@illuminis/comprism 0.1.0

package/out/graph/sync.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.status = status;
+exports.refresh = refresh;
+exports.coverageSentence = coverageSentence;
+exports.readerReport = readerReport;
+exports.pushFile = pushFile;
+/**
+ * Keep the service's map of this project in step with the files on disk.
+ *
+ * A map that lies is worse than no map, because the agent trusts it. So the
+ * rule here is simple and it is never bent: before the map is used, the files
+ * are checked; what moved is read again; and if it cannot be brought up to
+ * date, the agent is told so rather than being handed a confident answer from
+ * yesterday.
+ *
+ * The check costs about ten milliseconds. A full read of a seven hundred file
+ * project costs a second or two, and a partial one costs almost nothing,
+ * because only the files that actually moved are read.
+ *
+ * Nothing here decides anything. The machine reports what it has; the service
+ * says what it needs; the machine reads exactly that and sends structure back.
+ */
+const gateway_1 = require("../lib/gateway");
+const build_1 = require("./build");
+const read_python_1 = require("./read-python");
+const read_typescript_1 = require("./read-typescript");
+/** How many files' facts go in one call.
+ *
+ *  A whole project in one request is several megabytes and fails in the least
+ *  helpful way available: the request is rejected at the edge and nothing says
+ *  which part was too big. Batches also mean a project that loses its
+ *  connection half way has stored half its files rather than none, and the next
+ *  run reads only what is still missing.
+ */
+const BATCH = 120;
+function reply(r) {
+    return (r.graph ?? {});
+}
+/** What the service holds for this project, and whether it matches disk. */
+async function status(root, workspace, opts = {}) {
+    const state = (0, build_1.projectState)(root);
+    const answer = await (0, gateway_1.ask)({
+        intent: "graph", prompt: "", graphOp: "status", workspace,
+        graphPayload: {
+            fingerprint: state.fingerprint.hash,
+            // Ask for what the map holds in the same breath, when we are going to
+            // need it anyway. One round trip rather than two.
+            with_stamps: Boolean(opts.withStamps),
+        },
+    });
+    const graph = reply(answer);
+    return {
+        stamps: graph.stamps ?? null,
+        definedNames: graph.defined_names ?? [],
+        enabled: answer.granted !== false && graph.enabled !== false,
+        autoRefresh: graph.auto_refresh !== false,
+        fresh: Boolean(graph.fresh),
+        hasMap: Boolean(graph.has_map),
+        held: graph.held ?? null,
+        reachable: Boolean(answer.ok),
+    };
+}
+/**
+ * Bring the map up to date, reading only the files that moved.
+ *
+ * `force` reads everything again, which is what the manual refresh does: a
+ * person asking for a rebuild has usually just had an answer they did not
+ * believe, and telling them nothing needed doing is not an answer.
+ */
+async function refresh(root, workspace, opts = {}) {
+    const started = Date.now();
+    const state = (0, build_1.projectState)(root);
+    const blank = {
+        current: false, enabled: true, message: "", filesRead: 0,
+        filesTotal: state.files.length, seconds: 0, unread: 0,
+    };
+    const now = await status(root, workspace, { withStamps: !opts.force });
+    if (!now.enabled) {
+        return { ...blank, enabled: false, current: false, message: "Your company has the code map switched off, so nothing was read or sent." };
+    }
+    if (!now.reachable) {
+        return { ...blank, current: false, message: "The service could not be reached, so the map was left as it is. Work carries on without it." };
+    }
+    if (now.fresh && !opts.force) {
+        return { ...blank, current: true, message: `The map already matches all ${state.files.length} files in this project.` };
+    }
+    // What the service already holds, so only what moved is read. It came back
+    // with the status above when there was a map to describe, which is one round
+    // trip saved on every refresh; a forced rebuild asks for none of it because
+    // it is going to read everything anyway.
+    const known = opts.force ? {} : (now.stamps ?? {});
+    // What the service already knows this project defines. Used to drop calls
+    // that could never resolve, before they are sent. Absent on a project it has
+    // not joined yet, which costs size and never correctness.
+    const knownNames = now.definedNames;
+    const changed = state.files
+        .filter((f) => known[f.rel] !== state.stamps[f.rel])
+        .map((f) => f.rel);
+    const removed = Object.keys(known).filter((p) => !(p in state.stamps));
+    const read = (0, build_1.readFacts)(root, changed, knownNames);
+    const unreadTotal = read.unread.python + read.unread.typescript;
+    // Sent in batches. Each call is self contained: a connection lost half way
+    // leaves the files already sent stored, and the next run reads only the rest.
+    const paths = Object.keys(read.facts);
+    for (let i = 0; i < paths.length; i += BATCH) {
+        const slice = paths.slice(i, i + BATCH);
+        const payload = {};
+        for (const rel of slice) {
+            payload[rel] = { ...read.facts[rel], stamp: state.stamps[rel] };
+        }
+        const sent = await (0, gateway_1.ask)({
+            intent: "graph", prompt: "", graphOp: "update", workspace,
+            graphPayload: {
+                changed: payload,
+                // The removals travel with the first batch, so a project whose files
+                // were deleted stops answering questions about them immediately rather
+                // than at the end of a long upload.
+                removed: i === 0 ? removed : [],
+            },
+        });
+        if (!sent.ok) {
+            return { ...blank, current: false, seconds: read.seconds, message: "The map could not be sent in full, so it was left as it is. Work carries on without it." };
+        }
+    }
+    const coverage = coverageSentence(read.unread, state.files.length);
+    const done = await (0, gateway_1.ask)({
+        intent: "graph", prompt: "", graphOp: "finish", workspace,
+        graphPayload: {
+            commit: state.commit,
+            fingerprint: state.fingerprint.hash,
+            file_count: state.files.length - unreadTotal,
+            unread_files: unreadTotal,
+            coverage,
+            read_seconds: String(read.seconds),
+        },
+    });
+    const seconds = Math.round((Date.now() - started) / 100) / 10;
+    if (!done.ok) {
+        return { ...blank, current: false, seconds, message: "The files were sent but the map could not be stamped as current, so it will be read again next time." };
+    }
+    return {
+        current: true,
+        enabled: true,
+        filesRead: paths.length,
+        filesTotal: state.files.length,
+        unread: unreadTotal,
+        seconds,
+        message: paths.length === state.files.length
+            ? `Read all ${paths.length} files in ${seconds}s.`
+            : `Read the ${paths.length} files that changed, of ${state.files.length}, in ${seconds}s.`,
+    };
+}
+/** What was read and what was not, in one sentence an answer can carry.
+ *
+ *  Said out loud rather than hidden. A map that quietly covers less than it
+ *  claims is the one failure worth engineering against: the agent believes it
+ *  has seen everything, and writes a confident change that misses a caller. */
+function coverageSentence(unread, total) {
+    const gaps = [];
+    if (unread.python) {
+        gaps.push(`${unread.python} Python files could not be read because this machine has no Python 3`);
+    }
+    if (unread.typescript) {
+        gaps.push(`${unread.typescript} TypeScript files could not be read because this installation has no TypeScript compiler`);
+    }
+    if (!gaps.length)
+        return `It covers all ${total} code files in this project.`;
+    return `It covers ${total - unread.python - unread.typescript} of ${total} code files: ${gaps.join("; ")}.`;
+}
+/** What this machine can read at all. Asked before anything else, so a person
+ *  is told why their map is thin rather than left to guess. */
+function readerReport() {
+    const python = Boolean((0, read_python_1.findPython)());
+    const typescript = Boolean((0, read_typescript_1.loadCompiler)());
+    if (python && typescript)
+        return "This machine can read Python, TypeScript and JavaScript.";
+    const missing = [];
+    if (!python)
+        missing.push("Python 3 is not on this machine, so Python files are not mapped");
+    if (!typescript)
+        missing.push("the TypeScript compiler is not installed beside this tool, so TypeScript and JavaScript files are not mapped");
+    return `Partly: ${missing.join(", and ")}.`;
+}
+/**
+ * Put ONE file back into the map, now, and wait for it.
+ *
+ * The fast path, and it exists because the slow one loses a race that matters.
+ * An agent writes a file and asks the map about it in the same step, because
+ * asking for several actions at once is what a well behaved agent does. A
+ * refresh started in the background after the write has not finished by the
+ * time the question runs, so the question reaches a map that is one file
+ * behind, and the agent is told the thing it just created does not exist.
+ *
+ * So this is awaited before the write's result goes back. One round trip: the
+ * file's facts and the project's new fingerprint travel together, and the
+ * service stores, stamps and rejoins in that single call.
+ *
+ * Failure is silent on purpose. A map that could not be updated must never turn
+ * a successful write into a failed one; the next check picks the file up.
+ */
+async function pushFile(root, workspace, rels) {
+    const wanted = rels.filter(Boolean);
+    if (!wanted.length)
+        return false;
+    try {
+        const state = (0, build_1.projectState)(root);
+        // Only paths the map covers. Writing a README is not a change to the map,
+        // and paying a round trip to say so would tax every write an agent makes.
+        const indexed = new Set(state.files.map((f) => f.rel));
+        const present = wanted.filter((r) => indexed.has(r));
+        const gone = wanted.filter((r) => !indexed.has(r));
+        if (!present.length && !gone.length)
+            return false;
+        const read = present.length ? (0, build_1.readFacts)(root, present) : { facts: {}, unread: { python: 0, typescript: 0 }, seconds: 0, failures: [] };
+        const changed = {};
+        for (const rel of Object.keys(read.facts)) {
+            changed[rel] = { ...read.facts[rel], stamp: state.stamps[rel] };
+        }
+        const sent = await (0, gateway_1.ask)({
+            intent: "graph", prompt: "", graphOp: "update", workspace,
+            graphPayload: {
+                changed,
+                // A file the agent deleted or moved away leaves the map in the same
+                // call, or the map keeps answering questions about something gone.
+                removed: gone,
+                // The stamp, so the service can mark the map current without a second
+                // trip. This is what makes the write and the question safe in one step.
+                commit: state.commit,
+                fingerprint: state.fingerprint.hash,
+                file_count: state.files.length,
+                unread_files: 0,
+                coverage: coverageSentence({ python: 0, typescript: 0 }, state.files.length),
+                read_seconds: String(read.seconds),
+            },
+        });
+        return Boolean(sent.ok);
+    }
+    catch {
+        return false;
+    }
+}

package/out/lib/attach.d.ts

@@ -0,0 +1,62 @@
+/** One file that was found, and what the server made of it. */
+export interface Attached {
+    id: string;
+    filename: string;
+    /** What the extractor called it: `pdf`, `png`, `text` and so on. */
+    format: string;
+    /** Characters of text pulled out. Zero for a picture, which is not a failure. */
+    chars: number;
+    /** The text was longer than one turn can carry and was cut. */
+    truncated: boolean;
+    isImage: boolean;
+}
+/** A path somebody named, before anything has been read. */
+export interface Mention {
+    /** Exactly as it appeared, so it can be taken back out of the sentence. */
+    raw: string;
+    /** Resolved, unescaped and known to exist. */
+    file: string;
+}
+/**
+ * Take the shell's escaping back off a path.
+ *
+ * A dragged file arrives as `/Users/me/My\ Report.pdf`, and a pasted one is
+ * often in quotes. Both are the shell's way of saying "this is one thing", and
+ * neither is part of the name.
+ */
+export declare function unescapePath(token: string): string;
+/**
+ * Every file the typed line points at, in the order they were named.
+ *
+ * A token that looks like a path but is not on the disk is left alone and stays
+ * part of the question. Somebody writing about a path they plan to create is
+ * doing something perfectly ordinary, and refusing their line over it would be
+ * the tool arguing with them.
+ */
+export declare function mentions(line: string, cwd: string): Mention[];
+/**
+ * The question with the long paths taken out and the file names left in.
+ *
+ * "summarize @/Users/me/Downloads/Q3 Board Pack.pdf" is a worse question than
+ * "summarize Q3 Board Pack.pdf", and the second is what the model should be
+ * reading: the file is already in front of it under that name, so the path adds
+ * nothing but a place for the model to try to open something it cannot reach.
+ */
+export declare function withoutPaths(line: string, found: Mention[]): string;
+/**
+ * Hand the files to the server and get back the ids the question will carry.
+ *
+ * One at a time and in order, because the caps are per file and a refusal names
+ * which file it is refusing. A file that cannot be read does not stop the
+ * others: the person gets their answer about the four that worked, and is told
+ * plainly about the one that did not.
+ */
+export declare function upload(baseUrl: string, credential: string, files: string[]): Promise<{
+    attached: Attached[];
+    refused: {
+        file: string;
+        why: string;
+    }[];
+}>;
+/** What was attached, in one line each, for the person to see before it runs. */
+export declare function describe(a: Attached): string;

package/out/lib/attach.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unescapePath = unescapePath;
+exports.mentions = mentions;
+exports.withoutPaths = withoutPaths;
+exports.upload = upload;
+exports.describe = describe;
+/**
+ * Files handed to a question, from a terminal.
+ *
+ * ── What a person actually does ───────────────────────────────────────────
+ *
+ * They drag a file onto the terminal window. Every terminal answers that by
+ * typing the file's path at the cursor, with spaces backslash-escaped, which is
+ * why a path is not simply "the text up to the next space". Or they type `@`
+ * and a path, which is what everybody who has used one of these tools expects.
+ *
+ * Both end up here, and both mean the same thing: read this, it is what my
+ * question is about.
+ *
+ * ── Why the file is uploaded and not just named ───────────────────────────
+ *
+ * The agent can already open any file inside the folder it is working in, so
+ * naming one would have been cheaper. It would also have been wrong three ways:
+ * a screenshot is not text and could never be read that way, a PDF or a
+ * spreadsheet needs extracting before it means anything, and a file somewhere
+ * else on the disk is outside the folder the agent is allowed to touch. A
+ * person who attaches a file has said they want it read, so it is read.
+ *
+ * The reading happens on the server, by the same component the web composer
+ * uses. Nothing is stored: the text lives in memory for half an hour and then
+ * it is gone.
+ *
+ * ── What counts as a path, and what deliberately does not ─────────────────
+ *
+ * Only something said on purpose. An absolute path, a path starting `~/`, `./`
+ * or `../`, anything quoted, and anything after an `@`. A bare word like
+ * `package.json` mentioned in a sentence is NOT attached, even when a file of
+ * that name is sitting right there: the agent can open it itself for nothing,
+ * and silently uploading every filename somebody mentions would surprise them
+ * and charge them for it.
+ */
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/**
+ * Take the shell's escaping back off a path.
+ *
+ * A dragged file arrives as `/Users/me/My\ Report.pdf`, and a pasted one is
+ * often in quotes. Both are the shell's way of saying "this is one thing", and
+ * neither is part of the name.
+ */
+function unescapePath(token) {
+    let out = token.trim();
+    if ((out.startsWith('"') && out.endsWith('"'))
+        || (out.startsWith("'") && out.endsWith("'"))) {
+        out = out.slice(1, -1);
+    }
+    else {
+        out = out.replace(/\\(.)/g, '$1');
+    }
+    return out;
+}
+/** `~/notes.md` against this person's home folder. */
+function expand(file, cwd) {
+    const home = os.homedir();
+    const full = file === '~' ? home
+        : file.startsWith('~/') ? path.join(home, file.slice(2))
+            : path.resolve(cwd, file);
+    return full;
+}
+function isFile(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Every file the typed line points at, in the order they were named.
+ *
+ * A token that looks like a path but is not on the disk is left alone and stays
+ * part of the question. Somebody writing about a path they plan to create is
+ * doing something perfectly ordinary, and refusing their line over it would be
+ * the tool arguing with them.
+ */
+function mentions(line, cwd) {
+    const found = [];
+    const seen = new Set();
+    const consider = (raw, candidate) => {
+        const file = expand(unescapePath(candidate), cwd);
+        if (!isFile(file) || seen.has(file))
+            return;
+        seen.add(file);
+        found.push({ raw, file });
+    };
+    // Quoted first, because a quoted path may contain the spaces that would
+    // otherwise end a token, and the quotes are the person saying exactly that.
+    for (const m of line.matchAll(/"([^"]+)"|'([^']+)'/g)) {
+        consider(m[0], m[1] ?? m[2] ?? '');
+    }
+    // Then `@`, which is treated generously on purpose.
+    //
+    // A dragged file arrives escaped and a pasted one is usually quoted, but
+    // somebody who TYPES `@` and then a folder with a space in its name has said
+    // what they mean as plainly as it can be said. So everything after the `@` is
+    // tried, then the last word is dropped and it is tried again, until a real
+    // file turns up or the words run out. `@/Users/me/My Report.md in one line`
+    // finds the report and leaves the rest of the sentence alone.
+    for (const m of line.matchAll(/(?:^|\s)@(\S.*)$/gm)) {
+        const rest = m[1] ?? '';
+        for (let end = rest.length; end > 0; end = rest.lastIndexOf(' ', end - 1)) {
+            const before = found.length;
+            consider(`@${rest.slice(0, end)}`, rest.slice(0, end));
+            if (found.length > before)
+                break;
+        }
+    }
+    // Then every run of non-space, with `\ ` counting as part of the run rather
+    // than as the end of it. This is the dragged-file case and the `@` case.
+    for (const m of line.matchAll(/(?:\\.|[^\s\\])+/g)) {
+        const raw = m[0];
+        if (!raw)
+            continue;
+        const body = raw.startsWith('@') ? raw.slice(1) : raw;
+        const deliberate = raw.startsWith('@')
+            || /^[/~]/.test(body) || body.startsWith('./') || body.startsWith('../');
+        if (!deliberate)
+            continue;
+        consider(raw, body);
+    }
+    return found;
+}
+/**
+ * The question with the long paths taken out and the file names left in.
+ *
+ * "summarize @/Users/me/Downloads/Q3 Board Pack.pdf" is a worse question than
+ * "summarize Q3 Board Pack.pdf", and the second is what the model should be
+ * reading: the file is already in front of it under that name, so the path adds
+ * nothing but a place for the model to try to open something it cannot reach.
+ */
+function withoutPaths(line, found) {
+    let out = line;
+    for (const m of found)
+        out = out.replace(m.raw, path.basename(m.file));
+    return out.replace(/\s{2,}/g, ' ').trim();
+}
+/**
+ * Hand the files to the server and get back the ids the question will carry.
+ *
+ * One at a time and in order, because the caps are per file and a refusal names
+ * which file it is refusing. A file that cannot be read does not stop the
+ * others: the person gets their answer about the four that worked, and is told
+ * plainly about the one that did not.
+ */
+async function upload(baseUrl, credential, files) {
+    const root = baseUrl.replace(/\/+$/, '');
+    const attached = [];
+    const refused = [];
+    for (const file of files) {
+        try {
+            const form = new FormData();
+            form.append('file', new Blob([fs.readFileSync(file)]), path.basename(file));
+            const res = await fetch(`${root}/api/v1/agent/attachments`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${credential}` },
+                body: form,
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                refused.push({ file, why: body.detail || `the server said ${res.status}` });
+                continue;
+            }
+            const row = await res.json();
+            attached.push({
+                id: row.id, filename: row.filename, format: row.format,
+                chars: row.chars, truncated: row.truncated, isImage: row.is_image,
+            });
+        }
+        catch (err) {
+            refused.push({ file, why: err.message });
+        }
+    }
+    return { attached, refused };
+}
+/** What was attached, in one line each, for the person to see before it runs. */
+function describe(a) {
+    if (a.isImage)
+        return `${a.filename}  read as a picture`;
+    const size = a.chars >= 1000
+        ? `${Math.round(a.chars / 1000)}k characters`
+        : `${a.chars} characters`;
+    return `${a.filename}  ${size}${a.truncated ? ', shortened to fit' : ''}`;
+}

package/out/lib/config.d.ts

@@ -0,0 +1,93 @@
+import type { ExecutionMode, FooterConfig, Provider } from './types';
+export declare const HOME_DIR_NAME = ".comprism";
+export interface ContentPolicy {
+    /**
+     * Store request and response text alongside the records. Default false, and
+     * every screen and report is built to work without it. Turning it on is a
+     * tenant's explicit decision, never a default and never a nudge.
+     */
+    storeText: boolean;
+}
+export interface ProviderConfig {
+    enabled: boolean;
+    /** Shell command printing the key on stdout. Its OUTPUT is never stored. */
+    keyCommand?: string;
+}
+export interface Config {
+    config_version: 1;
+    /** Who the records are attributed to locally. Never an email by default. */
+    user: string;
+    mode: ExecutionMode;
+    providers: Record<Provider, ProviderConfig>;
+    /** Model ids the policy may consider. Empty means the whole catalog. */
+    allowedModels: string[];
+    /**
+     * The model a session and the SDK dispatch unless the caller names another.
+     *
+     * This exists because of a real failure. The client used to dispatch the
+     * cheapest catalog entry for whatever band the structural classifier
+     * guessed - so a short research question was banded `simple`, answered by the
+     * cheapest model, and the answer was the plausible-but-useless kind this
+     * entire product exists to warn people about.
+     *
+     * Two things were wrong with that. It contradicted the release's own rule
+     * that v1 observes and never alters dispatch. And it made a cost-quality
+     * trade-off on the user's behalf using exactly the evidence the estimator
+     * refuses to guess from - none. With no evidence, the honest default is a
+     * capable model the user chose once, not the cheapest one we inferred.
+     */
+    defaultModel: string;
+    contentPolicy: ContentPolicy;
+    /**
+     * Deployment context the tenant declares rather than the product infers.
+     *
+     * Everything here is optional and inferred from the workspace when absent.
+     * `verification` is the one worth setting by hand: whether anything checks the
+     * output before it reaches someone outside the company is what decides how
+     * expensive a wrong answer is, and a person knows it where a heuristic guesses.
+     */
+    context: {
+        role?: string | null;
+        workspace?: string | null;
+        application?: string | null;
+        verification?: 'automated_tests' | 'human_review' | 'none' | 'unknown';
+    };
+    /** Port the local proxy listens on. */
+    proxyPort: number;
+    /**
+     * The stats footer the proxy appends to a completed answer.
+     *
+     * The proxy is the only surface with no result object and no widget area, so
+     * it is the only one that writes into the message. Turning this off restores
+     * byte-faithful passthrough in both directions; inbound stripping still runs,
+     * because a footer already sitting in someone's history has to come out
+     * whether or not new ones are being written.
+     */
+    footer: FooterConfig;
+    created: string;
+    updated: string;
+}
+export type Keys = Partial<Record<Provider, string>>;
+export declare function homeDir(): string;
+/**
+ * Create the home directory at mode 700 if it is not there.
+ *
+ * 700 rather than the default 755: other local accounts have no business
+ * reading someone's work records, and a directory created world-readable is
+ * never noticed afterwards.
+ */
+export declare function ensureHome(): string;
+export declare function configPath(): string;
+export declare function defaultConfig(): Config;
+export declare function loadConfig(): Config;
+export declare function saveConfig(cfg: Config): void;
+/**
+ * Resolve keys for every enabled provider. Environment first, then the
+ * configured key command. A provider whose key does not resolve is simply not
+ * available; that is not an error until something tries to call it.
+ */
+export declare function resolveKeys(cfg: Config): Keys;
+export declare function availableProviders(keys: Keys): Provider[];
+/** Where the key for a provider would come from, for `setup` to report. */
+export declare function keySource(cfg: Config, provider: Provider): 'env' | 'command' | 'none';
+export declare function envVarName(provider: Provider): string;