windows-development-sandbox 1.17.0 → 1.18.0

package/dist/guest/toolchains/steam/commands.js

@@ -0,0 +1,155 @@
+// Where Steam things live in the sandbox and the SteamCMD command lines sbx-steam runs. Every value that goes on a
+// SteamCMD command line is checked first (an app or item ID is digits, a branch or account name a plain word, a
+// script a full path to an existing file): `+` starts a new SteamCMD command, so nothing else may reach it. No runtime
+// imports: the self-test loads this file.
+import fs from 'node:fs';
+import path from 'node:path';
+import { STEAM_ACCOUNT } from '../../../shared/accounts/kinds/steam.js';
+import { parseVdf } from '../../../shared/vdf.js';
+import { dataDir, toolsDir } from '../../runtime/paths.js';
+/** Where SteamCMD runs from in the sandbox (its own disk: its config\ holds the login). */
+export const STEAMCMD_DIR = 'C:\\SteamCMD';
+/** Valve publishes no checksum for it: steamcmd.exe inside must be Valve-signed. */
+export const STEAMCMD_URL = 'https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip';
+export const STEAM_CLIENT_URL = 'https://steamcdn-a.akamaihd.net/client/installer/SteamSetup.exe';
+/** SteamCMD's binaries, kept between sandboxes (never its config\ or sentry files). */
+export function steamCmdStore(tools = toolsDir) {
+    return path.join(tools, 'steamcmd');
+}
+/** Games and dedicated servers that sbx-steam app downloads: tools\steam-apps\<appid>. */
+export function steamAppsRoot(tools = toolsDir) {
+    return path.join(tools, 'steam-apps');
+}
+export function steamAppDir(appId, tools = toolsDir) {
+    return path.join(steamAppsRoot(tools), checkAppId(appId));
+}
+/** Workshop items that sbx-steam workshop get downloads (a cache on the data disk). */
+export function workshopCache(data = dataDir) {
+    return path.join(data, 'cache', 'steam-workshop');
+}
+/** Where a downloaded workshop item is. */
+export function workshopItemDir(cache, appId, item) {
+    return path.join(cache, 'steamapps', 'workshop', 'content', checkAppId(appId), checkItemId(item));
+}
+/** The Steam client (toolchains.steam.client), which updates itself in place. */
+export function steamClientDir(tools = toolsDir) {
+    return path.join(tools, 'steam');
+}
+function checked(value, pattern, what) {
+    if (!pattern.test(value))
+        throw new Error('not a ' + what + ': ' + JSON.stringify(value.slice(0, 80)));
+    return value;
+}
+export const checkAppId = (v) => checked(v, /^[1-9]\d{0,9}$/, 'Steam app ID');
+export const checkItemId = (v) => checked(v, /^[1-9]\d{0,19}$/, 'workshop item ID');
+export const checkBranch = (v) => checked(v, /^[A-Za-z0-9._-]{1,64}$/, 'branch name');
+/** A Steam account name, or "anonymous" (dedicated servers and free tools). */
+export const checkLogin = (v) => checked(v, STEAM_ACCOUNT, 'Steam account name');
+/** A full path SteamCMD can take as one value: no quotes, no `+` at the start of a part, no line breaks. */
+export function checkPathValue(p, what) {
+    if (!path.isAbsolute(p) || /["\r\n\0]/.test(p) || /(^|[\\/ ])\+/.test(p))
+        throw new Error(what + ' cannot be given to SteamCMD: ' + JSON.stringify(p.slice(0, 200)));
+    return p;
+}
+/** Downloads or updates an app (a game, a dedicated server) into a folder. force_install_dir comes before login. */
+export function appUpdateArgs(o) {
+    return [
+        '+force_install_dir',
+        checkPathValue(o.dir, 'The folder'),
+        '+login',
+        checkLogin(o.login),
+        '+app_update',
+        checkAppId(o.appId),
+        ...(o.beta ? ['-beta', checkBranch(o.beta)] : []),
+        ...(o.validate ? ['validate'] : []),
+        '+quit',
+    ];
+}
+/** Downloads workshop items of an app into <dir>\steamapps\workshop\content\<app>\<item>. */
+export function workshopGetArgs(o) {
+    if (!o.items.length)
+        throw new Error('no workshop item given');
+    if (o.items.length > 100)
+        throw new Error('at most 100 workshop items at once');
+    const app = checkAppId(o.appId);
+    return [
+        '+force_install_dir',
+        checkPathValue(o.dir, 'The folder'),
+        '+login',
+        checkLogin(o.login),
+        ...o.items.flatMap((item) => [
+            '+workshop_download_item',
+            app,
+            checkItemId(item),
+            ...(o.validate ? ['validate'] : []),
+        ]),
+        '+quit',
+    ];
+}
+/** Uploads a workshop item described by a workshop_item .vdf (a real account: not anonymous). */
+export function workshopPushArgs(login, script) {
+    if (login === 'anonymous')
+        throw new Error('uploading needs your Steam account, not anonymous');
+    return ['+login', checkLogin(login), '+workshop_build_item', checkPathValue(script, 'The script'), '+quit'];
+}
+/** Uploads a build described by an app_build .vdf (ContentBuilder). */
+export function appBuildArgs(login, script) {
+    if (login === 'anonymous')
+        throw new Error('uploading needs your Steam account, not anonymous');
+    return ['+login', checkLogin(login), '+run_app_build', checkPathValue(script, 'The script'), '+quit'];
+}
+/** Signs in (SteamCMD asks for the password and the Steam Guard code itself) and keeps the login. */
+export function loginArgs(login) {
+    if (login === 'anonymous')
+        throw new Error('anonymous needs no sign-in');
+    return ['+login', checkLogin(login), '+quit'];
+}
+/** At most this much of a build or workshop script is read. */
+export const MAX_SCRIPT_BYTES = 256 * 1024;
+/** What a SteamCMD script is: its root block ("AppBuild" or "workshopitem"), or null. */
+export function scriptKind(text) {
+    const root = parseVdf(text, { maxBytes: MAX_SCRIPT_BYTES, escapes: false });
+    const first = root ? Object.keys(root)[0]?.toLowerCase() : undefined;
+    return first === 'appbuild' || first === 'workshopitem' ? first : null;
+}
+/** An app_build script's text with Preview on and/or a description (null when it is not an app_build script). */
+export function withBuildSettings(text, o) {
+    if (scriptKind(text) !== 'appbuild')
+        return null;
+    if (o.desc !== undefined && !/^[^"\r\n\\]{1,200}$/.test(o.desc))
+        throw new Error('a build description is one line of at most 200 characters, without quotes or backslashes');
+    let out = text;
+    const set = (key, value) => {
+        const existing = new RegExp('"' + key + '"[ \\t]+"[^"\\r\\n]*"', 'i');
+        if (existing.test(out)) {
+            out = out.replace(existing, '"' + key + '" "' + value + '"');
+            return;
+        }
+        const at = out.toLowerCase().indexOf('"appbuild"');
+        const brace = at < 0 ? -1 : out.indexOf('{', at);
+        if (brace < 0)
+            throw new Error('the app_build script has no AppBuild block');
+        out = out.slice(0, brace + 1) + '\n\t"' + key + '" "' + value + '"' + out.slice(brace + 1);
+    };
+    if (o.preview)
+        set('Preview', '1');
+    if (o.desc !== undefined)
+        set('Desc', o.desc);
+    return out;
+}
+/** The script's text (bounded), or an error a person can act on. */
+export function readScript(file) {
+    let size;
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile())
+            throw new Error('not a file');
+        size = stat.size;
+    }
+    catch {
+        throw new Error('cannot read ' + file + ' (missing, a link, or not a file)');
+    }
+    if (size > MAX_SCRIPT_BYTES)
+        throw new Error(file + ' is bigger than ' + MAX_SCRIPT_BYTES / 1024 + ' KB');
+    return fs.readFileSync(file, 'utf8');
+}

package/dist/guest/toolchains/steam/steam.d.ts

@@ -0,0 +1,4 @@
+import type { Toolchains } from '../../../core/types.js';
+import type { ToolCtx } from '../step.js';
+import type { ToolEnv } from '../tool-env.js';
+export declare function setupSteam(env: ToolEnv, config: Toolchains['steam'], ctx: ToolCtx): Promise<void>;

package/dist/guest/toolchains/steam/steam.js

@@ -0,0 +1,61 @@
+// Steam (toolchains.steam): SteamCMD in C:\SteamCMD each boot (binaries kept in tools\steamcmd), steamcmd on PATH,
+// the Steam client when asked, STEAMWORKS_SDK from sdkFolder, and a word on the PC's Steam libraries mapped read-only.
+import fs from 'node:fs';
+import path from 'node:path';
+import { hasCachedLogin, readSteamAccountFile, steamConfigFile } from '../../../shared/accounts/kinds/steam.js';
+import { readBoundedFile } from '../../../shared/io/bounded.js';
+import { log } from '../../runtime/log.js';
+import { dryRun } from '../../runtime/paths.js';
+import { projectWorkspace } from '../../runtime/project-context.js';
+import { ensureSteamClient, installedSteamClient } from './client.js';
+import { STEAMCMD_DIR } from './commands.js';
+import { installSteamCmd } from './steamcmd.js';
+function signedInAs() {
+    const bytes = readBoundedFile(steamConfigFile(STEAMCMD_DIR), 256 * 1024);
+    if (!bytes || !hasCachedLogin(bytes.toString('utf8')))
+        return null;
+    return readSteamAccountFile(STEAMCMD_DIR) ?? 'your account';
+}
+/** STEAMWORKS_SDK from toolchains.steam.sdkFolder (relative to the project), when the folder is there. */
+function sdkFolder(env, setting) {
+    if (!setting.trim())
+        return;
+    const dir = path.resolve(projectWorkspace(), setting.trim());
+    let ok = false;
+    try {
+        ok = fs.statSync(dir).isDirectory();
+    }
+    catch {
+        // Not there: said below.
+    }
+    if (!ok) {
+        log('Steamworks SDK: ' + dir + ' is not there (toolchains.steam.sdkFolder); STEAMWORKS_SDK is not set');
+        env.summary.push('steamworks sdk: ' + dir + ' not found');
+        return;
+    }
+    env.vars.STEAMWORKS_SDK = dir;
+    env.summary.push('steamworks sdk: STEAMWORKS_SDK=' + dir);
+}
+export async function setupSteam(env, config, ctx) {
+    if (dryRun) {
+        log('(dry run) would set up SteamCMD' + (config.client ? ' and the Steam client' : ''));
+        return;
+    }
+    const exe = await installSteamCmd();
+    // Appended: C:\SteamCMD also holds Steam's own DLLs, which must not shadow a game's.
+    env.append.push(STEAMCMD_DIR);
+    env.vars.STEAMCMD = exe;
+    const user = signedInAs();
+    env.summary.push('steamcmd: C:\\SteamCMD, ' + (user ? 'signed in as ' + user : 'not signed in (sbx-steam login <account>)'));
+    sdkFolder(env, config.sdkFolder);
+    const fromPc = ctx.pcInstalls.items.filter((i) => i.kind === 'steam-game' || i.kind === 'steam-library');
+    if (fromPc.length)
+        env.summary.push('steam: ' + fromPc.length + " of this PC's games or libraries, read-only in C:\\PcInstalls\\steam");
+    if (!config.client)
+        return;
+    if (ctx.duringSession && !installedSteamClient()) {
+        env.summary.push('steam client: restart the sandbox to install it');
+        return;
+    }
+    await ensureSteamClient(env);
+}

package/dist/guest/toolchains/steam/steamcmd-install.d.ts

@@ -0,0 +1,29 @@
+import { type PersistedDeps } from '../persisted.js';
+/** Room SteamCMD needs: the zip is small, its first run fetches ~300 MB. */
+export declare const STEAMCMD_NEED_BYTES: number;
+export declare const STEAMCMD_UPDATE_TIMEOUT_MS: number;
+export interface RunResult {
+    readonly code: number;
+    readonly timedOut: boolean;
+}
+export interface SteamCmdDeps extends PersistedDeps {
+    /** Whether a file is Valve-signed (required: the default needs the guest runtime). */
+    readonly signed: (file: string) => boolean;
+    /** tools\steamcmd. */
+    readonly storeDir?: string;
+    /** C:\SteamCMD. */
+    readonly workDir?: string;
+    readonly download?: (url: string, file: string, verify: (part: string) => Promise<void>) => Promise<void>;
+    readonly extract?: (archive: string, destination: string) => Promise<void>;
+    readonly run?: (exe: string, args: string[], cwd: string, timeoutMs: number) => Promise<RunResult>;
+    readonly updateTimeoutMs?: number;
+}
+/** Runs a program with its output hidden; it is stopped after `timeoutMs`. */
+export declare function runWithTimeout(exe: string, args: string[], cwd: string, timeoutMs: number): Promise<RunResult>;
+/** steamcmd.zip into `store`: kept only when steamcmd.exe in it is Valve-signed. */
+export declare function fetchSteamCmd(store: string, deps: SteamCmdDeps): Promise<void>;
+/**
+ * steamcmd.exe in the working folder, ready to run: downloaded once, copied in, updated by its own first run (with a
+ * time limit), and its updated binaries kept for the next boot.
+ */
+export declare function prepareSteamCmd(deps: SteamCmdDeps): Promise<string>;

package/dist/guest/toolchains/steam/steamcmd-install.js

@@ -0,0 +1,177 @@
+// Getting SteamCMD ready, with every outside effect passed in (the self-test runs it with its own folders, download,
+// signer check and runner): steamcmd.zip once into tools\steamcmd (Valve publishes no checksum, so steamcmd.exe in it
+// must be Valve-signed before the zip is kept), a working copy in C:\SteamCMD every boot (config\ and the sentry
+// files never leave the sandbox's own disk), its first-run self-update with a time limit, and the updated binaries
+// kept for the next boot. No runtime imports.
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { extractArchive, moveIntoPlace, stagingFolder } from '../../../shared/download/archive.js';
+import { downloader } from '../../../shared/download/downloader.js';
+import { safeRemove } from '../../../shared/io/safe-remove.js';
+import { assertRoom } from '../persisted.js';
+import { STEAMCMD_DIR, STEAMCMD_URL, steamCmdStore } from './commands.js';
+const MB = 1024 ** 2;
+/** Room SteamCMD needs: the zip is small, its first run fetches ~300 MB. */
+export const STEAMCMD_NEED_BYTES = 600 * MB;
+export const STEAMCMD_UPDATE_TIMEOUT_MS = 15 * 60 * 1000;
+/** What a SteamCMD folder keeps that is the sign-in or this sandbox's own: never copied to the data disk. */
+const PRIVATE_DIRS = new Set(['config', 'logs', 'dumps', 'userdata', 'steamapps', 'appcache', 'depotcache']);
+const isPrivate = (name) => PRIVATE_DIRS.has(name.toLowerCase()) || /^ssfn/i.test(name);
+/** Files that show SteamCMD has finished its first run (it fetches these itself). */
+const BOOTSTRAPPED = ['steamclient.dll', 'steamclient64.dll'];
+/** Runs a program with its output hidden; it is stopped after `timeoutMs`. */
+export function runWithTimeout(exe, args, cwd, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(exe, args, { cwd, stdio: 'ignore', windowsHide: true });
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill();
+        }, timeoutMs);
+        child.once('error', (e) => {
+            clearTimeout(timer);
+            reject(e);
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            resolve({ code: code ?? -1, timedOut });
+        });
+    });
+}
+const notSigned = (file) => new Error(path.basename(file) + ' is not signed by Valve: not running it (it is downloaded again next boot)');
+/** steamcmd.zip into `store`: kept only when steamcmd.exe in it is Valve-signed. */
+export async function fetchSteamCmd(store, deps) {
+    fs.mkdirSync(path.dirname(store), { recursive: true });
+    assertRoom(path.dirname(store), STEAMCMD_NEED_BYTES, 'SteamCMD', 'Free room on the data disk.', deps);
+    const work = stagingFolder(store);
+    const unpacked = path.join(work, 'x');
+    const extract = deps.extract ?? extractArchive;
+    try {
+        fs.mkdirSync(work, { recursive: true });
+        const verify = async (part) => {
+            await extract(part, unpacked);
+            const exe = path.join(unpacked, 'steamcmd.exe');
+            if (!fs.existsSync(exe))
+                throw new Error('steamcmd.zip has no steamcmd.exe');
+            if (!deps.signed(exe))
+                throw notSigned(exe);
+        };
+        const zip = path.join(work, 'steamcmd.zip');
+        if (deps.download)
+            await deps.download(STEAMCMD_URL, zip, verify);
+        else
+            await downloader.file(STEAMCMD_URL, zip, { verify });
+        moveIntoPlace(unpacked, store);
+    }
+    finally {
+        if (fs.existsSync(work))
+            safeRemove(work, path.dirname(work));
+    }
+}
+/** Copies a SteamCMD folder, leaving out the sign-in and this sandbox's own files at its top. */
+async function copyBinaries(from, to) {
+    fs.mkdirSync(to, { recursive: true });
+    for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
+        if (isPrivate(entry.name) || entry.isSymbolicLink())
+            continue;
+        if (!entry.isFile() && !entry.isDirectory())
+            continue;
+        await fs.promises.cp(path.join(from, entry.name), path.join(to, entry.name), {
+            recursive: true,
+            force: true,
+            verbatimSymlinks: true,
+            filter: (source) => {
+                try {
+                    return !fs.lstatSync(source).isSymbolicLink();
+                }
+                catch {
+                    return false;
+                }
+            },
+        });
+    }
+}
+/** Size and time of SteamCMD's own top-level files: what changes when it updates itself. */
+function snapshot(dir) {
+    try {
+        return fs
+            .readdirSync(dir, { withFileTypes: true })
+            .filter((e) => e.isFile() && !isPrivate(e.name) && /\.(exe|dll)$/i.test(e.name))
+            .map((e) => {
+            const s = fs.statSync(path.join(dir, e.name));
+            return e.name.toLowerCase() + ':' + s.size + ':' + Math.floor(s.mtimeMs / 1000);
+        })
+            .sort()
+            .join('|');
+    }
+    catch {
+        return '';
+    }
+}
+const bootstrapped = (dir) => BOOTSTRAPPED.some((f) => fs.existsSync(path.join(dir, f)));
+/** Removes anything private that ended up in the kept copy (it must hold only binaries). */
+function scrubStore(store) {
+    let names = [];
+    try {
+        names = fs.readdirSync(store);
+    }
+    catch {
+        return;
+    }
+    for (const name of names.filter(isPrivate))
+        safeRemove(path.join(store, name), store);
+}
+/**
+ * steamcmd.exe in the working folder, ready to run: downloaded once, copied in, updated by its own first run (with a
+ * time limit), and its updated binaries kept for the next boot.
+ */
+export async function prepareSteamCmd(deps) {
+    const store = deps.storeDir ?? steamCmdStore(deps.toolsDir);
+    const work = deps.workDir ?? STEAMCMD_DIR;
+    const log = deps.log ?? (() => undefined);
+    const exe = path.join(work, 'steamcmd.exe');
+    // Set up already in this sandbox (a project that joins later): its files may be in use, so they are left alone.
+    if (fs.existsSync(exe) && bootstrapped(work)) {
+        if (!deps.signed(exe))
+            throw notSigned(exe);
+        return exe;
+    }
+    if (!fs.existsSync(path.join(store, 'steamcmd.exe'))) {
+        log('Downloading SteamCMD (~3 MB once; it fetches ~300 MB on its first run) ...');
+        await fetchSteamCmd(store, deps);
+    }
+    scrubStore(store);
+    await copyBinaries(store, work);
+    if (!deps.signed(exe)) {
+        safeRemove(store, path.dirname(store));
+        throw notSigned(exe);
+    }
+    const before = snapshot(work);
+    const run = deps.run ?? runWithTimeout;
+    const limit = deps.updateTimeoutMs ?? STEAMCMD_UPDATE_TIMEOUT_MS;
+    for (let attempt = 1; attempt <= 2; attempt++) {
+        log(attempt === 1 ? 'SteamCMD: checking for updates ...' : 'SteamCMD: trying its update once more ...');
+        const result = await run(exe, ['+quit'], work, limit);
+        if (result.timedOut)
+            throw new Error('SteamCMD did not finish updating itself in ' + Math.round(limit / 60000) + ' minutes');
+        if (bootstrapped(work))
+            break;
+        if (attempt === 2)
+            throw new Error('SteamCMD did not finish its first run (exit code ' + result.code + ')');
+    }
+    if (!deps.signed(exe))
+        throw notSigned(exe);
+    if (snapshot(work) !== before || !bootstrapped(store)) {
+        const staging = stagingFolder(store);
+        try {
+            await copyBinaries(work, staging);
+            moveIntoPlace(staging, store);
+        }
+        finally {
+            if (fs.existsSync(staging))
+                safeRemove(staging, path.dirname(staging));
+        }
+    }
+    return exe;
+}

package/dist/guest/toolchains/steam/steamcmd.d.ts

@@ -0,0 +1,6 @@
+import type { ToolEnv } from '../tool-env.js';
+export { STEAMCMD_DIR } from './commands.js';
+/** steamcmd.exe ready to run; throws with the reason when it cannot be set up. */
+export declare function installSteamCmd(): Promise<string>;
+/** steamcmd.exe ready to run, or null when it could not be set up (the reason is in the log and the summary). */
+export declare function ensureSteamCmd(env: ToolEnv): Promise<string | null>;

package/dist/guest/toolchains/steam/steamcmd.js

@@ -0,0 +1,23 @@
+// SteamCMD: steamcmd.zip from Valve's CDN (no checksum published: steamcmd.exe must be Valve-signed), its binaries
+// kept in tools\steamcmd and copied to C:\SteamCMD each boot (its config\ holds the login, which never sits on the
+// data disk). The work itself is in steamcmd-install.ts; this file gives it the sandbox's log and signer check.
+import { errMsg } from '../../../core/util/errors.js';
+import { log } from '../../runtime/log.js';
+import { SIGNERS, signedBy } from '../installers.js';
+import { prepareSteamCmd } from './steamcmd-install.js';
+export { STEAMCMD_DIR } from './commands.js';
+/** steamcmd.exe ready to run; throws with the reason when it cannot be set up. */
+export function installSteamCmd() {
+    return prepareSteamCmd({ signed: (file) => signedBy(file, SIGNERS.valve), log });
+}
+/** steamcmd.exe ready to run, or null when it could not be set up (the reason is in the log and the summary). */
+export async function ensureSteamCmd(env) {
+    try {
+        return await installSteamCmd();
+    }
+    catch (e) {
+        log('SteamCMD: not set up: ' + errMsg(e));
+        env.summary.push('steamcmd: not set up (' + errMsg(e) + ')');
+        return null;
+    }
+}

package/dist/guest/toolchains/step.d.ts

@@ -1,4 +1,5 @@
 import type { Config, DatabasePlan, GitAccess } from '../../core/types.js';
+import type { PcInstallManifest } from '../../shared/paths/pc-installs.js';
 import type { ToolEnv } from './tool-env.js';
 /** apps: the boot only (apps are machine-wide; a project that joins later shares them). */
 export interface ToolchainOptions {
@@ -8,6 +9,15 @@ export interface ToolchainOptions {
     refresh: boolean;
     databases: DatabasePlan[];
     apps?: Config['apps'];
+    /** pcInstalls: this PC's games, engines and editors mapped read-only (session.json). */
+    pcInstalls?: PcInstallManifest;
+}
+/** What a toolchain module's step gets besides its settings. */
+export interface ToolCtx {
+    readonly refresh: boolean;
+    readonly pcInstalls: PcInstallManifest;
+    /** A project joins a running sandbox: machine-wide installs (Visual Studio) wait for a restart. */
+    readonly duringSession: boolean;
 }
 /** One installer the scheduler runs: a toolchain, the apps, or a database server. */
 export interface ToolchainStep {

package/dist/host/accounts/deliver.d.ts

@@ -0,0 +1,26 @@
+import type { BootWant } from '../../core/local-config/index.js';
+import type { Config } from '../../core/types.js';
+import { type Payloads, type ServiceKind, type UsedBy } from '../../shared/accounts/index.js';
+import { AccountLeases } from './leases.js';
+import { ServiceAccountStore } from './store.js';
+export interface AccountDelivery {
+    readonly payloads: Payloads;
+    /** The kinds whose lease this launch holds (the sandbox may hand them back). */
+    readonly leased: readonly ServiceKind[];
+    readonly notes: readonly string[];
+}
+export interface DeliveryInput {
+    readonly config: Config;
+    /** The other projects this sandbox boots with (each one's own settings). */
+    readonly others: readonly BootWant[];
+    /** The toolchains on for this boot. */
+    readonly on: ReadonlySet<UsedBy>;
+    readonly storageRoot: string;
+    readonly dataPath: string;
+    readonly launchId: string;
+    /** Whether a sandbox still runs with that data set (a lease held there is not taken over). */
+    readonly isRunning: (dataSet: string) => boolean;
+    readonly store?: ServiceAccountStore;
+    readonly leases?: AccountLeases;
+}
+export declare function prepareServiceAccounts(i: DeliveryInput): AccountDelivery;

package/dist/host/accounts/deliver.js

@@ -0,0 +1,80 @@
+import { fingerprint, SERVICE_KINDS, SERVICE_SPECS, serviceWanted, } from '../../shared/accounts/index.js';
+import { setNameOf } from '../storage/index.js';
+import { takeHandoffs } from './handoff.js';
+import { AccountLeases } from './leases.js';
+import { ServiceAccountStore } from './store.js';
+/** How to get a first sign-in of a kind, for the note when none is saved. */
+function howToSave(spec) {
+    if (spec.kind === 'epic')
+        return "sign in to the Epic Games Launcher in this sandbox once, or take this PC's: sandbox account import epic";
+    if (spec.kind === 'steam')
+        return 'sign in once in this sandbox with sbx-steam login';
+    if (spec.returns)
+        return 'sign in once in this sandbox, or: sandbox account import ' + spec.kind;
+    return spec.sources.includes('typed')
+        ? 'save one: sandbox account login ' + spec.kind
+        : 'save one: sandbox account import ' + spec.kind + ' --from <file>';
+}
+export function prepareServiceAccounts(i) {
+    const store = i.store ?? new ServiceAccountStore(i.storageRoot);
+    const leases = i.leases ?? new AccountLeases(i.storageRoot);
+    const dataSet = setNameOf(i.dataPath);
+    const payloads = {};
+    const leased = [];
+    const notes = [];
+    // A sign-in the last sandbox renewed but did not get to hand over (it did not stop cleanly) comes first.
+    try {
+        takeHandoffs(i.dataPath, false, store, leases);
+    }
+    catch {
+        // Never stops a launch: the saved sign-in stays as it was.
+    }
+    for (const kind of SERVICE_KINDS) {
+        const spec = SERVICE_SPECS[kind];
+        if (!i.config.accounts[kind].share || !serviceWanted(kind, i.on))
+            continue;
+        const off = i.others.find((o) => !o.config.accounts[kind].share);
+        if (off) {
+            notes.push('Your ' + spec.label + ' sign-in was not handed over: ' + off.name + ' (also in this sandbox) turns it off.');
+            continue;
+        }
+        try {
+            let payload = null;
+            let unreadable = false;
+            try {
+                payload = store.read(kind);
+            }
+            catch {
+                unreadable = true;
+            }
+            if (spec.singleHolder) {
+                const claim = leases.claim(kind, dataSet, i.launchId, payload ? fingerprint(payload) : null, i.isRunning);
+                if (!claim.ok) {
+                    notes.push('Your ' + spec.label + ' sign-in is in use by sandbox ' + claim.heldBy + ': this one starts without it.');
+                    continue;
+                }
+                if (spec.returns)
+                    leased.push(kind);
+            }
+            if (unreadable) {
+                notes.push('Your saved ' +
+                    spec.label +
+                    ' sign-in could not be read (only the Windows user that saved it can): ' +
+                    howToSave(spec) +
+                    '.');
+                continue;
+            }
+            if (!payload) {
+                notes.push('No ' + spec.label + ' sign-in is saved yet: ' + howToSave(spec) + '.');
+                continue;
+            }
+            payloads[kind] = payload;
+            notes.push('Your ' + spec.label + ' sign-in is handed to this sandbox: ' + spec.warnings[0]);
+        }
+        catch {
+            // A store or lease file that cannot be written: this kind is left out, the launch goes on.
+            notes.push('Your ' + spec.label + ' sign-in could not be prepared, so it was not handed over.');
+        }
+    }
+    return { payloads: payloads, leased, notes };
+}

package/dist/host/accounts/handoff.d.ts

@@ -0,0 +1,17 @@
+import { type ServiceKind } from '../../shared/accounts/index.js';
+import { AccountLeases } from './leases.js';
+import { ServiceAccountStore } from './store.js';
+/** state\accounts in a data set, as this PC sees it. */
+export declare function handoffDir(dataPath: string): string;
+export declare function takeHandoffs(dataPath: string, final: boolean, store?: ServiceAccountStore, leases?: AccountLeases): {
+    taken: ServiceKind[];
+    dropped: ServiceKind[];
+};
+/**
+ * Forgets a sign-in everywhere: the saved one, its lease (what a running sandbox hands back afterwards is refused),
+ * and every copy a sandbox left in a data set and the PC has not taken yet.
+ */
+export declare function forgetEverywhere(kind: ServiceKind, storageRoot: string, store?: ServiceAccountStore, leases?: AccountLeases): {
+    removed: boolean;
+    pendingDeleted: number;
+};