The smoke test can be somebody

Without a token the signed-in half of a gated catalog is untestable here: the
real credential store is the OS keychain reached through Electron, and there is
no Electron in this process, so every title comes back `signInRequired` and
"owned" and "not owned" never happen.

SMOKE_TOKEN supplies one. Against a live Orbit it now reports
`open:1, purchasable:1, entitled:1` — the free title, the one this account has
not bought, and the one it has — which is the first end-to-end proof that the
access block survives the whole path from the engine's policy to a card.

It only ever reads. A smoke run must not leave a credential on the machine that
ran it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -55,6 +55,45 @@ so there was no resource seal and Gatekeeper refused it outright rather than
 asking. `scripts/after-pack.js` signs the bundle during the build now, and the
 result verifies as `valid on disk`.
 
+## Signing in, and titles that cost money
+
+**Nothing in this client knows anything about a particular store.** What a title costs,
+whether it needs an account, where to buy it and where to sign in all arrive from the
+catalog's own server — WarpEngine 0.5 answers `GET /api/service` with what it offers, and
+puts an `access` block on every catalog entry. A client that carried those facts would
+work for exactly one shop; this one asks.
+
+Where the server offers no sign-in — every WarpEngine before 0.5, and any store that
+sells nothing — the window shows none, and behaves exactly as it always did.
+
+Where it does:
+
+- the side menu grows an **Account** block: *Sign in…*, and *Sign out* once you are;
+- signing in shows a **short code**. Your browser opens on the store's own page and you
+  type the code there; approving it signs this device in. Nothing is typed into this
+  window, and no password ever reaches it — that is the whole reason for the detour;
+- the token is kept in the **OS keychain** (Keychain, libsecret, DPAPI) through
+  Electron's `safeStorage`, one per store. Where no keychain is available it is not
+  stored at all rather than written out in the clear: the cost is signing in again next
+  run.
+
+On a card, what you may do with a title is separate from what this machine can run:
+
+- **owned** or free → *Install*, as before;
+- **not owned** → the **price** on the card and a **Buy** button, which opens the store's
+  page in your browser. Buying happens there, not here — a checkout rebuilt in this
+  window would be a second place to get card handling wrong. **Refresh** afterwards and
+  the card becomes an *Install*;
+- **signed out, catalog gates it** → *Sign in to install*, because the catalog cannot say
+  whether it is yours until it knows who is asking.
+
+Two new categories go with it: **Owned** and **To buy**. Owning something is not the
+same as having installed it, which is the point of the first one.
+
+A title nobody has bought is **not** dimmed. That treatment belongs to what this
+*machine* cannot do — an unsupported platform, no build for this architecture — and
+there is nothing wrong with the machine here.
+
 ## Which store it installs
 
 On first run the client fetches the registry and offers what it finds. One store
@@ -62,35 +101,34 @@ and there is nothing to decide; several and the setup screen shows a picker.
 
 ```json
 [
-  { "name": "Teletype Games", "catalogUrl": "https://teletypegames.org", "storeRepositoryUrl": null },
+  { "name": "Teletype Games", "catalogUrl": "https://teletypegames.org" },
-  {
+  { "name": "Some Other Store", "catalogUrl": "https://games.example.org" }
-    "name": "Some Other Store",
-    "catalogUrl": "https://games.example.org",
-    "storeRepositoryUrl": "https://git.example.org/stores/other-desktop-store"
-  }
 ]
 ```
 
-**A store needs no repository of its own.** A name and a catalog are enough: the
+**A name and a catalog are the whole record.** The store engine's built-in defaults
-store engine's built-in defaults already cover the host-to-asset mapping, the
+already cover the host-to-asset mapping, the install modes, the platforms and the
-install modes, the platforms and the behaviour, so what is actually missing from
+behaviour, so what is actually missing from them is identity — and identity is all a
-them is identity — a slug, a name and a catalog URL — and that is exactly what a
+registry says. Nothing a record carries decides where files go: how a store behaves is
-registry record carries. With `storeRepositoryUrl` null the client writes a
+fixed per installed client, which knows its own machine, and a copy of that on a server
-three-section config and the store installs.
+would be a second authority over decisions this side has already made.
 
 From a record the client works out the rest:
 
-- **the store id** — which names the store home and the folder games land in —
+- **the store id** — which names the store home and the folder games land in — is a slug
-  comes from the repository name when there is one (`ttg-desktop-store` becomes
+  of the catalog host (`teletypegames.org` becomes `teletypegames`), or of the display
-  `ttg`), otherwise from the catalog host (`teletypegames.org` becomes
+  name if that fails. Derived from the *catalog* on purpose: the catalog is what a store
-  `teletypegames`), otherwise from the display name. A `config.json` that sets its
+  is, so two records naming the same one are the same store and land in the same place.
-  own id keeps it.
+  Reinstalling therefore never orphans what is already installed.
-- **`catalogUrl` and `name`** override the config's own `store.base_url` and
+- **the games folder** is that same slug inside the OS's usual place for programs, and it
-  `store.name`. The registry says which catalog this store is *for*, so it wins.
+  is the only subtree this store will ever delete from. That is the whole of how two
-- **`storeRepositoryUrl`**, when given → the store's `config.json`, read from
+  stores on one machine stay out of each other's files: a subfolder, derived here.
-  `…/raw/branch/master/config.json`. That file stays the authority on how the store
+- **released, archived and demo** titles are listed, where the engine alone would show
-  behaves: which platforms, which statuses, where things land. A repository
+  released and archived only — a catalog that publishes a demo means it to be played.
-  **without** a `config.json` is treated as no repository at all.
+
+Because a record has no paths in it and no config, there is nothing for the window to
+tamper with: `RegistryStoreDtoMapper.toModel` can take its choice at face value, and the
+config that lands on disk is written by the installer from the engine's own defaults.
 
 What the defaults produce, for a record with no repository: the games land in a
 folder named after the store id, and released, archived **and demo** titles are
@@ -123,11 +161,14 @@ Everything that is not a title lives in the **side menu** on the left, and the
   catalog into different folders show their folder instead of their id, because
   the id would not tell them apart. **Add a store…** brings up the registry
   picker, the same one the first run offers.
+- **Account** appears only where the catalog offers a sign-in, and holds *Sign in…* or
+  *Sign out* — see above.
 - **Actions** holds **Refresh**, which re-reads the catalog. Titles are installed
   one at a time from their own cards; there is no install-everything button.
 - **Categories** narrows the grid, one category at a time, with the count next to
   each: *Everything*, *Installed*, *Updates*, *Not installed*, then a row per
   **platform** (`godot`, `tic80`, `love`, …) and per **kind** (native or hosted).
+  Where the catalog gates anything, **Owned** and **To buy** join them.
   The axes are built from what the catalog actually contains — a platform with no
   titles is not listed, and a category that disappears under you falls back to
   *Everything* rather than leaving an empty grid. There is no genre in a
@@ -178,6 +219,7 @@ names. `make` on its own lists everything.
 | `make check` | **typecheck, lint and both test suites** — the gate |
 | `make start` | run the app against whatever store is installed |
 | `make smoke` | drive the store with no window and no Electron at all |
+| `SMOKE_HOME=<dir> SMOKE_TOKEN=<bearer> npm run smoke` | the same, against a sandbox store and as a signed-in person |
 | `make uitest` | load the window once and report what rendered |
 | `SELFTEST_SHOT=shot.png npm run uitest` | the same, and the window photographs itself into that file |
 | `make test` | both test suites |
@@ -273,9 +315,14 @@ on its own: publishing 1.2.0 got *"invalid username, password or token"* on the
 second package while the first had just gone up with the same token, and the same
 command succeeded immediately afterwards.
 
-Package names contain a space — `WarpEngine Client-1.5.0-arm64.dmg` — so the list of
+Package names have no spaces in them — `WarpEngineClient-2.3.0-arm64.dmg` — because a
-files is passed one path per line rather than as one string; splitting it on
+space in a release asset is a space in every `curl`, script and shell command that ever
-whitespace is what broke the first attempt at publishing 1.1.0.
+touches it. The app itself is still called **WarpEngine Client**: that name is what
+appears in the Dock and in `/Applications`, and only the file names were the problem.
+
+The list of files is still passed one path per line rather than as one string, since a
+path given on the command line can contain a space even when a built one cannot;
+splitting it on whitespace is what broke the first attempt at publishing 1.1.0.
 
 It needs `tea` installed and logged in — the devarea repo has `make tea` for that.
 Overridable: `TAG`, `REPO`, `TEA_LOGIN`, `NOTES`, `DIST`.
@@ -376,6 +423,18 @@ across them. One class serving three versions is the honest way to say that.
 
 ## Verified, and not
 
+**2.2.0** — the registry record was cut back to a name and a catalog, so the whole
+install path was measured again against a local registry serving exactly that. The slug
+came out `teletypegames` from the catalog host, the home `teletypegames-desktop`, the
+games subfolder `teletypegames`, and installing the same record twice landed in the same
+home. A record carrying `config` and `storeRepositoryUrl` — the fields a stale client or a
+tampering renderer might still send — changed nothing, because neither exists in the model
+any more. The site side was migrated and its specs re-run; the frontend was built, which
+first required removing a dead `engines` list that had been failing `vue-tsc` on master.
+
+Older entries below describe what was verified for the version they name, and some of
+them predate the store engine moving into this application.
+
 The pipeline's commands were run in the same containers it uses, before the pipeline was
 committed: `electronuserland/builder:22` installs, type-checks, lints, passes the smoke
 test (registry reached, store skipped as it should be on a machine that has none) and

RELEASE_NOTES.md

@@ -1,86 +1,34 @@
-# WarpEngine Client 2.0.0
+# WarpEngine Client 2.4.0
 
-**The store engine is part of the app. Nothing has to be installed on the machine any
+**The catalog can now say a title is not yours, and the client can do something about
-more.** Reading the catalog, choosing which release fits your computer, downloading and
+it.** Where a store sells things, a card shows the **price** and a **Buy** button that
-unpacking it, writing the menu entry and remembering what went where all happen inside
+opens the store's own page; where you own it, an **Install** as before. Two new
-the application now. There is no Python to find, no child process, and no JSON protocol
+categories go with it — **Owned** and **To buy** — because owning something is not the
-between the two halves — which is why this is a major version rather than a feature.
+same as having installed it.
 
-What that changes for a person: on Windows and on a fresh Mac the app simply works.
+**Signing in, without a password ever reaching this window.** The side menu grows an
-Before it looked for `python3`, `python` and `py -3`, and where none answered it drew a
+**Account** block, and signing in shows a short code: your browser opens on the store's
-screen with a link to python.org instead of a catalog. That screen is gone, along with
+own page and you type it there. That detour is the point — a desktop application asking
-the one that offered to refresh a store engine too old to drive.
+for a password is a desktop application people should not be giving one to. The token
+lives in the OS keychain (Keychain, libsecret, DPAPI), one per store, and *Sign out*
+revokes it at the server as well as forgetting it here.
 
-**Your existing library is kept.** `config.json` and `state.json` on disk are unchanged —
+**None of this is knowledge about any particular store.** It all arrives from the
-the same field names, the same `<scope>:<name>` keys, the same file modes — so a machine
+catalog's own server: WarpEngine 0.5 answers `GET /api/service` with what it offers, and
-whose games were installed by the shell store keeps them. Opening this version against
+puts an `access` block on every entry. A client that carried those facts would work for
-such a store lists them as installed, offers no needless update, and a sync reports
+exactly one shop — this one asks, which is why the same build serves any of them.
-*already up to date*. A `version: 1` state file is still migrated on first read.
 
-The two Python files an earlier install left in the store folder are removed the next
+**A store with no sign-in shows none.** Every WarpEngine before 0.5 has no descriptor at
-time that store is set up. Nothing reads them, and a folder that still looks like it
+all, and a 0.5 store that sells nothing reports none either. Both read as "a plain
-holds the engine invites someone to run it against a state file this app is also writing.
+catalog", which is what this client assumed for its whole life until now, and the window
+behaves accordingly: no Account block, no prices, no new categories.
 
-**The client knows which WarpEngine served a catalog.** Every WarpEngine API response
+**A title nobody has bought is not dimmed.** The dimming and the dashed badge belong to
-carries a `WarpEngine-Version` header, and the client now reads it, names the version in
+what this *machine* cannot do — an unsupported platform, no build for this architecture
-the log, and picks the catalog dialect for it. `SUPPORTED_WARP_ENGINE_VERSIONS` lists what
+— and there is nothing wrong with the machine when a title simply costs money.
-this build was written against — 0.2, 0.3 and 0.4 — and the four cases are all handled:
 
-| The header says | What the client does |
+**A bearer token is never sent to a host that did not issue it.** A gated download
-|---|---|
+answers with a redirect to signed storage, often somebody else's server, and some object
-| a supported version | reads the catalog with that version's dialect |
+stores refuse a request outright when an `Authorization` header rides along with the
-| nothing at all | reads it as the oldest supported version — an engine before 0.4.0 sent no header |
+signature. The credential stops at the origin it belongs to; a redirect back to the
-| something older | the same, and says so in the log |
+catalog keeps it.
-| something newer | tries the newest dialect anyway, warning that titles may be missed |
-
-Adding a version to that list fails the build until somebody says what it reads like, in
-the type checker and in the linter both. A new engine version cannot arrive unnoticed.
-
-**Refresh and the language picker are icons.** They sit together at the foot of the side
-menu, and the *Actions* heading that used to head a section of one button is gone. Both
-carry their name as a tooltip and to a screen reader, and the language picker is still a
-real `<select>` underneath — the native dropdown, keyboard and all, with only the glyph
-showing.
-
-### Also
-
-No runtime dependencies, still: the zip reader the installer needs is about 150 lines over
-`node:zlib` rather than a package. It restores the executable bit from each entry's
-external attributes, which is what makes an unpacked game able to start at all, and it
-refuses a zip64 archive, an unknown compression method or an entry that would be written
-outside its destination rather than guessing.
-
-The repository itself is free of Python too — the Makefile, the CI check and the release
-script read `package.json` and the forge's JSON with Node now.
-
-### Opening it on macOS
-
-Ad-hoc signed, **not notarised**, so macOS asks first:
-
-```sh
-xattr -dr com.apple.quarantine "/Applications/WarpEngine Client.app"
-```
-
-### What is attached
-
-The macOS package, built and verified on a Mac, plus the Linux (AppImage, deb) and
-Windows (installer, portable) packages the pipeline builds when the tag is pushed.
-
-### Verified
-
-`make check` is clean: typecheck, lint, the headless smoke test and the window self-test.
-
-The new engine was measured against the old one rather than trusted. On the same catalog
-and the same config, the Python engine and this one produce **the same 13-title listing
-with zero field differences** and the same resolved paths. Installing three titles — a
-bare TIC-80 binary wrapped in a bundle, a Godot `.app` symlinked, and a hosted web entry —
-gives **byte-identical payloads, identical file modes and an identical `Info.plist`**; the
-only difference in the two trees is the sandbox path inside the generated launcher script.
-`state.json` matches record for record.
-
-The upgrade path was tested directly: pointed at a store home installed by the Python
-engine, this one reports all three titles installed with no update available, and a
-re-sync writes nothing. Remove, prune, prune-suppression on a named sync, and the v1→v2
-state migration were each exercised. The zip reader was checked against Python's
-`extractall` on an archive holding stored, deflated, directory and symlink entries —
-identical bytes and identical modes — and its zip-slip and not-a-zip guards both fire.

STRUCTURE.md

@@ -59,6 +59,8 @@ src/
   infrastructure/
     engine/                   the store engine: catalog, releases, install, state
       dialects/               one per WarpEngine version's catalog shape
+      ServiceDescriptorClient what the catalog's server says it offers (GET /api/service)
+      DeviceSignInClient      the device authorization grant, client side
       launchers/              .desktop, .app bundle, .lnk — the three hosts
     archive/                  ZipArchive: a zip reader over node:zlib
     files/                    StoreFileSystem: atomic writes and the delete guard
@@ -66,7 +68,8 @@ src/
     http/                     HttpTextClient, StoreHttpClient, HttpStatusError
     json/                     JsonRecord: reading data that came from elsewhere
     config/                   BuildConfiguration: what was decided when this was packaged
-    electron/                 ApplicationEnvironment and GameLauncher adapters
+    electron/                 ApplicationEnvironment, GameLauncher, and the keychain
+                              credential store
   main/
     main.ts                   the entry point: one line of work
     ElectronApplication.ts    lifecycle, single instance, self-test mode

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "warp-engine-client",
-  "version": "1.2.0",
+  "version": "2.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "warp-engine-client",
-      "version": "1.2.0",
+      "version": "2.4.0",
       "license": "MIT",
       "devDependencies": {
         "@types/node": "^26.2.0",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "warp-engine-client",
   "productName": "WarpEngine Client",
-  "version": "2.0.0",
+  "version": "2.4.0",
   "description": "Graphical client for WarpEngine stores: install a catalog into your own application menu.",
   "license": "MIT",
   "author": "Teletype Games <games@teletype.hu>",
@@ -44,7 +44,11 @@
       "target": [
         "dmg",
         "zip"
-      ]
+      ],
+      "artifactName": "WarpEngineClient-${version}-${arch}-mac.${ext}"
+    },
+    "dmg": {
+      "artifactName": "WarpEngineClient-${version}-${arch}.${ext}"
     },
     "win": {
       "target": [
@@ -52,6 +56,12 @@
         "portable"
       ]
     },
+    "nsis": {
+      "artifactName": "WarpEngineClient-Setup-${version}-${arch}.${ext}"
+    },
+    "portable": {
+      "artifactName": "WarpEngineClient-Portable-${version}-${arch}.${ext}"
+    },
     "linux": {
       "category": "Game",
       "target": [
@@ -59,6 +69,9 @@
         "deb"
       ]
     },
+    "appImage": {
+      "artifactName": "WarpEngineClient-${version}-${arch}.${ext}"
+    },
     "afterPack": "scripts/after-pack.js"
   },
   "allowScripts": {

scripts/ci-upload.sh

@@ -53,9 +53,10 @@ api() {
   curl -fsS -X "$method" -H "$AUTH" "$FORGE$path" "$@"
 }
 
-# Package names contain spaces — "WarpEngine Client Setup 1.5.0.exe" does — so the list
+# The list lives one path per line in a file and is read with `while IFS= read -r`. The
-# lives one path per line in a file and is read with `while IFS= read -r`. A single
+# built package names have no spaces in them any more, but a path given on the command
-# variable looped over with $list splits on the space and uploads nothing.
+# line still can — and a single variable looped over with $list splits on the space and
+# uploads nothing, which is a silent way to publish a release with no assets.
 LIST="$(mktemp)"
 trap 'rm -f "$LIST"' EXIT
 if [ "$#" -gt 0 ]; then

scripts/release.sh

@@ -43,9 +43,10 @@ REPO="${REPO:-$(git remote get-url origin 2>/dev/null |
 #
 #   - the version filter, because dist/ keeps whatever earlier builds left there
 #     and a release would quietly get the previous version's files attached;
-#   - the spaces. "WarpEngine Client-1.5.0-arm64.dmg" has one, so the list lives one
+#   - the spaces. The built names have none since 2.3.0 — `WarpEngineClient-2.3.0-arm64.dmg`
-#     path per line in a file and is read with `while IFS= read -r`. Holding it in
+#     — but a path given as an argument still can, so the list stays one path per line in
-#     a single variable and looping over $list splits it on the space.
+#     a file, read with `while IFS= read -r`. Holding it in a single variable and looping
+#     over $list splits it on the space, and publishes nothing.
 LIST="$(mktemp)"
 trap 'rm -f "$LIST"' EXIT
 if [ "$#" -gt 0 ]; then

src/application/mappers/GameDtoMapper.ts

@@ -1,3 +1,4 @@
+import { readAccessVerdict, type CatalogPrice } from '../../domain/models/CatalogAccess'
 import type { Game } from '../../domain/models/Game'
 import type { GameDto } from '../../shared/contracts/dto/GameDto'
 
@@ -6,10 +7,11 @@ const ABSOLUTE_URL = /^https?:\/\//
 /**
  * A title as the window may see it.
  *
- * Two decisions live here rather than in the renderer: the box art is resolved
+ * Three decisions live here rather than in the renderer: the box art is resolved
- * against the catalog's base URL, and whether a title can be launched is answered
+ * against the catalog's base URL, whether a title can be launched is answered here —
- * here — so the window never receives a filesystem path it could be talked into
+ * so the window never receives a filesystem path it could be talked into opening —
- * opening.
+ * and the catalog's access block is reduced to a verdict and a printed price, because
+ * a view that had to reason about entitlement is a view with a rule in it.
  */
 export class GameDtoMapper {
   public toDto (game: Game, catalogBaseUrl: string): GameDto {
@@ -29,7 +31,10 @@ export class GameDtoMapper {
       launchable: this.isLaunchable(game),
       installable: game.installable,
       unavailableReason: game.unavailableReason,
-      unavailableDetail: game.unavailableDetail
+      unavailableDetail: game.unavailableDetail,
+      accessVerdict: readAccessVerdict(game.access),
+      priceLabel: formatPrice(game.access?.price ?? null),
+      purchaseUrl: game.access?.purchaseUrl ?? null
     }
   }
 
@@ -49,3 +54,25 @@ export class GameDtoMapper {
     return game.menuEntryPath !== null || game.executablePath !== null
   }
 }
+
+/**
+ * A price as a person reads it, in the currency the catalog named.
+ *
+ * `Intl` with the *catalog's* currency and the system locale: the store decides what it
+ * charges in, the reader's machine decides where the symbol and the separators go.
+ * There is no conversion here and there must not be — inventing an exchange rate would
+ * be quoting a price nobody agreed to.
+ */
+function formatPrice (price: CatalogPrice | null): string | null {
+  if (price === null) return null
+  if (price.amountCents <= 0) return null
+
+  try {
+    return new Intl.NumberFormat(undefined, {
+      style: 'currency', currency: price.currency
+    }).format(price.amountCents / 100)
+  } catch {
+    // An unknown currency code: better the number and the code than nothing at all.
+    return `${(price.amountCents / 100).toFixed(2)} ${price.currency}`
+  }
+}

src/application/mappers/RegistryStoreDtoMapper.ts

@@ -7,7 +7,6 @@ export class RegistryStoreDtoMapper {
     return {
       name: store.name,
       catalogUrl: store.catalogUrl,
-      storeRepositoryUrl: store.storeRepositoryUrl,
       storeId: deriveStoreId(store)
     }
   }
@@ -18,10 +17,6 @@ export class RegistryStoreDtoMapper {
 
   /** The window hands a record straight back when asking for an install. */
   public toModel (dto: RegistryStoreDto): RegistryStore {
-    return {
+    return { name: dto.name, catalogUrl: dto.catalogUrl }
-      name: dto.name,
-      catalogUrl: dto.catalogUrl,
-      storeRepositoryUrl: dto.storeRepositoryUrl
-    }
   }
 }

src/application/services/AccountService.ts

@@ -0,0 +1,112 @@
+import {
+  NO_ACCOUNT, type SignInOutcome, type SignInPrompt, type StoreAccount
+} from '../../domain/models/StoreAccount'
+import type { StoreCatalogGateway } from '../../domain/ports/StoreCatalogGateway'
+import type { StoreSelectionService } from './StoreSelectionService'
+
+/** A sign-in that is under way: what to show, and how it ended. */
+export interface SignInSession {
+  readonly prompt: SignInPrompt
+  readonly finished: Promise<SignInResult>
+}
+
+export interface SignInResult {
+  readonly outcome: SignInOutcome
+  readonly account: StoreAccount
+}
+
+/**
+ * Signing in to the store that is open, and out of it again.
+ *
+ * The waiting lives here rather than in the gateway because it is orchestration: a loop
+ * with a cancel and a deadline in it, over a port that only knows how to ask once. That
+ * split is also what keeps the port testable without a clock.
+ *
+ * One sign-in at a time, per application rather than per store: a second one started
+ * while the first is waiting would leave two loops racing to write the same token, and
+ * a person can only be at one browser tab anyway.
+ */
+export class AccountService {
+  private cancelled = false
+  private active: SignInSession | null = null
+
+  public constructor (
+    private readonly catalogGateway: StoreCatalogGateway,
+    private readonly selection: StoreSelectionService
+  ) {}
+
+  /** Null where no store is open — the window asks before anything is chosen. */
+  public async readAccount (): Promise<StoreAccount> {
+    const store = this.selection.findCurrentStore()
+    if (store === null) return NO_ACCOUNT
+
+    return await this.catalogGateway.readAccount(store)
+  }
+
+  /**
+   * Ask the store for a code, then keep polling until somebody answers.
+   *
+   * Returns as soon as there is something to show: the code has to be on screen while
+   * the polling happens, and a person cannot answer a code they have not seen yet.
+   */
+  public async beginSignIn (clientName: string): Promise<SignInSession> {
+    if (this.active !== null) return this.active
+
+    const store = this.selection.requireCurrentStore()
+    const prompt = await this.catalogGateway.requestSignIn(store, clientName)
+    this.cancelled = false
+
+    const session: SignInSession = { prompt, finished: this.awaitAnswer(prompt) }
+    this.active = session
+    return session
+  }
+
+  /** Give up waiting. The code stays valid at the server until it expires by itself. */
+  public cancelSignIn (): void {
+    this.cancelled = true
+  }
+
+  public async signOut (): Promise<StoreAccount> {
+    const store = this.selection.findCurrentStore()
+    if (store === null) return NO_ACCOUNT
+
+    this.cancelSignIn()
+    return await this.catalogGateway.signOut(store)
+  }
+
+  private isCancelled (): boolean {
+    return this.cancelled
+  }
+
+  private async awaitAnswer (prompt: SignInPrompt): Promise<SignInResult> {
+    const store = this.selection.requireCurrentStore()
+    const deadline = Date.now() + prompt.expiresInSeconds * 1000
+
+    try {
+      while (!this.isCancelled()) {
+        await delay(prompt.intervalSeconds * 1000)
+        // Read through a method, not the field: cancelling happens *during* the delay
+        // above, and a flow analysis that only sees the loop condition concludes this
+        // can never be true.
+        if (this.isCancelled()) break
+        // The server's own expiry is the authority; this one only stops the loop when
+        // the server has stopped answering at all.
+        if (Date.now() > deadline) return { outcome: 'expired', account: await this.readAccount() }
+
+        const result = await this.catalogGateway.pollSignIn(store, prompt.deviceCode)
+        if (result.state === 'approved') return { outcome: 'signedIn', account: result.account }
+        if (result.state === 'denied') return { outcome: 'denied', account: result.account }
+        if (result.state === 'expired') return { outcome: 'expired', account: result.account }
+      }
+      return { outcome: 'cancelled', account: await this.readAccount() }
+    } finally {
+      this.active = null
+    }
+  }
+}
+
+async function delay (milliseconds: number): Promise<void> {
+  await new Promise<void>((resolve: () => void): void => {
+    setTimeout((): void => { resolve() }, milliseconds)
+  })
+}

src/application/services/StoreProvisioningService.ts

@@ -30,6 +30,14 @@ export class StoreProvisioningService {
     return this.registry.listStores()
   }
 
+  /**
+   * Install the chosen store.
+   *
+   * The window's choice is taken at face value, which is safe because a record is only a
+   * name and a catalog: there is no path in it and nothing that decides what may be
+   * deleted. The store's own configuration is written by the installer from the engine's
+   * defaults, so the renderer cannot influence where anything lands.
+   */
   public async installStore (
     store: RegistryStore,
     progress?: EngineProgressListener
@@ -38,4 +46,5 @@ export class StoreProvisioningService {
     const installed = await this.installer.installEngine(home, store, progress)
     return this.selection.adoptStore(installed)
   }
+
 }

src/domain/models/CatalogAccess.ts

@@ -0,0 +1,42 @@
+/**
+ * What a catalog says about getting one title.
+ *
+ * The vocabulary is the engine's and deliberately generic — `gated`, `entitled`, a
+ * price. One client reads many catalogs, so a field named after what a particular shop
+ * calls the thing it sells is a field that works in exactly one shop.
+ *
+ * Absent (`null` where this appears) is its own answer: an engine too old to have an
+ * opinion. That is not the same as "not gated", and only one of the two is a reason to
+ * offer somebody a sign-in.
+ */
+export interface CatalogAccess {
+  /** Downloading needs an entitlement. */
+  readonly gated: boolean
+  /** For the signed-in caller; null when nobody was signed in to ask about. */
+  readonly entitled: boolean | null
+  readonly price: CatalogPrice | null
+  /** Where a person goes to get it. Absolute — it opens in their own browser. */
+  readonly purchaseUrl: string | null
+  /** Where a hosted build is played, when the catalog serves it somewhere of its own. */
+  readonly webUrl: string | null
+}
+
+export interface CatalogPrice {
+  readonly amountCents: number
+  readonly currency: string
+}
+
+/**
+ * Can this caller install this title?
+ *
+ * Three answers, because the middle one is real: yes; no, and here is where to buy it;
+ * and "the catalog would tell you if you signed in". A client that collapsed the last
+ * two would either hide a title somebody owns or offer to sell them one they have.
+ */
+export type AccessVerdict = 'open' | 'entitled' | 'purchasable' | 'signInRequired'
+
+export function readAccessVerdict (access: CatalogAccess | null): AccessVerdict {
+  if (access?.gated !== true) return 'open'
+  if (access.entitled === true) return 'entitled'
+  return access.entitled === false ? 'purchasable' : 'signInRequired'
+}

src/domain/models/CatalogListing.ts

@@ -1,4 +1,5 @@
 import type { Game } from './Game'
+import type { StoreAccount } from './StoreAccount'
 import type { StorePaths } from './StorePaths'
 
 /** One reading of a store's catalog. */
@@ -6,4 +7,13 @@ export interface CatalogListing {
   readonly games: readonly Game[]
   readonly skipped: readonly string[]
   readonly paths: StorePaths | null
+  /**
+   * Where this machine stands with the store, as of this reading.
+   *
+   * Part of the listing rather than a call of its own because it is the same answer
+   * from the same request: the catalog was fetched with whatever credential we hold,
+   * and what it said about entitlements is only meaningful next to whether anybody was
+   * signed in when it said it.
+   */
+  readonly account: StoreAccount
 }

src/domain/models/Game.ts

@@ -1,3 +1,5 @@
+import type { CatalogAccess } from './CatalogAccess'
+
 /** How a title runs: unpacked on this machine, or served as a web build. */
 export type GameMode = 'app' | 'web'
 
@@ -41,4 +43,12 @@ export interface Game {
   readonly unavailableReason: UnavailableReason | null
   /** The engine's sentence for it, for a tooltip or the log. */
   readonly unavailableDetail: string | null
+  /**
+   * What the catalog says about getting it, or null where it said nothing.
+   *
+   * Kept separate from `installable`: that one is about this machine — no build for
+   * this architecture — and this one is about this person. A title can be perfectly
+   * installable and still not yours.
+   */
+  readonly access: CatalogAccess | null
 }

src/domain/models/InstalledRecord.ts

@@ -6,8 +6,13 @@ import type { SelectedGame } from './SelectedGame'
  * This is the shape `state.json` carries, keyed `<scope>:<name>`. Every path in it
  * is something the store put there and may therefore delete — which is why an
  * uninstall reads the record rather than guessing at paths.
+ *
+ * The catalog's `access` block is deliberately *not* part of it. Whether somebody may
+ * download a title is the server's answer to a question asked now; a copy of it on disk
+ * would go stale the moment a purchase or a refund happened, and a stale "yes" is the
+ * dangerous direction. What is installed stays installed either way.
  */
-export interface InstalledRecord extends SelectedGame {
+export interface InstalledRecord extends Omit<SelectedGame, 'access'> {
   /** The unpacked archive's directory; null for a hosted entry, which has none. */
   readonly payload: string | null
   readonly executable: string | null

src/domain/models/RegistryStore.ts

@@ -1,14 +1,15 @@
 /**
- * A store the site's registry offers.
+ * A store the site's registry offers: a name and a catalog.
  *
- * A name and a catalog are what make a store; the repository is optional. When
+ * That is the whole record, and it is enough. How a store behaves is not the registry's
- * there is one it stays the authority on how that store behaves — which platforms
+ * business — this client carries its own store engine, whose defaults cover the
- * it offers, where things land — and when there is not, the engine's own defaults
+ * host-to-asset mapping, the install modes, the platforms and the behaviour — so what
- * cover all of it and this record covers the identity. That is the whole reason a
+ * was actually missing from those defaults is identity, and identity is all this is.
- * store needs no repository of its own.
+ *
+ * Keeping two stores on one machine out of each other's files is a subfolder, derived
+ * here from the store's own slug rather than told to us by a server.
  */
 export interface RegistryStore {
   readonly name: string
   readonly catalogUrl: string
-  readonly storeRepositoryUrl: string | null
 }

src/domain/models/SelectedGame.ts

@@ -1,3 +1,4 @@
+import type { CatalogAccess } from './CatalogAccess'
 import type { UnavailableReason } from './Game'
 
 /**
@@ -26,6 +27,8 @@ export interface SelectedGame {
   readonly createdAt: string | null
   /** `app` for a native archive, `web` for a hosted page. */
   readonly mode: string
+  /** What the catalog says about getting it; null from an engine that cannot say. */
+  readonly access: CatalogAccess | null
 }
 
 /**
@@ -47,6 +50,8 @@ export interface UnavailableEntry {
   readonly reason: UnavailableReason
   /** The sentence behind the code, for a tooltip or the log. */
   readonly detail: string
+  /** Carried here too: a title with no build for this machine can still have a price. */
+  readonly access: CatalogAccess | null
 }
 
 /** What a survey of the catalog found: installable, why not, and what was skipped. */

src/domain/models/ServiceDescriptor.ts

@@ -0,0 +1,43 @@
+/**
+ * What one catalog's server says about itself.
+ *
+ * This is how the client stops being built for a particular store. Whether there is a
+ * sign-in here, where it lives, whether any title can be gated — all of it used to be
+ * knowledge the client would have had to carry, and a client that carries it works for
+ * exactly one catalog. Now the server answers, and the same binary serves any of them.
+ *
+ * Every field is optional in practice: an engine older than 0.5 has no descriptor at
+ * all, and `DEFAULT_SERVICE_DESCRIPTOR` is what that means — a plain catalog, nothing
+ * gated, nobody to sign in as. That is what this client always assumed.
+ */
+export interface ServiceDescriptor {
+  readonly engineVersion: string | null
+  /** Whether any title in this catalog can require an entitlement. */
+  readonly catalogGated: boolean
+  /** Null where the server offers no sign-in, which is most of them. */
+  readonly auth: AuthDescriptor | null
+}
+
+export interface AuthDescriptor {
+  /** The device authorization grant, for a client with no browser of its own. */
+  readonly device: DeviceAuthDescriptor
+}
+
+export interface DeviceAuthDescriptor {
+  /** Where to ask for a code pair. */
+  readonly authorizeUrl: string
+  /** Where to poll for the token. */
+  readonly tokenUrl: string
+  /** Where to throw the token away again. */
+  readonly revokeUrl: string | null
+  /** Where a person takes the code, opened in their own browser. */
+  readonly verificationUrl: string
+  /** Seconds the server asks the client to wait between polls. */
+  readonly interval: number
+}
+
+export const DEFAULT_SERVICE_DESCRIPTOR: ServiceDescriptor = {
+  engineVersion: null,
+  catalogGated: false,
+  auth: null
+}

src/domain/models/StoreAccount.ts

@@ -0,0 +1,28 @@
+/**
+ * Whether this machine is signed in to one store, and whether it could be.
+ *
+ * Two booleans rather than one, because the interesting case is the first being false:
+ * most catalogs have no sign-in at all, and a client that shows a greyed-out "Sign in"
+ * on them is telling people about a door that does not exist.
+ */
+export interface StoreAccount {
+  readonly signInAvailable: boolean
+  readonly signedIn: boolean
+}
+
+export const NO_ACCOUNT: StoreAccount = { signInAvailable: false, signedIn: false }
+
+/** What to show a person while they finish signing in somewhere else. */
+export interface SignInPrompt {
+  /** Opaque to the window: it is the client's half of the exchange, not the person's. */
+  readonly deviceCode: string
+  /** The short one, shown on screen and typed into a browser. */
+  readonly userCode: string
+  /** Opened in the person's own browser. */
+  readonly verificationUrl: string
+  readonly intervalSeconds: number
+  readonly expiresInSeconds: number
+}
+
+/** How a sign-in ended. `cancelled` is this side giving up, `denied` is the person. */
+export type SignInOutcome = 'signedIn' | 'denied' | 'expired' | 'cancelled'

src/domain/models/StoreIdentity.ts

@@ -3,28 +3,22 @@ import type { RegistryStore } from './RegistryStore'
 /**
  * A store id, from whatever the registry gave us.
  *
- * The id names the store home, the folder games land in and the launcher files, so
+ * The id names the store home, the folder games land in and the launcher files, so it
- * it has to be short and filesystem-safe. Three sources, in order of how much they
+ * has to be short and filesystem-safe. Two sources, in order of how much they were
- * were meant to be a name:
+ * meant to be a name:
  *
- *   1. the repository name — `ttg-desktop-store` becomes `ttg`;
+ *   1. the catalog host — `https://teletypegames.org` becomes `teletypegames`;
- *   2. the catalog host — `https://teletypegames.org` becomes `teletypegames`;
+ *   2. the display name, slugged, as a last resort.
- *   3. the display name, slugged, as a last resort.
  *
- * The store's own config.json overrides all of it whenever one exists.
+ * Derived rather than carried, and derived from the catalog: the catalog is what a store
+ * *is*, so two records naming the same catalog are the same store and land in the same
+ * place, which is what keeps a reinstall from orphaning what is already there.
  */
 export function deriveStoreId (store: RegistryStore): string {
-  const fromRepository = store.storeRepositoryUrl === null
+  return toSlug(readHostLabel(store.catalogUrl)) || toSlug(store.name) || 'store'
-    ? ''
-    : (lastSegment(store.storeRepositoryUrl).replace(/-(desktop-)?store$/, ''))
-  return toSlug(fromRepository) || toSlug(readHostLabel(store.catalogUrl)) || toSlug(store.name) || 'store'
 }
 
-function lastSegment (url: string): string {
+/** `https://www.teletypegames.org/x` -> `teletypegames`. */
-  return url.replace(/\/+$/, '').split('/').pop() ?? ''
-}
-
-/** `https://www.teletypegames.org/x` → `teletypegames`. */
 function readHostLabel (catalogUrl: string): string {
   try {
     const host = new URL(catalogUrl).hostname.replace(/^www\./, '')

src/domain/models/WarpEngineVersion.ts

@@ -18,7 +18,7 @@ export const WARP_ENGINE_VERSION_HEADER = 'warpengine-version'
  * compile error until `selectCatalogDialect` says which dialect it gets, which is the
  * point — a new engine version should not be able to arrive silently.
  */
-export const SUPPORTED_WARP_ENGINE_VERSIONS = ['0.2', '0.3', '0.4'] as const
+export const SUPPORTED_WARP_ENGINE_VERSIONS = ['0.2', '0.3', '0.4', '0.5'] as const
 
 export type SupportedWarpEngineVersion = typeof SUPPORTED_WARP_ENGINE_VERSIONS[number]
 

src/domain/ports/CredentialRepository.ts

@@ -0,0 +1,16 @@
+/**
+ * Where a store's sign-in token is kept between runs.
+ *
+ * One token per store, keyed by store id, because the client serves several stores at
+ * once and being signed in to one says nothing about the others.
+ *
+ * A port rather than a file path because the storage is the host's business: on a
+ * desktop it is the OS keychain, in a test it is a map. Nothing above this layer knows
+ * which, and nothing above it should — the token is the one value in this application
+ * that must not end up somewhere it can be read by looking.
+ */
+export interface CredentialRepository {
+  readToken: (storeId: string) => string | null
+  writeToken: (storeId: string, token: string) => void
+  clearToken: (storeId: string) => void
+}

src/domain/ports/StoreCatalogGateway.ts

@@ -1,6 +1,7 @@
 import type { CatalogListing } from '../models/CatalogListing'
 import type { EngineProgressListener } from '../models/EngineProgress'
 import type { InstalledStore } from '../models/InstalledStore'
+import type { SignInPrompt, StoreAccount } from '../models/StoreAccount'
 import type { StorePaths } from '../models/StorePaths'
 
 /**
@@ -15,4 +16,20 @@ export interface StoreCatalogGateway {
   readPaths: (store: InstalledStore, progress?: EngineProgressListener) => Promise<StorePaths>
   syncGames: (store: InstalledStore, names: readonly string[], progress?: EngineProgressListener) => Promise<void>
   removeGame: (store: InstalledStore, name: string, progress?: EngineProgressListener) => Promise<void>
+
+  /** Whether this store offers a sign-in, and whether we are holding a token for it. */
+  readAccount: (store: InstalledStore) => Promise<StoreAccount>
+  /**
+   * Ask the store for a code pair. The *waiting* is not here: polling is a loop with a
+   * cancel in it, which is orchestration, and orchestration belongs above this port.
+   */
+  requestSignIn: (store: InstalledStore, clientName: string) => Promise<SignInPrompt>
+  /** One poll. Returns the account once it is answered, or null while it is not. */
+  pollSignIn: (store: InstalledStore, deviceCode: string) => Promise<SignInPollResult>
+  signOut: (store: InstalledStore) => Promise<StoreAccount>
+}
+
+export interface SignInPollResult {
+  readonly state: 'pending' | 'approved' | 'denied' | 'expired'
+  readonly account: StoreAccount
 }

src/infrastructure/electron/SafeStorageCredentialRepository.ts

@@ -0,0 +1,94 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { safeStorage } from 'electron'
+import type { CredentialRepository } from '../../domain/ports/CredentialRepository'
+import type { ApplicationEnvironment } from '../../domain/ports/ApplicationEnvironment'
+
+const FILE_NAME = 'credentials.json'
+
+/**
+ * Tokens in the OS keychain's own encryption, in the application's data directory.
+ *
+ * Not in the store home next to `config.json` and `state.json`: those two are the
+ * store's public description of itself and its record of what it installed, both
+ * meant to be read and both copied around when somebody moves a library. A password
+ * does not belong in either.
+ *
+ * `safeStorage` is Electron's wrapper over the platform keychain (Keychain on macOS,
+ * libsecret on Linux, DPAPI on Windows). Where it is unavailable — a Linux box with no
+ * secret service — this stores nothing at all rather than falling back to plain text.
+ * The cost is signing in again next run; the alternative is a readable token on disk
+ * for somebody who thought it was encrypted.
+ */
+export class SafeStorageCredentialRepository implements CredentialRepository {
+  public constructor (private readonly environment: ApplicationEnvironment) {}
+
+  public readToken (storeId: string): string | null {
+    if (!this.available()) return null
+    const encoded = this.readAll()[storeId]
+    if (typeof encoded !== 'string') return null
+
+    try {
+      return safeStorage.decryptString(Buffer.from(encoded, 'base64'))
+    } catch {
+      // A token encrypted under a keychain this machine no longer has. Signing in
+      // again is the only way through, and an unreadable entry is not worth an error.
+      return null
+    }
+  }
+
+  public writeToken (storeId: string, token: string): void {
+    if (!this.available()) return
+
+    const all = { ...this.readAll() }
+    all[storeId] = safeStorage.encryptString(token).toString('base64')
+    this.writeAll(all)
+  }
+
+  public clearToken (storeId: string): void {
+    const all = this.readAll()
+    if (!(storeId in all)) return
+
+    // Rebuilt without the key rather than deleted from a copy: the linter forbids a
+    // dynamic delete, and this says the same thing without pretending the object was
+    // ever mutable.
+    const remaining = Object.fromEntries(
+      Object.entries(all).filter(([key]: readonly [string, unknown]): boolean => key !== storeId)
+    )
+    this.writeAll(remaining)
+  }
+
+  public available (): boolean {
+    try {
+      return safeStorage.isEncryptionAvailable()
+    } catch {
+      return false
+    }
+  }
+
+  private readAll (): Record<string, unknown> {
+    try {
+      const parsed: unknown = JSON.parse(fs.readFileSync(this.filePath(), 'utf8'))
+      return typeof parsed === 'object' && parsed !== null ? parsed as Record<string, unknown> : {}
+    } catch {
+      return {}
+    }
+  }
+
+  private writeAll (all: Record<string, unknown>): void {
+    try {
+      const target = this.filePath()
+      fs.mkdirSync(path.dirname(target), { recursive: true })
+      // 0600 as well as the encryption: defence in depth costs one argument here, and
+      // the file is only ever read by this application.
+      fs.writeFileSync(target, `${JSON.stringify(all, null, 2)}\n`, { mode: 0o600 })
+    } catch {
+      // A token that could not be saved means signing in again next run, which is not
+      // worth stopping the application for.
+    }
+  }
+
+  private filePath (): string {
+    return this.environment.resolveUserDataPath(FILE_NAME)
+  }
+}

src/infrastructure/engine/CatalogClient.ts

@@ -41,15 +41,29 @@ export class CatalogClient {
     private readonly configuration: StoreConfiguration,
     private readonly files: StoreFileSystem,
     private readonly cachePath: string,
-    private readonly log: (line: string) => void
+    private readonly log: (line: string) => void,
+    /**
+     * The bearer token to send, asked for per request rather than held.
+     *
+     * Every call this client makes goes to the catalog's own host, so the credential
+     * belongs on all of them: the catalog needs it to say what this person owns, and
+     * the download needs it to be allowed at all.
+     */
+    bearerToken: () => string | null = (): null => null
   ) {
     this.http = new StoreHttpClient({
       userAgent: `warp-engine-client/${CLIENT_VERSION} (${configuration.store.id})`,
       timeout: configuration.behavior.timeout,
-      insecure: configuration.behavior.insecure
+      insecure: configuration.behavior.insecure,
+      bearerToken
     })
   }
 
+  /** The same HTTP client, for the service descriptor and the sign-in flow. */
+  public httpClient (): StoreHttpClient {
+    return this.http
+  }
+
   public apiUrl (endpoint: 'catalog' | 'download', parameters?: Readonly<Record<string, string>>): string {
     const { baseUrl, api } = this.configuration.store
     const url = `${baseUrl}/${api[endpoint].replace(/^\/+/, '')}`

src/infrastructure/engine/CatalogSurveyor.ts

@@ -134,7 +134,8 @@ export class CatalogSurveyor {
         author: software.author,
         imageUrl: software.imageUrl,
         createdAt: release.createdAt,
-        mode
+        mode,
+        access: entry.access
       })
     }
     return { games, reasons, unavailable }
@@ -172,6 +173,7 @@ function toUnavailable (
 ): UnavailableEntry {
   const software: CatalogSoftware = entry.software
   return {
+    access: entry.access,
     name: software.name,
     title: software.title,
     platform: software.platform,

src/infrastructure/engine/DeviceSignInClient.ts

@@ -0,0 +1,117 @@
+import type { DeviceAuthDescriptor } from '../../domain/models/ServiceDescriptor'
+import type { StoreHttpClient } from '../http/StoreHttpClient'
+import { asRecord, readNumber, readOptionalString, readString } from '../json/JsonRecord'
+
+/** What the server said when asked for a code pair. */
+export interface DeviceCodeRequest {
+  readonly deviceCode: string
+  /** Short enough to read off this screen and type into a browser. */
+  readonly userCode: string
+  readonly verificationUrl: string
+  readonly intervalSeconds: number
+  readonly expiresInSeconds: number
+}
+
+export type DeviceSignInState = 'pending' | 'approved' | 'denied' | 'expired'
+
+export interface DevicePollResult {
+  readonly state: DeviceSignInState
+  /** Present exactly once: on the poll that finds the grant newly approved. */
+  readonly token: string | null
+}
+
+/**
+ * The device authorization grant, client side.
+ *
+ * The client has no browser of its own, so it cannot host a login form without asking
+ * somebody to type a password into a window that is not one. Instead it asks for a pair
+ * of codes, shows the short one, sends the person to the server's own page, and polls
+ * with the long one until it is answered.
+ *
+ * Every address comes from the service descriptor rather than from here. That is the
+ * point: this class knows the *shape* of the flow, which is the engine's, and nothing
+ * about any particular store's addresses.
+ */
+export class DeviceSignInClient {
+  public constructor (
+    private readonly http: StoreHttpClient,
+    private readonly device: DeviceAuthDescriptor
+  ) {}
+
+  public async requestCode (clientName: string): Promise<DeviceCodeRequest> {
+    const { json } = await this.http.requestJson(this.device.authorizeUrl, {
+      method: 'POST',
+      payload: { client_name: clientName }
+    })
+    const record = asRecord(json)
+    if (record === null) throw new Error('the server did not answer with a device code')
+
+    const deviceCode = readOptionalString(record, 'deviceCode')
+    const userCode = readOptionalString(record, 'userCode')
+    if (deviceCode === null || userCode === null) {
+      throw new Error('the server did not answer with a device code')
+    }
+
+    return {
+      deviceCode,
+      userCode,
+      verificationUrl: readOptionalString(record, 'verificationUrl') ?? this.device.verificationUrl,
+      // The server's own pacing wins over the descriptor's: it knows what it can take.
+      intervalSeconds: Math.max(1, readNumber(record, 'interval', this.device.interval)),
+      expiresInSeconds: Math.max(1, readNumber(record, 'expiresIn', 600))
+    }
+  }
+
+  public async poll (deviceCode: string): Promise<DevicePollResult> {
+    // 404 is a real answer here — the grant was swept or never existed — so it is read
+    // rather than thrown, and reported as expired: from the client's side those are the
+    // same situation, and both mean start again.
+    const { json, statusCode } = await this.http.requestJson(this.device.tokenUrl, {
+      method: 'POST',
+      payload: { device_code: deviceCode },
+      accept: [ 404, 410 ]
+    })
+    if (statusCode !== 200) return { state: 'expired', token: null }
+
+    const record = asRecord(json)
+    if (record === null) return { state: 'pending', token: null }
+
+    return {
+      state: toState(readString(record, 'state')),
+      token: readOptionalString(record, 'token')
+    }
+  }
+
+  /**
+   * Signing out: the token this client carries is revoked at the server.
+   *
+   * There is no token argument because there is nowhere to put one — the credential
+   * rides on the request as a bearer header, from the same supplier every other call
+   * uses. Best effort on purpose: the token is thrown away locally either way, and a
+   * server that cannot be reached must not leave somebody stuck signed in.
+   */
+  public async revoke (): Promise<boolean> {
+    if (this.device.revokeUrl === null) return false
+
+    try {
+      const { statusCode } = await this.http.requestJson(this.device.revokeUrl, {
+        method: 'DELETE',
+        accept: [ 204, 401 ]
+      })
+      return statusCode === 204
+    } catch {
+      return false
+    }
+  }
+}
+
+function toState (value: string): DeviceSignInState {
+  switch (value) {
+    case 'approved':
+    case 'denied':
+    case 'expired':
+      return value
+    default:
+      return 'pending'
+  }
+}

src/infrastructure/engine/NativeStoreCatalogGateway.ts

@@ -10,19 +10,24 @@ import type { InstalledStore } from '../../domain/models/InstalledStore'
 import type {
   CatalogSurvey, SelectedGame, UnavailableEntry
 } from '../../domain/models/SelectedGame'
+import type { ServiceDescriptor } from '../../domain/models/ServiceDescriptor'
+import type { SignInPrompt, StoreAccount } from '../../domain/models/StoreAccount'
 import { APP_MODE, WEB_MODE, type StoreConfiguration } from '../../domain/models/StoreConfiguration'
 import type { StorePaths } from '../../domain/models/StorePaths'
-import type { StoreCatalogGateway } from '../../domain/ports/StoreCatalogGateway'
+import type { CredentialRepository } from '../../domain/ports/CredentialRepository'
+import type { SignInPollResult, StoreCatalogGateway } from '../../domain/ports/StoreCatalogGateway'
 import { StoreFileSystem } from '../files/StoreFileSystem'
 import { CatalogClient, type FetchedCatalog } from './CatalogClient'
 import { CatalogSurveyor } from './CatalogSurveyor'
 import type { CatalogEntry } from './dialects/CatalogDialect'
 import { selectCatalogDialect } from './dialects/CatalogDialectSelector'
 import { DesktopLayoutResolver } from './DesktopLayoutResolver'
+import { DeviceSignInClient } from './DeviceSignInClient'
 import { GameInstaller } from './GameInstaller'
 import { HostMachineDetector } from './HostMachineDetector'
 import { LauncherWriter } from './launchers/LauncherWriter'
 import { PayloadInstaller } from './PayloadInstaller'
+import { ServiceDescriptorClient } from './ServiceDescriptorClient'
 import { StoreConfigurationReader } from './StoreConfigurationReader'
 import { StoreStateRepository } from './StoreStateRepository'
 
@@ -45,6 +50,12 @@ const CATALOG_CACHE_FILE_NAME = 'catalog.json'
 export class NativeStoreCatalogGateway implements StoreCatalogGateway {
   private readonly hosts = new HostMachineDetector()
 
+  /**
+   * The credentials are injected because they are the host's to keep: on a desktop the
+   * OS keychain, in the smoke test a map in memory. Nothing here knows which.
+   */
+  public constructor (private readonly credentials: CredentialRepository = NO_CREDENTIALS) {}
+
   public async listGames (
     store: InstalledStore,
     progress: EngineProgressListener = {}
@@ -53,7 +64,10 @@ export class NativeStoreCatalogGateway implements StoreCatalogGateway {
     const host = this.hosts.findHost()
     engine.log(`host: ${host.operatingSystem}/${host.architecture}`)
 
-    const survey = engine.surveyor.survey(await this.readEntries(engine), host)
+    const [ descriptor, entries ] = await Promise.all([
+      engine.service.fetchDescriptor(), this.readEntries(engine)
+    ])
+    const survey = engine.surveyor.survey(entries, host)
     const installed = engine.state.readState()
 
     // One list, both kinds: a client that hides what it cannot install leaves the
@@ -64,7 +78,12 @@ export class NativeStoreCatalogGateway implements StoreCatalogGateway {
     ].sort((left: Game, right: Game): number =>
       left.title.toLowerCase().localeCompare(right.title.toLowerCase()))
 
-    return { games, skipped: survey.skipped, paths: this.toPaths(engine) }
+    return {
+      games,
+      skipped: survey.skipped,
+      paths: this.toPaths(engine),
+      account: toAccount(descriptor, this.credentials.readToken(store.id))
+    }
   }
 
   /**
@@ -132,6 +151,72 @@ export class NativeStoreCatalogGateway implements StoreCatalogGateway {
     return Promise.resolve()
   }
 
+  public async readAccount (store: InstalledStore): Promise<StoreAccount> {
+    const engine = this.openStore(store, {})
+    const descriptor = await engine.service.fetchDescriptor()
+    return toAccount(descriptor, this.credentials.readToken(store.id))
+  }
+
+  public async requestSignIn (store: InstalledStore, clientName: string): Promise<SignInPrompt> {
+    const { client } = await this.openSignIn(store)
+    const requested = await client.requestCode(clientName)
+    return {
+      deviceCode: requested.deviceCode,
+      userCode: requested.userCode,
+      verificationUrl: requested.verificationUrl,
+      intervalSeconds: requested.intervalSeconds,
+      expiresInSeconds: requested.expiresInSeconds
+    }
+  }
+
+  /**
+   * One poll. The token is written here, on the single answer that carries it — a
+   * caller that had to remember to save it would eventually forget.
+   */
+  public async pollSignIn (store: InstalledStore, deviceCode: string): Promise<SignInPollResult> {
+    const { client, descriptor, log } = await this.openSignIn(store)
+    const result = await client.poll(deviceCode)
+    if (result.state === 'approved' && result.token !== null) {
+      this.credentials.writeToken(store.id, result.token)
+      log('signed in')
+    }
+    return {
+      state: result.state,
+      account: toAccount(descriptor, this.credentials.readToken(store.id))
+    }
+  }
+
+  /**
+   * Sign out: tell the server, then forget the token locally regardless.
+   *
+   * The local half is what matters and must not depend on the network — somebody
+   * signing out on a train has to actually be signed out.
+   */
+  public async signOut (store: InstalledStore): Promise<StoreAccount> {
+    const engine = this.openStore(store, {})
+    const descriptor = await engine.service.fetchDescriptor()
+    if (descriptor.auth !== null && this.credentials.readToken(store.id) !== null) {
+      await new DeviceSignInClient(engine.catalog.httpClient(), descriptor.auth.device).revoke()
+    }
+    this.credentials.clearToken(store.id)
+    engine.log('signed out')
+    return toAccount(descriptor, null)
+  }
+
+  /** The sign-in client for one store, or a clear error if the store offers none. */
+  private async openSignIn (store: InstalledStore): Promise<SignInContext> {
+    const engine = this.openStore(store, {})
+    const descriptor = await engine.service.fetchDescriptor()
+    if (descriptor.auth === null) {
+      throw new Error(`${store.name} does not offer signing in`)
+    }
+    return {
+      client: new DeviceSignInClient(engine.catalog.httpClient(), descriptor.auth.device),
+      descriptor,
+      log: engine.log
+    }
+  }
+
   /**
    * Fetch the catalog and read it with the dialect its engine version calls for.
    *
@@ -157,7 +242,8 @@ export class NativeStoreCatalogGateway implements StoreCatalogGateway {
     const layouts = new DesktopLayoutResolver(configuration, this.hosts)
     const layout = layouts.resolveLayout()
     const catalog = new CatalogClient(
-      configuration, files, path.join(store.home, CATALOG_CACHE_FILE_NAME), log)
+      configuration, files, path.join(store.home, CATALOG_CACHE_FILE_NAME), log,
+      (): string | null => this.credentials.readToken(store.id))
     const launchers = new LauncherWriter(configuration, layouts, files, log)
 
     return {
@@ -167,6 +253,7 @@ export class NativeStoreCatalogGateway implements StoreCatalogGateway {
       catalog,
       launchers,
       log,
+      service: new ServiceDescriptorClient(catalog.httpClient(), configuration.store.baseUrl, log),
       surveyor: new CatalogSurveyor(configuration, log),
       state: new StoreStateRepository(files, path.join(store.home, STATE_FILE_NAME), log),
       installer: new GameInstaller(
@@ -197,10 +284,16 @@ export class NativeStoreCatalogGateway implements StoreCatalogGateway {
       installedVersion: record?.version ?? null,
       menuEntryPath: record?.menuEntry ?? null,
       executablePath: record?.executable ?? null,
-      hostedUrl: game.mode === WEB_MODE ? engine.launchers.webUrl(game) : null,
+      // The catalog's own play address wins where it gives one: a store that gates its
+      // web builds serves them from a page that knows how to ask somebody to sign in,
+      // and the raw /file/ directory under it does not.
+      hostedUrl: game.mode === WEB_MODE
+        ? game.access?.webUrl ?? engine.launchers.webUrl(game)
+        : null,
       installable: true,
       unavailableReason: null,
-      unavailableDetail: null
+      unavailableDetail: null,
+      access: game.access
     }
   }
 
@@ -226,6 +319,7 @@ interface StoreEngineContext {
   readonly layout: DesktopLayout
   readonly layouts: DesktopLayoutResolver
   readonly catalog: CatalogClient
+  readonly service: ServiceDescriptorClient
   readonly launchers: LauncherWriter
   readonly surveyor: CatalogSurveyor
   readonly state: StoreStateRepository
@@ -258,10 +352,42 @@ function toUnavailableGame (entry: UnavailableEntry): Game {
     hostedUrl: null,
     installable: false,
     unavailableReason: entry.reason,
-    unavailableDetail: entry.detail
+    unavailableDetail: entry.detail,
+    access: entry.access
   }
 }
 
+interface SignInContext {
+  readonly client: DeviceSignInClient
+  readonly descriptor: ServiceDescriptor
+  readonly log: (line: string) => void
+}
+
+/**
+ * Holding a token for a store that has no sign-in is not being signed in.
+ *
+ * It happens: a store can lose its identity configuration, or a client can keep a token
+ * from before. Reporting it as signed in would offer a "sign out" for a door that is no
+ * longer there.
+ */
+function toAccount (descriptor: ServiceDescriptor, token: string | null): StoreAccount {
+  const available = descriptor.auth !== null
+  return { signInAvailable: available, signedIn: available && token !== null }
+}
+
+/**
+ * A client with nowhere to keep a token is a client that is never signed in.
+ *
+ * The two writers throw nothing away and record nothing: this is the shape the smoke
+ * test runs in, where there is no Electron and therefore no keychain, and a store with
+ * no sign-in behaves exactly as it always did.
+ */
+const NO_CREDENTIALS: CredentialRepository = {
+  readToken: (): null => null,
+  writeToken: (storeId: string, token: string): void => { void storeId; void token },
+  clearToken: (storeId: string): void => { void storeId }
+}
+
 function toMode (mode: string): GameMode {
   return mode === WEB_MODE ? WEB_MODE : APP_MODE
 }

src/infrastructure/engine/ServiceDescriptorClient.ts

@@ -0,0 +1,89 @@
+import {
+  DEFAULT_SERVICE_DESCRIPTOR, type AuthDescriptor, type DeviceAuthDescriptor,
+  type ServiceDescriptor
+} from '../../domain/models/ServiceDescriptor'
+import { HttpStatusError } from '../http/HttpTextClient'
+import type { StoreHttpClient } from '../http/StoreHttpClient'
+import { asRecord, readBoolean, readNumber, readOptionalString, readRecord } from '../json/JsonRecord'
+
+const SERVICE_PATH = '/api/service'
+
+/**
+ * `GET /api/service`: what this catalog's server is, asked before anything else.
+ *
+ * A missing descriptor is an answer, not a failure. Every WarpEngine before 0.5 has no
+ * such endpoint, so a 404 means "an older engine" — a plain catalog with nothing gated
+ * and nobody to sign in as, which is exactly what this client assumed for its whole
+ * life before now. Same for a network that is simply down: the store still works
+ * offline from its cached catalog, and refusing to open because we could not ask the
+ * server about itself would be a worse client than the one we had.
+ */
+export class ServiceDescriptorClient {
+  public constructor (
+    private readonly http: StoreHttpClient,
+    private readonly baseUrl: string,
+    private readonly log: (line: string) => void
+  ) {}
+
+  public async fetchDescriptor (): Promise<ServiceDescriptor> {
+    const url = `${this.baseUrl}${SERVICE_PATH}`
+    try {
+      const { json } = await this.http.requestJson(url)
+      const record = asRecord(json)
+      if (record === null) return DEFAULT_SERVICE_DESCRIPTOR
+
+      const descriptor: ServiceDescriptor = {
+        engineVersion: readOptionalString(record, 'version'),
+        catalogGated: readBoolean(readRecord(record, 'catalog') ?? {}, 'gated', false),
+        auth: readAuth(record, this.baseUrl)
+      }
+      this.log(describe(descriptor))
+      return descriptor
+    } catch (error: unknown) {
+      if (error instanceof HttpStatusError && error.statusCode === 404) {
+        this.log('the catalog has no service descriptor — an engine older than 0.5')
+      } else {
+        this.log(`warning: could not read ${url} — carrying on as a plain catalog`)
+      }
+      return DEFAULT_SERVICE_DESCRIPTOR
+    }
+  }
+}
+
+function readAuth (record: Readonly<Record<string, unknown>>, baseUrl: string): AuthDescriptor | null {
+  const auth = readRecord(record, 'auth')
+  if (auth === null) return null
+
+  const device = readRecord(auth, 'device')
+  if (device === null) return null
+
+  const authorizeUrl = absolute(readOptionalString(device, 'authorizeUrl'), baseUrl)
+  const tokenUrl = absolute(readOptionalString(device, 'tokenUrl'), baseUrl)
+  const verificationUrl = absolute(readOptionalString(device, 'verificationUrl'), baseUrl)
+  // Two of the three are the flow itself and the third is where a person goes. Without
+  // all three there is no sign-in to offer, and half a flow is worse than none.
+  if (authorizeUrl === null || tokenUrl === null || verificationUrl === null) return null
+
+  const descriptor: DeviceAuthDescriptor = {
+    authorizeUrl,
+    tokenUrl,
+    revokeUrl: absolute(readOptionalString(device, 'revokeUrl'), baseUrl),
+    verificationUrl,
+    interval: Math.max(1, readNumber(device, 'interval', 5))
+  }
+  return { device: descriptor }
+}
+
+/** A server may answer with a path; it knows its own address better than we do. */
+function absolute (value: string | null, baseUrl: string): string | null {
+  if (value === null || value.length === 0) return null
+  if (value.startsWith('http://') || value.startsWith('https://')) return value
+  return `${baseUrl.replace(/\/+$/, '')}/${value.replace(/^\/+/, '')}`
+}
+
+function describe (descriptor: ServiceDescriptor): string {
+  const version = descriptor.engineVersion ?? 'an unnamed version'
+  const gated = descriptor.catalogGated ? 'some titles need an entitlement' : 'nothing is gated'
+  const auth = descriptor.auth === null ? 'no sign-in' : 'sign-in available'
+  return `catalog served by WarpEngine ${version} — ${gated}, ${auth}`
+}

src/infrastructure/engine/dialects/AccessAwareCatalogDialect.ts

@@ -0,0 +1,57 @@
+import {
+  readBoolean, readNumber, readOptionalString, readRecord, readString, type JsonRecord
+} from '../../json/JsonRecord'
+import type { CatalogAccess, CatalogPrice } from '../../../domain/models/CatalogAccess'
+import { SoftwareListCatalogDialect } from './SoftwareListCatalogDialect'
+
+/**
+ * The catalog as WarpEngine 0.5 serves it: the same entries, plus what they cost.
+ *
+ * 0.5 is the first engine that can say a title is not yours. Every entry carries an
+ * `access` block — even in a catalog that gates nothing, so that "this store is open"
+ * and "this store did not say" stay tellable apart. Everything else about the shape is
+ * unchanged, which is why this is the older dialect with one field added rather than a
+ * parser of its own.
+ *
+ * The words are the engine's, not any store's. A client reads more than one catalog,
+ * and a field named after what one shop calls its wares is a field that only works
+ * there.
+ */
+export class AccessAwareCatalogDialect extends SoftwareListCatalogDialect {
+  protected override readAccess (entry: JsonRecord): CatalogAccess | null {
+    const access = readRecord(entry, 'access')
+    // An entry with no block at all: possible from a 0.5 engine whose policy failed to
+    // answer. Reading it as "open" would be inventing the friendlier of two answers.
+    if (access === null) return null
+
+    return {
+      gated: readBoolean(access, 'gated', false),
+      entitled: readNullableBoolean(access, 'entitled'),
+      price: readPrice(access),
+      purchaseUrl: readOptionalString(access, 'purchaseUrl'),
+      webUrl: readOptionalString(access, 'webUrl')
+    }
+  }
+}
+
+/**
+ * Three states, not two: yes, no, and nobody asked.
+ *
+ * A client that is not signed in gets null, and that is the case worth keeping
+ * separate — it is the difference between "you do not own this" and "there is no you",
+ * and only the second is a reason to offer signing in.
+ */
+function readNullableBoolean (record: JsonRecord, key: string): boolean | null {
+  const value = record[key]
+  return typeof value === 'boolean' ? value : null
+}
+
+/** A price with no currency is not a price anybody can be shown. */
+function readPrice (access: JsonRecord): CatalogPrice | null {
+  const price = readRecord(access, 'price')
+  if (price === null) return null
+
+  const currency = readString(price, 'currency')
+  if (currency.length === 0) return null
+  return { amountCents: readNumber(price, 'amountCents'), currency }
+}

src/infrastructure/engine/dialects/CatalogDialect.ts

@@ -1,3 +1,4 @@
+import type { CatalogAccess } from '../../../domain/models/CatalogAccess'
 import type { SupportedWarpEngineVersion } from '../../../domain/models/WarpEngineVersion'
 
 /**
@@ -17,6 +18,15 @@ export interface CatalogDialect {
 
 export interface CatalogEntry {
   readonly software: CatalogSoftware
+  /**
+   * What the catalog says about getting this title, or null where it says nothing.
+   *
+   * Null is not "free": it is an engine too old to have an opinion, and a store that
+   * never gated anything reads the same as one that could not say. Both mean the same
+   * thing in practice — try the download — but only one of them is worth offering a
+   * sign-in for.
+   */
+  readonly access: CatalogAccess | null
   /**
    * The release the catalog itself calls newest-and-stable, or null when it names none.
    *

src/infrastructure/engine/dialects/CatalogDialectSelector.ts

@@ -1,4 +1,5 @@
 import type { SupportedWarpEngineVersion } from '../../../domain/models/WarpEngineVersion'
+import { AccessAwareCatalogDialect } from './AccessAwareCatalogDialect'
 import type { CatalogDialect } from './CatalogDialect'
 import { SoftwareListCatalogDialect } from './SoftwareListCatalogDialect'
 
@@ -7,9 +8,11 @@ import { SoftwareListCatalogDialect } from './SoftwareListCatalogDialect'
  *
  * The switch is exhaustive over `SUPPORTED_WARP_ENGINE_VERSIONS`, which is the whole
  * mechanism: adding a version to that list stops compiling here until somebody decides
- * what it reads like. Three versions share one dialect today because the catalog's
+ * what it reads like. Three versions share one dialect because the catalog's shape did
- * shape has not changed across them — and one class serving three versions is the
+ * not change across them — and one class serving three versions is the honest way to
- * honest way to say that, rather than three identical ones pretending otherwise.
+ * say that, rather than three identical ones pretending otherwise.
+ *
+ * 0.5 gets its own, because that is the engine that started saying what a title costs.
  */
 export function selectCatalogDialect (version: SupportedWarpEngineVersion): CatalogDialect {
   switch (version) {
@@ -17,5 +20,7 @@ export function selectCatalogDialect (version: SupportedWarpEngineVersion): Cata
     case '0.3':
     case '0.4':
       return new SoftwareListCatalogDialect(version)
+    case '0.5':
+      return new AccessAwareCatalogDialect(version)
   }
 }

src/infrastructure/engine/dialects/SoftwareListCatalogDialect.ts

@@ -2,6 +2,7 @@ import type { SupportedWarpEngineVersion } from '../../../domain/models/WarpEngi
 import {
   asRecord, readOptionalString, readRecord, readString, type JsonRecord
 } from '../../json/JsonRecord'
+import type { CatalogAccess } from '../../../domain/models/CatalogAccess'
 import type {
   CatalogAsset, CatalogDialect, CatalogEntry, CatalogRelease, CatalogSoftware
 } from './CatalogDialect'
@@ -35,6 +36,7 @@ export class SoftwareListCatalogDialect implements CatalogDialect {
       if (software === null) continue
       found.push({
         software,
+        access: this.readAccess(entry),
         latestRelease: this.readLatestRelease(entry),
         releaseCandidates: this.readCandidates(entry)
       })
@@ -42,8 +44,20 @@ export class SoftwareListCatalogDialect implements CatalogDialect {
     return found
   }
 
+  /**
+   * What the catalog says about getting this title. Nothing, at these versions.
+   *
+   * An engine older than 0.5 has no opinion to report, and inventing one here would be
+   * worse than admitting it: "not gated" and "could not say" are different answers, and
+   * only the first is safe to act on. The subclass that can read it overrides this.
+   */
+  protected readAccess (entry: JsonRecord): CatalogAccess | null {
+    void entry
+    return null
+  }
+
   /** A title with no name is not a title: nothing could be keyed by it. */
-  private readSoftware (entry: JsonRecord): CatalogSoftware | null {
+  protected readSoftware (entry: JsonRecord): CatalogSoftware | null {
     const software = readRecord(entry, 'software')
     if (software === null) return null
     const name = readOptionalString(software, 'name')
@@ -59,7 +73,7 @@ export class SoftwareListCatalogDialect implements CatalogDialect {
     }
   }
 
-  private readLatestRelease (entry: JsonRecord): CatalogRelease | null {
+  protected readLatestRelease (entry: JsonRecord): CatalogRelease | null {
     const latest = readRecord(entry, 'latestRelease')
     return latest === null ? null : this.readRelease(latest)
   }
@@ -70,7 +84,7 @@ export class SoftwareListCatalogDialect implements CatalogDialect {
    * `releases` arrives newest-first from the API and `latestRelease` is usually its
    * first element, so identity is settled on the release's own id where it has one.
    */
-  private readCandidates (entry: JsonRecord): readonly CatalogRelease[] {
+  protected readCandidates (entry: JsonRecord): readonly CatalogRelease[] {
     const records: JsonRecord[] = []
     const latest = readRecord(entry, 'latestRelease')
     if (latest !== null) records.push(latest)
@@ -93,7 +107,7 @@ export class SoftwareListCatalogDialect implements CatalogDialect {
     return candidates
   }
 
-  private readRelease (release: JsonRecord): CatalogRelease {
+  protected readRelease (release: JsonRecord): CatalogRelease {
     const assets: CatalogAsset[] = []
     const listed = release['assets']
     if (Array.isArray(listed)) {

src/infrastructure/http/StoreHttpClient.ts

@@ -12,6 +12,7 @@ export interface HttpResponseBody {
   readonly contentType: string
   /** Lower-cased names, as Node delivers them. The engine version arrives in one. */
   readonly headers: Readonly<Record<string, string>>
+  readonly statusCode: number
 }
 
 export interface StoreHttpOptions {
@@ -19,6 +20,22 @@ export interface StoreHttpOptions {
   /** Seconds, as the store config states it. */
   readonly timeout: number
   readonly insecure: boolean
+  /**
+   * The bearer token to send, asked for per request.
+   *
+   * A function rather than a value because the token changes under a long-lived
+   * client — signing in and out do not rebuild it — and because there is no reason
+   * to hold the secret in a field that outlives the request that needs it.
+   */
+  readonly bearerToken?: () => string | null
+}
+
+interface RequestOptions {
+  readonly method?: string
+  readonly body?: string
+  readonly contentType?: string
+  /** Statuses to hand back rather than throw on. */
+  readonly accept?: readonly number[]
 }
 
 /**
@@ -33,8 +50,8 @@ export interface StoreHttpOptions {
 export class StoreHttpClient {
   public constructor (private readonly options: StoreHttpOptions) {}
 
-  public async readBytes (url: string): Promise<HttpResponseBody> {
+  public async readBytes (url: string, request: RequestOptions = {}): Promise<HttpResponseBody> {
-    return await this.request(url, MAX_REDIRECTS, async (
+    return await this.request(url, MAX_REDIRECTS, request, async (
       response: http.IncomingMessage
     ): Promise<HttpResponseBody> => {
       const chunks: Buffer[] = []
@@ -42,11 +59,31 @@ export class StoreHttpClient {
       return {
         body: Buffer.concat(chunks),
         contentType: response.headers['content-type'] ?? '',
-        headers: readHeaders(response)
+        headers: readHeaders(response),
+        statusCode: response.statusCode ?? 0
       }
     })
   }
 
+  /** A JSON request and a JSON answer — the shape every auth endpoint speaks. */
+  public async requestJson (
+    url: string,
+    request: RequestOptions & { readonly payload?: unknown } = {}
+  ): Promise<{ readonly json: unknown, readonly statusCode: number }> {
+    const { payload, ...rest } = request
+    const response = await this.readBytes(url, {
+      ...rest,
+      ...(payload === undefined
+        ? {}
+        : { body: JSON.stringify(payload), contentType: 'application/json' })
+    })
+    const text = response.body.toString('utf8')
+    return {
+      json: text.trim().length === 0 ? null : JSON.parse(text),
+      statusCode: response.statusCode
+    }
+  }
+
   /**
    * Stream `url` into `destination` atomically. Returns bytes written.
    *
@@ -60,7 +97,7 @@ export class StoreHttpClient {
     let written = 0
 
     try {
-      await this.request(url, MAX_REDIRECTS, async (response: http.IncomingMessage): Promise<void> => {
+      await this.request(url, MAX_REDIRECTS, {}, async (response: http.IncomingMessage): Promise<void> => {
         response.on('data', (chunk: Buffer): void => { written += chunk.length })
         await pipeline(response, fs.createWriteStream(partial))
       })
@@ -76,42 +113,93 @@ export class StoreHttpClient {
   private async request<TResult> (
     url: string,
     redirectsLeft: number,
-    consume: (response: http.IncomingMessage) => Promise<TResult>
+    request: RequestOptions,
+    consume: (response: http.IncomingMessage) => Promise<TResult>,
+    origin: string = originOf(url)
   ): Promise<TResult> {
-    const response = await this.open(url)
+    const response = await this.open(url, request, origin)
     const status = response.statusCode ?? 0
     const location = response.headers.location
 
     if (status >= 300 && status < 400 && location !== undefined) {
       response.resume()
       if (redirectsLeft <= 0) throw new Error(`too many redirects for ${url}`)
-      return await this.request(new URL(location, url).toString(), redirectsLeft - 1, consume)
+      const next = new URL(location, url).toString()
+      // The origin travels with the redirect chain, not with each hop: a gated
+      // download answers 302 to a signed storage URL, and *that* host must not be
+      // sent our bearer token. It is somebody else's server, and a presigned URL is
+      // refused outright by some object stores when an Authorization header rides
+      // along with the signature. A redirect back to the catalog keeps the token,
+      // because that is the server that issued it.
+      return await this.request(next, redirectsLeft - 1, redirectedRequest(request), consume, origin)
     }
-    if (status !== 200) {
+    if (status !== 200 && !(request.accept ?? []).includes(status)) {
       response.resume()
       throw new HttpStatusError(url, status)
     }
     return await consume(response)
   }
 
-  private async open (url: string): Promise<http.IncomingMessage> {
+  private async open (
+    url: string,
+    request: RequestOptions,
+    origin: string
+  ): Promise<http.IncomingMessage> {
     return new Promise<http.IncomingMessage>((
       resolve: (response: http.IncomingMessage) => void,
       reject: (error: Error) => void
     ): void => {
       const secure = !url.startsWith('http://')
       const client = secure ? https : http
-      const request = client.get(url, {
+      const outgoing = client.request(url, {
-        headers: { 'User-Agent': this.options.userAgent },
+        method: request.method ?? 'GET',
+        headers: this.buildHeaders(url, request, origin),
         ...(secure && this.options.insecure ? { rejectUnauthorized: false } : {})
       }, resolve)
 
-      request.setTimeout(Math.max(1, this.options.timeout) * 1000, (): void => {
+      outgoing.setTimeout(Math.max(1, this.options.timeout) * 1000, (): void => {
-        request.destroy(new Error(`${url} timed out`))
+        outgoing.destroy(new Error(`${url} timed out`))
       })
-      request.on('error', reject)
+      outgoing.on('error', reject)
+      if (request.body !== undefined) outgoing.write(request.body)
+      outgoing.end()
     })
   }
+
+  private buildHeaders (
+    url: string,
+    request: RequestOptions,
+    origin: string
+  ): Record<string, string> {
+    const headers: Record<string, string> = { 'User-Agent': this.options.userAgent }
+    if (request.contentType !== undefined) headers['Content-Type'] = request.contentType
+    if (request.body !== undefined) {
+      headers['Content-Length'] = String(Buffer.byteLength(request.body))
+    }
+
+    const token = originOf(url) === origin ? this.options.bearerToken?.() ?? null : null
+    if (token !== null && token.length > 0) headers['Authorization'] = `Bearer ${token}`
+    return headers
+  }
+}
+
+/**
+ * A redirect is followed as a GET without the body.
+ *
+ * That is what every client does with 301/302 after a POST, and what the servers
+ * answering them expect. `accept` travels on, because it describes what the caller
+ * is willing to read rather than anything about one hop.
+ */
+function redirectedRequest (request: RequestOptions): RequestOptions {
+  return request.accept === undefined ? {} : { accept: request.accept }
+}
+
+function originOf (url: string): string {
+  try {
+    return new URL(url).origin
+  } catch {
+    return ''
+  }
 }
 
 /**

src/infrastructure/repositories/HttpStoreRegistryRepository.ts

@@ -15,10 +15,10 @@ const DEFAULT_REGISTRY_URL = 'https://teletypegames.org/api/stores'
  * field a build was packaged with (for shipping a client for another site), and finally
  * the address of ours.
  *
- * A record needs a name and a catalog URL; those two make a store. The repository
+ * A name and a catalog URL make a store, and are all a record carries. Anything else it
- * is optional and arrives as null when absent — a store configured by nothing but
+ * happens to say is ignored: how a store behaves is this client's own business, decided
- * this record installs on the engine's defaults. Records missing either of the two
+ * by the engine it ships with. Records missing either field are dropped rather than
- * required fields are dropped rather than half-used.
+ * half-used.
  */
 export class HttpStoreRegistryRepository implements StoreRegistryRepository {
   public readonly sourceUrl: string
@@ -44,18 +44,12 @@ export class HttpStoreRegistryRepository implements StoreRegistryRepository {
     return parsed
       .map((row: unknown): JsonRecord | null => asRecord(row))
       .filter((row: JsonRecord | null): row is JsonRecord => row !== null)
-      .map((row: JsonRecord): RegistryStore => {
+      // Both spellings, because a registry is someone else's API: ours answers
-        // Both spellings, because a registry is someone else's API: ours answers
+      // camelCase, and a hand-rolled one may not.
-        // camelCase, and a hand-rolled one may not.
+      .map((row: JsonRecord): RegistryStore => ({
-        const repository = (
+        name: readString(row, 'name').trim(),
-          readString(row, 'storeRepositoryUrl') || readString(row, 'store_repository_url')
+        catalogUrl: (readString(row, 'catalogUrl') || readString(row, 'catalog_url')).trim()
-        ).trim()
+      }))
-        return {
-          name: readString(row, 'name').trim(),
-          catalogUrl: (readString(row, 'catalogUrl') || readString(row, 'catalog_url')).trim(),
-          storeRepositoryUrl: repository.length > 0 ? repository : null
-        }
-      })
       .filter((store: RegistryStore): boolean =>
         store.name.length > 0 && store.catalogUrl.length > 0)
   }

src/infrastructure/repositories/NativeStoreEngineInstaller.ts

@@ -6,12 +6,8 @@ import type { RegistryStore } from '../../domain/models/RegistryStore'
 import { DESKTOP_STORE_ENGINE } from '../../domain/models/StoreEngine'
 import { deriveStoreId } from '../../domain/models/StoreIdentity'
 import type { StoreEngineInstaller } from '../../domain/ports/StoreEngineInstaller'
-import { asRecord, readString } from '../json/JsonRecord'
-import { HttpStatusError, type HttpTextClient } from '../http/HttpTextClient'
 
 const CONFIG_FILE_NAME = 'config.json'
-const DEFAULT_FORGE_BASE = 'https://git.teletypegames.org'
-const DEFAULT_BRANCH = 'master'
 
 /** What an install used to leave in a store home, back when the engine was a script. */
 const RETIRED_ENGINE_FILES: readonly string[] = ['desktop_store.py', 'warpstore.py']
@@ -19,51 +15,63 @@ const RETIRED_ENGINE_FILES: readonly string[] = ['desktop_store.py', 'warpstore.
 /**
  * Setting up a store where there is none.
  *
- * Since the engine moved into this application there is nothing to download but the
+ * Nothing is downloaded and nothing is asked of a server. The engine ships in this
- * store's own configuration, so an install is one HTTP call and one file. The store
+ * application and its defaults already cover the host-to-asset mapping, the install
- * home stays where it was and keeps its name, because the state and the catalog cache
+ * modes, the platforms and the behaviour; what a registry record adds is identity — a
- * beside that config are what make an existing library recognisable.
+ * name, a catalog and a slug — and that is what gets written.
+ *
+ * The config is written to disk rather than kept in memory because it is the store's
+ * own record of itself: `StoreConfigurationReader` reads it on every operation, an
+ * existing store home is recognised by it, and a person can look at it.
  */
 export class NativeStoreEngineInstaller implements StoreEngineInstaller {
-  private readonly forgeBase: string
+  public installEngine (
-
-  public constructor (private readonly httpClient: HttpTextClient, forgeBase?: string) {
-    const configured = process.env['FORGE_BASE']
-    this.forgeBase = forgeBase ?? (configured !== undefined && configured.length > 0
-      ? configured
-      : DEFAULT_FORGE_BASE)
-  }
-
-  public async installEngine (
     home: string,
     store: RegistryStore,
     progress: EngineProgressListener = {}
   ): Promise<InstalledStore> {
     fs.mkdirSync(home, { recursive: true })
 
-    const config = await this.readStoreConfig(store, progress)
+    const storeId = deriveStoreId(store)
     const configPath = path.join(home, CONFIG_FILE_NAME)
-    fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`)
+    fs.writeFileSync(configPath, `${JSON.stringify(this.buildConfig(store, storeId), null, 2)}\n`)
     this.removeRetiredEngine(home, progress)
 
     progress.onLog?.(`${store.name} is set up in ${home}`)
-    const configStore = asRecord(config['store'])
+    return Promise.resolve({
-    return {
+      id: storeId,
-      id: configStore === null ? deriveStoreId(store) : readString(configStore, 'id', deriveStoreId(store)),
       name: store.name,
       home,
       configPath,
       engine: DESKTOP_STORE_ENGINE.id
+    })
+  }
+
+  /**
+   * The store's configuration: its identity, and the two things worth stating.
+   *
+   * Everything absent from this falls to the engine's defaults, which is most of it. The
+   * subfolder is named after the store so two stores on one machine cannot reach into
+   * each other's files — it is the prune boundary, so it has to be the store's own.
+   * Demo titles are listed because a catalog that publishes them means them to be
+   * played; the engine defaults to released and archived only, which is the safer
+   * default for a store nobody configured.
+   */
+  private buildConfig (store: RegistryStore, storeId: string): Record<string, unknown> {
+    return {
+      store: { id: storeId, name: store.name, base_url: store.catalogUrl },
+      paths: { subfolder: storeId },
+      catalog: { statuses: ['released', 'archived', 'demo'] }
     }
   }
 
   /**
    * Clear out the scripts an older client downloaded here.
    *
-   * A store home provisioned by 1.5.0 or by the shell installer holds two Python
+   * A store home provisioned by 1.5.0 or by a shell installer holds two Python files
-   * files that nothing reads any more. They are harmless, but a directory that still
+   * that nothing reads any more. They are harmless, but a directory that still looks
-   * looks like it holds the engine invites someone to run it against a state file
+   * like it holds the engine invites someone to run it against a state file this
-   * this application is also writing.
+   * application is also writing.
    */
   private removeRetiredEngine (home: string, progress: EngineProgressListener): void {
     for (const fileName of RETIRED_ENGINE_FILES) {
@@ -73,79 +81,4 @@ export class NativeStoreEngineInstaller implements StoreEngineInstaller {
       progress.onLog?.(`removed the retired ${fileName}`)
     }
   }
-
-  /**
-   * The store's configuration.
-   *
-   * Three cases, and all of them install:
-   *
-   *   - **a repository with a config.json** — that file is the authority on how the
-   *     store behaves: which platforms it offers, which statuses it shows, where
-   *     things land;
-   *   - **a repository without one** (404) — the engine's defaults, as below;
-   *   - **no repository at all** — the same defaults, without the round trip.
-   *
-   * The engine's built-in defaults already cover the host-to-asset mapping, the
-   * modes, the platforms and the behaviour, so what a store actually has to supply is
-   * identity: a slug, a name and a catalog. That is exactly what a registry record
-   * carries, which is why a store needs no repository of its own. The registry always
-   * wins on those three, whatever a config file says.
-   */
-  private async readStoreConfig (
-    store: RegistryStore,
-    progress: EngineProgressListener
-  ): Promise<Record<string, unknown>> {
-    const storeId = deriveStoreId(store)
-    const config = await this.readPublishedConfig(store, storeId, progress)
-
-    const existing = asRecord(config['store']) ?? {}
-    config['store'] = {
-      ...existing,
-      id: readString(existing, 'id', storeId),
-      name: store.name,
-      base_url: store.catalogUrl
-    }
-    return config
-  }
-
-  private async readPublishedConfig (
-    store: RegistryStore,
-    storeId: string,
-    progress: EngineProgressListener
-  ): Promise<Record<string, unknown>> {
-    const repositoryUrl = store.storeRepositoryUrl
-    if (repositoryUrl === null) {
-      progress.onLog?.(`${store.name} has no store repository — using the engine defaults`)
-      return this.defaultConfig(storeId)
-    }
-    try {
-      progress.onLog?.(`reading the store config from ${repositoryUrl}`)
-      const body = await this.httpClient.readText(this.configUrl(repositoryUrl))
-      return { ...(asRecord(JSON.parse(body)) ?? {}) }
-    } catch (error: unknown) {
-      if (!(error instanceof HttpStatusError) || error.statusCode !== 404) throw error
-      progress.onLog?.('no config.json in the store repository — using the engine defaults')
-      return this.defaultConfig(storeId)
-    }
-  }
-
-  /**
-   * What a store gets when nothing else says otherwise.
-   *
-   * Two fields, on top of the identity added by the caller. The subfolder keeps two
-   * stores on one machine out of each other's files, and it is the prune boundary, so
-   * it must be the store's own. Demo titles are listed because a catalog that
-   * publishes them means them to be played — the engine defaults to released and
-   * archived only, which is the safer default for a store nobody configured.
-   */
-  private defaultConfig (storeId: string): Record<string, unknown> {
-    return {
-      paths: { subfolder: storeId },
-      catalog: { statuses: ['released', 'archived', 'demo'] }
-    }
-  }
-
-  private configUrl (repositoryUrl: string, branch: string = DEFAULT_BRANCH): string {
-    return `${repositoryUrl.replace(/\/+$/, '')}/raw/branch/${branch}/${CONFIG_FILE_NAME}`
-  }
 }

src/main/composition/ServiceContainer.ts

@@ -1,4 +1,5 @@
 import type { App, IpcMain, Shell } from 'electron'
+import { AccountService } from '../../application/services/AccountService'
 import { ApplicationStateService } from '../../application/services/ApplicationStateService'
 import { CatalogService } from '../../application/services/CatalogService'
 import { GameLaunchService } from '../../application/services/GameLaunchService'
@@ -7,12 +8,14 @@ import { StoreProvisioningService } from '../../application/services/StoreProvis
 import { StoreSelectionService } from '../../application/services/StoreSelectionService'
 import { ElectronApplicationEnvironment } from '../../infrastructure/electron/ElectronApplicationEnvironment'
 import { ElectronGameLauncher } from '../../infrastructure/electron/ElectronGameLauncher'
+import { SafeStorageCredentialRepository } from '../../infrastructure/electron/SafeStorageCredentialRepository'
 import { NativeStoreCatalogGateway } from '../../infrastructure/engine/NativeStoreCatalogGateway'
 import { HttpTextClient } from '../../infrastructure/http/HttpTextClient'
 import { FileSystemInstalledStoreRepository } from '../../infrastructure/repositories/FileSystemInstalledStoreRepository'
 import { NativeStoreEngineInstaller } from '../../infrastructure/repositories/NativeStoreEngineInstaller'
 import { HttpStoreRegistryRepository } from '../../infrastructure/repositories/HttpStoreRegistryRepository'
 import { JsonFilePreferencesRepository } from '../../infrastructure/repositories/JsonFilePreferencesRepository'
+import { AccountIpcController } from '../ipc/AccountIpcController'
 import { AppIpcController } from '../ipc/AppIpcController'
 import { CatalogIpcController } from '../ipc/CatalogIpcController'
 import { IpcRouter } from '../ipc/IpcRouter'
@@ -35,6 +38,7 @@ export class ServiceContainer {
   public readonly provisioning: StoreProvisioningService
   public readonly state: ApplicationStateService
   public readonly launching: GameLaunchService
+  public readonly accounts: AccountService
 
   private readonly controllers: readonly { register: (router: IpcRouter) => void }[]
 
@@ -46,14 +50,16 @@ export class ServiceContainer {
     const httpClient = new HttpTextClient()
 
     const stores = new FileSystemInstalledStoreRepository()
-    const catalogGateway = new NativeStoreCatalogGateway()
+    const credentials = new SafeStorageCredentialRepository(environment)
+    const catalogGateway = new NativeStoreCatalogGateway(credentials)
     const registry = new HttpStoreRegistryRepository(httpClient)
-    const installer = new NativeStoreEngineInstaller(httpClient)
+    const installer = new NativeStoreEngineInstaller()
     const preferencesRepository = new JsonFilePreferencesRepository(environment)
 
     const preferences = new PreferencesService(preferencesRepository, environment)
     this.selection = new StoreSelectionService(stores, preferences)
     this.catalog = new CatalogService(catalogGateway, this.selection)
+    this.accounts = new AccountService(catalogGateway, this.selection)
     this.provisioning = new StoreProvisioningService(registry, installer, stores, this.selection)
     this.launching = new GameLaunchService(new ElectronGameLauncher(shell), this.catalog)
     this.state = new ApplicationStateService(
@@ -63,7 +69,8 @@ export class ServiceContainer {
     this.controllers = [
       new AppIpcController(this.state, preferences, this.launching),
       new CatalogIpcController(this.catalog, this.launching, this.guard, this.streams),
-      new StoreIpcController(this.provisioning, this.selection, this.guard, this.streams)
+      new StoreIpcController(this.provisioning, this.selection, this.guard, this.streams),
+      new AccountIpcController(this.accounts, this.streams)
     ]
   }
 

src/main/diagnostics/SelfTestRunner.ts

@@ -28,6 +28,8 @@ interface SelfTestReport {
   readonly locales: readonly string[]
   /** `<accessible name>:<glyph count>` per icon-only control in the footer. */
   readonly iconControls: readonly string[]
+  /** `<title> [current|newer] Upgrade:on|off Uninstall:on|off` per installed card. */
+  readonly cardMenus: readonly string[]
 }
 
 /** What changed after clicking a store that was not open. */
@@ -74,7 +76,11 @@ export class SelfTestRunner {
     // picker are the only way to reach those two actions now that neither has a label.
     const iconsNamed = report.iconControls.length === 2 &&
       report.iconControls.every((control: string): boolean => /^.+:1$/.test(control))
-    const rendered = report.locales.length > 1 && iconsNamed && (
+    // Every installed card offers both actions, and Upgrade is enabled exactly when the
+    // version line says there is something newer. Uninstall is always available.
+    const menusAgree = report.cardMenus.every((entry: string): boolean =>
+      /\[newer\] \S+:on \S+:on$/.test(entry) || /\[current\] \S+:off \S+:on$/.test(entry))
+    const rendered = report.locales.length > 1 && iconsNamed && menusAgree && (
       (report.cards > 0 && !report.gateVisible && report.stores.length > 0 &&
         report.categories.length > 0 && report.activeCategory !== null) ||
       (report.gateVisible && report.gateAction.length > 0))
@@ -107,6 +113,16 @@ export class SelfTestRunner {
       locales: [...document.getElementById('locale').options].map((option) => option.value),
       // The two icon-only controls: a glyph with no accessible name is a button nobody
       // can identify, and the failure is silent because the icon still draws.
+      // One entry per installed card: its title, whether the version line shows an
+      // upgrade, and the menu's two items with their disabled state. This is the only
+      // way to see that Upgrade is offered exactly when there is something newer —
+      // a screenshot shows a closed menu.
+      cardMenus: [...document.querySelectorAll('.card.is-installed')].map((card) => {
+        const items = [...card.querySelectorAll('.menu-item')]
+          .map((item) => item.textContent + (item.disabled ? ':off' : ':on'))
+        const arrow = card.querySelector('.version.has-update') === null ? 'current' : 'newer'
+        return (card.querySelector('h2') || {}).textContent + ' [' + arrow + '] ' + items.join(' ')
+      }),
       iconControls: [...document.querySelectorAll('.side-tools .icon-btn')]
         .map((control) => {
           const named = control.getAttribute('aria-label') || control.getAttribute('title') ||
@@ -132,7 +148,8 @@ export class SelfTestRunner {
       paths: readString(record, 'paths'),
       logLines: readNumber(record, 'logLines'),
       locales: readStringArray(record, 'locales'),
-      iconControls: readStringArray(record, 'iconControls')
+      iconControls: readStringArray(record, 'iconControls'),
+      cardMenus: readStringArray(record, 'cardMenus')
     }
   }
 

src/main/ipc/AccountIpcController.ts

@@ -0,0 +1,80 @@
+import os from 'node:os'
+import type { AccountService, SignInResult } from '../../application/services/AccountService'
+import type { StoreAccount } from '../../domain/models/StoreAccount'
+import { IPC_CHANNELS } from '../../shared/contracts/IpcChannels'
+import type { AccountDto, SignInPromptDto } from '../../shared/contracts/dto/AccountDto'
+import type { WindowStreamBroadcaster } from '../streams/WindowStreamBroadcaster'
+import type { IpcRouter } from './IpcRouter'
+
+/**
+ * Signing in and out.
+ *
+ * Deliberately outside the single-flight guard: signing in takes as long as somebody
+ * takes to find their browser, and holding the store busy for that would stop them
+ * doing anything else meanwhile. Nothing here writes to the library.
+ *
+ * `beginSignIn` answers with the code as soon as there is one and lets the waiting run
+ * on; the end arrives on the sign-in stream. A reply that only came back minutes later
+ * would be a request the window had to keep alive for no reason.
+ */
+export class AccountIpcController {
+  public constructor (
+    private readonly accounts: AccountService,
+    private readonly streams: WindowStreamBroadcaster
+  ) {}
+
+  public register (router: IpcRouter): void {
+    router.handle(IPC_CHANNELS.accountRead, async (): Promise<AccountDto> =>
+      toDto(await this.accounts.readAccount()))
+    router.handle(IPC_CHANNELS.accountBeginSignIn, async (): Promise<SignInPromptDto> =>
+      this.handleBeginSignIn())
+    router.handle(IPC_CHANNELS.accountCancelSignIn, (): Promise<void> => {
+      this.accounts.cancelSignIn()
+      return Promise.resolve()
+    })
+    router.handle(IPC_CHANNELS.accountSignOut, async (): Promise<AccountDto> =>
+      toDto(await this.accounts.signOut()))
+  }
+
+  private async handleBeginSignIn (): Promise<SignInPromptDto> {
+    const session = await this.accounts.beginSignIn(clientName())
+
+    session.finished.then((result: SignInResult): void => {
+      this.streams.publishSignInFinished({
+        outcome: result.outcome, account: toDto(result.account)
+      })
+    }, (error: unknown): void => {
+      // A sign-in that fell over is a sign-in that did not happen; the window needs to
+      // stop showing a code either way.
+      this.streams.publishSignInFinished({
+        outcome: 'expired', account: { signInAvailable: true, signedIn: false }
+      })
+      this.streams.publishLog(`sign-in failed: ${describe(error)}`)
+    })
+
+    return {
+      userCode: session.prompt.userCode,
+      verificationUrl: session.prompt.verificationUrl,
+      expiresInSeconds: session.prompt.expiresInSeconds
+    }
+  }
+}
+
+function toDto (account: StoreAccount): AccountDto {
+  return { signInAvailable: account.signInAvailable, signedIn: account.signedIn }
+}
+
+/**
+ * What this device calls itself on the person's account page.
+ *
+ * The machine's own name, because that is what somebody looking at a list of signed-in
+ * devices needs in order to recognise which one to remove.
+ */
+function clientName (): string {
+  const hostname = os.hostname()
+  return hostname.length > 0 ? `WarpEngine Client (${hostname})` : 'WarpEngine Client'
+}
+
+function describe (error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}

src/main/ipc/CatalogIpcController.ts

@@ -46,7 +46,11 @@ export class CatalogIpcController {
       return {
         games: this.gameMapper.toDtoList(listing.games, baseUrl),
         skipped: listing.skipped,
-        paths: listing.paths === null ? null : this.pathsMapper.toDto(listing.paths)
+        paths: listing.paths === null ? null : this.pathsMapper.toDto(listing.paths),
+        account: {
+          signInAvailable: listing.account.signInAvailable,
+          signedIn: listing.account.signedIn
+        }
       }
     })
   }

src/main/ipc/IpcArguments.ts

@@ -27,12 +27,9 @@ export function requireStringArray (value: unknown, name: string): readonly stri
 export function requireRegistryStore (value: unknown): RegistryStoreDto {
   const record = asRecord(value)
   if (record === null) throw new TypeError('a store record is required')
-  const repository = readString(record, 'storeRepositoryUrl')
   const store: RegistryStoreDto = {
     name: readString(record, 'name'),
     catalogUrl: readString(record, 'catalogUrl'),
-    // Optional: a store with no repository installs on the engine's defaults.
-    storeRepositoryUrl: repository.length > 0 ? repository : null,
     storeId: readString(record, 'storeId')
   }
   if (store.name.length === 0 || store.catalogUrl.length === 0) {

src/main/streams/WindowStreamBroadcaster.ts

@@ -1,10 +1,12 @@
 import type { BrowserWindow } from 'electron'
 import type { EngineProgressListener } from '../../domain/models/EngineProgress'
 import { IPC_CHANNELS } from '../../shared/contracts/IpcChannels'
+import type { SignInFinishedDto } from '../../shared/contracts/dto/AccountDto'
 import type { SyncEventDto } from '../../shared/contracts/dto/SyncEventDto'
 
 /**
- * The three one-way streams to the window: log lines, progress events, busy state.
+ * The one-way streams to the window: log lines, progress events, busy state, and how a
+ * sign-in ended.
  *
  * Holds no window of its own — the reference is handed in when one exists and
  * cleared when it does not, so a stream that outlives the window is a no-op rather
@@ -33,6 +35,14 @@ export class WindowStreamBroadcaster {
     this.send(IPC_CHANNELS.streamBusyChanged, busy)
   }
 
+  /**
+   * A sign-in finishes minutes after the call that started it returned, and in another
+   * window entirely — so it arrives as an event rather than as a reply.
+   */
+  public publishSignInFinished (result: SignInFinishedDto): void {
+    this.send(IPC_CHANNELS.streamSignInFinished, result)
+  }
+
   /** A progress listener wired to these streams, for handing to the engine. */
   public asProgressListener (): EngineProgressListener {
     return {

src/preload/preload.ts

@@ -3,6 +3,9 @@ import {
   BRIDGE_GLOBAL_NAME, type BridgeApi, type StreamListener
 } from '../shared/contracts/BridgeApi'
 import { IPC_CHANNELS } from '../shared/contracts/IpcChannels'
+import type {
+  AccountDto, SignInFinishedDto, SignInPromptDto
+} from '../shared/contracts/dto/AccountDto'
 import type { AppStateDto } from '../shared/contracts/dto/AppStateDto'
 import type { CatalogListingDto } from '../shared/contracts/dto/CatalogListingDto'
 import type { InstalledStoreDto } from '../shared/contracts/dto/InstalledStoreDto'
@@ -40,6 +43,15 @@ const bridge: BridgeApi = {
   launchGame: async (name: string): Promise<boolean> =>
     ipcRenderer.invoke(IPC_CHANNELS.catalogLaunchGame, name) as Promise<boolean>,
 
+  readAccount: async (): Promise<AccountDto> =>
+    ipcRenderer.invoke(IPC_CHANNELS.accountRead) as Promise<AccountDto>,
+  beginSignIn: async (): Promise<SignInPromptDto> =>
+    ipcRenderer.invoke(IPC_CHANNELS.accountBeginSignIn) as Promise<SignInPromptDto>,
+  cancelSignIn: async (): Promise<void> =>
+    ipcRenderer.invoke(IPC_CHANNELS.accountCancelSignIn) as Promise<void>,
+  signOut: async (): Promise<AccountDto> =>
+    ipcRenderer.invoke(IPC_CHANNELS.accountSignOut) as Promise<AccountDto>,
+
   listRegistryStores: async (): Promise<RegistryResultDto> =>
     ipcRenderer.invoke(IPC_CHANNELS.storeListRegistry) as Promise<RegistryResultDto>,
   installStore: async (store: RegistryStoreDto): Promise<InstalledStoreDto> =>
@@ -66,6 +78,12 @@ const bridge: BridgeApi = {
     ipcRenderer.on(IPC_CHANNELS.streamBusyChanged, (_event: IpcRendererEvent, busy: boolean): void => {
       listener(busy)
     })
+  },
+  onSignInFinished: (listener: StreamListener<SignInFinishedDto>): void => {
+    ipcRenderer.on(
+      IPC_CHANNELS.streamSignInFinished,
+      (_event: IpcRendererEvent, payload: SignInFinishedDto): void => { listener(payload) }
+    )
   }
 }
 

src/renderer/RendererApplication.ts

@@ -1,5 +1,6 @@
 import type { BridgeApi } from '../shared/contracts/BridgeApi'
 import { requireBridge } from './BridgeAccess'
+import { AccountController } from './controllers/AccountController'
 import { CatalogController } from './controllers/CatalogController'
 import { EngineStreamController } from './controllers/EngineStreamController'
 import { PreferencesController } from './controllers/PreferencesController'
@@ -11,6 +12,7 @@ import { GameCardView } from './views/GameCardView'
 import { GateView } from './views/GateView'
 import { LogDrawerView } from './views/LogDrawerView'
 import { SideMenuView } from './views/SideMenuView'
+import { SignInView } from './views/SignInView'
 import { TopBarView } from './views/TopBarView'
 
 /**
@@ -28,10 +30,12 @@ export class RendererApplication {
   private readonly grid: CatalogGridView
   private readonly topBar: TopBarView
   private readonly sideMenu: SideMenuView
+  private readonly signInPanel: SignInView
   private readonly catalog: CatalogController
   private readonly stores: StoreController
   private readonly preferences: PreferencesController
   private readonly streams: EngineStreamController
+  private readonly accounts: AccountController
 
   public constructor (bridge: BridgeApi = requireBridge()) {
     this.bridge = bridge
@@ -44,12 +48,25 @@ export class RendererApplication {
     this.stores = new StoreController(this.bridge, this.store, this.log, this.catalog)
     this.preferences = new PreferencesController(this.bridge, this.store)
     this.streams = new EngineStreamController(this.bridge, this.store, this.log)
+    this.accounts = new AccountController(
+      this.bridge, this.store, this.log,
+      async (): Promise<void> => { await this.catalog.refresh() }
+    )
 
     this.grid = new CatalogGridView(new GameCardView({
       onInstall: (name: string): void => { void this.catalog.syncGames([name]) },
+      // The same call as an install: a sync of one name fetches whatever the catalog
+      // now has for it, and the engine replaces the old payload and menu entry.
+      onUpgrade: (name: string): void => { void this.catalog.syncGames([name]) },
       onLaunch: (name: string): void => { void this.catalog.launchGame(name) },
-      onRemove: (name: string): void => { void this.catalog.removeGame(name) }
+      onRemove: (name: string): void => { void this.catalog.removeGame(name) },
+      onPurchase: (name: string): void => { void this.purchase(name) },
+      onSignIn: (): void => { void this.accounts.signIn() }
     }))
+    this.signInPanel = new SignInView({
+      onOpenPage: (): void => { void this.accounts.openVerificationPage() },
+      onCancel: (): void => { void this.accounts.cancelSignIn() }
+    })
     this.topBar = new TopBarView({
       onToggleNavigation: (): void => { void this.preferences.toggleNavigation() }
     })
@@ -58,11 +75,29 @@ export class RendererApplication {
       onAddStore: (): void => { void this.stores.offerStores() },
       onRefresh: (): void => { void this.catalog.refresh() },
       onSelectCategory: (filter: CategoryFilter): void => { this.store.applyFilter(filter) },
-      onSelectLocale: (locale: string): void => { void this.preferences.selectLocale(locale) }
+      onSelectLocale: (locale: string): void => { void this.preferences.selectLocale(locale) },
+      onSignIn: (): void => { void this.accounts.signIn() },
+      onSignOut: (): void => { void this.accounts.signOut() }
     })
 
     this.store.subscribe((state: AppState): void => { this.render(state) })
     this.streams.subscribe()
+    this.accounts.subscribe()
+  }
+
+  /**
+   * Buying happens in a browser.
+   *
+   * A checkout rebuilt in this window would be a second place to get card handling
+   * wrong, and the store's own pages already do it. What this side owes afterwards is
+   * a refresh, which the Refresh button is for.
+   */
+  private async purchase (name: string): Promise<void> {
+    const url = this.store.readState().games
+      .find((candidate): boolean => candidate.name === name)?.purchaseUrl ?? null
+    if (url === null) return
+
+    await this.bridge.openUrl(url)
   }
 
   /** Decides what the window is showing, then hands over to the views. */
@@ -88,6 +123,7 @@ export class RendererApplication {
     }
 
     document.body.classList.toggle('nav-closed', !state.navigationOpen)
+    this.signInPanel.render(state)
     this.topBar.render(state)
     this.sideMenu.render(state)
     this.log.render(state)

src/renderer/controllers/AccountController.ts

@@ -0,0 +1,85 @@
+import type { BridgeApi } from '../../shared/contracts/BridgeApi'
+import type { SignInFinishedDto } from '../../shared/contracts/dto/AccountDto'
+import type { AppStore } from '../state/AppStore'
+import type { LogDrawerView } from '../views/LogDrawerView'
+
+/**
+ * Signing in and out, from the window's side.
+ *
+ * Two halves that do not meet: `signIn` puts a code on screen and returns, and the
+ * answer arrives later on the sign-in stream — because the person is not here while it
+ * happens, they are in a browser. Nothing waits on anything.
+ *
+ * A sign-in that succeeds refreshes the catalog rather than patching the cards, since
+ * every entitlement in the listing was read without a credential and is now stale.
+ */
+export class AccountController {
+  public constructor (
+    private readonly bridge: BridgeApi,
+    private readonly store: AppStore,
+    private readonly log: LogDrawerView,
+    private readonly onSignedIn: () => Promise<void>
+  ) {}
+
+  public subscribe (): void {
+    this.bridge.onSignInFinished((result: SignInFinishedDto): void => {
+      this.store.applySignIn(null)
+      this.store.applyAccount(result.account)
+      this.log.appendLine(this.describeOutcome(result))
+      // Only a successful sign-in changes what the catalog would say. The other three
+      // leave it exactly as it was, and re-reading it would be a pointless wait.
+      if (result.outcome === 'signedIn') void this.onSignedIn()
+    })
+  }
+
+  public async signIn (): Promise<void> {
+    try {
+      const prompt = await this.bridge.beginSignIn()
+      this.store.applySignIn(prompt)
+      // Opened for them rather than waiting to be clicked: the browser is where the
+      // rest of this happens, and the code on screen is no use until it is open.
+      await this.bridge.openUrl(prompt.verificationUrl)
+    } catch (error: unknown) {
+      this.store.applySignIn(null)
+      this.log.appendLine(`${this.store.readState().messages.signInFailed} ${describe(error)}`)
+    }
+  }
+
+  /** Re-open the page for somebody who closed the tab before typing the code. */
+  public async openVerificationPage (): Promise<void> {
+    const prompt = this.store.readState().signIn
+    if (prompt === null) return
+
+    await this.bridge.openUrl(prompt.verificationUrl)
+  }
+
+  public async cancelSignIn (): Promise<void> {
+    this.store.applySignIn(null)
+    await this.bridge.cancelSignIn()
+  }
+
+  public async signOut (): Promise<void> {
+    try {
+      this.store.applyAccount(await this.bridge.signOut())
+      // The listing was read as somebody; it has to be read again as nobody, or every
+      // owned title keeps its Install button until the next refresh.
+      await this.onSignedIn()
+    } catch (error: unknown) {
+      this.log.appendLine(describe(error))
+    }
+  }
+
+  private describeOutcome (result: SignInFinishedDto): string {
+    const messages = this.store.readState().messages
+    switch (result.outcome) {
+      case 'signedIn': return messages.signInDone
+      case 'denied': return messages.signInDenied
+      case 'expired': return messages.signInExpired
+      case 'cancelled': return messages.signInCancelled
+    }
+  }
+}
+
+function describe (error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}

src/renderer/controllers/CatalogController.ts

@@ -19,7 +19,7 @@ export class CatalogController {
   public async refresh (): Promise<void> {
     try {
       const listing: CatalogListingDto = await this.bridge.listGames()
-      this.store.applyCatalog(listing.games, listing.paths)
+      this.store.applyCatalog(listing.games, listing.paths, listing.account)
       for (const reason of listing.skipped) this.log.appendLine(`skipped ${reason}`)
     } catch (error: unknown) {
       this.reportFailure(error)

src/renderer/index.html

@@ -36,6 +36,17 @@
         <button id="add-store" class="btn btn-ghost btn-wide"></button>
       </section>
 
+      <!--
+        Signing in, and who is signed in. The whole block is hidden where the catalog
+        offers no sign-in at all, which is most of them: a greyed-out button is telling
+        somebody about a door that does not exist.
+      -->
+      <section class="side-block" id="account-block" hidden>
+        <h2 class="side-head" id="head-account"></h2>
+        <p class="side-quiet-text" id="account-state"></p>
+        <button id="account-action" class="btn btn-ghost btn-wide"></button>
+      </section>
+
       <section class="side-block side-cats">
         <h2 class="side-head" id="head-cats"></h2>
         <nav class="cats" id="cats"></nav>
@@ -74,6 +85,22 @@
     </aside>
 
     <div class="content">
+      <!--
+        The code to type into a browser. A panel over the grid rather than a screen of
+        its own: the catalog is still there and still readable, and the sign-in is
+        something happening elsewhere that this window is only reporting on.
+      -->
+      <section id="signin" class="signin" hidden>
+        <h2 id="signin-title"></h2>
+        <p id="signin-body"></p>
+        <p class="signin-code" id="signin-code"></p>
+        <p class="signin-waiting" id="signin-waiting"></p>
+        <div class="signin-actions">
+          <button id="signin-open" class="btn btn-secondary"></button>
+          <button id="signin-cancel" class="btn btn-ghost"></button>
+        </div>
+      </section>
+
       <!-- Shown instead of the grid when there is nothing to drive yet. -->
       <section id="gate" class="gate" hidden>
         <h1 id="gate-title"></h1>

src/renderer/state/AppStore.ts

@@ -1,3 +1,4 @@
+import type { AccountDto, SignInPromptDto } from '../../shared/contracts/dto/AccountDto'
 import type { AppStateDto } from '../../shared/contracts/dto/AppStateDto'
 import type { GameDto } from '../../shared/contracts/dto/GameDto'
 import type { InstalledStoreDto } from '../../shared/contracts/dto/InstalledStoreDto'
@@ -31,6 +32,10 @@ export interface AppState {
   readonly progress: SyncProgress | null
   /** Non-null while the setup screen is up, which is also what hides the grid. */
   readonly gate: GatePresentation | null
+  /** Where this machine stands with the open store. */
+  readonly account: AccountDto
+  /** Non-null while a code is on screen waiting to be typed into a browser. */
+  readonly signIn: SignInPromptDto | null
 }
 
 const INITIAL_STATE: AppState = {
@@ -47,7 +52,9 @@ const INITIAL_STATE: AppState = {
   filter: ALL_CATEGORIES,
   busy: false,
   progress: null,
-  gate: null
+  gate: null,
+  account: { signInAvailable: false, signedIn: false },
+  signIn: null
 }
 
 export type AppStateListener = (state: AppState) => void
@@ -96,13 +103,38 @@ export class AppStore {
     this.notify()
   }
 
-  public applyCatalog (games: readonly GameDto[], paths: StorePathsDto | null): void {
+  public applyCatalog (
-    this.state = { ...this.state, games, paths: paths ?? this.state.paths }
+    games: readonly GameDto[],
+    paths: StorePathsDto | null,
+    account: AccountDto
+  ): void {
+    this.state = { ...this.state, games, paths: paths ?? this.state.paths, account }
+    this.notify()
+  }
+
+  public applyAccount (account: AccountDto): void {
+    this.state = { ...this.state, account }
+    this.notify()
+  }
+
+  public applySignIn (prompt: SignInPromptDto | null): void {
+    this.state = { ...this.state, signIn: prompt }
     this.notify()
   }
 
   public applySelectedStore (store: InstalledStoreDto): void {
-    this.state = { ...this.state, currentStore: store, games: [], paths: null, filter: ALL_CATEGORIES }
+    // A new store means a new account: whether we are signed in is per store, and
+    // carrying the old answer over would show somebody as signed in to a shop they
+    // have never visited.
+    this.state = {
+      ...this.state,
+      currentStore: store,
+      games: [],
+      paths: null,
+      filter: ALL_CATEGORIES,
+      account: { signInAvailable: false, signedIn: false },
+      signIn: null
+    }
     this.notify()
   }
 

src/renderer/state/CategoryFilter.ts

@@ -46,6 +46,12 @@ function matchesGroup (game: GameDto, group: string): boolean {
       return game.updateAvailable
     case 'available':
       return game.installable && !game.installed
+    case 'owned':
+      // Owning something is not the same as having installed it — the point of the
+      // category is finding what you paid for and have not put on this machine yet.
+      return game.accessVerdict === 'entitled'
+    case 'purchasable':
+      return game.accessVerdict === 'purchasable'
     case 'unsupported':
       return !game.installable
     default:
@@ -57,8 +63,8 @@ function matchesGroup (game: GameDto, group: string): boolean {
  * The categories, built from what the catalog actually contains.
  *
  * There is no genre in a WarpEngine catalog, so the useful axes are the state of a
- * title on this machine, the platform it was built with, and whether it runs here or
+ * title on this machine, what this person may have of it, the platform it was built
- * in a browser. Empty axes are left out rather than shown as zeroes, and an axis with
+ * with, and whether it runs here or in a browser. Empty axes are left out rather than shown as zeroes, and an axis with
  * a single value is left out too — a filter that changes nothing is noise.
  */
 export function buildCategorySections (
@@ -73,6 +79,8 @@ export function buildCategorySections (
     { kind: 'group', value: 'installed', label: messages.catInstalled, count: count((game: GameDto): boolean => game.installed) },
     { kind: 'group', value: 'updates', label: messages.catUpdates, count: count((game: GameDto): boolean => game.updateAvailable) },
     { kind: 'group', value: 'available', label: messages.catAvailable, count: count((game: GameDto): boolean => game.installable && !game.installed) },
+    { kind: 'group', value: 'owned', label: messages.catOwned, count: count((game: GameDto): boolean => game.accessVerdict === 'entitled') },
+    { kind: 'group', value: 'purchasable', label: messages.catPurchasable, count: count((game: GameDto): boolean => game.accessVerdict === 'purchasable') },
     { kind: 'group', value: 'unsupported', label: messages.catUnsupported, count: count((game: GameDto): boolean => !game.installable) }
   ]
   sections.push({

src/renderer/style.css

@@ -282,6 +282,34 @@ body.nav-closed .side { margin-left: calc(-1 * var(--side-width)); }
 .gate-actions { display: flex; gap: 14px; justify-content: center; align-items: center; flex-wrap: wrap; }
 .gate-choice { display: inline-flex; align-items: center; gap: 8px; color: var(--ink-dim); font-size: 13px; }
 
+/* --- signing in --------------------------------------------------------- */
+/*
+ * The code, while somebody carries it to a browser. A band across the top of the
+ * content rather than a screen of its own: the sign-in is happening elsewhere, and
+ * there is no reason the catalog should stop being readable while it does.
+ */
+.signin {
+  margin: 18px 18px 0;
+  padding: 18px 20px;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  background: var(--panel);
+  text-align: center;
+}
+.signin h2 { margin: 0 0 6px; font-size: 16px; }
+.signin p { margin: 0 0 10px; color: var(--ink-dim); font-size: 13px; }
+/* The one thing on screen somebody has to copy by eye, so: large, spaced, and
+   selectable — a code that cannot be highlighted is a code that has to be retyped. */
+.signin-code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 28px;
+  letter-spacing: 0.22em;
+  color: var(--ink);
+  user-select: text;
+}
+.signin-waiting { font-size: 12px; }
+.signin-actions { display: flex; gap: 10px; justify-content: center; }
+
 /* --- the grid ----------------------------------------------------------- */
 .grid {
   flex: 1;
@@ -300,6 +328,11 @@ body.nav-closed .side { margin-left: calc(-1 * var(--side-width)); }
   align-content: start;
 }
 .empty { margin: auto; color: var(--ink-dim); }
+/* A title somebody has not bought is not a broken one: the dimming and the dashed
+   border belong to what this *machine* cannot do, and there is nothing wrong with
+   the machine here. */
+.card.is-purchasable { opacity: 1; }
+.side-quiet-text { color: var(--ink-dim); font-size: 12px; margin: 0 0 8px; }
 .gate { overflow-y: auto; }
 
 .card {
@@ -345,6 +378,14 @@ body.nav-closed .side { margin-left: calc(-1 * var(--side-width)); }
 }
 .badge-app { color: var(--accent); border-color: #2f5a49; }
 .badge-web { color: var(--warn); border-color: #5a4a2f; }
+/* A price reads as a fact rather than a warning: same weight as the mode badges,
+   filled rather than outlined, so it is findable while scanning a row of cards. */
+.badge-price {
+  color: var(--ink);
+  background: var(--panel-2);
+  border-color: var(--line);
+}
+.badge-owned { color: var(--accent); border-color: #2f5a49; }
 .version { font-size: 12px; color: var(--ink-dim); margin-left: auto; }
 .desc {
   margin: 0;
@@ -357,6 +398,56 @@ body.nav-closed .side { margin-left: calc(-1 * var(--side-width)); }
 }
 .actions { display: flex; gap: 8px; margin-top: auto; }
 
+/* --- the card's actions menu -------------------------------------------- */
+/*
+ * A <details> holding the two actions that are not the card's headline. The card is the
+ * positioning context, and the panel is pinned to the button's right edge so it opens
+ * inward rather than off the side of the grid.
+ */
+.menu { position: relative; margin-left: auto; }
+.menu-toggle { list-style: none; }
+/* Safari and Chrome each draw their own marker on a summary; both have to go. */
+.menu-toggle::-webkit-details-marker { display: none; }
+.menu-toggle::marker { content: ''; }
+.menu[open] .menu-toggle { color: var(--ink); background: var(--panel-2); border-color: var(--line); }
+
+.menu-items {
+  position: absolute;
+  right: 0;
+  bottom: calc(100% + 6px);
+  z-index: 20;
+  min-width: 148px;
+  display: flex;
+  flex-direction: column;
+  padding: 4px;
+  gap: 2px;
+  background: var(--panel-2);
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  box-shadow: 0 10px 28px rgb(0 0 0 / .45);
+}
+.menu-item {
+  font: inherit;
+  font-size: 13px;
+  text-align: left;
+  padding: 7px 10px;
+  border: 0;
+  border-radius: 7px;
+  background: transparent;
+  color: var(--ink);
+  cursor: pointer;
+  white-space: nowrap;
+}
+.menu-item:hover:not(:disabled) { background: #2b3746; }
+.menu-item:disabled { color: var(--ink-dim); opacity: .5; cursor: default; }
+
+.icon-dots { fill: currentColor; stroke: none; }
+
+/* An installed version with a newer one behind it: the arrow carries the news, so the
+   colour only has to make it findable in a grid. */
+.version.has-update { color: var(--accent); font-weight: 600; }
+
+
 /* --- log ----------------------------------------------------------------
    No permanent footer: the panel is in the flow only while it is open, and the
    switch for it sits in the side menu with everything else that is not a title. */

src/renderer/views/CatalogGridView.ts

@@ -9,7 +9,26 @@ export class CatalogGridView {
   private readonly grid = requireElement('grid', HTMLElement)
   private readonly empty = requireElement('empty', HTMLElement)
 
-  public constructor (private readonly cards: GameCardView) {}
+  public constructor (private readonly cards: GameCardView) {
+    this.closeMenusOnOutsideClick()
+  }
+
+  /**
+   * One listener for every card's actions menu.
+   *
+   * A `<details>` does not close when the pointer goes elsewhere, and a card cannot own
+   * this: cards are rebuilt on every render, so a listener per card would be a listener
+   * per render. The grid is created once, which makes it the right place for it.
+   */
+  private closeMenusOnOutsideClick (): void {
+    document.addEventListener('click', (event: MouseEvent): void => {
+      const target = event.target
+      const clicked = target instanceof Node ? target : null
+      for (const menu of this.grid.querySelectorAll('details.menu[open]')) {
+        if (clicked === null || !menu.contains(clicked)) menu.removeAttribute('open')
+      }
+    })
+  }
 
   public render (state: AppState): void {
     const shown = state.games.filter((game: GameDto): boolean => matchesFilter(game, state.filter))

src/renderer/views/GameCardView.ts

@@ -4,15 +4,22 @@ import { createElement } from '../dom/Dom'
 
 export interface GameCardViewCallbacks {
   readonly onInstall: (name: string) => void
+  readonly onUpgrade: (name: string) => void
   readonly onLaunch: (name: string) => void
   readonly onRemove: (name: string) => void
+  /** Opens the catalog's own purchase page in the person's browser. */
+  readonly onPurchase: (name: string) => void
+  readonly onSignIn: () => void
 }
 
 /**
  * One card.
  *
- * A card is a function of a title and the strings: it holds no state of its own, so
+ * A card is a function of a title and the strings: it holds no state of its own, so the
- * the grid can throw the lot away and rebuild after every listing.
+ * grid can throw the lot away and rebuild after every listing. The one exception is the
+ * actions menu, whose open/closed state lives in a `<details>` element — and being
+ * thrown away is exactly what should happen to an open menu when the catalog changes
+ * under it.
  */
 export class GameCardView {
   public constructor (private readonly callbacks: GameCardViewCallbacks) {}
@@ -21,6 +28,7 @@ export class GameCardView {
     const card = createElement('article', 'card')
     if (game.installed) card.classList.add('is-installed')
     if (!game.installable) card.classList.add('is-unavailable')
+    if (game.accessVerdict === 'purchasable') card.classList.add('is-purchasable')
     card.appendChild(this.createArt(game))
     card.appendChild(this.createBody(game, messages, busy))
     return card
@@ -71,13 +79,41 @@ export class GameCardView {
       meta.appendChild(badge)
     }
     meta.appendChild(createElement('span', 'badge badge-plain', game.platform))
-    meta.appendChild(createElement('span', 'version',
+    // The price is where the mode badge is rather than down by the button: what a title
-      game.installed && game.installedVersion !== null
+    // costs is something a person scans a grid for, and a number that only appears
-        ? `${game.installedVersion} · ${messages.installed}`
+    // beside a button is a number they have to hunt for card by card.
-        : game.version))
+    if (game.priceLabel !== null && game.accessVerdict !== 'entitled') {
+      meta.appendChild(createElement('span', 'badge badge-price', game.priceLabel))
+    }
+    if (game.accessVerdict === 'entitled') {
+      const owned = createElement('span', 'badge badge-owned', messages.owned)
+      owned.title = messages.ownedHint
+      meta.appendChild(owned)
+    }
+    meta.appendChild(this.createVersion(game, messages))
     return meta
   }
 
+  /**
+   * The version, and what the catalog has that this machine does not.
+   *
+   * Both numbers, when they differ: which version is installed is the thing a person
+   * came to the card to find out, and "there is a newer one" is only meaningful next to
+   * it. Where they agree, the second number would be noise.
+   */
+  private createVersion (game: GameDto, messages: MessageBundle): HTMLElement {
+    if (!game.installed || game.installedVersion === null) {
+      return createElement('span', 'version', game.version)
+    }
+    if (!game.updateAvailable) {
+      return createElement('span', 'version', `${game.installedVersion} · ${messages.installed}`)
+    }
+    const version = createElement('span', 'version has-update',
+      `${game.installedVersion} → ${game.version}`)
+    version.title = messages.updateAvailable
+    return version
+  }
+
   private createActions (game: GameDto, messages: MessageBundle, busy: boolean): HTMLElement {
     const actions = createElement('div', 'actions')
 
@@ -89,25 +125,128 @@ export class GameCardView {
       return actions
     }
 
-    const primary = createElement('button', 'btn btn-primary')
+    // Not yours yet: the card sells rather than installs. Deliberately a live button
-    primary.disabled = busy
+    // and not a dimmed one — the dimmed treatment above is for what this *machine*
+    // cannot do, and there is nothing wrong with this machine.
+    if (!game.installed && game.accessVerdict === 'purchasable') {
+      actions.appendChild(this.createPurchase(game, messages, busy))
+      return actions
+    }
+    // The catalog would know, if it knew who was asking.
+    if (!game.installed && game.accessVerdict === 'signInRequired') {
+      actions.appendChild(this.createSignIn(messages, busy))
+      return actions
+    }
 
-    if (game.installed && !game.updateAvailable) {
+    actions.appendChild(this.createPrimary(game, messages, busy))
+    // Only an installed title has anything in the menu: nothing to upgrade and nothing
+    // to uninstall until there is something on the disk.
+    if (game.installed) actions.appendChild(this.createMenu(game, messages, busy))
+    return actions
+  }
+
+  /**
+   * Buy it — which happens in a browser, not here.
+   *
+   * Payment is the store's business and its own web pages already do it; a checkout
+   * rebuilt in this window would be a second place to get card handling wrong. After
+   * buying, Refresh is what turns the card into an Install.
+   */
+  private createPurchase (game: GameDto, messages: MessageBundle, busy: boolean): HTMLElement {
+    const button = createElement('button', 'btn btn-primary btn-purchase')
+    button.textContent = game.priceLabel === null
+      ? messages.purchase
+      : `${messages.purchase} · ${game.priceLabel}`
+    button.disabled = busy || game.purchaseUrl === null
+    button.title = messages.purchaseHint
+    button.addEventListener('click', (): void => { this.callbacks.onPurchase(game.name) })
+    return button
+  }
+
+  private createSignIn (messages: MessageBundle, busy: boolean): HTMLElement {
+    const button = createElement('button', 'btn btn-secondary')
+    button.textContent = messages.signInToInstall
+    button.disabled = busy
+    button.title = messages.signInToInstallHint
+    button.addEventListener('click', (): void => { this.callbacks.onSignIn() })
+    return button
+  }
+
+  /**
+   * The one action a card leads with.
+   *
+   * For an installed title that is playing it — including when an upgrade is waiting,
+   * because the version on the disk still runs and wanting to play it is not the same
+   * as wanting to wait for a download.
+   */
+  private createPrimary (game: GameDto, messages: MessageBundle, busy: boolean): HTMLElement {
+    const primary = createElement('button', 'btn btn-primary')
+    if (game.installed) {
       primary.textContent = game.mode === 'web' ? messages.open : messages.play
       primary.disabled = busy || !game.launchable
       primary.addEventListener('click', (): void => { this.callbacks.onLaunch(game.name) })
-    } else {
+      return primary
-      primary.textContent = game.updateAvailable ? messages.update : messages.install
-      primary.addEventListener('click', (): void => { this.callbacks.onInstall(game.name) })
     }
-    actions.appendChild(primary)
+    primary.textContent = messages.install
+    primary.disabled = busy
+    primary.addEventListener('click', (): void => { this.callbacks.onInstall(game.name) })
+    return primary
+  }
 
-    if (game.installed) {
+  /**
-      const remove = createElement('button', 'btn btn-ghost', messages.remove)
+   * The three-dot menu: upgrade, and uninstall.
-      remove.disabled = busy
+   *
-      remove.addEventListener('click', (): void => { this.callbacks.onRemove(game.name) })
+   * A `<details>` rather than a scripted popover, so the open state is the DOM's and the
-      actions.appendChild(remove)
+   * keyboard works without being taught to. Upgrade is present but disabled when there
+   * is nothing newer — a menu whose items appear and disappear makes a person hunt for
+   * the one they used last time, and "greyed out" already says "not now".
+   */
+  private createMenu (game: GameDto, messages: MessageBundle, busy: boolean): HTMLElement {
+    const menu = createElement('details', 'menu')
+    const toggle = createElement('summary', 'icon-btn menu-toggle')
+    toggle.title = messages.moreActions
+    toggle.setAttribute('aria-label', messages.moreActions)
+    toggle.appendChild(this.createDotsIcon())
+    menu.appendChild(toggle)
+
+    const items = createElement('div', 'menu-items')
+    items.appendChild(this.createMenuItem(messages.upgrade, busy || !game.updateAvailable,
+      (): void => { this.callbacks.onUpgrade(game.name) }))
+    items.appendChild(this.createMenuItem(messages.uninstall, busy,
+      (): void => { this.callbacks.onRemove(game.name) }))
+    menu.appendChild(items)
+    return menu
+  }
+
+  private createMenuItem (
+    label: string,
+    disabled: boolean,
+    perform: () => void
+  ): HTMLButtonElement {
+    const item = createElement('button', 'menu-item', label)
+    item.disabled = disabled
+    item.addEventListener('click', (): void => {
+      // Close before acting: the click starts work that re-renders the grid, and a menu
+      // left open would vanish mid-gesture rather than answer the press.
+      item.closest('details')?.removeAttribute('open')
+      perform()
+    })
+    return item
+  }
+
+  private createDotsIcon (): SVGSVGElement {
+    const svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+    svg.setAttribute('class', 'icon icon-dots')
+    svg.setAttribute('viewBox', '0 0 16 16')
+    svg.setAttribute('aria-hidden', 'true')
+    svg.setAttribute('focusable', 'false')
+    for (const y of [3.5, 8, 12.5]) {
+      const dot = document.createElementNS('http://www.w3.org/2000/svg', 'circle')
+      dot.setAttribute('cx', '8')
+      dot.setAttribute('cy', String(y))
+      dot.setAttribute('r', '1.35')
+      svg.appendChild(dot)
     }
-    return actions
+    return svg
   }
 }

src/renderer/views/SideMenuView.ts

@@ -12,6 +12,8 @@ export interface SideMenuViewCallbacks {
   readonly onRefresh: () => void
   readonly onSelectCategory: (filter: CategoryFilter) => void
   readonly onSelectLocale: (locale: string) => void
+  readonly onSignIn: () => void
+  readonly onSignOut: () => void
 }
 
 /**
@@ -26,6 +28,10 @@ export class SideMenuView {
   private readonly addStore = requireElement('add-store', HTMLButtonElement)
   private readonly refresh = requireElement('refresh', HTMLButtonElement)
   private readonly categories = requireElement('cats', HTMLElement)
+  private readonly accountBlock = requireElement('account-block', HTMLElement)
+  private readonly accountHead = requireElement('head-account', HTMLElement)
+  private readonly accountState = requireElement('account-state', HTMLElement)
+  private readonly accountAction = requireElement('account-action', HTMLButtonElement)
   private readonly locale = requireElement('locale', HTMLSelectElement)
   /** The square around the select: it is what a pointer hovers, so the tooltip is its. */
   private readonly localeControl = requireElement('locale-control', HTMLElement)
@@ -34,8 +40,20 @@ export class SideMenuView {
     this.addStore.addEventListener('click', callbacks.onAddStore)
     this.refresh.addEventListener('click', callbacks.onRefresh)
     this.locale.addEventListener('change', (): void => { callbacks.onSelectLocale(this.locale.value) })
+    this.accountAction.addEventListener('click', (): void => {
+      if (this.signedIn) this.callbacks.onSignOut()
+      else this.callbacks.onSignIn()
+    })
   }
 
+  /**
+   * Which of the two the one button does.
+   *
+   * Read at click time rather than rebound on every render: a listener replaced under
+   * a pointer that is already down is a click that goes nowhere.
+   */
+  private signedIn = false
+
   public render (state: AppState): void {
     setText(this.storesHead, state.messages.stores)
     setText(this.categoriesHead, state.messages.categories)
@@ -49,6 +67,7 @@ export class SideMenuView {
     this.localeControl.title = state.messages.language
 
     this.renderStores(state)
+    this.renderAccount(state)
     this.renderCategories(state)
     this.renderLocales(state)
     this.renderEnabled(state)
@@ -78,6 +97,27 @@ export class SideMenuView {
     }))
   }
 
+  /**
+   * The account block, or nothing at all.
+   *
+   * Hidden outright where the catalog offers no sign-in — which is most of them. A
+   * disabled "Sign in" would be telling somebody about a door that is not there.
+   */
+  private renderAccount (state: AppState): void {
+    this.accountBlock.hidden = !state.account.signInAvailable
+    if (!state.account.signInAvailable) return
+
+    this.signedIn = state.account.signedIn
+    setText(this.accountHead, state.messages.account)
+    setText(this.accountState, state.account.signedIn ? state.messages.signedIn : '')
+    setText(this.accountAction, state.account.signedIn
+      ? state.messages.signOut
+      : state.messages.signIn)
+    // A sign-in already under way has its own panel with a cancel on it; a second
+    // "Sign in" here would start a second flow behind the first one's code.
+    this.accountAction.disabled = state.busy || state.signIn !== null
+  }
+
   private renderCategories (state: AppState): void {
     const sections = buildCategorySections(state.games, state.messages)
     const nodes: HTMLElement[] = []

src/renderer/views/SignInView.ts

@@ -0,0 +1,47 @@
+import { requireElement, setText } from '../dom/Dom'
+import type { AppState } from '../state/AppStore'
+
+export interface SignInViewCallbacks {
+  readonly onOpenPage: () => void
+  readonly onCancel: () => void
+}
+
+/**
+ * The code, while somebody takes it to a browser.
+ *
+ * A panel over the catalog rather than a screen of its own: the sign-in is happening
+ * somewhere else, and there is no reason this window should stop being useful while it
+ * does. Everything on it is one of three things — the code, a way back to the page for
+ * whoever closed the tab, and a way out.
+ */
+export class SignInView {
+  private readonly panel = requireElement('signin', HTMLElement)
+  private readonly title = requireElement('signin-title', HTMLElement)
+  private readonly body = requireElement('signin-body', HTMLElement)
+  private readonly code = requireElement('signin-code', HTMLElement)
+  private readonly waiting = requireElement('signin-waiting', HTMLElement)
+  private readonly openPage = requireElement('signin-open', HTMLButtonElement)
+  private readonly cancel = requireElement('signin-cancel', HTMLButtonElement)
+
+  public constructor (callbacks: SignInViewCallbacks) {
+    this.openPage.addEventListener('click', callbacks.onOpenPage)
+    this.cancel.addEventListener('click', callbacks.onCancel)
+  }
+
+  public render (state: AppState): void {
+    const prompt = state.signIn
+    if (prompt === null) {
+      this.panel.hidden = true
+      return
+    }
+
+    const storeName = state.currentStore?.name ?? state.messages.appName
+    setText(this.title, state.messages.signInTitle.replace('%{store}', storeName))
+    setText(this.body, state.messages.signInBody)
+    setText(this.code, prompt.userCode)
+    setText(this.waiting, state.messages.signInWaiting)
+    setText(this.openPage, state.messages.signInOpenAgain)
+    setText(this.cancel, state.messages.signInCancel)
+    this.panel.hidden = false
+  }
+}

src/scripts/SmokeTest.ts

@@ -3,9 +3,9 @@ import path from 'node:path'
 import { GameDtoMapper } from '../application/mappers/GameDtoMapper'
 import type { CatalogListing } from '../domain/models/CatalogListing'
 import type { InstalledStore } from '../domain/models/InstalledStore'
-import type { RegistryStore } from '../domain/models/RegistryStore'
 import { DESKTOP_STORE_ENGINE } from '../domain/models/StoreEngine'
 import { deriveStoreId } from '../domain/models/StoreIdentity'
+import type { CredentialRepository } from '../domain/ports/CredentialRepository'
 import { NativeStoreCatalogGateway } from '../infrastructure/engine/NativeStoreCatalogGateway'
 import { HttpTextClient } from '../infrastructure/http/HttpTextClient'
 import { FileSystemInstalledStoreRepository } from '../infrastructure/repositories/FileSystemInstalledStoreRepository'
@@ -27,12 +27,18 @@ import { LOCALES } from '../shared/i18n/MessageBundle'
  *
  *   npm run smoke                                       the store on this machine
  *   SMOKE_HOME=/path/to/store-home npm run smoke        a sandbox store
+ *   SMOKE_TOKEN=<bearer> npm run smoke                  as a signed-in person
+ *
+ * `SMOKE_TOKEN` exists because the signed-in path is otherwise untestable here: the
+ * real credential store is the OS keychain, reached through Electron, and there is no
+ * Electron in this process. Without it a gated catalog can only ever be read as an
+ * anonymous caller, and "owned" and "not owned" never happen.
  */
 class SmokeTest {
   private failed = false
 
   private readonly stores = new FileSystemInstalledStoreRepository()
-  private readonly catalogGateway = new NativeStoreCatalogGateway()
+  private readonly catalogGateway = new NativeStoreCatalogGateway(envCredentials())
   private readonly httpClient = new HttpTextClient()
   private readonly registry = new HttpStoreRegistryRepository(this.httpClient)
   private readonly gameMapper = new GameDtoMapper()
@@ -66,34 +72,17 @@ class SmokeTest {
         return
       }
       this.reportOk('registry', `${String(stores.length)} store(s) from ${this.registry.sourceUrl}`)
+      // The slug is worth printing: it names the store home and the games subfolder, and
+      // it is derived here rather than told to us, so a wrong catalog URL shows up as a
+      // wrong folder name before anything is installed.
       for (const store of stores) {
         this.reportOk(`  ${store.name}`, `${store.catalogUrl} · ${deriveStoreId(store)}`)
-        await this.checkStoreConfig(store)
       }
     } catch (error: unknown) {
       this.reportBad('registry', `${this.registry.sourceUrl}: ${this.describe(error)}`)
     }
   }
 
-  /**
-   * A store needs no repository, and a repository needs no config.json: either way
-   * the engine's defaults carry it. So both absences are reported, not failed.
-   */
-  private async checkStoreConfig (store: RegistryStore): Promise<void> {
-    if (store.storeRepositoryUrl === null) {
-      this.reportOk('  config', 'no repository — the engine defaults would be used')
-      return
-    }
-    const url = `${store.storeRepositoryUrl.replace(/\/+$/, '')}/raw/branch/master/config.json`
-    try {
-      const config: unknown = JSON.parse(await this.httpClient.readText(url))
-      const sections = typeof config === 'object' && config !== null ? Object.keys(config).length : 0
-      this.reportOk('  config.json', `${String(sections)} sections`)
-    } catch (error: unknown) {
-      this.reportOk('  config.json', `absent (${this.describe(error)}) — defaults would be used`)
-    }
-  }
-
   private findStore (): InstalledStore | null {
     const sandbox = process.env['SMOKE_HOME']
     if (sandbox !== undefined && sandbox.length > 0) {
@@ -141,10 +130,44 @@ class SmokeTest {
     }
     const games = this.gameMapper.toDtoList(listing.games, listing.paths?.catalogBaseUrl ?? '')
     this.reportListing(games)
+    this.reportAccess(listing, games)
 
     if (logLines.length > 0) this.reportOk('stderr log', `${String(logLines.length)} lines (kept off stdout)`)
   }
 
+  /**
+   * What the catalog said about who may have what.
+   *
+   * The load-bearing case is the boring one: an older engine says nothing, every title
+   * comes back `open`, and the client behaves exactly as it did before any of this
+   * existed. A gated catalog is where the rest of it starts mattering.
+   */
+  private reportAccess (listing: CatalogListing, games: readonly GameDto[]): void {
+    const account = listing.account
+    this.reportOk('sign-in', account.signInAvailable
+      ? (account.signedIn ? 'offered, and signed in' : 'offered, not signed in')
+      : 'not offered by this catalog')
+
+    const counts = new Map<string, number>()
+    for (const game of games) {
+      counts.set(game.accessVerdict, (counts.get(game.accessVerdict) ?? 0) + 1)
+    }
+    const summary = [...counts.entries()]
+      .map(([verdict, count]: readonly [string, number]): string => `${verdict}:${String(count)}`)
+      .join(', ')
+    this.reportOk('access', summary)
+
+    // A price with nothing to click, or a purchase button with no price, is a card
+    // somebody cannot act on.
+    const unbuyable = games.filter((game: GameDto): boolean =>
+      game.accessVerdict === 'purchasable' && game.purchaseUrl === null)
+    if (unbuyable.length > 0) {
+      this.reportBad('purchase links', `${String(unbuyable.length)} priced titles have nowhere to buy them`)
+    } else if ((counts.get('purchasable') ?? 0) > 0) {
+      this.reportOk('purchase links', 'every priced title has one')
+    }
+  }
+
   private reportListing (games: readonly GameDto[]): void {
     const installable = games.filter((game: GameDto): boolean => game.installable)
     const native = installable.filter((game: GameDto): boolean => game.mode === 'app').length
@@ -203,3 +226,19 @@ void new SmokeTest().run().then(
     process.exitCode = 1
   }
 )
+
+/**
+ * The token from the environment, for every store.
+ *
+ * Deliberately not per store: this is a test harness pointed at one catalog at a time,
+ * and a keyed map here would be ceremony around a single value. Nothing writes — a
+ * smoke run must not leave a credential behind on the machine that ran it.
+ */
+function envCredentials (): CredentialRepository {
+  const token = process.env['SMOKE_TOKEN'] ?? ''
+  return {
+    readToken: (): string | null => (token.length > 0 ? token : null),
+    writeToken: (storeId: string, value: string): void => { void storeId; void value },
+    clearToken: (storeId: string): void => { void storeId }
+  }
+}

src/shared/contracts/BridgeApi.ts

@@ -1,3 +1,4 @@
+import type { AccountDto, SignInFinishedDto, SignInPromptDto } from './dto/AccountDto'
 import type { AppStateDto } from './dto/AppStateDto'
 import type { CatalogListingDto } from './dto/CatalogListingDto'
 import type { InstalledStoreDto } from './dto/InstalledStoreDto'
@@ -30,6 +31,12 @@ export interface BridgeApi {
   removeGame: (name: string) => Promise<void>
   launchGame: (name: string) => Promise<boolean>
 
+  readAccount: () => Promise<AccountDto>
+  /** Answers with the code to show; how it ended arrives on `onSignInFinished`. */
+  beginSignIn: () => Promise<SignInPromptDto>
+  cancelSignIn: () => Promise<void>
+  signOut: () => Promise<AccountDto>
+
   listRegistryStores: () => Promise<RegistryResultDto>
   installStore: (store: RegistryStoreDto) => Promise<InstalledStoreDto>
   selectStore: (home: string) => Promise<StoreSelectionDto>
@@ -40,6 +47,7 @@ export interface BridgeApi {
   onLog: (listener: StreamListener<string>) => void
   onSyncEvent: (listener: StreamListener<SyncEventDto>) => void
   onBusyChanged: (listener: StreamListener<boolean>) => void
+  onSignInFinished: (listener: StreamListener<SignInFinishedDto>) => void
 }
 
 /** The name the bridge is published under on `window`. */

src/shared/contracts/IpcChannels.ts

@@ -19,6 +19,11 @@ export const IPC_CHANNELS = {
   catalogRemoveGame: 'catalog:removeGame',
   catalogLaunchGame: 'catalog:launchGame',
 
+  accountRead: 'account:read',
+  accountBeginSignIn: 'account:beginSignIn',
+  accountCancelSignIn: 'account:cancelSignIn',
+  accountSignOut: 'account:signOut',
+
   storeListRegistry: 'store:listRegistry',
   storeInstallStore: 'store:installStore',
   storeSelectStore: 'store:selectStore',
@@ -26,7 +31,9 @@ export const IPC_CHANNELS = {
   /** Main to renderer, one way. */
   streamLog: 'stream:log',
   streamSyncEvent: 'stream:syncEvent',
-  streamBusyChanged: 'stream:busyChanged'
+  streamBusyChanged: 'stream:busyChanged',
+  /** How a sign-in ended, once the browser half is done. */
+  streamSignInFinished: 'stream:signInFinished'
 } as const
 
 export type IpcChannel = (typeof IPC_CHANNELS)[keyof typeof IPC_CHANNELS]

src/shared/contracts/dto/AccountDto.ts

@@ -0,0 +1,21 @@
+/** Where this machine stands with one store. */
+export interface AccountDto {
+  readonly signInAvailable: boolean
+  readonly signedIn: boolean
+}
+
+/** What to show while somebody finishes signing in in their browser. */
+export interface SignInPromptDto {
+  /** The short code, read off this screen and typed into a browser. */
+  readonly userCode: string
+  readonly verificationUrl: string
+  readonly expiresInSeconds: number
+}
+
+export type SignInOutcomeDto = 'signedIn' | 'denied' | 'expired' | 'cancelled'
+
+/** The end of a sign-in, pushed to the window when the waiting is over. */
+export interface SignInFinishedDto {
+  readonly outcome: SignInOutcomeDto
+  readonly account: AccountDto
+}

src/shared/contracts/dto/CatalogListingDto.ts

@@ -1,3 +1,4 @@
+import type { AccountDto } from './AccountDto'
 import type { GameDto } from './GameDto'
 import type { StorePathsDto } from './StorePathsDto'
 
@@ -6,4 +7,12 @@ export interface CatalogListingDto {
   readonly games: readonly GameDto[]
   readonly skipped: readonly string[]
   readonly paths: StorePathsDto | null
+  /**
+   * Where this machine stood with the store when the catalog was read.
+   *
+   * Carried with the listing rather than asked for separately, because the entitlement
+   * each entry reports is only meaningful next to whether anybody was signed in when
+   * the catalog answered.
+   */
+  readonly account: AccountDto
 }

src/shared/contracts/dto/GameDto.ts

@@ -1,6 +1,19 @@
 /** How a title runs: unpacked on this machine, or served as a web build. */
 export type GameModeDto = 'app' | 'web'
 
+/**
+ * Whether this person can install this title.
+ *
+ * Separate from `installable`, which is about the machine. A title can have a perfectly
+ * good build for this architecture and still not be yours.
+ *
+ *   - `open`           — nothing to own; install it
+ *   - `entitled`       — owned; install it
+ *   - `purchasable`    — not owned, and here is the price
+ *   - `signInRequired` — the catalog would say, if it knew who was asking
+ */
+export type AccessVerdictDto = 'open' | 'entitled' | 'purchasable' | 'signInRequired'
+
 /** Why a title cannot be installed on this machine. */
 export type UnavailableReasonDto = 'platformOff' | 'hostAsset' | 'noAsset' | 'vetoed'
 
@@ -30,4 +43,9 @@ export interface GameDto {
   readonly installable: boolean
   readonly unavailableReason: UnavailableReasonDto | null
   readonly unavailableDetail: string | null
+  readonly accessVerdict: AccessVerdictDto
+  /** Already formatted for the window's locale; null where there is no price to show. */
+  readonly priceLabel: string | null
+  /** Opened in the person's own browser. Null where the catalog named none. */
+  readonly purchaseUrl: string | null
 }

src/shared/contracts/dto/RegistryStoreDto.ts

@@ -2,8 +2,6 @@
 export interface RegistryStoreDto {
   readonly name: string
   readonly catalogUrl: string
-  /** Null when the store has no repository of its own; the engine's defaults are then used. */
+  /** Derived from the catalog host, or the name — what the store will be called on disk. */
-  readonly storeRepositoryUrl: string | null
-  /** Derived from the repository, the catalog host or the name — what the store will be called on disk. */
   readonly storeId: string
 }

src/shared/i18n/EnglishMessages.ts

@@ -6,12 +6,13 @@
  */
 export const ENGLISH_MESSAGES = {
   appName: 'WarpEngine Client',
-  refresh: 'Refresh',
+  refresh: 'Refresh the catalog',
   install: 'Install',
-  update: 'Update',
+  upgrade: 'Upgrade',
   play: 'Play',
   open: 'Open',
-  remove: 'Remove',
+  uninstall: 'Uninstall',
+  moreActions: 'More actions',
   installed: 'installed',
   native: 'native',
   hosted: 'hosted',
@@ -30,6 +31,8 @@ export const ENGLISH_MESSAGES = {
   catInstalled: 'Installed',
   catUpdates: 'Updates',
   catAvailable: 'Not installed',
+  catOwned: 'Owned',
+  catPurchasable: 'To buy',
   catUnsupported: 'Not for this machine',
   catPlatform: 'Platform',
   catMode: 'Kind',
@@ -51,7 +54,27 @@ export const ENGLISH_MESSAGES = {
   failed: 'failed',
   removed: 'removed',
   upToDate: 'Everything is up to date.',
-  of: 'of'
+  of: 'of',
+  owned: 'owned',
+  ownedHint: 'This account owns it — install it on this machine',
+  purchase: 'Buy',
+  purchaseHint: 'Opens the store page in your browser',
+  signInToInstall: 'Sign in to install',
+  signInToInstallHint: 'This title needs an account; the catalog will say whether you own it',
+  account: 'Account',
+  signIn: 'Sign in…',
+  signOut: 'Sign out',
+  signedIn: 'Signed in',
+  signInTitle: 'Sign in to %{store}',
+  signInBody: 'Your browser is opening the sign-in page. Type this code there:',
+  signInOpenAgain: 'Open the page again',
+  signInWaiting: 'Waiting for you to approve it…',
+  signInCancel: 'Cancel',
+  signInDone: 'Signed in.',
+  signInDenied: 'That sign-in was refused.',
+  signInExpired: 'That code expired. Try again.',
+  signInCancelled: 'Sign-in cancelled.',
+  signInFailed: 'Signing in did not work.'
 } as const
 
 /** Every string the window can show, by key. */

src/shared/i18n/HungarianMessages.ts

@@ -6,12 +6,13 @@ import type { MessageBundle } from './MessageBundle'
  */
 export const HUNGARIAN_MESSAGES: MessageBundle = {
   appName: 'WarpEngine Client',
-  refresh: 'Frissítés',
+  refresh: 'Katalógus frissítése',
   install: 'Telepítés',
-  update: 'Frissítés',
+  upgrade: 'Frissítés',
   play: 'Indítás',
   open: 'Megnyitás',
-  remove: 'Eltávolítás',
+  uninstall: 'Eltávolítás',
+  moreActions: 'További műveletek',
   installed: 'telepítve',
   native: 'natív',
   hosted: 'hosztolt',
@@ -30,6 +31,8 @@ export const HUNGARIAN_MESSAGES: MessageBundle = {
   catInstalled: 'Telepítve',
   catUpdates: 'Frissítés',
   catAvailable: 'Nincs telepítve',
+  catOwned: 'Birtokolt',
+  catPurchasable: 'Megvehető',
   catUnsupported: 'Erre a gépre nem',
   catPlatform: 'Platform',
   catMode: 'Fajta',
@@ -51,5 +54,25 @@ export const HUNGARIAN_MESSAGES: MessageBundle = {
   failed: 'hiba',
   removed: 'eltávolítva',
   upToDate: 'Minden naprakész.',
-  of: '/'
+  of: '/',
+  owned: 'birtokolt',
+  ownedHint: 'Ez a fiók birtokolja — telepítheted erre a gépre',
+  purchase: 'Megvásárlás',
+  purchaseHint: 'Megnyitja a bolt oldalát a böngésződben',
+  signInToInstall: 'Belépés a telepítéshez',
+  signInToInstallHint: 'Ehhez a címhez fiók kell; a katalógus akkor mondja meg, birtoklod-e',
+  account: 'Fiók',
+  signIn: 'Belépés…',
+  signOut: 'Kilépés',
+  signedIn: 'Belépve',
+  signInTitle: 'Belépés ide: %{store}',
+  signInBody: 'Megnyílik a böngésződ a belépő oldallal. Írd be ott ezt a kódot:',
+  signInOpenAgain: 'Oldal újranyitása',
+  signInWaiting: 'Várunk a jóváhagyásra…',
+  signInCancel: 'Mégsem',
+  signInDone: 'Beléptél.',
+  signInDenied: 'A belépést elutasították.',
+  signInExpired: 'A kód lejárt. Próbáld újra.',
+  signInCancelled: 'Belépés megszakítva.',
+  signInFailed: 'A belépés nem sikerült.'
 }