@protoboardai/core 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,13 @@
+Protoboard Stack: @protoboardai/core
+Copyright 2026 Delta Robotics, Inc.
+
+This product includes software developed at Delta Robotics, Inc.
+(https://deltaroboticsinc.com).
+
+Licensed under the Apache License, Version 2.0 (the "License").
+See the LICENSE file in this package for full terms.
+
+"Protoboard", the Protoboard logo and the "0" mark are trademarks of
+Delta Robotics, Inc. The License grants no rights to them (section 6);
+see TRADEMARKS.md in the Protoboard Stack repository
+(https://github.com/Delta-Robotics-Inc/protoboard-stack).

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@protoboardai/core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Protoboard framework core: project loading, definition registry and origins, resolution, aggregated checks, build",
+  "license": "Apache-2.0",
+  "author": "Delta Robotics, Inc.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Delta-Robotics-Inc/protoboard-stack.git",
+    "directory": "packages/core"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./library-client": "./src/library-client.ts",
+    "./views": "./src/view-ids.ts",
+    "./cdp": "./src/cdp.ts",
+    "./browser": "./src/browser.ts",
+    "./account": "./src/account.ts",
+    "./access": "./src/access.ts",
+    "./stack": "./src/stack.ts",
+    "./build-info": "./src/build-info.ts",
+    "./stack-unpack": "./src/stack-unpack.ts",
+    "./pbar": "./src/pbar.ts",
+    "./path-setup": "./src/path-setup.ts",
+    "./part-trust": "./src/part-trust.ts",
+    "./library-sort": "./src/library-sort.ts",
+    "./bom": "./src/bom-model.ts",
+    "./fx": "./src/fx-rates.ts",
+    "./offers": "./src/part-offers.ts",
+    "./agents": "./src/agents.ts",
+    "./agent-launcher": "./src/agent-launcher.ts",
+    "./user-folders": "./src/user-folders.ts",
+    "./private-dir": "./src/private-dir.ts"
+  },
+  "files": [
+    "src",
+    "templates",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "protoboard": {
+    "toolchain": {
+      "uhd": "0.3.0",
+      "typescript": "7.0.2"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@deltarobotics/uhd": "^0.3.0",
+    "@protoboardai/cloud": "^0.2.0",
+    "jsonc-parser": "^3.3.1",
+    "smol-toml": "^1.9.0",
+    "tsx": "^4.23.8"
+  }
+}

package/src/access.ts

@@ -0,0 +1,311 @@
+/**
+ * The Protoboard cloud needs a sign-in; local work never does (PB-928 as
+ * changed on 2026-10-21: the stack is open source, and only the hosted cloud
+ * is a paid service). Creating, modelling, checking, building, the viewer,
+ * layout, circuits and releases run with no account. Everything that uses
+ * the library does need one, browsing included (the library is not
+ * accessible over the CLI when signed out either):
+ * searching it and its categories, the project's libraries, fetching library
+ * parts, update checks, prices and offers, publishing. The CLI asks `checkAccess` before
+ * such a command (packages/cli/src/gate.ts is the table of which ones), and
+ * the VS Code extension reads the same answer from `protoboard whoami`.
+ *
+ * What it is, plainly: a courtesy on the user's machine, so that a cloud
+ * command signed out stops at once with one line saying how to sign in,
+ * before it changes anything. It is not the protection. The parts service
+ * refuses every read of the library without a valid sign-in on its own
+ * (protoboard-cloud docs/access.md); a fork that removes this file gets the
+ * service's 401 instead of this line.
+ *
+ * The cases (docs/specs/distribution.md, "Sign-in for the cloud"):
+ *
+ * - A fresh answer from the service is kept for `ACCESS_RECHECK_HOURS` and
+ *   used without contacting anything: cloud commands stay fast, and agents run many.
+ * - When the service cannot be reached, the last good answer is accepted for
+ *   `OFFLINE_GRACE_DAYS`; the command itself then says what it could not reach.
+ * - A parts service that signs no one in (local development, `PB_CLOUD_AUTH=none`,
+ *   or a library someone else hosts without accounts) is open.
+ * - `PROTOBOARD_CLOUD_TOKEN` (the service token, CI) counts as signed in. It is
+ *   not sent anywhere by this check; the service judges it when it is used.
+ * - An account the service's invite list refuses is not allowed, and is told so.
+ *
+ * What the check sends, and nothing else: `GET <service>/.well-known/uhd-library`
+ * without credentials, `GET <service>/v1/me` with the account's ID token, and,
+ * when that token is older than an hour, the refresh to Google's token endpoint
+ * that every signed-in command already makes. Nothing about the project: not
+ * its name, its path, its files or its parts.
+ *
+ * No VS Code API here: the CLI calls it, and the extension reads its result
+ * from `protoboard whoami --format json` (`access`).
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { ensurePrivateDir } from "./private-dir.js";
+import { join } from "node:path";
+import { AccountError, CredentialStore, accountToken, configDir, fetchProblem, serviceKey } from "./account.js";
+
+/** How long a good answer is used without asking the service again. */
+export const ACCESS_RECHECK_HOURS = 12;
+
+/**
+ * How long the last good answer is accepted while the service cannot be
+ * reached. Seven days: a week of travel or bench work without a connection
+ * keeps working, and an account taken off the invite list stops within a week
+ * even on a machine that never goes online (online, it stops at the next
+ * check, at most `ACCESS_RECHECK_HOURS` later).
+ */
+export const OFFLINE_GRACE_DAYS = 7;
+
+/** Why access was given. */
+export type AccessVia =
+  /** The service accepted the signed-in account just now. */
+  | "account"
+  /** The service accepted it within the last `ACCESS_RECHECK_HOURS`; nothing was contacted. */
+  | "recent"
+  /** The service cannot be reached; it accepted the account within the last `OFFLINE_GRACE_DAYS`. */
+  | "offline"
+  /** The service signs no one in (local development). */
+  | "open-service"
+  /** `PROTOBOARD_CLOUD_TOKEN` is set (CI). */
+  | "service-token";
+
+/** Why access was refused. */
+export type AccessRefusal =
+  /** Nobody is signed in to the service. */
+  | "signed-out"
+  /** The sign-in no longer works (revoked, disabled, expired). */
+  | "sign-in-invalid"
+  /** Signed in, but the service's invite list does not have the account. */
+  | "not-invited"
+  /** The service cannot be reached and there is no recent good answer. */
+  | "unreachable";
+
+export interface Access {
+  /** Whether this machine may use the service's account features (the cloud) now. */
+  allowed: boolean;
+  service: string;
+  via?: AccessVia;
+  reason?: AccessRefusal;
+  /** One line for a person: what is wrong and what to run. Set when not allowed. */
+  message?: string;
+  email?: string;
+  /** When the service last accepted the account (ISO). */
+  verifiedAt?: string;
+  /** With `via: "offline"`: until when the last answer is accepted (ISO). */
+  offlineUntil?: string;
+}
+
+/** The last answer per service. Not a secret: no token, only who and when. */
+interface AccessRecord {
+  /** The account it was for; a record of another account is ignored. `open` for a service without sign-in. */
+  uid: string;
+  email?: string;
+  verifiedAt: string;
+}
+
+const HOUR = 3_600_000;
+const DAY = 24 * HOUR;
+
+/** `<config dir>/access.json`: beside the credentials, never in a project. */
+export function accessFile(env: NodeJS.ProcessEnv = process.env, platform: NodeJS.Platform = process.platform): string {
+  return join(configDir(env, platform), "access.json");
+}
+
+function readRecords(file: string): Record<string, AccessRecord> {
+  if (!existsSync(file)) return {};
+  try {
+    const all = JSON.parse(readFileSync(file, "utf8")) as Record<string, AccessRecord>;
+    return all && typeof all === "object" ? all : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeRecord(file: string, service: string, record: AccessRecord | undefined): void {
+  try {
+    const all = readRecords(file);
+    if (record) all[service] = record;
+    else if (service in all) delete all[service];
+    else return;
+    ensurePrivateDir(join(file, ".."));
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(all, null, 2) + "\n", { mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, file);
+  } catch {
+    // the record only saves a request next time: a folder that cannot be written is not a reason to refuse
+  }
+}
+
+/**
+ * The services this machine is signed in to, the most recently confirmed
+ * first: those the credential store can list, and those the service's last
+ * answers name (the OS credential stores are asked by name only). What an
+ * account command falls back on when a project cannot say which service is
+ * its own (`unloadedProjectService`).
+ */
+export function savedServices(options: { env?: NodeJS.ProcessEnv; platform?: NodeJS.Platform; store?: CredentialStore; also?: string[] } = {}): string[] {
+  const env = options.env ?? process.env;
+  let store: CredentialStore;
+  try {
+    store = options.store ?? new CredentialStore({ env, ...(options.platform ? { platform: options.platform } : {}) });
+  } catch {
+    return [];
+  }
+  const records = readRecords(accessFile(env, options.platform));
+  const named = Object.keys(records).sort((a, b) => Date.parse(records[b]!.verifiedAt) - Date.parse(records[a]!.verifiedAt));
+  const candidates = [...new Set([...named, ...store.services(), ...(options.also ?? [])].map(serviceKey))];
+  return candidates.filter((s) => {
+    try {
+      return !!store.get(s);
+    } catch {
+      return false;
+    }
+  });
+}
+
+/** Forget the last answer for a service (`protoboard logout`, a new `login`): the next check asks the service. */
+export function forgetAccess(service: string, options: { env?: NodeJS.ProcessEnv; platform?: NodeJS.Platform } = {}): void {
+  writeRecord(accessFile(options.env, options.platform), serviceKey(service), undefined);
+}
+
+export interface AccessOptions {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  store?: CredentialStore;
+  fetch?: typeof fetch;
+  /** Milliseconds since the epoch (tests). */
+  now?: number;
+  /** Ask the service even when a recent answer is kept (`whoami --check`, the extension after a sign-in). */
+  fresh?: boolean;
+}
+
+const SIGN_IN = "sign in with `protoboard login`";
+const LIBRARY = "The Protoboard library";
+
+/**
+ * The one line a refused cloud command prints. `what` names what needed the
+ * cloud ("Adding library parts"); without it the line speaks of the library.
+ */
+export function accessMessage(a: Pick<Access, "reason" | "service" | "email">, detail?: string, what = LIBRARY): string {
+  switch (a.reason) {
+    case "not-invited":
+      return `${what} needs an invited account: ${a.email ?? "this account"} is signed in to ${a.service} but is not on its invite list${detail ? ` (${detail})` : ""}. Ask for an invitation, or ${SIGN_IN} with an invited account. Local work (check, build, the viewer) needs no account.`;
+    case "sign-in-invalid":
+      return `${what} needs a sign-in: the one kept for ${a.service}${a.email ? ` (${a.email})` : ""} no longer works${detail ? ` (${detail})` : ""}. To sign in again, ${SIGN_IN}.`;
+    case "unreachable":
+      return `${what} needs ${a.service}, which cannot be reached to check the sign-in${detail ? ` (${detail})` : ""}.`;
+    default:
+      return `${what} needs a Protoboard account: ${SIGN_IN} (not signed in to ${a.service}).`;
+  }
+}
+
+/**
+ * Whether this machine may use the account features (the cloud) of the
+ * library at `service`: see the top of this file for the cases. Never throws; a credential store that
+ * cannot be read is "signed out" with the reason in the message.
+ */
+export async function checkAccess(service: string, options: AccessOptions = {}): Promise<Access> {
+  const env = options.env ?? process.env;
+  const key = serviceKey(service);
+  const now = options.now ?? Date.now();
+  const f = options.fetch ?? fetch;
+  const file = accessFile(env, options.platform);
+  const refuse = (reason: AccessRefusal, extra: Partial<Access> = {}, detail?: string): Access => ({ allowed: false, service: key, reason, ...extra, message: accessMessage({ reason, service: key, ...(extra.email ? { email: extra.email } : {}) }, detail) });
+
+  // CI: the service token stands for an account. Nothing is asked; the service judges the token when it is used.
+  if (env.PROTOBOARD_CLOUD_TOKEN) return { allowed: true, service: key, via: "service-token" };
+
+  let store: CredentialStore;
+  try {
+    store = options.store ?? new CredentialStore({ env, ...(options.platform ? { platform: options.platform } : {}) });
+  } catch (e) {
+    return refuse("signed-out", {}, (e as Error).message);
+  }
+  const session = store.get(key);
+  const record = readRecords(file)[key];
+  const age = record ? now - Date.parse(record.verifiedAt) : Infinity;
+  const who = session ? { ...(session.email ? { email: session.email } : {}) } : {};
+  // the last answer counts only for the account it was given to (or, signed out, for an open service)
+  const mine = !!record && age >= 0 && record.uid === (session ? session.uid : "open");
+
+  if (mine && !options.fresh && age < ACCESS_RECHECK_HOURS * HOUR) {
+    return { allowed: true, service: key, via: session ? "recent" : "open-service", ...who, verifiedAt: record.verifiedAt };
+  }
+  const offline = (what: string): Access => {
+    if (mine && age < OFFLINE_GRACE_DAYS * DAY) {
+      return { allowed: true, service: key, via: session ? "offline" : "open-service", ...who, verifiedAt: record.verifiedAt, offlineUntil: new Date(Date.parse(record.verifiedAt) + OFFLINE_GRACE_DAYS * DAY).toISOString() };
+    }
+    return refuse("unreachable", who, what);
+  };
+
+  // does the service sign anyone in? (no credentials in this request)
+  let needsAccount: boolean;
+  try {
+    const res = await f(`${key}/.well-known/uhd-library`, { signal: AbortSignal.timeout(10_000) });
+    if (!res.ok) return offline(`GET ${key}/.well-known/uhd-library answered ${res.status}`);
+    needsAccount = !!((await res.json()) as { account?: unknown }).account;
+  } catch (e) {
+    return offline(`GET ${key}/.well-known/uhd-library: ${fetchProblem(e)}`);
+  }
+  const verifiedAt = new Date(now).toISOString();
+  if (!needsAccount) {
+    writeRecord(file, key, { uid: "open", verifiedAt });
+    return { allowed: true, service: key, via: "open-service", verifiedAt };
+  }
+  if (!session) {
+    writeRecord(file, key, undefined);
+    return refuse("signed-out");
+  }
+  let me: { signedIn?: boolean; allowed?: boolean; problem?: string };
+  try {
+    const token = await accountToken(key, { store, fetch: f, now });
+    const res = await f(`${key}/v1/me`, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(10_000) });
+    if (res.status >= 500) return offline(`GET ${key}/v1/me answered ${res.status}`);
+    me = (await res.json().catch(() => ({}))) as typeof me;
+  } catch (e) {
+    // Firebase said the sign-in is over: that is an answer. Anything else is "could not ask".
+    if (e instanceof AccountError && e.code === "SESSION_EXPIRED") {
+      writeRecord(file, key, undefined);
+      return refuse("sign-in-invalid", who, e.message.replace(/: run `protoboard login` again$/, ""));
+    }
+    return offline(e instanceof AccountError ? e.message : `GET ${key}/v1/me: ${fetchProblem(e)}`);
+  }
+  if (!me.signedIn) {
+    writeRecord(file, key, undefined);
+    return refuse("sign-in-invalid", who, "the service does not accept it");
+  }
+  if (me.allowed === false) {
+    writeRecord(file, key, undefined);
+    return refuse("not-invited", who, me.problem);
+  }
+  writeRecord(file, key, { uid: session.uid, ...(session.email ? { email: session.email } : {}), verifiedAt });
+  return { allowed: true, service: key, via: "account", ...who, verifiedAt };
+}
+
+/** Thrown by `requireAccess`: the CLI prints `message` as its one line and exits `ACCESS_EXIT_CODE`. */
+export class AccessError extends Error {
+  readonly code = "SIGN_IN_REQUIRED";
+  constructor(
+    readonly access: Access,
+    what?: string,
+  ) {
+    const line = access.message ?? accessMessage(access);
+    super(what && line.startsWith(LIBRARY) ? what + line.slice(LIBRARY.length) : line);
+    this.name = "AccessError";
+  }
+}
+
+/** The CLI's exit code for a cloud command refused for want of a sign-in (1 is findings, 2 a failed command). */
+export const ACCESS_EXIT_CODE = 4;
+
+/**
+ * `checkAccess`, throwing `AccessError` when the service definitely refuses
+ * (signed out, a sign-in that no longer works, not invited). A service that
+ * cannot be reached is not a refusal here: the command goes on and says
+ * itself what it could not reach.
+ */
+export async function requireAccess(service: string, options: AccessOptions & { what?: string } = {}): Promise<Access> {
+  const a = await checkAccess(service, options);
+  if (!a.allowed && a.reason !== "unreachable") throw new AccessError(a, options.what);
+  return a;
+}