windows-development-sandbox 1.17.3 → 1.18.0

package/dist/shared/accounts/fingerprint.js

@@ -0,0 +1,20 @@
+// The fingerprint of a sign-in: a SHA-256 of its canonical JSON (keys sorted), so the sandbox can tell a renewed one
+// from the one it was given without keeping either around. Node only (not for the web bundle).
+import crypto from 'node:crypto';
+/** JSON with every object's keys sorted, so equal values always give equal text. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return '[' + value.map(canonical).join(',') + ']';
+    if (value && typeof value === 'object')
+        return ('{' +
+            Object.keys(value)
+                .filter((k) => value[k] !== undefined)
+                .sort()
+                .map((k) => JSON.stringify(k) + ':' + canonical(value[k]))
+                .join(',') +
+            '}');
+    return JSON.stringify(value) ?? 'null';
+}
+export function fingerprint(payload) {
+    return crypto.createHash('sha256').update(canonical(payload)).digest('hex');
+}

package/dist/shared/accounts/index.d.ts

@@ -0,0 +1,5 @@
+export * from './kinds.js';
+export * from './payloads.js';
+export { fingerprint } from './fingerprint.js';
+export { epicSettingsFile, MAX_EPIC_INI_BYTES, readEpicLogin, withEpicLogin, type EpicPayload } from './kinds/epic.js';
+export * from './kinds/steam.js';

package/dist/shared/accounts/index.js

@@ -0,0 +1,7 @@
+// Service sign-ins kept for sandboxes (accounts.<kind>.share): the kinds, their payloads, the fingerprint and the
+// Epic launcher's ini handling. kinds.ts and payloads.ts are web-safe; fingerprint.ts needs node:crypto.
+export * from './kinds.js';
+export * from './payloads.js';
+export { fingerprint } from './fingerprint.js';
+export { epicSettingsFile, MAX_EPIC_INI_BYTES, readEpicLogin, withEpicLogin } from './kinds/epic.js';
+export * from './kinds/steam.js';

package/dist/shared/accounts/kinds/epic.d.ts

@@ -0,0 +1,10 @@
+import type { Payload } from '../payloads.js';
+/** At most this much of a GameUserSettings.ini is read. */
+export declare const MAX_EPIC_INI_BYTES: number;
+export type EpicPayload = Payload<'epic'>;
+/** GameUserSettings.ini under a LocalAppData folder (the PC's or the sandbox's). */
+export declare function epicSettingsFile(localAppData: string): string;
+/** The saved sign-in in an ini text, or null (none, turned off, or not the expected shape). */
+export declare function readEpicLogin(ini: string): EpicPayload | null;
+/** The ini text with its [RememberMe] section replaced by this sign-in (the other sections are kept). */
+export declare function withEpicLogin(ini: string, login: EpicPayload): string;

package/dist/shared/accounts/kinds/epic.js

@@ -0,0 +1,56 @@
+// The Epic Games Launcher's saved sign-in ("Remember me"): the Data value of the [RememberMe] section of its
+// GameUserSettings.ini. Pure text handling for the host (taking this PC's) and the sandbox (writing it in at boot,
+// noticing when the launcher renews it). Read line by line: the sandbox may have written the file. The file is often
+// UTF-16: callers decode it with shared/io/text.ts and write it back in the encoding they read.
+import { EpicPayloadSchema } from '../payloads.js';
+/** At most this much of a GameUserSettings.ini is read. */
+export const MAX_EPIC_INI_BYTES = 1024 * 1024;
+const SECTION = '[rememberme]';
+/** GameUserSettings.ini under a LocalAppData folder (the PC's or the sandbox's). */
+export function epicSettingsFile(localAppData) {
+    return localAppData + '\\EpicGamesLauncher\\Saved\\Config\\Windows\\GameUserSettings.ini';
+}
+const isHeader = (line) => line.trimStart().startsWith('[');
+/** The saved sign-in in an ini text, or null (none, turned off, or not the expected shape). */
+export function readEpicLogin(ini) {
+    let inSection = false;
+    let enabled = true;
+    let data = null;
+    for (const raw of ini.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (isHeader(line)) {
+            inSection = line.toLowerCase() === SECTION;
+            continue;
+        }
+        if (!inSection)
+            continue;
+        const at = line.indexOf('=');
+        if (at < 0)
+            continue;
+        const key = line.slice(0, at).trim().toLowerCase();
+        const value = line.slice(at + 1).trim();
+        if (key === 'enable')
+            enabled = value.toLowerCase() === 'true';
+        else if (key === 'data')
+            data = value;
+    }
+    if (!enabled || !data)
+        return null;
+    const parsed = EpicPayloadSchema.safeParse({ data });
+    return parsed.success ? parsed.data : null;
+}
+/** The ini text with its [RememberMe] section replaced by this sign-in (the other sections are kept). */
+export function withEpicLogin(ini, login) {
+    const kept = [];
+    let inSection = false;
+    for (const line of ini.split(/\r?\n/)) {
+        if (isHeader(line))
+            inSection = line.trim().toLowerCase() === SECTION;
+        if (!inSection)
+            kept.push(line);
+    }
+    while (kept.length && kept[kept.length - 1].trim() === '')
+        kept.pop();
+    const section = ['[RememberMe]', 'Enable=True', 'Data=' + EpicPayloadSchema.parse(login).data];
+    return [...kept, ...(kept.length ? [''] : []), ...section, ''].join('\r\n');
+}

package/dist/shared/accounts/kinds/steam.d.ts

@@ -0,0 +1,28 @@
+import { type Payload } from '../payloads.js';
+export type SteamPayload = Payload<'steam'>;
+/** At most this much of config.vdf is read (the payload's limit). */
+export declare const MAX_STEAM_CONFIG_BYTES: number;
+/** A sentry's bytes (its base64 fits the payload's 64 KB). */
+export declare const MAX_SENTRY_BYTES: number;
+export declare const STEAM_ACCOUNT: RegExp;
+/** The file SteamCMD's folder keeps the account name in (sbx-steam writes it; config.vdf may not say it). */
+export declare const STEAM_ACCOUNT_FILE = "sbx-account.txt";
+export declare function steamConfigFile(steamcmdDir: string): string;
+/** Whether a config.vdf holds a cached login (a ConnectCache entry). */
+export declare function hasCachedLogin(configVdf: string): boolean;
+/** The account names a config.vdf knows (its Accounts block), in order. */
+export declare function steamAccounts(configVdf: string): string[];
+/** The account name kept beside SteamCMD (sbx-account.txt), or null. */
+export declare function readSteamAccountFile(steamcmdDir: string): string | null;
+/** The sentry files beside steamcmd.exe (the newest 4, in name order), each bounded. */
+export declare function readSentries(steamcmdDir: string): {
+    name: string;
+    base64: string;
+}[];
+/**
+ * The cached login in a SteamCMD folder, or null: no config.vdf, no cached login in it, or no account name (`account`
+ * is used when the folder does not say one).
+ */
+export declare function readSteamCmdLogin(steamcmdDir: string, account?: string): SteamPayload | null;
+/** Writes a cached login into a SteamCMD folder (config\config.vdf, the sentries, the account name). */
+export declare function writeSteamCmdLogin(steamcmdDir: string, p: SteamPayload): void;

package/dist/shared/accounts/kinds/steam.js

@@ -0,0 +1,99 @@
+// SteamCMD's cached login, for the host (a steamcmd folder on this PC) and the sandbox (C:\SteamCMD): config\config.vdf
+// (its ConnectCache holds the login token) and the ssfn sentry files beside steamcmd.exe. No password is ever in them.
+// Every file is read bounded and without following links: the sandbox may have written them.
+import fs from 'node:fs';
+import path from 'node:path';
+import { readBoundedFile } from '../../io/bounded.js';
+import { decodeText } from '../../io/text.js';
+import { parseVdf, vdfObject } from '../../vdf.js';
+import { SteamPayloadSchema } from '../payloads.js';
+/** At most this much of config.vdf is read (the payload's limit). */
+export const MAX_STEAM_CONFIG_BYTES = 256 * 1024;
+/** A sentry's bytes (its base64 fits the payload's 64 KB). */
+export const MAX_SENTRY_BYTES = 48 * 1024;
+const MAX_SENTRIES = 4;
+const MAX_ENTRIES = 5000;
+const SENTRY = /^ssfn\d{1,40}$/;
+export const STEAM_ACCOUNT = /^[A-Za-z0-9_]{1,64}$/;
+/** The file SteamCMD's folder keeps the account name in (sbx-steam writes it; config.vdf may not say it). */
+export const STEAM_ACCOUNT_FILE = 'sbx-account.txt';
+export function steamConfigFile(steamcmdDir) {
+    return path.join(steamcmdDir, 'config', 'config.vdf');
+}
+function steamKey(root) {
+    return vdfObject(root, 'InstallConfigStore', 'Software', 'Valve', 'Steam');
+}
+/** Whether a config.vdf holds a cached login (a ConnectCache entry). */
+export function hasCachedLogin(configVdf) {
+    const cache = vdfObject(steamKey(parseVdf(configVdf, { maxBytes: MAX_STEAM_CONFIG_BYTES })), 'ConnectCache');
+    return cache !== undefined && Object.keys(cache).length > 0;
+}
+/** The account names a config.vdf knows (its Accounts block), in order. */
+export function steamAccounts(configVdf) {
+    const accounts = vdfObject(steamKey(parseVdf(configVdf, { maxBytes: MAX_STEAM_CONFIG_BYTES })), 'Accounts');
+    return accounts ? Object.keys(accounts).filter((a) => STEAM_ACCOUNT.test(a)) : [];
+}
+/** The account name kept beside SteamCMD (sbx-account.txt), or null. */
+export function readSteamAccountFile(steamcmdDir) {
+    const bytes = readBoundedFile(path.join(steamcmdDir, 'config', STEAM_ACCOUNT_FILE), 256);
+    const name = bytes ? decodeText(bytes).text.trim() : '';
+    return STEAM_ACCOUNT.test(name) ? name : null;
+}
+/** The sentry files beside steamcmd.exe (the newest 4, in name order), each bounded. */
+export function readSentries(steamcmdDir) {
+    let names;
+    try {
+        names = fs
+            .readdirSync(steamcmdDir)
+            .slice(0, MAX_ENTRIES)
+            .filter((n) => SENTRY.test(n));
+    }
+    catch {
+        return [];
+    }
+    const mtime = (name) => {
+        try {
+            return fs.lstatSync(path.join(steamcmdDir, name)).mtimeMs;
+        }
+        catch {
+            return 0;
+        }
+    };
+    const found = [];
+    for (const name of names.sort((a, b) => mtime(b) - mtime(a))) {
+        if (found.length >= MAX_SENTRIES)
+            break;
+        const bytes = readBoundedFile(path.join(steamcmdDir, name), MAX_SENTRY_BYTES);
+        if (bytes && bytes.length)
+            found.push({ name, base64: bytes.toString('base64') });
+    }
+    // By name: the same files read back the same (file times change when they are written in a sandbox).
+    return found.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+/**
+ * The cached login in a SteamCMD folder, or null: no config.vdf, no cached login in it, or no account name (`account`
+ * is used when the folder does not say one).
+ */
+export function readSteamCmdLogin(steamcmdDir, account) {
+    const bytes = readBoundedFile(steamConfigFile(steamcmdDir), MAX_STEAM_CONFIG_BYTES);
+    if (!bytes)
+        return null;
+    const configVdf = decodeText(bytes).text;
+    if (!hasCachedLogin(configVdf))
+        return null;
+    const name = readSteamAccountFile(steamcmdDir) ?? steamAccounts(configVdf)[0] ?? account;
+    if (!name)
+        return null;
+    const parsed = SteamPayloadSchema.safeParse({ account: name, configVdf, sentries: readSentries(steamcmdDir) });
+    return parsed.success ? parsed.data : null;
+}
+/** Writes a cached login into a SteamCMD folder (config\config.vdf, the sentries, the account name). */
+export function writeSteamCmdLogin(steamcmdDir, p) {
+    const login = SteamPayloadSchema.parse(p);
+    const config = path.dirname(steamConfigFile(steamcmdDir));
+    fs.mkdirSync(config, { recursive: true });
+    fs.writeFileSync(steamConfigFile(steamcmdDir), login.configVdf, 'utf8');
+    fs.writeFileSync(path.join(config, STEAM_ACCOUNT_FILE), login.account, 'utf8');
+    for (const s of login.sentries)
+        fs.writeFileSync(path.join(steamcmdDir, s.name), Buffer.from(s.base64, 'base64'));
+}

package/dist/shared/accounts/kinds.d.ts

@@ -0,0 +1,41 @@
+export declare const SERVICE_KINDS: readonly ["epic", "steam", "unity", "cfx", "keystore", "play", "expo", "appstore"];
+export type ServiceKind = (typeof SERVICE_KINDS)[number];
+/** The toolchains a sign-in serves (it is handed over only when one of them is on for the boot). */
+export type UsedBy = 'unreal' | 'steam' | 'unity' | 'fivem' | 'android' | 'flutter' | 'reactNative' | 'godot' | 'dotnet';
+export declare const USED_BY: readonly UsedBy[];
+/** Where a saved sign-in came from: this PC's program, a file you gave, values you typed, or a sandbox. */
+export type AccountSource = 'pc' | 'file' | 'typed' | 'sandbox';
+export declare const ACCOUNT_SOURCES: readonly AccountSource[];
+/** One value `sandbox account login` asks for (or `import --from` needs besides the file). */
+export interface ServiceField {
+    readonly name: string;
+    readonly label: string;
+    readonly secret: boolean;
+    readonly optional?: boolean;
+    readonly pattern?: RegExp;
+}
+export interface ServiceSpec<K extends ServiceKind = ServiceKind> {
+    readonly kind: K;
+    readonly label: string;
+    /** Handed over only when one of these is on for this boot. */
+    readonly usedBy: readonly UsedBy[];
+    readonly sources: readonly AccountSource[];
+    /** Works in one sandbox at a time (a lease on this PC). */
+    readonly singleHolder: boolean;
+    /** The sandbox may hand a renewed one back. */
+    readonly returns: boolean;
+    /** The largest payload (its JSON) accepted from a file or a sandbox. */
+    readonly maxBytes: number;
+    /** Shown on every surface. */
+    readonly warnings: readonly string[];
+    /** What `login` asks for, or what `import --from` needs besides the file. */
+    readonly fields: readonly ServiceField[];
+}
+export declare const SERVICE_SPECS: {
+    readonly [K in ServiceKind]: ServiceSpec<K>;
+};
+/** Where a sandbox leaves a renewed sign-in, under the data folder: state\accounts\<kind>.json. */
+export declare const HANDOFF_PARTS: readonly ["state", "accounts"];
+export declare function isServiceKind(value: string): value is ServiceKind;
+/** Whether a sign-in is wanted when these toolchains are on. */
+export declare function serviceWanted(kind: ServiceKind, on: ReadonlySet<UsedBy>): boolean;

package/dist/shared/accounts/kinds.js

@@ -0,0 +1,154 @@
+// Service sign-ins a sandbox can keep (accounts.<kind>.share): what each one is, which toolchains use it, where it can
+// come from, and the rules for handing it over (one sandbox at a time, handed back when renewed). Pure, web-safe: no
+// Node built-ins. The payload shapes are in payloads.ts, the host side in host/accounts, the sandbox side in
+// guest/accounts.
+export const SERVICE_KINDS = ['epic', 'steam', 'unity', 'cfx', 'keystore', 'play', 'expo', 'appstore'];
+export const USED_BY = [
+    'unreal',
+    'steam',
+    'unity',
+    'fivem',
+    'android',
+    'flutter',
+    'reactNative',
+    'godot',
+    'dotnet',
+];
+export const ACCOUNT_SOURCES = ['pc', 'file', 'typed', 'sandbox'];
+const AGENT_CAN_USE = 'The agent in the sandbox can use this sign-in while it is there.';
+const ONE_PLACE = 'It works in one sandbox at a time: a second sandbox starts without it while the first one runs.';
+export const SERVICE_SPECS = {
+    epic: {
+        kind: 'epic',
+        label: 'Epic Games',
+        usedBy: ['unreal'],
+        sources: ['pc', 'sandbox'],
+        singleHolder: true,
+        returns: true,
+        maxBytes: 64 * 1024,
+        warnings: [
+            AGENT_CAN_USE,
+            "A sign-in works in one place at a time: taking this PC's signs the launcher on this PC out the first time a sandbox uses it.",
+        ],
+        fields: [],
+    },
+    steam: {
+        kind: 'steam',
+        label: 'Steam (SteamCMD)',
+        usedBy: ['steam'],
+        sources: ['file', 'sandbox'],
+        singleHolder: true,
+        returns: true,
+        maxBytes: 768 * 1024,
+        warnings: [
+            AGENT_CAN_USE + ' It can upload builds and workshop items to your Steam apps.',
+            ONE_PLACE,
+            'No password is kept: sign in once with sbx-steam login in a sandbox (Steam Guard asks there).',
+        ],
+        fields: [],
+    },
+    unity: {
+        kind: 'unity',
+        label: 'Unity',
+        usedBy: ['unity'],
+        sources: ['pc', 'file', 'typed', 'sandbox'],
+        singleHolder: true,
+        returns: true,
+        maxBytes: 256 * 1024,
+        warnings: [
+            AGENT_CAN_USE,
+            ONE_PLACE,
+            'A Pro seat is handed back when the sandbox stops cleanly; a sandbox closed abruptly may keep it until you return it.',
+        ],
+        fields: [
+            { name: 'email', label: 'Unity ID email', secret: false, optional: true },
+            { name: 'password', label: 'Unity ID password', secret: true, optional: true },
+            { name: 'serial', label: 'Serial (Plus or Pro; empty for Personal)', secret: true, optional: true },
+        ],
+    },
+    cfx: {
+        kind: 'cfx',
+        label: 'Cfx.re (FiveM / RedM server key)',
+        usedBy: ['fivem'],
+        sources: ['typed'],
+        singleHolder: false,
+        returns: false,
+        maxBytes: 4 * 1024,
+        warnings: [AGENT_CAN_USE + ' Anyone with the key can run a server under your Cfx.re account.'],
+        fields: [
+            { name: 'licenseKey', label: 'Server licence key (cfxk_...)', secret: true, pattern: /^cfxk_[A-Za-z0-9_]+$/ },
+            {
+                name: 'steamWebApiKey',
+                label: 'Steam Web API key (optional)',
+                secret: true,
+                optional: true,
+                pattern: /^[A-F0-9]{32}$/,
+            },
+        ],
+    },
+    keystore: {
+        kind: 'keystore',
+        label: 'Android upload keystore',
+        usedBy: ['android'],
+        sources: ['file'],
+        singleHolder: false,
+        returns: false,
+        maxBytes: 512 * 1024,
+        warnings: [AGENT_CAN_USE + ' It can sign app updates as you; keep a backup of the keystore elsewhere.'],
+        fields: [
+            { name: 'storePassword', label: 'Keystore password', secret: true },
+            { name: 'keyAlias', label: 'Key alias', secret: false },
+            { name: 'keyPassword', label: 'Key password', secret: true },
+        ],
+    },
+    play: {
+        kind: 'play',
+        label: 'Google Play (service account)',
+        usedBy: ['android'],
+        sources: ['file'],
+        singleHolder: false,
+        returns: false,
+        maxBytes: 128 * 1024,
+        warnings: [AGENT_CAN_USE + ' It can publish to Google Play with what the service account is allowed.'],
+        fields: [],
+    },
+    expo: {
+        kind: 'expo',
+        label: 'Expo (EAS)',
+        usedBy: ['reactNative'],
+        sources: ['typed'],
+        singleHolder: false,
+        returns: false,
+        maxBytes: 4 * 1024,
+        warnings: [AGENT_CAN_USE + ' It can start EAS builds and submissions on your Expo account.'],
+        fields: [{ name: 'token', label: 'Expo access token', secret: true }],
+    },
+    appstore: {
+        kind: 'appstore',
+        label: 'App Store Connect API key',
+        usedBy: ['reactNative', 'flutter'],
+        sources: ['file', 'typed'],
+        singleHolder: false,
+        returns: false,
+        maxBytes: 16 * 1024,
+        warnings: [AGENT_CAN_USE + ' It can upload and submit apps with what the key is allowed.'],
+        fields: [
+            { name: 'issuerId', label: 'Issuer ID', secret: false },
+            { name: 'keyId', label: 'Key ID', secret: false, pattern: /^[A-Z0-9]{10}$/ },
+        ],
+    },
+};
+/** Where a sandbox leaves a renewed sign-in, under the data folder: state\accounts\<kind>.json. */
+export const HANDOFF_PARTS = ['state', 'accounts'];
+/** The toolchains that build for Android and so want its signing keys (they turn the Android toolchain on). */
+const ANDROID_USERS = ['flutter', 'reactNative', 'godot', 'unity'];
+export function isServiceKind(value) {
+    return SERVICE_KINDS.includes(value);
+}
+/** Whether a sign-in is wanted when these toolchains are on. */
+export function serviceWanted(kind, on) {
+    const spec = SERVICE_SPECS[kind];
+    if (spec.usedBy.some((u) => on.has(u)))
+        return true;
+    return spec.usedBy.includes('android') && ANDROID_USERS.some((u) => on.has(u));
+}

package/dist/shared/accounts/payloads.d.ts

@@ -0,0 +1,151 @@
+import { z } from 'zod';
+import { type ServiceKind } from './kinds.js';
+/** The Epic Games Launcher's "Remember me" (the Data value of [RememberMe] in its GameUserSettings.ini). */
+export declare const EpicPayloadSchema: z.ZodObject<{
+    data: z.ZodString;
+}, z.core.$strict>;
+/** SteamCMD's cached login: config\config.vdf (ConnectCache) and the ssfn sentry files. No password. */
+export declare const SteamPayloadSchema: z.ZodObject<{
+    account: z.ZodString;
+    configVdf: z.ZodString;
+    sentries: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        base64: z.ZodString;
+    }, z.core.$strict>>;
+    client: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** A Unity licence file (Unity_lic.ulf), and the Unity ID to sign in with when it has to be made again. */
+export declare const UnityPayloadSchema: z.ZodObject<{
+    ulf: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    serial: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** A FiveM / RedM server licence key from the Cfx.re keymaster, and an optional Steam Web API key. */
+export declare const CfxPayloadSchema: z.ZodObject<{
+    licenseKey: z.ZodString;
+    steamWebApiKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** An Android upload keystore and what opens it. */
+export declare const KeystorePayloadSchema: z.ZodObject<{
+    fileName: z.ZodString;
+    jksBase64: z.ZodString;
+    storePassword: z.ZodString;
+    keyAlias: z.ZodString;
+    keyPassword: z.ZodString;
+}, z.core.$strict>;
+/** A Google Play service account key (its JSON file). */
+export declare const PlayPayloadSchema: z.ZodObject<{
+    serviceAccountJson: z.ZodString;
+}, z.core.$strict>;
+/** An Expo access token (EXPO_TOKEN). */
+export declare const ExpoPayloadSchema: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strict>;
+/** An App Store Connect API key: its issuer, its ID and the .p8 private key. */
+export declare const AppstorePayloadSchema: z.ZodObject<{
+    issuerId: z.ZodString;
+    keyId: z.ZodString;
+    p8: z.ZodString;
+}, z.core.$strict>;
+export declare const PAYLOADS: {
+    readonly epic: z.ZodObject<{
+        data: z.ZodString;
+    }, z.core.$strict>;
+    readonly steam: z.ZodObject<{
+        account: z.ZodString;
+        configVdf: z.ZodString;
+        sentries: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            base64: z.ZodString;
+        }, z.core.$strict>>;
+        client: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly unity: z.ZodObject<{
+        ulf: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+        serial: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly cfx: z.ZodObject<{
+        licenseKey: z.ZodString;
+        steamWebApiKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly keystore: z.ZodObject<{
+        fileName: z.ZodString;
+        jksBase64: z.ZodString;
+        storePassword: z.ZodString;
+        keyAlias: z.ZodString;
+        keyPassword: z.ZodString;
+    }, z.core.$strict>;
+    readonly play: z.ZodObject<{
+        serviceAccountJson: z.ZodString;
+    }, z.core.$strict>;
+    readonly expo: z.ZodObject<{
+        token: z.ZodString;
+    }, z.core.$strict>;
+    readonly appstore: z.ZodObject<{
+        issuerId: z.ZodString;
+        keyId: z.ZodString;
+        p8: z.ZodString;
+    }, z.core.$strict>;
+};
+export type Payload<K extends ServiceKind> = z.output<(typeof PAYLOADS)[K]>;
+export type AnyPayload = Payload<ServiceKind>;
+export type Payloads = Partial<{
+    [K in ServiceKind]: Payload<K>;
+}>;
+/** The secrets-file field: the sign-ins this launch hands over, each optional. */
+export declare const ServiceAccountsSchema: z.ZodObject<{
+    epic: z.ZodOptional<z.ZodObject<{
+        data: z.ZodString;
+    }, z.core.$strict>>;
+    steam: z.ZodOptional<z.ZodObject<{
+        account: z.ZodString;
+        configVdf: z.ZodString;
+        sentries: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            base64: z.ZodString;
+        }, z.core.$strict>>;
+        client: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    unity: z.ZodOptional<z.ZodObject<{
+        ulf: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+        serial: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    cfx: z.ZodOptional<z.ZodObject<{
+        licenseKey: z.ZodString;
+        steamWebApiKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    keystore: z.ZodOptional<z.ZodObject<{
+        fileName: z.ZodString;
+        jksBase64: z.ZodString;
+        storePassword: z.ZodString;
+        keyAlias: z.ZodString;
+        keyPassword: z.ZodString;
+    }, z.core.$strict>>;
+    play: z.ZodOptional<z.ZodObject<{
+        serviceAccountJson: z.ZodString;
+    }, z.core.$strict>>;
+    expo: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+    }, z.core.$strict>>;
+    appstore: z.ZodOptional<z.ZodObject<{
+        issuerId: z.ZodString;
+        keyId: z.ZodString;
+        p8: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ServiceAccounts = z.output<typeof ServiceAccountsSchema>;
+/** A launch's id (generate.ts: "<ms>-<6 hex>"). */
+export declare const LaunchIdSchema: z.ZodString;
+/** What a sandbox leaves in state\accounts\<kind>.json: the renewed sign-in and the launch it belongs to. */
+export declare function handoffSchema<K extends ServiceKind>(kind: K): z.ZodType<{
+    kind: K;
+    launchId: string;
+    payload: Payload<K>;
+}>;
+/** The kinds that are in a secrets-file field, in order. */
+export declare function deliveredKinds(given: ServiceAccounts | undefined): ServiceKind[];