@illuminis/comprism 0.1.3 → 0.1.4

package/out/lib/commandlist.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOne = readOne;
+exports.listOne = listOne;
+exports.fetchCommandList = fetchCommandList;
+/**
+ * The session's command and skill list, as the service decides it (manual 6.4).
+ *
+ * The service names each file or folder it needs from the project and this
+ * reads it, inside the project and through the executor's own checks, so a
+ * secrets file is never sent and nothing outside the project is read. It asks
+ * again with what it was given until it has what it needs. Every choice about
+ * what counts as a skill, what it is called and what its line says is made on
+ * the service.
+ */
+const files_1 = require("../executor/files");
+const gateway_1 = require("./gateway");
+const ROUNDS = 6;
+const MAX_CHARS = 8000;
+function readOne(root, rel) {
+    const r = (0, files_1.performFileAction)(root, 'read_file', { path: rel });
+    return r.isError ? null : r.content.slice(0, MAX_CHARS);
+}
+function listOne(root, rel) {
+    const r = (0, files_1.performFileAction)(root, 'list_dir', { path: rel });
+    if (r.isError)
+        return null;
+    return r.content === '(empty)' ? [] : r.content.split('\n').filter(Boolean);
+}
+/** Ask the service for this project's list. `words` are the session words
+ *  this tool runs. */
+async function fetchCommandList(root, words) {
+    const files = {};
+    const listings = {};
+    for (let round = 0; round < ROUNDS; round += 1) {
+        const reply = await (0, gateway_1.ask)({
+            intent: 'commands', prompt: '',
+            commandsPayload: { words, round, files, listings, project: root },
+        });
+        const body = reply.commands;
+        if (!reply.ok || reply.served === false || !body) {
+            return { ok: false, items: [], needsUpdate: [], keepHistory: false };
+        }
+        if (!body.wants) {
+            return {
+                ok: true,
+                items: body.items ?? [],
+                needsUpdate: body.needs_update ?? [],
+                keepHistory: body.keep_history === true,
+            };
+        }
+        for (const p of body.wants.read ?? [])
+            files[p] = readOne(root, p);
+        for (const f of body.wants.list ?? [])
+            listings[f] = listOne(root, f);
+    }
+    return { ok: false, items: [], needsUpdate: [], keepHistory: false };
+}

package/out/lib/decision.d.ts

@@ -0,0 +1,22 @@
+import type { WithheldReason } from './types';
+export interface LocalVerdict {
+    recommendation: string | null;
+    withheld: WithheldReason | null;
+    withheldDetail?: string;
+    breakdown: Record<string, never>;
+    tableHashes: Record<string, never>;
+    baselineVersion: string | null;
+    policyVersion: string;
+    estimatorVersion: string;
+    /** True only on a close corpus match. Every surface must flag the rest. */
+    confident: boolean;
+    /** Which rung of the lookup answered, carried for provenance. */
+    rung: string | null;
+}
+export declare const POLICY_VERSION = "served-v1";
+export declare function decide(input: {
+    prompt: string;
+    callingModel?: string;
+    contextTokens?: number;
+    freshContext?: boolean;
+}): Promise<LocalVerdict>;

package/out/lib/decision.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POLICY_VERSION = void 0;
+exports.decide = decide;
+/**
+ * The decision, as this tool now gets it: by asking.
+ *
+ * ── What this replaced ────────────────────────────────────────────────────
+ *
+ * `estimator.ts` computed the decision here, on the customer's machine, from
+ * tables and curves that are the product's whole method. That file stays in the
+ * repository because our own tests read it, and it is excluded from every
+ * published package, because a package on a public registry is readable forever
+ * by anyone who installs it.
+ *
+ * So the interception paths call this instead. It asks our server and returns
+ * the SAME SHAPE the call sites already expect, which is why swapping it in
+ * changed one import line in each of them rather than rewriting three files.
+ *
+ * The maths-bearing fields come back empty on purpose. A breakdown per candidate
+ * and the hashes of the tables consulted are the reasoning, and the reasoning
+ * stays on the server where it is written into the server's own decision record.
+ * The client records WHAT was decided; it no longer records how.
+ */
+const gateway_1 = require("./gateway");
+exports.POLICY_VERSION = 'served-v1';
+async function decide(input) {
+    const reply = await (0, gateway_1.ask)({
+        intent: 'decide',
+        prompt: input.prompt,
+        ...(input.callingModel ? { callingModel: input.callingModel } : {}),
+        contextTokens: input.contextTokens ?? 0,
+        freshContext: input.freshContext ?? true,
+    });
+    const d = reply.decision;
+    return {
+        recommendation: d.model,
+        // A server that could not decide is not an error here. Rule 10: the caller
+        // runs what it was going to run, and the reason travels with the record.
+        withheld: d.model ? null : 'no_decision',
+        ...(d.rationale ? { withheldDetail: d.rationale } : {}),
+        breakdown: {},
+        tableHashes: {},
+        baselineVersion: null,
+        policyVersion: exports.POLICY_VERSION,
+        estimatorVersion: exports.POLICY_VERSION,
+        confident: d.confident,
+        rung: d.rung,
+    };
+}

package/out/lib/fingerprint.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Normalization before hashing: lowercase, collapse runs of whitespace, trim.
+ *
+ * Deliberately mild. Aggressive normalization (stripping punctuation, stemming)
+ * would collapse genuinely different requests onto one fingerprint, and a
+ * fingerprint collision is a chain-linking error that is invisible afterwards.
+ */
+export declare function normalisePrompt(prompt: string): string;
+export declare function fingerprint(prompt: string): string;
+/**
+ * A short, stable id. `crypto.randomUUID` would do, but ids appear in every
+ * report and a 12-character id is legible in a terminal where a UUID is noise.
+ */
+export declare function newId(prefix: string): string;
+/**
+ * Context size in tokens, approximated from characters.
+ *
+ * Four characters per token is the industry's usual rule of thumb and it is an
+ * approximation, not a measurement - which is why every figure derived from it
+ * carries `derivation: 'inferred'` with this method named. The provider's own
+ * reported token counts are used wherever they exist; this is only for the
+ * context estimate that has to exist *before* the call is made.
+ */
+export declare const APPROX_CHARS_PER_TOKEN = 4;
+export declare function approxTokens(text: string): number;

package/out/lib/fingerprint.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPROX_CHARS_PER_TOKEN = void 0;
+exports.normalisePrompt = normalisePrompt;
+exports.fingerprint = fingerprint;
+exports.newId = newId;
+exports.approxTokens = approxTokens;
+/**
+ * Fingerprinting: how a request is identified without being kept.
+ *
+ * Every record refers to a request by the sha256 of its normalized text. The
+ * text itself is never written anywhere. Two consequences the rest of the
+ * system depends on:
+ *
+ *   - A verbatim retry produces the identical fingerprint, which is how Phase 2
+ *     recognizes two calls as attempts at the same unit of work without ever
+ *     comparing the words.
+ *   - Nothing can be reversed out of the record. A fingerprint identifies a
+ *     request to someone who already has it, and is inert to everyone else.
+ */
+const node_crypto_1 = require("node:crypto");
+/**
+ * Normalization before hashing: lowercase, collapse runs of whitespace, trim.
+ *
+ * Deliberately mild. Aggressive normalization (stripping punctuation, stemming)
+ * would collapse genuinely different requests onto one fingerprint, and a
+ * fingerprint collision is a chain-linking error that is invisible afterwards.
+ */
+function normalisePrompt(prompt) {
+    return prompt.replace(/\s+/g, ' ').trim().toLowerCase();
+}
+function fingerprint(prompt) {
+    return (0, node_crypto_1.createHash)('sha256').update(normalisePrompt(prompt), 'utf8').digest('hex');
+}
+/**
+ * A short, stable id. `crypto.randomUUID` would do, but ids appear in every
+ * report and a 12-character id is legible in a terminal where a UUID is noise.
+ */
+function newId(prefix) {
+    const rand = (0, node_crypto_1.createHash)('sha256')
+        .update(`${process.pid}:${Date.now()}:${Math.random()}`)
+        .digest('hex')
+        .slice(0, 12);
+    return `${prefix}_${rand}`;
+}
+/**
+ * Context size in tokens, approximated from characters.
+ *
+ * Four characters per token is the industry's usual rule of thumb and it is an
+ * approximation, not a measurement - which is why every figure derived from it
+ * carries `derivation: 'inferred'` with this method named. The provider's own
+ * reported token counts are used wherever they exist; this is only for the
+ * context estimate that has to exist *before* the call is made.
+ */
+exports.APPROX_CHARS_PER_TOKEN = 4;
+function approxTokens(text) {
+    return Math.ceil(text.length / exports.APPROX_CHARS_PER_TOKEN);
+}

package/out/lib/gateway.d.ts

@@ -33,8 +33,36 @@ export interface CatalogProvider {
     permitted: boolean;
     models: CatalogModel[];
 }
+/**
+ * One session's cost, as the server worked it out.
+ *
+ * Deliberately loose below the top level: the fields are named by the service
+ * and a client that re-declared every one of them would need a release every
+ * time a cost factor was added. What matters is that nothing here is computed
+ * on this side, so a new field arrives and prints without a new version.
+ */
+export interface SpendReport {
+    session: Record<string, unknown> | null;
+    /** The per-session fold: the five cost factors and what they add to. */
+    cost_factors: Record<string, unknown>;
+    /** Every provider call, with its tokens, its price and the decision behind it. */
+    calls: Record<string, unknown>[];
+    /**
+     * What a client should DRAW: headings, labels, ordered rows, formatted values.
+     *
+     * Sent by the server so that adding a cost factor, renaming one or changing
+     * how a figure reads is a server change and never obliges a customer to
+     * install a new version of the tool. Loosely typed on purpose, for the same
+     * reason: a field added there must arrive here without a release.
+     */
+    presentation?: Record<string, unknown>;
+    decisions: Record<string, unknown>[];
+    units_of_work: Record<string, unknown>[];
+}
 export interface GatewayReply {
-    intent: 'decide' | 'answer' | 'catalog' | 'store_key' | 'session' | 'job_start' | 'resolve_workspace' | 'sign_in' | 'sign_out' | 'attach' | 'transcribe' | 'graph';
+    /** Local transport metadata, not an authentication decision. */
+    httpStatus?: number;
+    intent: 'decide' | 'answer' | 'catalog' | 'store_key' | 'session' | 'job_start' | 'resolve_workspace' | 'sign_in' | 'sign_out' | 'attach' | 'transcribe' | 'graph' | 'spend' | 'project' | 'commands' | 'transcript' | 'context' | 'compact' | 'sessions' | 'permissions' | 'jobs' | 'agents' | 'integrations' | 'skills' | 'plugins' | 'schema' | 'usage' | 'instructions' | 'config' | 'memory' | 'worktrees' | 'privacy' | 'hooks' | 'queue' | 'review' | 'release';
     client: string;
     decision: Decision;
     answer: string | null;
@@ -89,7 +117,109 @@ export interface GatewayReply {
     /** Present only for a graph request: what the map holds, what it still needs,
      *  or the answer to one of the five questions. */
     graph?: Record<string, unknown>;
+    /**
+     * One session's cost, worked out term by term. Present only for a spend
+     * request.
+     *
+     * Shaped by the server and rendered here, never recomputed here: the whole
+     * point of asking the service is that the terminal and the portal quote one
+     * set of figures. A client that added anything up itself would be a second
+     * source of truth for the one number this product sells.
+     */
+    spend?: SpendReport | null;
+    /** The first line of a session, as the service wrote it (manual 2.2). */
+    project_line?: string | null;
+    /** The lines a project operation prints, written by the service. */
+    lines?: string[] | null;
+    data?: Record<string, unknown> | null;
+    /** Present only for a context or compact request: lines to print (6.13, 6.15). */
+    context?: {
+        lines: string[];
+        ok?: boolean;
+    } | null;
+    /** Present only for a transcript request: lines to print as sent (6.9). */
+    transcript?: {
+        job_id: string;
+        lines: string[];
+        complete: boolean;
+    } | null;
+    /** Present only for a jobs request (manual 5.14): lines to print as sent. */
+    jobs?: {
+        lines: string[];
+        job_id?: string;
+        running?: boolean;
+    } | null;
+    /** The result object a script reads (manual 10.3), built by the service. */
+    result?: Record<string, unknown> | null;
+    /** One reason word for a refusal, turned into a number by `exit_status`. */
+    reason?: string | null;
+    /** Reason word to exit number (Appendix B), as the service sends it. */
+    exit_status?: Record<string, number> | null;
+    /** Present only for a usage request: the figures and the lines to print. */
+    usage?: Record<string, unknown> | null;
+    /** Present only for a schema request: the published shape and the table. */
+    schema_doc?: Record<string, unknown> | null;
+    /** Present only for an agents request (manual 5.24): lines to print as sent. */
+    agents?: {
+        lines: string[];
+        helpers?: Array<Record<string, unknown>>;
+        wants?: {
+            read?: string[];
+            list?: string[];
+        } | null;
+    } | null;
+    /** Present only for a commands request (manual 6.4, 6.5). `wants` names
+     *  the project files to send on the next round. */
+    commands?: {
+        items?: {
+            name: string;
+            description: string;
+            source: string;
+        }[];
+        needs_update?: string[];
+        keep_history?: boolean;
+        wants?: {
+            read?: string[];
+            list?: string[];
+        } | null;
+    } | null;
     /** Who this machine is signed in as. Present only for a session request. */
+    /** For sessions: `lines` to print as they are, and the records behind
+     *  them (`sessions` for a list, the one session's fields for a resume). */
+    sessions?: SessionsReply | null;
+    /** For permissions: `lines` to print as they are (manual 4.14). */
+    permissions?: {
+        lines?: string[];
+        verdict?: string;
+    } | null;
+    /** For integrations: `lines` to print as they are (web manual 9.5). */
+    integrations?: Record<string, unknown> & {
+        lines?: string[];
+        connections?: unknown[];
+    } | null;
+    /** `comprism plugins` (manual 9.15 to 9.17), in the service's words. */
+    plugins?: Record<string, unknown> & {
+        lines?: string[];
+        line?: string;
+        error?: string;
+    } | null;
+    /** `comprism skills` (manual 9.1 to 9.4): rows to draw, or what was saved. */
+    skills?: {
+        rows?: Array<{
+            name: string;
+            description: string;
+            where: string;
+            active: boolean;
+            note?: string | null;
+        }>;
+        empty?: string | null;
+        line?: string;
+        error?: string;
+        wants?: {
+            read?: string[];
+            list?: string[];
+        } | null;
+    } | null;
     session?: SessionOut | null;
     /** Permission for one coding job. Present only for a job_start request. */
     job?: JobOut | null;
@@ -97,6 +227,9 @@ export interface GatewayReply {
     sign_in?: SignInOut | null;
     /** Present only for an attach or transcribe request. */
     upload?: UploadOut | null;
+    /** For attach: why the file will not be read, from the service's fixed
+     *  list. The sentence is in `message`. */
+    refusal?: string | null;
     /**
      * True when the request was understood, allowed and acted on.
      *
@@ -119,6 +252,21 @@ export interface GatewayReply {
     ok: boolean;
 }
 /** Permission to send one file, and the address to send it to. */
+/** One session as the service describes it (CLI manual 8.4, 8.5). */
+export interface SessionRecord {
+    session_id: string;
+    number: string;
+    title: string;
+    last_job_id?: string | null;
+    continues_job?: string | null;
+    conversation_kept?: boolean;
+    cost_usd: number;
+    jobs: number;
+}
+export interface SessionsReply extends Partial<SessionRecord> {
+    lines: string[];
+    sessions?: SessionRecord[];
+}
 export interface UploadOut {
     /** Presented at the upload address in place of the workspace credential. */
     ticket: string;
@@ -190,7 +338,7 @@ export interface SessionOut {
     can_write: boolean;
 }
 export interface Ask {
-    intent: 'decide' | 'answer' | 'catalog' | 'store_key' | 'session' | 'job_start' | 'resolve_workspace' | 'sign_in' | 'sign_out' | 'attach' | 'transcribe' | 'graph';
+    intent: 'decide' | 'answer' | 'catalog' | 'store_key' | 'session' | 'job_start' | 'resolve_workspace' | 'sign_in' | 'sign_out' | 'attach' | 'transcribe' | 'graph' | 'spend' | 'project' | 'commands' | 'transcript' | 'context' | 'compact' | 'sessions' | 'permissions' | 'jobs' | 'agents' | 'integrations' | 'skills' | 'plugins' | 'schema' | 'usage' | 'instructions' | 'config' | 'memory' | 'worktrees' | 'privacy' | 'hooks' | 'queue' | 'review' | 'release';
     prompt: string;
     callingModel?: string;
     contextTokens?: number;
@@ -207,11 +355,37 @@ export interface Ask {
     resumeJobId?: string;
     /** For sign_in only. Sent once, over TLS, and written nowhere. */
     password?: string;
+    /** Company login (manual 1.10): the token a browser approval issued. */
+    deviceToken?: string;
     /** For sign_in, when a second factor is required. */
     challenge?: string;
     code?: string;
     /** For sign_in: how this machine appears where a person goes to revoke it. */
     machineLabel?: string;
+    /** Which session to break down. Omitted means the newest one recorded. */
+    spendSession?: string;
+    /** For project: the folder facts this machine observed (manual 2.1 to 2.3). */
+    project?: Record<string, unknown>;
+    /** For instructions, config, memory and worktrees (manual 2.5 to 2.11). */
+    op?: string;
+    payload?: Record<string, unknown>;
+    /** For commands: the session words this tool runs, and the project files
+     *  the service asked for on the previous round. */
+    commandsPayload?: Record<string, unknown>;
+    sessionsPayload?: Record<string, unknown>;
+    /** For jobs: op (list, find, stop) and job (manual 5.14). */
+    jobsPayload?: Record<string, unknown>;
+    /** For agents: the helper definition files this machine read (manual 5.24). */
+    agentsPayload?: Record<string, unknown>;
+    /** For usage: this machine's offset from UTC in minutes (manual 10.12). */
+    tzMinutes?: number;
+    skillsPayload?: Record<string, unknown>;
+    integrationsPayload?: Record<string, unknown>;
+    pluginsPayload?: Record<string, unknown>;
+    /** For permissions: op, action, target and the settings files (manual 4.14). */
+    permissionsPayload?: Record<string, unknown>;
+    /** For transcript: the job whose record to print (manual 6.9). */
+    jobId?: string;
     /** For graph: which of the map's operations this is. */
     graphOp?: 'status' | 'stamps' | 'update' | 'finish' | 'ask' | 'forget' | 'policy';
     /** For graph: the project on this machine the map belongs to. */
@@ -226,6 +400,14 @@ export interface Ask {
      * that could carry it.
      */
     graphPayload?: Record<string, unknown>;
+    /** For attach: the file's name and size, asked about before its bytes are
+     *  sent. Never its contents (manual 3.10). */
+    attachment?: {
+        filename: string;
+        size_bytes: number;
+    };
+    /** For answer: ids of files already attached, read before the question. */
+    attachments?: string[];
 }
 /**
  * The same door, at an address this machine is not signed in to yet.
@@ -237,3 +419,5 @@ export interface Ask {
  */
 export declare function askAt(url: string, input: Ask, tenant?: string): Promise<GatewayReply>;
 export declare function ask(input: Ask): Promise<GatewayReply>;
+/** A sentence for a certificate failure, or null when the failure was not one. */
+export declare function certificateProblem(e: unknown): string | null;

package/out/lib/gateway.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.askAt = askAt;
 exports.ask = ask;
+exports.certificateProblem = certificateProblem;
 /**
  * The one door, from this side of it.
  *
@@ -21,6 +22,7 @@ exports.ask = ask;
  * the shape of the reply, which is not a secret and cannot be one.
  */
 const connection_1 = require("./connection");
+const version_1 = require("./version");
 /**
  * A decision that decides nothing, for when the door cannot be reached.
  *
@@ -105,6 +107,9 @@ async function post(url, input, credential, tenant) {
         headers.authorization = `Bearer ${conn.workspaceKey}`;
     if (conn.tenant)
         headers['X-Tenant-ID'] = conn.tenant;
+    // Which tool is asking, so the service can say when a feature needs a newer
+    // one (manual 1.7). It decides; this only says what it is.
+    headers['X-Comprism-Version'] = version_1.COMPRISM_VERSION;
     // Forwarded, never written to disk: the customer's money stays the
     // customer's, and we hold no secret of theirs on their behalf.
     if (input.providerKey)
@@ -113,6 +118,11 @@ async function post(url, input, credential, tenant) {
         const res = await fetch(`${conn.url.replace(/\/+$/, '')}/api/v1/dev/gateway`, {
             method: 'POST',
             headers,
+            // Never waits forever. A service that restarts mid request, or a network
+            // that goes quiet, answers as unreachable (Appendix B, 6) rather than
+            // leaving the terminal hanging. Longer for a question a model answers.
+            signal: AbortSignal.timeout(['answer', 'decide', 'compact', 'transcribe'].includes(input.intent)
+                ? 300_000 : 120_000),
             body: JSON.stringify({
                 intent: input.intent,
                 client: 'cli',
@@ -128,10 +138,27 @@ async function post(url, input, credential, tenant) {
                 ...(input.password ? { password: input.password } : {}),
                 ...(input.challenge ? { challenge: input.challenge } : {}),
                 ...(input.code ? { code: input.code } : {}),
+                ...(input.deviceToken ? { device_token: input.deviceToken } : {}),
                 ...(input.machineLabel ? { machine_label: input.machineLabel } : {}),
+                ...(input.spendSession ? { spend_session: input.spendSession } : {}),
+                ...(input.project ? { project: input.project } : {}),
+                ...(input.op ? { op: input.op } : {}),
+                ...(input.payload ? { payload: input.payload } : {}),
+                ...(input.commandsPayload ? { commands_payload: input.commandsPayload } : {}),
+                ...(input.sessionsPayload ? { sessions_payload: input.sessionsPayload } : {}),
+                ...(input.jobsPayload ? { jobs_payload: input.jobsPayload } : {}),
+                ...(input.agentsPayload ? { agents_payload: input.agentsPayload } : {}),
+                ...(input.tzMinutes !== undefined ? { tz_minutes: input.tzMinutes } : {}),
+                ...(input.skillsPayload ? { skills_payload: input.skillsPayload } : {}),
+                ...(input.integrationsPayload ? { integrations_payload: input.integrationsPayload } : {}),
+                ...(input.pluginsPayload ? { plugins_payload: input.pluginsPayload } : {}),
+                ...(input.permissionsPayload ? { permissions_payload: input.permissionsPayload } : {}),
+                ...(input.jobId ? { job_id: input.jobId } : {}),
                 ...(input.graphOp ? { graph_op: input.graphOp } : {}),
                 ...(input.workspace ? { workspace: input.workspace } : {}),
                 ...(input.graphPayload ? { graph_payload: input.graphPayload } : {}),
+                ...(input.attachment ? { attachment: input.attachment } : {}),
+                ...(input.attachments?.length ? { attachments: input.attachments } : {}),
             }),
         });
         if (!res.ok) {
@@ -156,16 +183,44 @@ async function post(url, input, credential, tenant) {
             // credential path was alive and would have worked. Newer builds answer
             // 200 with `served: false` and never reach this line.
             if (res.status === 422)
-                return { ...failed, served: false };
-            return failed;
+                return { ...failed, served: false, httpStatus: res.status };
+            return { ...failed, httpStatus: res.status };
         }
         // `ok` is this client's own marker and the server never sends it: it
         // records that the workspace answered at all. Set here, on the one path
         // where that is true, so no caller has to infer it from an empty field.
         const reply = (await res.json());
+        if (reply.reason === 'upgrade') {
+            // Said before any work starts or anything is charged, and the number is
+            // Appendix B's 10 (manual 1.7).
+            process.stderr.write(`  ${String(reply.message || 'This needs a newer comprism. Run comprism update.').split('\n').join('\n  ')}\n`);
+            process.exit(10);
+        }
         return { ...reply, ok: true };
     }
-    catch {
-        return openFailure(input.intent, input.callingModel, 'the service could not be reached');
+    catch (e) {
+        // A certificate problem is said as one, with the setting to change, never
+        // as "could not be reached" (manual 1.11).
+        return openFailure(input.intent, input.callingModel, certificateProblem(e) ?? 'the service could not be reached');
+    }
+}
+/** The certificate codes Node reports when a company's own authority is not
+ *  trusted, or a certificate is wrong (manual 1.11). */
+const CERT_CODES = new Set(["UNABLE_TO_VERIFY_LEAF_SIGNATURE", "SELF_SIGNED_CERT_IN_CHAIN",
+    "DEPTH_ZERO_SELF_SIGNED_CERT", "UNABLE_TO_GET_ISSUER_CERT", "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "CERT_HAS_EXPIRED", "ERR_TLS_CERT_ALTNAME_INVALID", "CERT_UNTRUSTED"]);
+/** A sentence for a certificate failure, or null when the failure was not one. */
+function certificateProblem(e) {
+    let cause = e;
+    for (let i = 0; i < 4 && cause; i += 1) {
+        const code = cause.code;
+        if (code && CERT_CODES.has(code)) {
+            const file = process.env.NODE_EXTRA_CA_CERTS;
+            return `a certificate problem (${code}): the service's certificate is not trusted on this machine. `
+                + (file ? `NODE_EXTRA_CA_CERTS is ${file}; check it holds your company's certificate authority.`
+                    : "If your company uses its own certificate authority, set NODE_EXTRA_CA_CERTS to its certificate file.");
+        }
+        cause = cause.cause;
     }
+    return null;
 }

package/out/lib/history.d.ts

@@ -0,0 +1,24 @@
+export declare function historyFile(): string;
+export declare class History {
+    /** Newest first, as shown on the prompt line. Shared with the reader, which
+     *  walks it with Up and Down. */
+    readonly entries: string[];
+    /** Newest first, as sent. What the file holds. */
+    private saved;
+    /** The company's rule: true keeps, false removes, null (the service could
+     *  not be asked) keeps this session's requests in memory and leaves any
+     *  file exactly as it is. */
+    private keep;
+    /** Begin a session under the company's rule. */
+    start(keep: boolean | null): void;
+    private off;
+    /** `history off`: nothing is remembered, in memory or on disk. */
+    disable(): void;
+    /** Remember one request. `shown` is how it looked at the prompt, paste
+     *  labels included; `sent` is what was sent. */
+    add(shown: string, sent: string): void;
+    /** End the session. Without permission to keep, nothing is left behind. */
+    finish(): void;
+    private write;
+    private remove;
+}