string' && version.length > 0 ? version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}

package/dist/steam/cloudStore.d.ts

@@ -0,0 +1,30 @@
+import type { KeyValueStore } from '@driftengine/core';
+/**
+ * Steam Cloud, behind the persistence seam the engine already had.
+ *
+ * **`KeyValueStore` needed no widening for this**, which is the point of the seam: the engine
+ * reads preferences synchronously during boot, Steam's cloud API is synchronous, and the two fit
+ * without an adapter. A game that keeps its saves here gets them on the player's other machine for
+ * free, and nothing in the engine knows Steam exists.
+ *
+ * **Every call degrades rather than throws.** Cloud storage can be turned off per title or per
+ * account, and the failure that produces is a game that will not start — on the first preference
+ * read, before anything is on screen. So a throw falls back to memory, which is exactly what
+ * `BrowserStore` does when `localStorage` is blocked: the settings last the session instead of
+ * resetting between screens.
+ */
+export interface SteamCloud {
+    readFile(name: string): string;
+    writeFile(name: string, data: string): boolean;
+    deleteFile(name: string): boolean;
+    fileExists(name: string): boolean;
+}
+export declare class SteamCloudStore implements KeyValueStore {
+    private readonly cloud;
+    /** What was read or written this session, so a blocked cloud still behaves like a store. */
+    private readonly local;
+    constructor(cloud: SteamCloud);
+    read(key: string): string | null;
+    write(key: string, value: string): void;
+    remove(key: string): void;
+}

package/dist/steam/cloudStore.js

@@ -0,0 +1,54 @@
+/**
+ * A key is a file name on somebody's disk.
+ *
+ * Slashes, backslashes and dots would make one key reach another game's file, or none at all.
+ * Replaced rather than rejected, because a game that has been writing `world.day.23` for a year
+ * must not start losing saves the day this lands.
+ */
+function fileNameFor(key) {
+    return `${key.replace(/[^A-Za-z0-9._-]/g, '_').replace(/\.\.+/g, '.')}.txt`;
+}
+export class SteamCloudStore {
+    cloud;
+    /** What was read or written this session, so a blocked cloud still behaves like a store. */
+    local = new Map();
+    constructor(cloud) {
+        this.cloud = cloud;
+    }
+    read(key) {
+        const cached = this.local.get(key);
+        if (cached !== undefined)
+            return cached;
+        try {
+            const name = fileNameFor(key);
+            if (!this.cloud.fileExists(name))
+                return null;
+            const value = this.cloud.readFile(name);
+            if (typeof value !== 'string' || value.length === 0)
+                return null;
+            this.local.set(key, value);
+            return value;
+        }
+        catch {
+            return null;
+        }
+    }
+    write(key, value) {
+        this.local.set(key, value);
+        try {
+            this.cloud.writeFile(fileNameFor(key), value);
+        }
+        catch {
+            /* Off for this account or this title. The value is in memory and the game carries on. */
+        }
+    }
+    remove(key) {
+        this.local.delete(key);
+        try {
+            this.cloud.deleteFile(fileNameFor(key));
+        }
+        catch {
+            /* As above. */
+        }
+    }
+}

package/dist/steam/depot.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The two files `steamcmd` needs to upload a build, generated from the manifest.
+ *
+ * **Written rather than copied**, because the alternative is a template with somebody else's app
+ * id in it. A wrong app id uploads a game into another game's depot, or fails after the whole
+ * payload has crossed the network; a wrong depot id ships a build nobody can install.
+ *
+ * **Nothing is set live.** `setlive` is empty unless a branch is named, so an upload is a build
+ * sitting in Steam's admin waiting for a person, not a release. Valve's own template does the same
+ * and it is the line people delete by accident.
+ *
+ * Pure: the strings are the whole of it, and every rule above is a test.
+ */
+export interface DepotOptions {
+    readonly appId: number;
+    readonly depotId: number;
+    readonly description: string;
+    /** Relative to where the scripts are written. */
+    readonly contentRoot: string;
+    /** A branch to publish to, or null to upload and stop. */
+    readonly branch: string | null;
+}
+export interface DepotScripts {
+    readonly appFileName: string;
+    readonly app: string;
+    readonly depotFileName: string;
+    readonly depot: string;
+}
+export declare function depotScripts(options: DepotOptions): DepotScripts;

package/dist/steam/depot.js

@@ -0,0 +1,39 @@
+export function depotScripts(options) {
+    const depotFileName = `depot_build_${options.depotId}.vdf`;
+    return {
+        appFileName: `app_build_${options.appId}.vdf`,
+        app: `"appbuild"
+{
+\t"appid"\t"${options.appId}"
+\t"desc"\t"${options.description}"
+\t"buildoutput"\t"./steam-build-output"
+\t"contentroot"\t"./${options.contentRoot}"
+\t"setlive"\t"${options.branch ?? ''}"
+\t"preview"\t"0"
+\t"local"\t""
+
+\t"depots"
+\t{
+\t\t"${options.depotId}"\t"${depotFileName}"
+\t}
+}
+`,
+        depotFileName,
+        depot: `"DepotBuildConfig"
+{
+\t"DepotID"\t"${options.depotId}"
+\t"contentroot"\t"./${options.contentRoot}"
+
+\t"FileMapping"
+\t{
+\t\t"LocalPath"\t"*"
+\t\t"DepotPath"\t"."
+\t\t"recursive"\t"1"
+\t}
+
+\t"FileExclusion"\t"*.pdb"
+\t"FileExclusion"\t"*.log"
+}
+`,
+    };
+}