windows-development-sandbox 1.17.3 → 1.18.2

package/dist/app/features/accounts/services.def.d.ts

@@ -0,0 +1,111 @@
+import { z } from 'zod';
+import { type Page, type Section } from '../../kernel/index.js';
+/** The kinds, as the help says them (the self-test checks this against shared/accounts SERVICE_KINDS). */
+export declare const SERVICE_NAMES_TEXT = "epic, steam, unity, cfx, keystore, play, expo or appstore";
+export declare const ServiceRowSchema: z.ZodObject<{
+    kind: z.ZodString;
+    label: z.ZodString;
+    share: z.ZodBoolean;
+    state: z.ZodEnum<{
+        none: "none";
+        saved: "saved";
+        unreadable: "unreadable";
+    }>;
+    source: z.ZodNullable<z.ZodString>;
+    savedAt: z.ZodNullable<z.ZodString>;
+    summary: z.ZodNullable<z.ZodString>;
+    heldBy: z.ZodNullable<z.ZodString>;
+    usedBy: z.ZodArray<z.ZodString>;
+    warnings: z.ZodArray<z.ZodString>;
+    canImport: z.ZodBoolean;
+    canLogin: z.ZodBoolean;
+    needsFile: z.ZodBoolean;
+}, z.core.$strip>;
+export type ServiceRow = z.output<typeof ServiceRowSchema>;
+export declare const ServicesListSchema: z.ZodObject<{
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ServicesList = z.output<typeof ServicesListSchema>;
+/** `sandbox account status`: one line per service. */
+export declare function servicesText(o: ServicesList): string;
+export declare const listServices: import("../../kernel/define.js").QueryDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    services: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        share: z.ZodBoolean;
+        state: z.ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: z.ZodNullable<z.ZodString>;
+        savedAt: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        heldBy: z.ZodNullable<z.ZodString>;
+        usedBy: z.ZodArray<z.ZodString>;
+        warnings: z.ZodArray<z.ZodString>;
+        canImport: z.ZodBoolean;
+        canLogin: z.ZodBoolean;
+        needsFile: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>, "accounts.services">;
+export declare const serviceImport: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.import">;
+export declare const serviceLogin: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.login">;
+export declare const serviceLogout: import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deleted: z.ZodBoolean;
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.logout">;
+export declare const SERVICE_OPERATIONS: readonly [import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.import">, import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.login">, import("../../kernel/define.js").OperationDef<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    deleted: z.ZodBoolean;
+    message: z.ZodString;
+}, z.core.$strip>, "accounts.service.logout">];
+/** The category id of a service in the menu and its section id on the web. */
+export declare function serviceCategory(kind: string): string;
+/** One service's section: its facts, its warnings and its actions. */
+export declare function serviceSection(s: ServiceRow): Section;
+/** The sections of every service (appended to the accounts page on the web). */
+export declare function serviceSections(o: ServicesList): Section[];
+/** One service's page for the menu: its section, and its actions as keys. */
+export declare function servicePage(s: ServiceRow): Page;

package/dist/app/features/accounts/services.def.js

@@ -0,0 +1,187 @@
+// Service sign-ins for sandboxes (accounts.<kind>.share): Epic, Steam, Unity, Cfx.re, signing keys and app-store
+// keys. Whether each one is shared and saved (where it came from and when, never its value), taking one from this PC
+// or a file, typing one, and forgetting it. Pure: schemas, labels and page builders; services.run.ts does the work.
+// The kinds live in shared/accounts (a def imports no shared code): the query's rows carry everything a page shows.
+import { z } from 'zod';
+import { action } from '../../kernel/index.js';
+import { defineOperation, defineQuery } from '../../kernel/index.js';
+import { setSetting } from '../settings/settings.def.js';
+/** The kinds, as the help says them (the self-test checks this against shared/accounts SERVICE_KINDS). */
+export const SERVICE_NAMES_TEXT = 'epic, steam, unity, cfx, keystore, play, expo or appstore';
+const KindSchema = z
+    .string()
+    .max(40)
+    .optional()
+    .describe('the service: ' + SERVICE_NAMES_TEXT);
+export const ServiceRowSchema = z.object({
+    kind: z.string().describe('The service (epic, steam ...)'),
+    label: z.string().describe('Its name'),
+    share: z.boolean().describe('Sandboxes get it (setting accounts.<kind>.share)'),
+    state: z.enum(['none', 'saved', 'unreadable']).describe('Whether one is saved and can be opened by you'),
+    source: z.string().nullable().describe('Where the saved one came from: pc, file, typed or sandbox'),
+    savedAt: z.string().nullable().describe('When it was saved'),
+    summary: z.string().nullable().describe('Which account (never the secret)'),
+    heldBy: z.string().nullable().describe('The data set whose sandbox holds it now (one-holder services)'),
+    usedBy: z.array(z.string()).describe('The toolchains it is handed over for'),
+    warnings: z.array(z.string()).describe('What everyone who shares it must know'),
+    canImport: z.boolean().describe('It can be taken from this PC or a file (sandbox account import)'),
+    canLogin: z.boolean().describe('It can be typed (sandbox account login)'),
+    needsFile: z.boolean().describe('Importing it needs --from <file>'),
+});
+export const ServicesListSchema = z.object({ services: z.array(ServiceRowSchema) });
+const STATE_TEXT = {
+    none: 'not saved',
+    saved: 'saved (encrypted)',
+    unreadable: 'cannot be read',
+};
+const STATE_TONE = {
+    none: 'muted',
+    saved: 'ok',
+    unreadable: 'danger',
+};
+const SOURCE_TEXT = {
+    pc: 'taken from this PC',
+    file: 'from a file',
+    typed: 'typed in',
+    sandbox: 'signed in (or renewed) in a sandbox',
+};
+const day = (iso) => (iso ? iso.slice(0, 10) : '');
+/** `sandbox account status`: one line per service. */
+export function servicesText(o) {
+    const table = [
+        ['SERVICE', 'SHARE', 'SIGN-IN', 'SAVED', 'NOTE'],
+        ...o.services.map((s) => [
+            s.kind,
+            s.share ? 'on' : 'off',
+            STATE_TEXT[s.state],
+            day(s.savedAt) || '-',
+            [s.summary, s.heldBy ? 'in use by sandbox ' + s.heldBy : null].filter(Boolean).join(', ') || '-',
+        ]),
+    ];
+    const widths = table[0].map((_, i) => Math.max(...table.map((r) => r[i].length)));
+    return table
+        .map((r) => r.map((cell, i) => (i === r.length - 1 ? cell : cell.padEnd(widths[i] + 2))).join(''))
+        .join('\n');
+}
+export const listServices = defineQuery({
+    id: 'accounts.services',
+    title: 'Services',
+    summary: 'service sign-ins for sandboxes (Epic, Steam, Unity, signing keys ...): shared or not, saved or not',
+    input: z.object({ name: KindSchema }),
+    output: ServicesListSchema,
+    text: servicesText,
+    cli: { name: 'account', action: 'status', positional: ['name'], json: true },
+});
+const MessageSchema = z.object({ message: z.string().describe('What happened') });
+export const serviceImport = defineOperation({
+    id: 'accounts.service.import',
+    title: 'Import…',
+    summary: "save a service sign-in from this PC's program or a file, for sandboxes",
+    input: z.object({
+        name: KindSchema,
+        from: z.string().max(1000).optional().describe('(import) the file or folder to take the sign-in from'),
+    }),
+    output: MessageSchema,
+    text: (o) => o.message,
+    cli: { name: 'account', action: 'import', positional: ['name'], flags: { from: { flag: '--from', value: 'path' } } },
+});
+export const serviceLogin = defineOperation({
+    id: 'accounts.service.login',
+    title: 'Sign in…',
+    summary: 'type a service key or token to keep for sandboxes',
+    input: z.object({ name: KindSchema }),
+    output: MessageSchema,
+    text: (o) => o.message,
+    cli: { name: 'account', action: 'login', positional: ['name'] },
+});
+export const serviceLogout = defineOperation({
+    id: 'accounts.service.logout',
+    title: 'Forget…',
+    summary: 'delete a saved service sign-in, and every copy a sandbox left that this PC has not taken yet',
+    danger: true,
+    input: z.object({ name: KindSchema }),
+    output: z.object({ deleted: z.boolean().describe('One was saved and is gone'), message: z.string() }),
+    text: (o) => o.message,
+    cli: { name: 'account', action: 'logout', positional: ['name'] },
+});
+export const SERVICE_OPERATIONS = [serviceImport, serviceLogin, serviceLogout];
+/** The category id of a service in the menu and its section id on the web. */
+export function serviceCategory(kind) {
+    return 'service:' + kind;
+}
+/** What can be done with one service: share or stop, import, sign in, forget. */
+function serviceActions(s) {
+    return [
+        action(setSetting, { scope: 'user', key: 'accounts.' + s.kind + '.share', value: !s.share }, {
+            key: 't',
+            verb: s.share ? 'stop sharing' : 'share',
+            label: s.share ? 'Stop sharing' : 'Share with sandboxes',
+            importance: 1,
+        }),
+        ...(s.canImport ? [action(serviceImport, { name: s.kind }, { key: 'i', verb: 'import', importance: 1 })] : []),
+        ...(s.canLogin ? [action(serviceLogin, { name: s.kind }, { key: 'n', verb: 'sign in', importance: 1 })] : []),
+        ...(s.state !== 'none'
+            ? [action(serviceLogout, { name: s.kind }, { key: 'x', verb: 'forget', importance: 2 })]
+            : []),
+    ];
+}
+/** How to get a first sign-in, in words. */
+function howTo(s) {
+    const ways = [
+        ...(s.canImport ? ['sandbox account import ' + s.kind + (s.needsFile ? ' --from <file>' : '')] : []),
+        ...(s.canLogin ? ['sandbox account login ' + s.kind] : []),
+    ];
+    return ways.length ? ways.join(', or ') : 'sign in once inside a sandbox';
+}
+/** One service's section: its facts, its warnings and its actions. */
+export function serviceSection(s) {
+    const facts = [
+        {
+            id: s.kind + ':share',
+            label: 'Shared with sandboxes',
+            value: s.share ? 'on' : 'off  (sandbox config set accounts.' + s.kind + '.share true)',
+            tone: s.share ? 'ok' : 'muted',
+            description: 'For sandboxes that use ' + s.usedBy.join(' or ') + '. ' + s.warnings.join(' '),
+        },
+        {
+            id: s.kind + ':state',
+            label: 'Sign-in',
+            value: STATE_TEXT[s.state] + (s.savedAt ? '  ' + day(s.savedAt) : ''),
+            tone: STATE_TONE[s.state],
+            description: s.state === 'none' ? 'Save one: ' + howTo(s) + '.' : undefined,
+        },
+        ...(s.source ? [{ id: s.kind + ':source', label: 'From', value: SOURCE_TEXT[s.source] ?? s.source }] : []),
+        ...(s.summary ? [{ id: s.kind + ':summary', label: 'Account', value: s.summary }] : []),
+        ...(s.heldBy
+            ? [{ id: s.kind + ':held', label: 'In use by', value: 'sandbox ' + s.heldBy, tone: 'accent' }]
+            : []),
+    ];
+    const warnings = s.warnings.map((w, i) => ({
+        id: s.kind + ':warning:' + i,
+        label: w,
+        tone: 'warn',
+        group: 'Before you share it',
+    }));
+    const notes = [
+        ...(s.state === 'unreadable'
+            ? [{ text: 'Only the Windows user that saved it can read it: save it again.', tone: 'muted' }]
+            : []),
+    ];
+    return {
+        id: serviceCategory(s.kind),
+        title: s.label,
+        summary: (s.share ? 'shared' : 'not shared') + ' · ' + STATE_TEXT[s.state],
+        facts,
+        items: warnings,
+        notes,
+        actions: serviceActions(s),
+    };
+}
+/** The sections of every service (appended to the accounts page on the web). */
+export function serviceSections(o) {
+    return o.services.map(serviceSection);
+}
+/** One service's page for the menu: its section, and its actions as keys. */
+export function servicePage(s) {
+    return { title: 'Accounts', sections: [serviceSection(s)] };
+}

package/dist/app/features/accounts/services.run.d.ts

@@ -0,0 +1,65 @@
+import type { Config } from '../../../core/types.js';
+import { AccountLeases, ServiceAccountStore, type PcEnv } from '../../../host/accounts/index.js';
+import { type ServiceKind } from '../../../shared/accounts/index.js';
+import { type OperationIO } from '../../kernel/index.js';
+import { type ServiceRow } from './services.def.js';
+/** One service's row: never the sign-in, and the store's summary through safeText. */
+export declare function serviceRow(kind: ServiceKind, config: Config, store: ServiceAccountStore, leases: AccountLeases): ServiceRow;
+export interface ImportDeps {
+    readonly store: ServiceAccountStore;
+    readonly pc: PcEnv;
+    readonly share: boolean;
+}
+/** Saves a kind's sign-in from this PC's program or from a file, after a confirmation (--yes answers it). */
+export declare function importServiceFlow(io: OperationIO, kind: ServiceKind, from: string | undefined, deps: ImportDeps): Promise<{
+    message: string;
+}>;
+/** Saves what you type for a kind (a key, a token). */
+export declare function loginServiceFlow(io: OperationIO, kind: ServiceKind, deps: Omit<ImportDeps, 'pc'>): Promise<{
+    message: string;
+}>;
+/** Forgets a kind's sign-in everywhere after asking (--yes answers it). */
+export declare function logoutServiceFlow(io: OperationIO, kind: ServiceKind, storageRoot: string, store: ServiceAccountStore, leases: AccountLeases): Promise<{
+    deleted: boolean;
+    message: string;
+}>;
+export declare const listServicesRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").QueryDef<import("zod").ZodObject<{
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    services: import("zod").ZodArray<import("zod").ZodObject<{
+        kind: import("zod").ZodString;
+        label: import("zod").ZodString;
+        share: import("zod").ZodBoolean;
+        state: import("zod").ZodEnum<{
+            none: "none";
+            saved: "saved";
+            unreadable: "unreadable";
+        }>;
+        source: import("zod").ZodNullable<import("zod").ZodString>;
+        savedAt: import("zod").ZodNullable<import("zod").ZodString>;
+        summary: import("zod").ZodNullable<import("zod").ZodString>;
+        heldBy: import("zod").ZodNullable<import("zod").ZodString>;
+        usedBy: import("zod").ZodArray<import("zod").ZodString>;
+        warnings: import("zod").ZodArray<import("zod").ZodString>;
+        canImport: import("zod").ZodBoolean;
+        canLogin: import("zod").ZodBoolean;
+        needsFile: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>, "accounts.services">, import("../../../cli/commands/context.js").Context>;
+export declare const serviceImportRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    from: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "accounts.service.import">, import("../../../cli/commands/context.js").Context>;
+export declare const serviceLoginRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "accounts.service.login">, import("../../../cli/commands/context.js").Context>;
+export declare const serviceLogoutRun: import("../../kernel/define.js").Implementation<import("../../kernel/define.js").OperationDef<import("zod").ZodObject<{
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    deleted: import("zod").ZodBoolean;
+    message: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "accounts.service.logout">, import("../../../cli/commands/context.js").Context>;

package/dist/app/features/accounts/services.run.js

@@ -0,0 +1,212 @@
+// The service sign-ins' work: their status, taking one from this PC or a file, typing one, and forgetting one
+// everywhere. Talks only through io; the sign-in itself is never an output, a log line or part of a question. The
+// flows take the store, the leases and this PC's folders, so the self-test runs them with its own.
+import fs from 'node:fs';
+import path from 'node:path';
+import { requireOnPc } from '../../../cli/commands/context.js';
+import { fail, safeText } from '../../../core/util/index.js';
+import { AccountLeases, forgetEverywhere, HOST_SOURCES, pcEnv, ServiceAccountStore, } from '../../../host/accounts/index.js';
+import { isServiceKind, SERVICE_KINDS, SERVICE_SPECS, } from '../../../shared/accounts/index.js';
+import { readBoundedFile } from '../../../shared/io/index.js';
+import { implement } from '../../context.js';
+import { cancelled } from '../../kernel/index.js';
+import { listServices, serviceImport, serviceLogin, serviceLogout } from './services.def.js';
+/** One service's row: never the sign-in, and the store's summary through safeText. */
+export function serviceRow(kind, config, store, leases) {
+    const spec = SERVICE_SPECS[kind];
+    const source = HOST_SOURCES[kind];
+    const state = store.state(kind);
+    const info = state === 'none' ? null : store.info(kind);
+    const holder = spec.singleHolder ? leases.holder(kind) : null;
+    return {
+        kind,
+        label: spec.label,
+        share: config.accounts[kind].share,
+        state,
+        source: info?.source ?? null,
+        savedAt: info?.savedAt ?? null,
+        summary: info?.summary ? safeText(info.summary) : null,
+        heldBy: holder ? safeText(holder.dataSet) : null,
+        usedBy: [...spec.usedBy],
+        warnings: [...spec.warnings],
+        canImport: Boolean(source.fromPc || source.fromFile),
+        canLogin: Boolean(source.fromAnswers),
+        needsFile: Boolean(source.fromFile && !source.fromPc),
+    };
+}
+/** The kind an operation is about: the name given (checked), else asked. */
+async function kindOf(io, given, verb, offered = () => true) {
+    if (given !== undefined) {
+        const name = given.trim().toLowerCase();
+        if (!isServiceKind(name))
+            fail('There is no service called "' + safeText(given) + '".', 'Use one of: ' + SERVICE_KINDS.join(', '));
+        return name;
+    }
+    const choices = SERVICE_KINDS.filter((k) => offered(SERVICE_SPECS[k])).map((k) => ({
+        value: k,
+        label: SERVICE_SPECS[k].label,
+    }));
+    if (!choices.length)
+        fail('No service can do that.');
+    const picked = await io.choose({ title: 'Which service do you want to ' + verb + '?', choices });
+    if (picked === undefined || !isServiceKind(picked))
+        cancelled();
+    return picked;
+}
+/** Asks for the kind's fields; optional ones may stay empty. */
+async function askFields(io, spec) {
+    const answers = {};
+    for (const field of spec.fields) {
+        const validate = (value) => {
+            const v = value.trim();
+            if (!v)
+                return field.optional ? true : 'This one is needed.';
+            return !field.pattern || field.pattern.test(v) ? true : 'That does not look right for ' + field.label + '.';
+        };
+        const title = field.label + (field.optional ? ' (Enter to skip)' : '') + ':';
+        const answer = field.secret
+            ? await io.secret({ title, validate })
+            : await io.text({ title, validate, allowEmpty: Boolean(field.optional) });
+        if (answer === undefined) {
+            if (field.optional)
+                continue;
+            cancelled();
+        }
+        if (answer.trim())
+            answers[field.name] = answer.trim();
+    }
+    return answers;
+}
+function savedMessage(kind, share) {
+    return ('Saved your ' +
+        SERVICE_SPECS[kind].label +
+        ' sign-in (encrypted for your Windows user).' +
+        (share ? '' : ' Sandboxes get it once you share it: sandbox config set accounts.' + kind + '.share true'));
+}
+/** Saves a kind's sign-in from this PC's program or from a file, after a confirmation (--yes answers it). */
+export async function importServiceFlow(io, kind, from, deps) {
+    const spec = SERVICE_SPECS[kind];
+    const source = HOST_SOURCES[kind];
+    if (!source.fromPc && !source.fromFile)
+        fail(spec.label + ' cannot be imported.', 'Type it instead: sandbox account login ' + kind);
+    let file = from === undefined ? undefined : path.resolve(from);
+    const isFile = (p) => {
+        try {
+            return fs.statSync(p).isFile();
+        }
+        catch {
+            return false;
+        }
+    };
+    const useFile = Boolean(source.fromFile && (file ? isFile(file) : !source.fromPc));
+    if (useFile && !file) {
+        const asked = await io.path({ title: 'The ' + spec.label + ' file:', pathKind: 'file' });
+        if (asked === undefined)
+            cancelled();
+        file = path.resolve(asked);
+    }
+    const yes = await io.confirm({
+        title: useFile
+            ? 'Save the ' + spec.label + ' sign-in from this file for sandboxes?'
+            : "Take this PC's " + spec.label + ' sign-in for sandboxes?',
+        lines: [...spec.warnings],
+        yes: 'Save it',
+        noTerminal: { message: 'Cannot ask here (no terminal).', fix: 'Add --yes to save it without asking.' },
+    });
+    if (!yes)
+        cancelled('Nothing saved.');
+    let payload;
+    let saved;
+    if (useFile) {
+        const bytes = readBoundedFile(file, spec.maxBytes);
+        if (!bytes)
+            fail('Cannot read ' + file + ' (missing, a link, or bigger than ' + spec.maxBytes / 1024 + ' KB).');
+        payload = source.fromFile(bytes, await askFields(io, spec));
+        saved = 'file';
+    }
+    else {
+        payload = source.fromPc(deps.pc, file);
+        saved = 'pc';
+    }
+    if (!payload)
+        return {
+            message: 'No saved ' +
+                spec.label +
+                ' sign-in found on this PC' +
+                (file ? ' in ' + file : '') +
+                (spec.returns ? ' (sign in there first, or sign in once inside a sandbox).' : '.'),
+        };
+    deps.store.save(kind, payload, saved, source.summary(payload));
+    for (const w of spec.warnings)
+        io.log(w, 'warn');
+    return { message: savedMessage(kind, deps.share) };
+}
+/** Saves what you type for a kind (a key, a token). */
+export async function loginServiceFlow(io, kind, deps) {
+    const spec = SERVICE_SPECS[kind];
+    const source = HOST_SOURCES[kind];
+    if (!source.fromAnswers)
+        fail(spec.label + ' has nothing to type.', spec.sources.includes('sandbox')
+            ? 'Sign in once inside a sandbox (it is kept), or: sandbox account import ' + kind
+            : 'Run: sandbox account import ' + kind + ' --from <file>');
+    const payload = source.fromAnswers(await askFields(io, spec));
+    deps.store.save(kind, payload, 'typed', source.summary(payload));
+    for (const w of spec.warnings)
+        io.log(w, 'warn');
+    return { message: savedMessage(kind, deps.share) };
+}
+/** Forgets a kind's sign-in everywhere after asking (--yes answers it). */
+export async function logoutServiceFlow(io, kind, storageRoot, store, leases) {
+    const label = SERVICE_SPECS[kind].label;
+    const yes = await io.confirm({
+        title: 'Forget the saved ' + label + ' sign-in?',
+        lines: ['The next sandboxes start signed out; a copy a sandbox left behind is deleted too.'],
+        yes: 'Forget',
+        danger: true,
+        noTerminal: { message: 'Cannot ask here (no terminal).', fix: 'Add --yes to forget it without asking.' },
+    });
+    if (!yes)
+        cancelled('Nothing changed.');
+    const { removed, pendingDeleted } = forgetEverywhere(kind, storageRoot, store, leases);
+    if (!removed && !pendingDeleted)
+        return { deleted: false, message: 'No ' + label + ' sign-in was saved.' };
+    return {
+        deleted: true,
+        message: 'The saved ' +
+            label +
+            ' sign-in is deleted' +
+            (pendingDeleted ? ' (and ' + pendingDeleted + ' copy a sandbox left)' : '') +
+            '. The next sandboxes start signed out.',
+    };
+}
+export const listServicesRun = implement(listServices, async (ctx, input) => {
+    const store = new ServiceAccountStore(ctx.storageRoot);
+    const leases = new AccountLeases(ctx.storageRoot);
+    const name = input.name?.trim().toLowerCase();
+    if (name !== undefined && name !== '' && !isServiceKind(name))
+        fail('There is no service called "' + safeText(input.name ?? '') + '".', 'Use one of: ' + SERVICE_KINDS.join(', '));
+    const kinds = name ? [name] : [...SERVICE_KINDS];
+    return { services: kinds.map((k) => serviceRow(k, ctx.loaded.config, store, leases)) };
+});
+export const serviceImportRun = implement(serviceImport, async (ctx, input, io) => {
+    requireOnPc('account import');
+    const kind = await kindOf(io, input.name, 'import', (s) => Boolean(HOST_SOURCES[s.kind].fromPc || HOST_SOURCES[s.kind].fromFile));
+    return importServiceFlow(io, kind, input.from, {
+        store: new ServiceAccountStore(ctx.storageRoot),
+        pc: pcEnv(),
+        share: ctx.loaded.config.accounts[kind].share,
+    });
+});
+export const serviceLoginRun = implement(serviceLogin, async (ctx, input, io) => {
+    requireOnPc('account login');
+    const kind = await kindOf(io, input.name, 'sign in to', (s) => Boolean(HOST_SOURCES[s.kind].fromAnswers));
+    return loginServiceFlow(io, kind, {
+        store: new ServiceAccountStore(ctx.storageRoot),
+        share: ctx.loaded.config.accounts[kind].share,
+    });
+});
+export const serviceLogoutRun = implement(serviceLogout, async (ctx, input, io) => {
+    requireOnPc('account logout');
+    const kind = await kindOf(io, input.name, 'forget');
+    return logoutServiceFlow(io, kind, ctx.storageRoot, new ServiceAccountStore(ctx.storageRoot), new AccountLeases(ctx.storageRoot));
+});