@fastagent-sh/fastagent 0.22.1 → 0.24.0

package/dist/engines/pi/auth.js

@@ -1,112 +1,29 @@
 /**
  * Auth for the pi engine: a read-WRITE {@link CredentialStore} over a fastagent credentials file, consumed by the
- * `Models` collection (models.ts). The write path refuses to overwrite a corrupt file, so a torn read never clobbers
- * the other providers' credentials.
+ * `Models` collection (models.ts), and which of those files an agent reads. The write path refuses to overwrite a
+ * corrupt file, so a torn read never clobbers the other providers' credentials.
  */
-import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { GLOBAL_HOME_DIR, SECRETS_DIRNAME, SECRET_FILE_MODE } from "../../paths.js";
-import { writeFileAtomic } from "../../atomic-write.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalHome, SECRETS_DIRNAME, resolveOverridePath, resolveSecretsDir } from "../../paths.js";
 import { log } from "../../log.js";
-import lockfile from "proper-lockfile";
+import { withLockedFile } from "./locked-file.js";
 /**
  * The GLOBAL fastagent credentials file (distinct from pi's `~/.pi`), under the user-global machinery home
  * `~/.fastagent/`.
  */
-export const GLOBAL_AUTH_PATH = join(homedir(), GLOBAL_HOME_DIR, SECRETS_DIRNAME, "auth.json");
+export const GLOBAL_AUTH_PATH = join(globalHome(), SECRETS_DIRNAME, "auth.json");
+/** The one refusal for a caller that names both sources: silently preferring one would hide the other's mistake. */
+export function assertOneCredentialSource(options) {
+    if (options.authPath !== undefined && options.credentialStore !== undefined) {
+        throw new Error("pass authPath or credentialStore, not both: a supplied store replaces the credentials file");
+    }
+}
 /** A valid stored credential, or undefined — a foreign/old entry reads as not-configured, not a crash. */
 function pick(creds, providerId) {
     const cred = creds[providerId];
     return cred && (cred.type === "oauth" || cred.type === "api_key") ? cred : undefined;
 }
-const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf8", mode: SECRET_FILE_MODE };
-/**
- * The file a write must land IN, which is not always the path it is addressed BY. pi writes the auth file in place,
- * so it follows a symlink to the target; an atomic rename would replace the link with a regular file instead, and
- * from then on the two tools would be editing different files — the same split the shared lock exists to prevent,
- * arriving one write later. A dangling link (a dotfile manager that has not checked the target out yet) still names
- * where the credentials belong, so it is followed too rather than overwritten.
- */
-function writeTarget(authPath) {
-    if (existsSync(authPath))
-        return realpathSync(authPath);
-    const link = lstatSync(authPath, { throwIfNoEntry: false });
-    // ponytail: one hop. A chain of dangling links would have its second link replaced; resolve iteratively if that
-    // ever shows up in a real layout.
-    return link?.isSymbolicLink() ? resolve(dirname(authPath), readlinkSync(authPath)) : authPath;
-}
-/** Serialized cross-process read-modify-write of the credentials file. */
-async function withLockedAuthFile(authPath, fn) {
-    mkdirSync(dirname(authPath), { recursive: true });
-    if (!existsSync(authPath)) {
-        try {
-            // `wx` makes this an exclusive CREATE, which is the one case `writeFileSync` honours `mode` in — so no chmod
-            // after it (unlike writeFileAtomic, whose temp may already exist from a crashed writer).
-            writeFileSync(authPath, "{}", { ...AUTH_FILE_WRITE_OPTIONS, flag: "wx" });
-        }
-        catch (error) {
-            // EEXIST: the path IS taken, by something `existsSync` does not see through — either another process created
-            // the file just now (its credentials must not be clobbered) or the path is a dangling symlink. Both are left
-            // alone: the write below resolves where they belong.
-            if (error.code !== "EEXIST")
-                throw error;
-        }
-    }
-    let compromised;
-    const throwIfCompromised = () => {
-        if (compromised)
-            throw compromised;
-    };
-    const release = await lockfile.lock(authPath, {
-        // MUST match pi-coding-agent's `core/auth-storage.js`, which locks with `realpath: false`. When the auth file
-        // itself is a symlink (dotfile managers do this), the two settings name DIFFERENT lock files and both locks can
-        // be held at once — so `pi` and `fastagent` would refresh the same provider concurrently, and a rotated refresh
-        // token logs one of them out. Resolving the link would be the stronger rule, but only if BOTH sides did it, and
-        // we do not own the other side.
-        realpath: false,
-        retries: { retries: 10, factor: 2, minTimeout: 100, maxTimeout: 10_000, randomize: true },
-        stale: 30_000,
-        onCompromised: (error) => {
-            compromised = error;
-        },
-    });
-    let result;
-    try {
-        throwIfCompromised();
-        const current = existsSync(authPath) ? readFileSync(authPath, "utf8") : undefined;
-        const out = await fn(current);
-        throwIfCompromised();
-        // Rename, not an in-place rewrite: it is what lets `read` stay unlocked, and it is the only spelling that applies
-        // the mode before the content is reachable.
-        if (out.next !== undefined) {
-            writeFileAtomic(writeTarget(authPath), out.next, SECRET_FILE_MODE);
-        }
-        throwIfCompromised();
-        result = out.result;
-    }
-    catch (error) {
-        // The primary failure stays the signal; unlock noise must not mask it.
-        try {
-            await release();
-        }
-        catch {
-            // Secondary: a compromised or stale-reclaimed lock often cannot release cleanly.
-        }
-        throw error;
-    }
-    // Success path: a failed release is a real cleanup failure (the leftover auth.json.lock stalls the next writer for
-    // the staleness window with zero diagnostics), so it surfaces instead of resolving a silently degraded operation.
-    try {
-        await release();
-    }
-    catch (releaseError) {
-        if (compromised === undefined)
-            throw releaseError;
-    }
-    throwIfCompromised();
-    return result;
-}
 /** Decode the credentials JSON, shared by the read and write paths. */
 function decodeCreds(raw) {
     let parsed;
@@ -153,16 +70,25 @@ function parseForWrite(raw, where) {
 }
 /**
  * A read-write `CredentialStore` over the given credentials file (default {@link GLOBAL_AUTH_PATH}; the directory
- * opener passes the project-level `<root>/.secrets/auth.json`), optionally falling back to a second file.
+ * opener passes the project-level `<root>/.secrets/auth.json`), optionally falling back to a second file. A path is
+ * read like `FASTAGENT_AUTH_PATH` (`~` is the home directory, a relative one resolves against the cwd), so every
+ * caller that names a file names the same one.
  *
  * The fallback is PER PROVIDER, not per file: logging one provider into a project must not hide the others a person
  * already has globally. And the layer a credential was READ from is the layer its refresh is written back to —
  * anything else would conjure a second holder of the same OAuth grant, which is the failure this whole area exists
  * to avoid. A provider present in neither layer is new, and new credentials belong to the primary.
+ *
+ * The fallback also yields to `projectAuthenticates`: a provider the project authenticates some other way (an env key,
+ * its own models.json) never reaches it — for reading, listing or writing back.
  */
-export function fastagentCredentialStore(authPath = GLOBAL_AUTH_PATH, options = {}) {
+export function fastagentCredentialStore(path, options = {}) {
     const warn = options.warn ?? ((message) => log.warn(message));
-    const fallback = options.fallbackPath !== undefined && options.fallbackPath !== authPath ? options.fallbackPath : undefined;
+    const authPath = resolveOverridePath(path) ?? GLOBAL_AUTH_PATH;
+    const fallbackPath = resolveOverridePath(options.fallbackPath);
+    const fallback = fallbackPath !== undefined && fallbackPath !== authPath ? fallbackPath : undefined;
+    /** The fallback, when it may serve this provider at all. */
+    const fallbackFor = async (providerId) => fallback === undefined || (await options.projectAuthenticates?.(providerId)) ? undefined : fallback;
     /**
      * The file that owns this provider: where it already is, else the primary.
      *
@@ -171,18 +97,21 @@ export function fastagentCredentialStore(authPath = GLOBAL_AUTH_PATH, options =
      * "one grant, one copy" rule can be lost. Re-checking under the lock means locking both files in a fixed order;
      * worth it only if concurrent logins stop being a rounding error.
      */
-    const owner = (providerId) => {
-        if (fallback === undefined)
+    const owner = async (providerId) => {
+        const second = await fallbackFor(providerId);
+        if (second === undefined)
             return authPath;
         const primary = readCreds(authPath, warn);
         if (primary && pick(primary, providerId))
             return authPath;
-        const secondary = readCreds(fallback, warn);
-        return secondary && pick(secondary, providerId) ? fallback : authPath;
+        const secondary = readCreds(second, warn);
+        return secondary && pick(secondary, providerId) ? second : authPath;
     };
     return {
+        layerOf: owner,
         async read(providerId) {
-            for (const path of fallback === undefined ? [authPath] : [authPath, fallback]) {
+            const second = await fallbackFor(providerId);
+            for (const path of second === undefined ? [authPath] : [authPath, second]) {
                 const creds = readCreds(path, warn);
                 const found = creds && pick(creds, providerId);
                 if (found)
@@ -196,15 +125,17 @@ export function fastagentCredentialStore(authPath = GLOBAL_AUTH_PATH, options =
             const infos = new Map();
             for (const path of fallback === undefined ? [authPath] : [fallback, authPath]) {
                 for (const [providerId, cred] of Object.entries(readCreds(path, warn) ?? {})) {
+                    if (path === fallback && (await fallbackFor(providerId)) === undefined)
+                        continue;
                     if (cred && (cred.type === "oauth" || cred.type === "api_key"))
                         infos.set(providerId, { providerId, type: cred.type });
                 }
             }
             return [...infos.values()];
         },
-        modify(providerId, fn) {
-            const path = owner(providerId);
-            return withLockedAuthFile(path, async (current) => {
+        async modify(providerId, fn) {
+            const path = await owner(providerId);
+            return withLockedFile(path, async (current) => {
                 const creds = parseForWrite(current, path); // corrupt → throw → no clobber
                 const next = await fn(pick(creds, providerId));
                 if (next === undefined)
@@ -214,12 +145,12 @@ export function fastagentCredentialStore(authPath = GLOBAL_AUTH_PATH, options =
             });
         },
         async delete(providerId) {
-            const path = owner(providerId);
+            const path = await owner(providerId);
             // No-op when nothing is stored: do NOT take the lock (which would create the file) on a machine that never
             // stored this provider.
             if (!existsSync(path))
                 return;
-            await withLockedAuthFile(path, async (current) => {
+            await withLockedFile(path, async (current) => {
                 const creds = parseForWrite(current, path);
                 if (!(providerId in creds))
                     return { result: undefined }; // absent: no write
@@ -229,3 +160,31 @@ export function fastagentCredentialStore(authPath = GLOBAL_AUTH_PATH, options =
         },
     };
 }
+// ── Which files an agent reads ───────────────────────────────────────────────
+/**
+ * The auth-file override: the SDK's `authPath` option > `FASTAGENT_AUTH_PATH` env > undefined (then
+ * `<secrets dir>/auth.json`). The CLI has no flag for it: a second spelling of one environment variable buys nothing,
+ * and the variable is what a deployed container reads anyway.
+ */
+function resolveAuthPathOverride(flag, env) {
+    return resolveOverridePath(flag ?? env.FASTAGENT_AUTH_PATH);
+}
+/** The effective auth file for an agent: override if present, else `<secrets dir>/auth.json`. */
+export function resolveAuthPath(dir, flag, env = process.env) {
+    return resolveAuthPathOverride(flag, env) ?? join(resolveSecretsDir(dir, env), "auth.json");
+}
+/**
+ * The {@link AuthLayers} an agent directory reads: `authPath` option > `FASTAGENT_AUTH_PATH` > its own file, and
+ * behind it the user-global store, because a login is a PERSON on a machine and not a project — one `login -g` then
+ * serves every agent here.
+ *
+ * No fallback when a path was named: "use this file" is an instruction, not a preference. BOTH knobs
+ * {@link resolveAuthPath} reads count as that instruction, `FASTAGENT_SECRETS_DIR` included — it is what the
+ * Fly/Railway/AgentCore artifacts set, and a deployed container must read its mounted credentials and nothing else
+ * (the artifact is the truth).
+ */
+export function resolveAuthLayers(agentDir, authPath, env = process.env) {
+    const path = resolveAuthPath(agentDir, authPath, env);
+    const named = resolveAuthPathOverride(authPath, env) ?? resolveOverridePath(env.FASTAGENT_SECRETS_DIR);
+    return named === undefined ? { path, fallback: GLOBAL_AUTH_PATH } : { path };
+}

package/dist/engines/pi/config.d.ts

@@ -63,28 +63,3 @@ export declare function rewriteConfigModel(src: string, spec: string): string |
  * would refuse to start an agent whose config names a model.
  */
 export declare function resolveModelSpec(flag: string | undefined, config: FastagentConfig, env?: NodeJS.ProcessEnv): string | undefined;
-/** The default credentials file under a resolved secrets dir ({@link resolveSecretsDir}). */
-export declare function defaultAuthPath(secretsDir: string): string;
-/** The effective auth file for an agent: override if present, else `<secrets dir>/auth.json`. */
-export declare function resolveAuthPath(dir: string, flag?: string, env?: NodeJS.ProcessEnv): string;
-/**
- * Which credentials files an agent reads: `path` first, then, per provider, `fallback` — present only when nothing
- * named the path ({@link resolveAuthFallback}). One value because it is one decision: the opener, the model list, the
- * startup report and the first-run picker all read through it.
- */
-export interface AuthLayers {
-    path: string;
-    fallback?: string;
-}
-/** The {@link AuthLayers} an agent directory reads: `authPath` option > `FASTAGENT_AUTH_PATH` > its own file. */
-export declare function resolveAuthLayers(agentDir: string, authPath?: string, env?: NodeJS.ProcessEnv): AuthLayers;
-/**
- * Where a credential the project does not have is read from instead: the user-global store, because a login is a
- * PERSON on a machine and not a project — one `login -g` then serves every agent here. Undefined when an explicit
- * path was named: "use this file" is an instruction, not a preference, so it gets no second layer.
- *
- * BOTH knobs {@link resolveAuthPath} reads count as that instruction, `FASTAGENT_SECRETS_DIR` included — it is what
- * the Fly/Railway/AgentCore artifacts set, and a deployed container must read its mounted credentials and nothing
- * else (the artifact is the truth).
- */
-export declare function resolveAuthFallback(flag?: string, env?: NodeJS.ProcessEnv): string | undefined;

package/dist/engines/pi/config.js

@@ -14,11 +14,10 @@ import { existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { THINKING_LEVELS } from "./session-settings.js";
-import { GLOBAL_AUTH_PATH } from "./auth.js";
 import { readSecretDeclaration } from "../../declared-secrets.js";
 import { assertCorsOrigins } from "../../channels/serve.js";
 import { moduleLoadHint } from "../../loader.js";
-import { AGENT_CONFIG_FILE, resolveOverridePath, resolveSecretsDir } from "../../paths.js";
+import { AGENT_CONFIG_FILE } from "../../paths.js";
 /** Identity function for typing and IDE completion (vite/next-style). */
 export function defineConfig(config) {
     return config;
@@ -152,7 +151,8 @@ export function resolveModel(models, spec) {
     const modelId = spec.slice(slash + 1);
     const model = models.getModel(provider, modelId);
     if (!model) {
-        throw new Error(`unknown model "${spec}" (provider "${provider}" / id "${modelId}" not in registry); run \`fastagent models\` to list available specs`);
+        throw new Error(`unknown model "${spec}" (provider "${provider}" / id "${modelId}" not in registry); run \`fastagent models\` to list ` +
+            "available specs, or `fastagent models --refresh` in the agent to fetch models newer than the installed pi");
     }
     return model;
 }
@@ -189,37 +189,3 @@ export function rewriteConfigModel(src, spec) {
 export function resolveModelSpec(flag, config, env = process.env) {
     return flag ?? (env.FASTAGENT_MODEL || config.model);
 }
-/**
- * The auth-file override: the SDK's `authPath` option > `FASTAGENT_AUTH_PATH` env > undefined (the opener then falls
- * back to {@link defaultAuthPath} under the {@link resolveSecretsDir} dir). The CLI has no flag for it: a second
- * spelling of one environment variable buys nothing, and the variable is what a deployed container reads anyway.
- */
-function resolveAuthPathOverride(flag, env = process.env) {
-    return resolveOverridePath(flag ?? env.FASTAGENT_AUTH_PATH);
-}
-/** The default credentials file under a resolved secrets dir ({@link resolveSecretsDir}). */
-export function defaultAuthPath(secretsDir) {
-    return join(secretsDir, "auth.json");
-}
-/** The effective auth file for an agent: override if present, else `<secrets dir>/auth.json`. */
-export function resolveAuthPath(dir, flag, env = process.env) {
-    return resolveAuthPathOverride(flag, env) ?? defaultAuthPath(resolveSecretsDir(dir, env));
-}
-/** The {@link AuthLayers} an agent directory reads: `authPath` option > `FASTAGENT_AUTH_PATH` > its own file. */
-export function resolveAuthLayers(agentDir, authPath, env = process.env) {
-    const fallback = resolveAuthFallback(authPath, env);
-    return { path: resolveAuthPath(agentDir, authPath, env), ...(fallback !== undefined ? { fallback } : {}) };
-}
-/**
- * Where a credential the project does not have is read from instead: the user-global store, because a login is a
- * PERSON on a machine and not a project — one `login -g` then serves every agent here. Undefined when an explicit
- * path was named: "use this file" is an instruction, not a preference, so it gets no second layer.
- *
- * BOTH knobs {@link resolveAuthPath} reads count as that instruction, `FASTAGENT_SECRETS_DIR` included — it is what
- * the Fly/Railway/AgentCore artifacts set, and a deployed container must read its mounted credentials and nothing
- * else (the artifact is the truth).
- */
-export function resolveAuthFallback(flag, env = process.env) {
-    const explicit = resolveAuthPathOverride(flag, env) ?? resolveOverridePath(env.FASTAGENT_SECRETS_DIR);
-    return explicit === undefined ? GLOBAL_AUTH_PATH : undefined;
-}

package/dist/engines/pi/create.d.ts

@@ -1,15 +1,16 @@
 import type { ExecutionEnv, Skill, ThinkingLevel } from "@earendil-works/pi-agent-core";
 import { type ModelRuntime } from "@earendil-works/pi-coding-agent";
-import type { Provider } from "@earendil-works/pi-ai";
+import type { CredentialStore, Provider } from "@earendil-works/pi-ai";
 import type { Agent } from "../../agent.ts";
-import { type AuthLayers, type FastagentConfig } from "./config.ts";
-import type { FastagentAuthOptions } from "./auth.ts";
+import { type FastagentConfig } from "./config.ts";
 import { type LoadedDefinition } from "./definition.ts";
 import type { ModuleLoadFailure } from "../../loader.ts";
 import { type ToolCollision, type MountedTool } from "./tool.ts";
 import { type DeclaredSecret } from "../../declared-secrets.ts";
 import { type PiAgentSessionFactory } from "./invoke-session.ts";
+import { type PiAgentSessionFactoryOptions } from "./agent-session-factory.ts";
 import { type AnyModel } from "./models.ts";
+import { type AgentModels } from "./agent-models.ts";
 import { type PiSessionRecordStore } from "./session-store.ts";
 import { type Lease, type SessionObserver } from "./turn-kit.ts";
 /**
@@ -18,6 +19,13 @@ import { type Lease, type SessionObserver } from "./turn-kit.ts";
  */
 export declare const CODING_TOOL_NAMES: readonly ["read", "grep", "find", "ls", "bash", "edit", "write"];
 export declare function piAllCodingTools(cwd: string): MountedTool[];
+/** How the model reaches a mounted tool it is not given up front. */
+export type ToolReach = "tool_search" | "codemode" | "hidden" | "inactive" | "unreachable";
+/** A mounted authored tool outside the default-active surface, and its way in. */
+export interface IndirectTool {
+    name: string;
+    reach: ToolReach;
+}
 /**
  * The full directory-agent tool set: all pi coding tools + `config.tools` + discovered `tools/` (deduped, existing
  * win), plus the authored names and collisions to report.
@@ -25,11 +33,8 @@ export declare function piAllCodingTools(cwd: string): MountedTool[];
 export declare function resolveAgentTools(config: FastagentConfig, agentDir: string, cwd: string): Promise<{
     tools: MountedTool[];
     toolNames: string[];
-    /**
-     * Tools registered but not initially active (defineTool `deferred: true`) — discovered/activated via the built-in
-     * `search_tools` loader.
-     */
-    deferredToolNames: string[];
+    /** Mounted authored tools the model is not given up front, with how each is reached. */
+    indirectTools: IndirectTool[];
     toolCollisions: ToolCollision[];
     toolFailures: ModuleLoadFailure[];
     /** Env vars the MOUNTED tools declared they need, BY TOOL NAME — a discovered tool shadowed by a
@@ -44,6 +49,8 @@ export declare function resolveAgentTools(config: FastagentConfig, agentDir: str
 export declare function piBasePrompt(options?: {
     tools?: MountedTool[];
     persona?: string;
+    /** The {@link BUILTIN_EXTENSIONS} this machine leaves enabled (`Machine.builtinExtensions`); all by default. */
+    builtinExtensions?: readonly string[];
 }): string;
 export interface AssembleSystemPromptOptions {
     /**
@@ -65,6 +72,10 @@ export declare function assembleSystemPrompt(options: AssembleSystemPromptOption
 export interface PiAssembly {
     lease: Lease;
     sessionFactory: PiAgentSessionFactory;
+    /** Extension-aware catalog for startup reporting and control-plane validation; never bound to a session. */
+    modelRuntime: () => Promise<ModelRuntime>;
+    /** A fresh runtime for every session, before loading its extensions. */
+    createModelRuntime: () => Promise<ModelRuntime>;
     /** The registry and configured model, resolved on first use (a credential read is async). */
     engine: () => Promise<{
         modelRuntime: ModelRuntime;
@@ -72,6 +83,12 @@ export interface PiAssembly {
     }>;
     /** The configured reasoning effort — the other half of the pair a session without overrides runs on. */
     thinkingLevel: ThinkingLevel;
+    /** The tools every session mounts. */
+    tools: MountedTool[];
+    /** Pi built-ins the mounted tools leave out, denied in every session so discovery cannot bring them back. */
+    excludedToolNames: readonly string[];
+    /** The prompt and skills a session runs on, read when a session is bound. */
+    readDefinition: PiAgentSessionFactoryOptions["readDefinition"];
     /** The extension entry points every session loads, discovered once with the assembly. */
     extensionPaths: readonly string[];
 }
@@ -98,6 +115,8 @@ export interface CreatePiAgentOptions {
     providers?: Provider[];
     /** Credentials file for stored OAuth/API-key auth (default `GLOBAL_AUTH_PATH`). */
     authPath?: string;
+    /** The caller's own credential store, in place of any file ({@link CredentialSourceOptions}). */
+    credentialStore?: CredentialStore;
     sessions?: PiSessionRecordStore;
     /** Supplies the working directory at L1 (default: process.cwd()), which loads no definition. */
     env?: ExecutionEnv;
@@ -129,6 +148,8 @@ export interface CreatePiAgentFromDefinitionOptions {
      * gets no second layer.
      */
     authPath?: string;
+    /** The caller's own credential store, in place of any file ({@link CredentialSourceOptions}). */
+    credentialStore?: CredentialStore;
     sessions?: PiSessionRecordStore;
     /** Filesystem/process environment; see {@link CreatePiAgentOptions.env}. */
     env?: ExecutionEnv;
@@ -137,20 +158,12 @@ export interface CreatePiAgentFromDefinitionOptions {
     observer?: SessionObserver;
 }
 /**
- * THE model registry an agent directory runs on: pi's built-ins, the directory's own `models.json` (custom endpoints
- * are definition data and travel with the artifact) layered over the machine's `~/.fastagent/models.json` (environment,
- * which does not travel), and any injected Provider instance, over the given credentials.
- * The directory rung assembles from it and `availableModelsFromDir` lists from it, so a layer added here reaches both.
+ * L2, as the value: load the directory (base + AGENTS.md + skills + env) and assemble. `models` is the directory's
+ * model environment when the caller already built it (the opener, whose report must describe what runs); otherwise it
+ * is built here from the credential options.
  */
-export declare function definitionModelRuntime(dir: string, options: FastagentAuthOptions & {
-    auth: AuthLayers;
-    providers?: Provider[];
-}): Promise<ModelRuntime>;
-/** L2, as the value: load the directory (base + AGENTS.md + skills + env) and assemble. */
-export declare function assemblePiFromDefinition(dir: string, 
-/** `auth` is the opener's already-resolved layers, which take the place of `authPath`. */
-options: Omit<CreatePiAgentFromDefinitionOptions, "observer"> & {
-    auth?: AuthLayers;
+export declare function assemblePiFromDefinition(dir: string, options: Omit<CreatePiAgentFromDefinitionOptions, "observer"> & {
+    models?: AgentModels;
 }): Promise<{
     assembly: PiAssembly;
     definition: LoadedDefinition;