windows-development-sandbox 1.17.0 → 1.18.0

package/dist/app/features/accounts/accounts.def.js

@@ -3,6 +3,8 @@
 // accounts.run.ts does the work over AccountsService.
 import { z } from 'zod';
 import { action, defineOperation, defineQuery, defineView, plural, } from '../../kernel/index.js';
+import { setSetting } from '../settings/settings.def.js';
+import { listServices, SERVICE_OPERATIONS, serviceSections, ServiceRowSchema, } from './services.def.js';
 const AgentSchema = z.string().default('claude').describe('whose login: an agent that keeps one (default: claude)');
 const NameSchema = z.string().optional().describe('account name');
 export const AccountRowSchema = z.object({
@@ -11,7 +13,19 @@ export const AccountRowSchema = z.object({
     isDefault: z.boolean().describe('New launches start with it'),
     isActive: z.boolean().describe('The sandbox uses it now'),
     savedAt: z.string().describe('When it was saved (ISO time)'),
+    kind: z
+        .enum(['subscription', 'console', 'api-key'])
+        .optional()
+        .describe('Claude: a subscription login, a Claude Console login (its API key), or an API key you gave'),
+    keyHint: z.string().nullable().optional().describe('The most of an API key ever shown: sk-ant-...abcd'),
 });
+const KIND_LABELS = { subscription: 'subscription', console: 'Console', 'api-key': 'API key' };
+/** "API key sk-ant-...abcd", "Console sk-ant-...abcd", "subscription"; null when the agent does not say. */
+export function kindText(r) {
+    if (!r.kind)
+        return null;
+    return KIND_LABELS[r.kind] + (r.keyHint ? ' ' + r.keyHint : '');
+}
 export const AgentAccountsSchema = z.object({
     name: z.string().describe('The agent'),
     kept: z.boolean().describe('Its login can be saved and switched'),
@@ -21,25 +35,42 @@ export const AgentAccountsSchema = z.object({
 export const AccountsListSchema = z.object({
     agent: z.string().describe('The agent asked for (the command line table shows only it)'),
     agents: z.array(AgentAccountsSchema).describe('Every agent, Claude first'),
+    services: z.array(ServiceRowSchema).describe('Service sign-ins for sandboxes (Epic, Steam ...)'),
 });
 const MessageSchema = z.object({ message: z.string().describe('What happened') });
 /** The name rule of a saved login: what the store accepts. */
 export const NAME_RULE = 'Use letters, digits, - and _ (up to 40).';
+/** The "Services" block under `sandbox account list`: one line per service that is shared or saved. */
+function servicesBlock(o) {
+    const kept = o.services.filter((s) => s.share || s.state !== 'none');
+    const lines = kept.map((s) => '  ' +
+        s.kind.padEnd(10) +
+        (s.share ? 'shared' : 'not shared') +
+        ', ' +
+        (s.state === 'none' ? 'not saved' : s.state === 'saved' ? 'saved' : 'cannot be read'));
+    return ['', 'Services' + (kept.length ? '' : ': none shared or saved') + '   (sandbox account status)', ...lines];
+}
 /** `sandbox account list`: the table of one agent, as the command line has always padded it. */
 export function accountsText(o) {
+    return [agentText(o), ...servicesBlock(o)].join('\n');
+}
+function agentText(o) {
     const rows = o.agents.find((a) => a.name === o.agent)?.accounts ?? [];
     if (!rows.length)
         return o.agent === 'claude'
-            ? "No saved accounts. Sign in inside the sandbox, then: sandbox account save <name>   (or --from-host to save this PC's login)"
+            ? "No saved accounts. Sign in inside the sandbox, then: sandbox account save <name>   (or --from-host to save this PC's login, or --api-key to type an API key)"
             : 'No saved ' +
                 o.agent +
                 ' accounts. Sign in inside the sandbox, then: sandbox account save <name> --agent ' +
                 o.agent;
+    // The KIND column only for an agent whose logins have kinds (Claude).
+    const kinds = rows.some((a) => a.kind);
     const table = [
-        ['', 'NAME', 'EMAIL', 'SAVED'],
+        ['', 'NAME', ...(kinds ? ['KIND'] : []), 'EMAIL', 'SAVED'],
         ...rows.map((a) => [
             (a.isActive ? '*' : ' ') + (a.isDefault ? 'D' : ' '),
             a.name,
+            ...(kinds ? [kindText(a) ?? '-'] : []),
             a.email ?? '-',
             a.savedAt.slice(0, 16).replace('T', ' '),
         ]),
@@ -72,6 +103,10 @@ export const saveAccount = defineOperation({
         agent: AgentSchema,
         name: NameSchema,
         fromHost: z.boolean().default(false).describe("(save) save this PC's login instead of the sandbox's"),
+        apiKey: z
+            .boolean()
+            .default(false)
+            .describe("(save, Claude) an Anthropic API key: typed in (hidden), or with --from-host this PC's"),
     }),
     output: z.object({ name: z.string().describe('The saved login'), message: z.string().describe('What happened') }),
     text: (o) => o.message,
@@ -79,7 +114,7 @@ export const saveAccount = defineOperation({
         name: 'account',
         action: 'save',
         positional: ['name'],
-        flags: { agent: { flag: '--agent' }, fromHost: { flag: '--from-host' } },
+        flags: { agent: { flag: '--agent' }, fromHost: { flag: '--from-host' }, apiKey: { flag: '--api-key' } },
     },
 });
 export const useAccount = defineOperation({
@@ -173,11 +208,25 @@ function saveItems(a) {
                 },
             ]
             : []),
+        ...(a.name === 'claude'
+            ? [
+                {
+                    id: '@save-key',
+                    label: '+ Save an API key…',
+                    group: 'Save a login',
+                    description: 'Saves an Anthropic API key (from the Claude Console) under a name you choose. What you type is not shown.',
+                    primary: action(saveAccount, { agent: a.name, fromHost: false, apiKey: true }, { verb: 'save', label: 'Save an API key' }),
+                },
+            ]
+            : []),
     ];
 }
 /** One saved login: its state in the hint and badges, Enter or a click uses it, d/r/x change it. */
 function loginItem(a, r) {
-    const hint = [r.isActive ? 'in the sandbox' : '', r.isDefault ? 'default' : ''].filter(Boolean).join(' · ');
+    const kind = kindText(r);
+    const hint = [r.kind ? KIND_LABELS[r.kind] : '', r.isActive ? 'in the sandbox' : '', r.isDefault ? 'default' : '']
+        .filter(Boolean)
+        .join(' · ');
     return {
         id: a.name + ':' + r.name,
         label: r.name,
@@ -185,11 +234,17 @@ function loginItem(a, r) {
         icon: a.name,
         hint,
         badges: [
+            ...(r.kind ? [{ text: KIND_LABELS[r.kind], tone: r.kind === 'subscription' ? 'muted' : 'warn' }] : []),
             ...(r.isActive ? [{ text: 'in the sandbox', tone: 'ok' }] : []),
             ...(r.isDefault ? [{ text: 'default', tone: 'accent' }] : []),
         ],
         description: r.isActive ? 'The sandbox uses this login now.' : 'Choose it to make the sandbox use this login.',
-        details: ['Agent  ' + a.name, 'Email  ' + (r.email ?? '-'), 'Saved  ' + r.savedAt.slice(0, 16).replace('T', ' ')],
+        details: [
+            'Agent  ' + a.name,
+            ...(kind ? ['Kind   ' + kind] : []),
+            'Email  ' + (r.email ?? '-'),
+            'Saved  ' + r.savedAt.slice(0, 16).replace('T', ' '),
+        ],
         // The login in use already offers nothing to switch to.
         ...(r.isActive ? {} : { primary: action(useAccount, { agent: a.name, name: r.name }, { verb: 'use' }) }),
         actions: [
@@ -223,9 +278,9 @@ export function agentSection(a) {
         items: [...saveItems(a), ...a.accounts.map((r) => loginItem(a, r))],
     };
 }
-/** The web's page: one card per agent (its logins and the save rows). */
-export function accountsPage(o) {
-    return { title: 'Accounts', sections: o.agents.map(agentSection) };
+/** The web's page: one card per agent (its logins and the save rows), then one section per service sign-in. */
+export function accountsPage(o, services = { services: o.services }) {
+    return { title: 'Accounts', sections: [...o.agents.map(agentSection), ...serviceSections(services)] };
 }
 /**
  * One agent's page for the menu: its section, and the keys of its save rows (s, p) which the menu's key bar shows
@@ -238,6 +293,11 @@ export function agentPage(a) {
             ...(a.canSavePc
                 ? [action(saveAccount, { agent: a.name, fromHost: true }, { key: 'p', verb: 'save PC login', importance: 3 })]
                 : []),
+            ...(a.name === 'claude'
+                ? [
+                    action(saveAccount, { agent: a.name, fromHost: false, apiKey: true }, { key: 'k', verb: 'save API key', importance: 3 }),
+                ]
+                : []),
         ]
         : [];
     return { title: 'Accounts', sections: [agentSection(a)], actions: keys };
@@ -245,8 +305,16 @@ export function agentPage(a) {
 export const accountsView = defineView({
     id: 'accounts',
     title: 'Accounts',
-    summary: 'Logins saved on this PC for each agent. Every launch starts with the default; "Use this login" switches now.',
-    queries: { accounts: listAccounts },
-    operations: [saveAccount, useAccount, defaultAccount, renameAccount, removeAccount],
-    build: ({ accounts }) => accountsPage(accounts),
+    summary: 'Logins saved on this PC for each agent (every launch starts with the default; "Use this login" switches now), and the service sign-ins sandboxes may get (Epic, Steam, Unity, signing keys ...).',
+    queries: { accounts: listAccounts, services: listServices },
+    operations: [
+        saveAccount,
+        useAccount,
+        defaultAccount,
+        renameAccount,
+        removeAccount,
+        ...SERVICE_OPERATIONS,
+        setSetting,
+    ],
+    build: ({ accounts, services }) => accountsPage(accounts, services),
 });

package/dist/app/features/accounts/accounts.run.d.ts

@@ -1,3 +1,4 @@
+import { type OperationIO } from '../../kernel/index.js';
 export declare const listAccountsRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").QueryDef<import("zod").ZodObject<{
     agent: import("zod").ZodDefault<import("zod").ZodString>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -12,13 +13,41 @@ export declare const listAccountsRun: import("../../kernel/define.js").Implement
             isDefault: import("zod").ZodBoolean;
             isActive: import("zod").ZodBoolean;
             savedAt: import("zod").ZodString;
+            kind: import("zod").ZodOptional<import("zod").ZodEnum<{
+                subscription: "subscription";
+                console: "console";
+                "api-key": "api-key";
+            }>>;
+            keyHint: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>>;
+    services: import("zod").ZodArray<import("zod").ZodObject<{
+        kind: import("zod").ZodString;
+        label: import("zod").ZodString;
+        share: import("zod").ZodBoolean;
+        state: import("zod").ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: import("zod").ZodNullable<import("zod").ZodString>;
+        savedAt: import("zod").ZodNullable<import("zod").ZodString>;
+        summary: import("zod").ZodNullable<import("zod").ZodString>;
+        heldBy: import("zod").ZodNullable<import("zod").ZodString>;
+        usedBy: import("zod").ZodArray<import("zod").ZodString>;
+        warnings: import("zod").ZodArray<import("zod").ZodString>;
+        canImport: import("zod").ZodBoolean;
+        canLogin: import("zod").ZodBoolean;
+        needsFile: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>, "accounts.list">, import("../../../cli/commands/context.js").Context>;
+/** Asks for an API key (one hidden question). The validator answers with fixed texts only, never the key. */
+export declare function askApiKey(io: OperationIO): Promise<string>;
 export declare const saveAccountRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
     agent: import("zod").ZodDefault<import("zod").ZodString>;
     name: import("zod").ZodOptional<import("zod").ZodString>;
     fromHost: import("zod").ZodDefault<import("zod").ZodBoolean>;
+    apiKey: import("zod").ZodDefault<import("zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
     name: import("zod").ZodString;
     message: import("zod").ZodString;

package/dist/app/features/accounts/accounts.run.js

@@ -3,9 +3,13 @@
 // safeText. Logins are never read here: the store keeps them sealed, and outputs hold names, emails and dates only.
 import { fail, safeText } from '../../../core/util/index.js';
 import { AccountsService } from '../../../cli/services/index.js';
+import { AccountLeases, ServiceAccountStore } from '../../../host/accounts/index.js';
+import { SERVICE_KINDS } from '../../../shared/accounts/index.js';
+import { apiKeyProblem } from '../../../host/profile/index.js';
 import { implement } from '../../context.js';
+import { serviceRow } from './services.run.js';
 import { cancelled } from '../../kernel/index.js';
-import { defaultAccount, listAccounts, NAME_RULE, removeAccount, renameAccount, saveAccount, useAccount, } from './accounts.def.js';
+import { defaultAccount, kindText, listAccounts, NAME_RULE, removeAccount, renameAccount, saveAccount, useAccount, } from './accounts.def.js';
 const NAME = /^[A-Za-z0-9_-]{1,40}$/;
 const validName = (v) => NAME.test(v.trim()) || NAME_RULE;
 /** "work" (me@example.com) as the notices and the command line have always said it. */
@@ -21,6 +25,7 @@ function savedLogins(service, agent) {
             isDefault: r.isDefault,
             isActive: r.isActive,
             savedAt: r.savedAt,
+            ...(r.kind ? { kind: r.kind, keyHint: r.keyHint ?? null } : {}),
         }));
     }
     catch {
@@ -46,7 +51,10 @@ async function accountName(io, service, verb, agent, given) {
         fail('No saved accounts.', 'Sign in inside the sandbox, then run: sandbox account save <name>');
     const picked = await io.choose({
         title: 'Which account?',
-        choices: rows.map((a) => ({ value: a.name, label: label(a) })),
+        choices: rows.map((a) => {
+            const kind = kindText(a);
+            return { value: a.name, label: label(a), ...(kind ? { description: kind } : {}) };
+        }),
     });
     if (picked === undefined)
         cancelled();
@@ -63,13 +71,34 @@ export const listAccountsRun = implement(listAccounts, async (ctx, input) => {
     // An agent that keeps no login, or no such agent: the command line says why (the store's own message).
     if (!agents.some((a) => a.name === input.agent && a.kept))
         service.list(input.agent);
-    return { agent: input.agent, agents };
+    const store = new ServiceAccountStore(ctx.storageRoot);
+    const leases = new AccountLeases(ctx.storageRoot);
+    const services = SERVICE_KINDS.map((k) => serviceRow(k, ctx.loaded.config, store, leases));
+    return { agent: input.agent, agents, services };
 });
+/** Asks for an API key (one hidden question). The validator answers with fixed texts only, never the key. */
+export async function askApiKey(io) {
+    io.log('Make an API key in the Claude Console (platform.claude.com, API keys), then paste it here.');
+    io.log('What you type is not shown. It is kept encrypted for your Windows user and never printed.', 'muted');
+    const key = await io.secret({
+        title: 'Anthropic API key',
+        validate: (v) => apiKeyProblem(v.trim()) ?? true,
+    });
+    if (key === undefined)
+        cancelled();
+    return key.trim();
+}
 export const saveAccountRun = implement(saveAccount, async (ctx, input, io) => {
     const service = new AccountsService(ctx);
+    if (input.apiKey && input.agent !== 'claude')
+        fail('--api-key is for Claude accounts only.', 'Leave out --agent, or leave out --api-key.');
     const name = await accountName(io, service, 'save', input.agent, input.name);
-    const saved = service.save(name, input.fromHost, input.agent);
-    return { name: saved.name, message: 'Saved account ' + label(saved) + '.' };
+    // --api-key alone: a key typed in; with --from-host: this PC's Console key or ANTHROPIC_API_KEY.
+    const saved = input.apiKey && !input.fromHost
+        ? service.saveApiKey(name, await askApiKey(io))
+        : service.save(name, input.fromHost, input.agent, input.apiKey);
+    const kind = saved.kind && saved.kind !== 'subscription' ? kindText(saved) : null;
+    return { name: saved.name, message: 'Saved account ' + label(saved) + (kind ? ' (' + kind + ')' : '') + '.' };
 });
 /**
  * Makes the sandbox use a saved login, then offers to restart the agent's running sessions. The switch is done before
@@ -77,7 +106,8 @@ export const saveAccountRun = implement(saveAccount, async (ctx, input, io) => {
  */
 async function switchTo(io, service, name, agent, noRestart) {
     const used = service.activate(name, agent);
-    const lines = ['Sandbox now uses ' + label(used) + '.'];
+    const kind = used.kind && used.kind !== 'subscription' ? kindText(used) : null;
+    const lines = ['Sandbox now uses ' + label(used) + (kind ? ' (' + kind + ')' : '') + '.'];
     if (used.note)
         lines.push(safeText(used.note));
     if (service.hasRunningSessions(agent) && !noRestart) {

package/dist/app/features/accounts/index.d.ts

@@ -1,2 +1,4 @@
 export * from './accounts.def.js';
 export * from './accounts.run.js';
+export * from './services.def.js';
+export * from './services.run.js';

package/dist/app/features/accounts/index.js

@@ -1,3 +1,6 @@
-// The accounts feature: the saved logins of each agent, and saving, using, defaulting, renaming and removing them.
+// The accounts feature: the saved logins of each agent (save, use, default, rename, remove), and the service sign-ins
+// sandboxes may get (Epic, Steam, Unity, signing keys ...: status, import, sign in, forget).
 export * from './accounts.def.js';
 export * from './accounts.run.js';
+export * from './services.def.js';
+export * from './services.run.js';

package/dist/app/features/accounts/services.def.d.ts

@@ -0,0 +1,111 @@
+import { z } from 'zod';
+import { type Page, type Section } from '../../kernel/index.js';
+/** The kinds, as the help says them (the self-test checks this against shared/accounts SERVICE_KINDS). */
+export declare const SERVICE_NAMES_TEXT = "epic, steam, unity, cfx, keystore, play, expo or appstore";
+export declare const ServiceRowSchema: z.ZodObject<{
+    kind: z.ZodString;
+    label: z.ZodString;
+    share: z.ZodBoolean;
+    state: z.ZodEnum<{
+        none: "none";
+        saved: "saved";
+        unreadable: "unreadable";
+    }>;
+    source: z.ZodNullable<z.ZodString>;
+    savedAt: z.ZodNullable<z.ZodString>;
+    summary: z.ZodNullable<z.ZodString>;
+    heldBy: z.ZodNullable<z.ZodString>;
+    usedBy: z.ZodArray<z.ZodString>;
+    warnings: z.ZodArray<z.ZodString>;
+    canImport: z.ZodBoolean;
+    canLogin: z.ZodBoolean;
+    needsFile: z.ZodBoolean;
+}, z.core.$strip>;
+export type ServiceRow = z.output<typeof ServiceRowSchema>;
+export declare const ServicesListSchema: z.ZodObject<{
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ServicesList = z.output<typeof ServicesListSchema>;
+/** `sandbox account status`: one line per service. */
+export declare function servicesText(o: ServicesList): string;
+export declare const listServices: import("../../kernel/define.js").QueryDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>, "accounts.services">;
+export declare const serviceImport: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.import">;
+export declare const serviceLogin: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.login">;
+export declare const serviceLogout: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deleted: z.ZodBoolean;
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.logout">;
+export declare const SERVICE_OPERATIONS: readonly [import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.import">, import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.login">, import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deleted: z.ZodBoolean;
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.logout">];
+/** The category id of a service in the menu and its section id on the web. */
+export declare function serviceCategory(kind: string): string;
+/** One service's section: its facts, its warnings and its actions. */
+export declare function serviceSection(s: ServiceRow): Section;
+/** The sections of every service (appended to the accounts page on the web). */
+export declare function serviceSections(o: ServicesList): Section[];
+/** One service's page for the menu: its section, and its actions as keys. */
+export declare function servicePage(s: ServiceRow): Page;

package/dist/app/features/accounts/services.def.js

@@ -0,0 +1,187 @@
+// Service sign-ins for sandboxes (accounts.<kind>.share): Epic, Steam, Unity, Cfx.re, signing keys and app-store
+// keys. Whether each one is shared and saved (where it came from and when, never its value), taking one from this PC
+// or a file, typing one, and forgetting it. Pure: schemas, labels and page builders; services.run.ts does the work.
+// The kinds live in shared/accounts (a def imports no shared code): the query's rows carry everything a page shows.
+import { z } from 'zod';
+import { action } from '../../kernel/index.js';
+import { defineOperation, defineQuery } from '../../kernel/index.js';
+import { setSetting } from '../settings/settings.def.js';
+/** The kinds, as the help says them (the self-test checks this against shared/accounts SERVICE_KINDS). */
+export const SERVICE_NAMES_TEXT = 'epic, steam, unity, cfx, keystore, play, expo or appstore';
+const KindSchema = z
+    .string()
+    .max(40)
+    .optional()
+    .describe('the service: ' + SERVICE_NAMES_TEXT);
+export const ServiceRowSchema = z.object({
+    kind: z.string().describe('The service (epic, steam ...)'),
+    label: z.string().describe('Its name'),
+    share: z.boolean().describe('Sandboxes get it (setting accounts.<kind>.share)'),
+    state: z.enum(['none', 'saved', 'unreadable']).describe('Whether one is saved and can be opened by you'),
+    source: z.string().nullable().describe('Where the saved one came from: pc, file, typed or sandbox'),
+    savedAt: z.string().nullable().describe('When it was saved'),
+    summary: z.string().nullable().describe('Which account (never the secret)'),
+    heldBy: z.string().nullable().describe('The data set whose sandbox holds it now (one-holder services)'),
+    usedBy: z.array(z.string()).describe('The toolchains it is handed over for'),
+    warnings: z.array(z.string()).describe('What everyone who shares it must know'),
+    canImport: z.boolean().describe('It can be taken from this PC or a file (sandbox account import)'),
+    canLogin: z.boolean().describe('It can be typed (sandbox account login)'),
+    needsFile: z.boolean().describe('Importing it needs --from <file>'),
+});
+export const ServicesListSchema = z.object({ services: z.array(ServiceRowSchema) });
+const STATE_TEXT = {
+    none: 'not saved',
+    saved: 'saved (encrypted)',
+    unreadable: 'cannot be read',
+};
+const STATE_TONE = {
+    none: 'muted',
+    saved: 'ok',
+    unreadable: 'danger',
+};
+const SOURCE_TEXT = {
+    pc: 'taken from this PC',
+    file: 'from a file',
+    typed: 'typed in',
+    sandbox: 'signed in (or renewed) in a sandbox',
+};
+const day = (iso) => (iso ? iso.slice(0, 10) : '');
+/** `sandbox account status`: one line per service. */
+export function servicesText(o) {
+    const table = [
+        ['SERVICE', 'SHARE', 'SIGN-IN', 'SAVED', 'NOTE'],
+        ...o.services.map((s) => [
+            s.kind,
+            s.share ? 'on' : 'off',
+            STATE_TEXT[s.state],
+            day(s.savedAt) || '-',
+            [s.summary, s.heldBy ? 'in use by sandbox ' + s.heldBy : null].filter(Boolean).join(', ') || '-',
+        ]),
+    ];
+    const widths = table[0].map((_, i) => Math.max(...table.map((r) => r[i].length)));
+    return table
+        .map((r) => r.map((cell, i) => (i === r.length - 1 ? cell : cell.padEnd(widths[i] + 2))).join(''))
+        .join('\n');
+}
+export const listServices = defineQuery({
+    id: 'accounts.services',
+    title: 'Services',
+    summary: 'service sign-ins for sandboxes (Epic, Steam, Unity, signing keys ...): shared or not, saved or not',
+    input: z.object({ name: KindSchema }),
+    output: ServicesListSchema,
+    text: servicesText,
+    cli: { name: 'account', action: 'status', positional: ['name'], json: true },
+});
+const MessageSchema = z.object({ message: z.string().describe('What happened') });
+export const serviceImport = defineOperation({
+    id: 'accounts.service.import',
+    title: 'Import…',
+    summary: "save a service sign-in from this PC's program or a file, for sandboxes",
+    input: z.object({
+        name: KindSchema,
+        from: z.string().max(1000).optional().describe('(import) the file or folder to take the sign-in from'),
+    }),
+    output: MessageSchema,
+    text: (o) => o.message,
+    cli: { name: 'account', action: 'import', positional: ['name'], flags: { from: { flag: '--from', value: 'path' } } },
+});
+export const serviceLogin = defineOperation({
+    id: 'accounts.service.login',
+    title: 'Sign in…',
+    summary: 'type a service key or token to keep for sandboxes',
+    input: z.object({ name: KindSchema }),
+    output: MessageSchema,
+    text: (o) => o.message,
+    cli: { name: 'account', action: 'login', positional: ['name'] },
+});
+export const serviceLogout = defineOperation({
+    id: 'accounts.service.logout',
+    title: 'Forget…',
+    summary: 'delete a saved service sign-in, and every copy a sandbox left that this PC has not taken yet',
+    danger: true,
+    input: z.object({ name: KindSchema }),
+    output: z.object({ deleted: z.boolean().describe('One was saved and is gone'), message: z.string() }),
+    text: (o) => o.message,
+    cli: { name: 'account', action: 'logout', positional: ['name'] },
+});
+export const SERVICE_OPERATIONS = [serviceImport, serviceLogin, serviceLogout];
+/** The category id of a service in the menu and its section id on the web. */
+export function serviceCategory(kind) {
+    return 'service:' + kind;
+}
+/** What can be done with one service: share or stop, import, sign in, forget. */
+function serviceActions(s) {
+    return [
+        action(setSetting, { scope: 'user', key: 'accounts.' + s.kind + '.share', value: !s.share }, {
+            key: 't',
+            verb: s.share ? 'stop sharing' : 'share',
+            label: s.share ? 'Stop sharing' : 'Share with sandboxes',
+            importance: 1,
+        }),
+        ...(s.canImport ? [action(serviceImport, { name: s.kind }, { key: 'i', verb: 'import', importance: 1 })] : []),
+        ...(s.canLogin ? [action(serviceLogin, { name: s.kind }, { key: 'n', verb: 'sign in', importance: 1 })] : []),
+        ...(s.state !== 'none'
+            ? [action(serviceLogout, { name: s.kind }, { key: 'x', verb: 'forget', importance: 2 })]
+            : []),
+    ];
+}
+/** How to get a first sign-in, in words. */
+function howTo(s) {
+    const ways = [
+        ...(s.canImport ? ['sandbox account import ' + s.kind + (s.needsFile ? ' --from <file>' : '')] : []),
+        ...(s.canLogin ? ['sandbox account login ' + s.kind] : []),
+    ];
+    return ways.length ? ways.join(', or ') : 'sign in once inside a sandbox';
+}
+/** One service's section: its facts, its warnings and its actions. */
+export function serviceSection(s) {
+    const facts = [
+        {
+            id: s.kind + ':share',
+            label: 'Shared with sandboxes',
+            value: s.share ? 'on' : 'off  (sandbox config set accounts.' + s.kind + '.share true)',
+            tone: s.share ? 'ok' : 'muted',
+            description: 'For sandboxes that use ' + s.usedBy.join(' or ') + '. ' + s.warnings.join(' '),
+        },
+        {
+            id: s.kind + ':state',
+            label: 'Sign-in',
+            value: STATE_TEXT[s.state] + (s.savedAt ? '  ' + day(s.savedAt) : ''),
+            tone: STATE_TONE[s.state],
+            description: s.state === 'none' ? 'Save one: ' + howTo(s) + '.' : undefined,
+        },
+        ...(s.source ? [{ id: s.kind + ':source', label: 'From', value: SOURCE_TEXT[s.source] ?? s.source }] : []),
+        ...(s.summary ? [{ id: s.kind + ':summary', label: 'Account', value: s.summary }] : []),
+        ...(s.heldBy
+            ? [{ id: s.kind + ':held', label: 'In use by', value: 'sandbox ' + s.heldBy, tone: 'accent' }]
+            : []),
+    ];
+    const warnings = s.warnings.map((w, i) => ({
+        id: s.kind + ':warning:' + i,
+        label: w,
+        tone: 'warn',
+        group: 'Before you share it',
+    }));
+    const notes = [
+        ...(s.state === 'unreadable'
+            ? [{ text: 'Only the Windows user that saved it can read it: save it again.', tone: 'muted' }]
+            : []),
+    ];
+    return {
+        id: serviceCategory(s.kind),
+        title: s.label,
+        summary: (s.share ? 'shared' : 'not shared') + ' · ' + STATE_TEXT[s.state],
+        facts,
+        items: warnings,
+        notes,
+        actions: serviceActions(s),
+    };
+}
+/** The sections of every service (appended to the accounts page on the web). */
+export function serviceSections(o) {
+    return o.services.map(serviceSection);
+}
+/** One service's page for the menu: its section, and its actions as keys. */
+export function servicePage(s) {
+    return { title: 'Accounts', sections: [serviceSection(s)] };
+}