@fastagent-sh/fastagent 0.24.4 → 0.26.0

package/dist/engines/pi/login.js

@@ -1,331 +0,0 @@
-/**
- * Signing in to a MODEL PROVIDER, for any front end: {@link login} runs one provider's flow over pi-ai's own
- * `AuthInteraction` and persists the credential through the same {@link fastagentCredentialStore} the runtime reads
- * (one writer, one lock/corruption semantics); {@link loginOptions} is the list a picker offers. `fastagent login` is
- * one front end ({@link loginFlow}: terminal menus, then {@link login}); a GUI client is another.
- */
-import { InMemoryCredentialStore, } from "@earendil-works/pi-ai";
-import { dirname } from "node:path";
-import { SettingsManager } from "@earendil-works/pi-coding-agent";
-import { fastagentCredentialStore } from "./auth.js";
-import { createPiModelRuntime, interactiveAuth, loginProviders, piModelsOver, probeApiKey } from "./models.js";
-import { agentModels } from "./agent-models.js";
-/** The user backed out of a prompt/menu, or the flow was aborted — a decision, not a failure. */
-export class LoginCancelled extends Error {
-}
-/**
- * Every interactive sign-in of pi's built-in providers, with what `credentials` (a credentials file, or the caller's
- * own store) already holds for each. A provider whose key can only come from its env var offers none and is left out.
- */
-export function loginOptions(credentials) {
-    return loginOptionsOver(credentials);
-}
-/** A credentials file path names fastagent's store over it; a store is used as given. */
-const storeOf = (credentials) => typeof credentials === "string" ? fastagentCredentialStore(credentials) : credentials;
-/** {@link loginOptions} over pi's built-ins plus `providers` (a same id replaces one). Not public: a test seam. */
-export async function loginOptionsOver(credentials, providers) {
-    // ONE read of the store: `list` is metadata only, and reading per provider would repeat a corrupt file's warning for
-    // every provider.
-    const held = new Map((await storeOf(credentials).list()).map((info) => [info.providerId, info.type]));
-    const offered = [];
-    for (const provider of loginProviders(providers)) {
-        const methods = ["oauth", "api_key"].filter((method) => interactiveAuth(provider, method));
-        if (methods.length === 0)
-            continue;
-        const stored = held.get(provider.id);
-        for (const method of methods) {
-            offered.push({
-                provider: provider.id,
-                method,
-                label: interactiveAuth(provider, method)?.name ?? provider.name,
-                subscription: method === "oauth" && provider.auth.oauth?.isSubscription === true,
-                ...(stored ? { stored } : {}),
-            });
-        }
-    }
-    return offered;
-}
-/** Combine present abort signals into one (no-op when none/one). */
-function anySignal(...signals) {
-    const present = signals.filter((s) => s !== undefined);
-    return present.length === 0 ? undefined : present.length === 1 ? present[0] : AbortSignal.any(present);
-}
-/**
- * Sign in to one of pi's built-in providers and persist the credential to `authPath`, or to the caller's
- * `credentialStore`.
- *
- * The store is checked FIRST (a no-op write runs the file store's refuse-corrupt and writability checks, or whatever
- * the caller's store does on a write), so a flow never runs toward a credential that could not be saved. An entered API key is verified with one minimal request to pi's
- * default model for the provider (its first model when pi names none), at pi's built-in endpoint, BEFORE it is
- * written. Credentials are provider-scoped, so any of the provider's models answers the question the check asks (does
- * the provider refuse the key, HTTP 401); a key the provider rejects is never stored, and the provider's key flow runs
- * again (the provider and method were not the mistake). Progress and outcome go out through `interaction.notify`.
- * A provider an agent's models.json points elsewhere is not this call's: store that key with `fastagentCredentialStore`.
- *
- * Aborting `interaction.signal` at any point, the verification included, rejects with {@link LoginCancelled} and
- * writes no credential (an OAuth device ID, the installation's identity, is kept once created). Every prompt carries a signal that aborts on it, on the prompt's own signal (a callback server
- * beating a `manual_code` prompt), and when the flow settles with a prompt still pending.
- */
-export function login(request) {
-    return loginOver(request);
-}
-/** {@link login}, plus {@link LoginInternals}. */
-export async function loginOver(request, internals = {}) {
-    const { providers, verifyWith, agentDir } = internals;
-    const { method, interaction } = request;
-    if (request.credentialStore === undefined && typeof request.authPath !== "string") {
-        throw new Error("login needs authPath or credentialStore: where the sign-in is written");
-    }
-    const provider = loginProviders(providers).find((p) => p.id === request.provider);
-    if (!provider)
-        throw new Error(`unknown provider "${request.provider}"`);
-    const auth = interactiveAuth(provider, method);
-    if (!auth?.login)
-        throw new Error(`provider "${provider.id}" has no interactive ${method} login`);
-    const flow = auth.login.bind(auth);
-    // The key under test lives here, not in the file, until it passes.
-    const trial = new InMemoryCredentialStore();
-    // Only a key needs the registry, and building an agent's fails on a broken models.json: an OAuth sign-in must not.
-    // For a key it is built BEFORE the flow, so that failure comes before the person types anything.
-    const models = method !== "api_key"
-        ? undefined
-        : agentDir
-            ? await createPiModelRuntime({
-                agentDir,
-                credentials: trial,
-                ...(providers ? { providers: [...providers] } : {}),
-            })
-            : piModelsOver(trial, providers);
-    const store = agentModels(undefined, request).credentials;
-    await store.modify(provider.id, async () => undefined);
-    const signal = interaction.signal ?? new AbortController().signal;
-    const notify = (event) => interaction.notify(event);
-    let getDeviceId = request.getDeviceId;
-    if (method === "oauth" && !getDeviceId && request.authPath !== undefined) {
-        // Only the settings file beside the credentials: no project's `.pi/settings.json` has a say in this write.
-        const settings = SettingsManager.create(dirname(request.authPath), dirname(request.authPath), {
-            projectTrusted: false,
-        });
-        const deviceId = settings.getOrCreateDeviceId();
-        await settings.flush();
-        const errors = settings.drainErrors();
-        if (errors.length)
-            throw new Error(`could not persist login device ID: ${errors.map(({ error }) => error.message).join("; ")}`);
-        getDeviceId = () => deviceId;
-    }
-    for (;;) {
-        const credential = await runFlow((io) => flow(io, { getDeviceId }), interaction, signal);
-        let verified = "n/a";
-        if (models) {
-            await trial.modify(provider.id, async () => credential);
-            const verdict = await verifyApiKey(models, provider.id, verifyWith, notify, signal);
-            if (signal.aborted)
-                throw new LoginCancelled("cancelled");
-            if (verdict === "rejected")
-                continue;
-            verified = verdict;
-        }
-        await store.modify(provider.id, async () => credential);
-        return { provider: provider.id, method, verified };
-    }
-}
-async function runFlow(flow, interaction, signal) {
-    if (signal.aborted)
-        throw new LoginCancelled("cancelled");
-    const done = new AbortController();
-    let credential;
-    try {
-        credential = await flow({
-            signal,
-            prompt: (prompt) => interaction.prompt({ ...prompt, signal: anySignal(prompt.signal, signal, done.signal) }),
-            notify: (event) => interaction.notify(event),
-        });
-    }
-    catch (error) {
-        // Whatever the provider made of the abort (its own error, a rejected prompt), it was the caller's decision.
-        if (signal.aborted)
-            throw new LoginCancelled("cancelled");
-        throw error;
-    }
-    finally {
-        done.abort();
-    }
-    // A provider that ignored the abort and finished anyway: the caller still cancelled.
-    if (signal.aborted)
-        throw new LoginCancelled("cancelled");
-    return credential;
-}
-/**
- * pi's default model per provider (`defaultModelPerProvider` in pi-coding-agent's model-resolver): the general-purpose
- * model pi itself starts on, so the likeliest to answer a minimal request. COPIED, because pi does not export it;
- * `test/login.test.ts` compares this against pi's own table, so a pi release that changes a default fails there.
- */
-export const PI_DEFAULT_MODELS = {
-    "amazon-bedrock": "us.anthropic.claude-opus-4-6-v1",
-    "ant-ling": "Ring-2.6-1T",
-    anthropic: "claude-opus-4-8",
-    openai: "gpt-5.5",
-    "azure-openai-responses": "gpt-5.4",
-    "openai-codex": "gpt-6.1-sol",
-    radius: "balanced",
-    nvidia: "nvidia/nemotron-3-super-120b-a12b",
-    deepseek: "deepseek-v4-pro",
-    google: "gemini-3.1-pro-preview",
-    "google-vertex": "gemini-3.1-pro-preview",
-    "github-copilot": "gpt-5.4",
-    openrouter: "moonshotai/kimi-k2.6",
-    "vercel-ai-gateway": "zai/glm-5.1",
-    xai: "grok-4.7",
-    groq: "openai/gpt-oss-120b",
-    cerebras: "gpt-oss-120b",
-    zai: "glm-5.3",
-    "zai-coding-cn": "glm-5.3",
-    mistral: "devstral-medium-latest",
-    minimax: "MiniMax-M2.7",
-    "minimax-cn": "MiniMax-M2.7",
-    moonshotai: "kimi-k2.6",
-    "moonshotai-cn": "kimi-k2.6",
-    huggingface: "moonshotai/Kimi-K2.6",
-    fireworks: "accounts/fireworks/models/kimi-k3",
-    together: "moonshotai/Kimi-K3",
-    baseten: "zai-org/GLM-5.2",
-    opencode: "kimi-k2.6",
-    "opencode-go": "kimi-k3",
-    "kimi-coding": "kimi-for-coding",
-    meta: "muse-spark-1.3",
-    "cloudflare-workers-ai": "@cf/moonshotai/kimi-k2.6",
-    "cloudflare-ai-gateway": "workers-ai/@cf/moonshotai/kimi-k2.6",
-    "qwen-token-plan": "qwen3.7-max",
-    "qwen-token-plan-cn": "qwen3.7-max",
-    "qwen-token-plan-individual": "qwen3.8-max",
-    xiaomi: "mimo-v2.5-pro",
-    "xiaomi-token-plan-cn": "mimo-v2.5-pro",
-    "xiaomi-token-plan-ams": "mimo-v2.5-pro",
-    "xiaomi-token-plan-sgp": "mimo-v2.5-pro",
-};
-/** One minimal request with the key under test. */
-async function verifyApiKey(models, providerId, verifyWith, notify, signal) {
-    const chosen = verifyWith?.startsWith(`${providerId}/`)
-        ? models.getModel(providerId, verifyWith.slice(providerId.length + 1))
-        : undefined;
-    const piDefault = PI_DEFAULT_MODELS[providerId];
-    // The provider's first model is the last resort only: catalogs are alphabetical, and a first model can be a
-    // special-purpose one that rejects a minimal request (which still answers the 401 question).
-    const model = chosen ??
-        (piDefault ? models.getModel(providerId, piDefault) : undefined) ??
-        models.getProvider(providerId)?.getModels()[0];
-    if (!model) {
-        notify({
-            type: "info",
-            message: `cannot verify the key: provider "${providerId}" lists no models — kept as entered`,
-        });
-        return "unknown";
-    }
-    const label = `${model.provider}/${model.id}`;
-    notify({ type: "progress", message: `verifying the key with ${label}…` });
-    const probe = await probeApiKey(models, model, signal);
-    if (signal.aborted)
-        return "unknown"; // the caller reports the cancel, not a verdict on the key
-    if (probe.state === "ok") {
-        notify({ type: "info", message: `key verified — ${label} responded` });
-    }
-    else if (probe.state === "rejected") {
-        notify({
-            type: "info",
-            message: `${providerId} rejected the API key (HTTP 401): ${probe.message} — enter it again (or cancel)`,
-        });
-    }
-    else {
-        notify({
-            type: "info",
-            message: `could not verify the key with ${label}: ${probe.message} — kept; invokes surface the provider's error`,
-        });
-    }
-    return probe.state;
-}
-/** {@link LoginIO} as pi-ai's `AuthInteraction`: what {@link login} drives for the terminal. */
-function terminalInteraction(io, signal) {
-    return {
-        ...(signal ? { signal } : {}),
-        prompt: async (p) => {
-            // A select is UNCANCELLABLE here: `LoginIO.select` takes no signal.
-            const v = p.type === "select"
-                ? await io.select(p.message, p.options.map((o) => ({
-                    value: o.id,
-                    label: o.label,
-                    ...(o.description ? { hint: o.description } : {}),
-                })))
-                : await io.prompt(p.message, { hidden: p.type === "secret", ...(p.signal ? { signal: p.signal } : {}) });
-            if (v === undefined)
-                throw new LoginCancelled("cancelled");
-            return v;
-        },
-        notify: (e) => {
-            if (e.type === "auth_url") {
-                io.note(`Open this URL to authorize:\n  ${e.url}`);
-                if (e.instructions)
-                    io.note(e.instructions);
-                io.openUrl(e.url);
-            }
-            else if (e.type === "device_code") {
-                io.note(`Go to ${e.verificationUri} and enter the code:  ${e.userCode}`);
-                io.openUrl(e.verificationUri);
-            }
-            else {
-                io.note(e.message);
-            }
-        },
-    };
-}
-async function selectMethod(io) {
-    const v = await io.select("Authentication method", [
-        { value: "oauth", label: "Use a subscription (OAuth)" },
-        { value: "api_key", label: "Use an API key" },
-    ]);
-    if (v !== "oauth" && v !== "api_key")
-        throw new LoginCancelled("no authentication method selected");
-    return v;
-}
-/**
- * `fastagent login`: ask only what was not given (method, then provider, from {@link loginOptions} with each one's
- * stored credential), then {@link login}.
- */
-export async function loginFlow(io, options) {
-    const offered = await loginOptionsOver(options.authPath, options.providers);
-    let provider = options.provider;
-    let method = options.method;
-    if (provider) {
-        const methods = offered.filter((o) => o.provider === provider).map((o) => o.method);
-        if (methods.length === 0) {
-            const known = loginProviders(options.providers).some((p) => p.id === provider);
-            throw new Error(known
-                ? `provider "${provider}" has no interactive login — set its API key via the provider's env var`
-                : `unknown provider "${provider}"`);
-        }
-        method ??= methods.length > 1 ? await selectMethod(io) : methods[0];
-    }
-    else {
-        const chosenMethod = method ?? (await selectMethod(io));
-        method = chosenMethod;
-        const candidates = offered.filter((o) => o.method === chosenMethod);
-        if (candidates.length === 0)
-            throw new Error(`no provider supports ${chosenMethod} login`);
-        provider = await io.select("Select a provider", candidates.map((o) => ({
-            value: o.provider,
-            label: o.label,
-            ...(o.stored ? { hint: `configured (${o.stored})` } : {}),
-        })));
-        if (!candidates.some((o) => o.provider === provider))
-            throw new LoginCancelled("no provider selected");
-    }
-    return loginOver({
-        provider: provider,
-        method: method,
-        authPath: options.authPath,
-        interaction: terminalInteraction(io, options.signal),
-    }, {
-        ...(options.providers ? { providers: options.providers } : {}),
-        ...(options.verifyWith ? { verifyWith: options.verifyWith } : {}),
-        ...(options.agentDir ? { agentDir: options.agentDir } : {}),
-    });
-}

package/dist/engines/pi/machine.d.ts

@@ -1,53 +0,0 @@
-/**
- * THE MACHINE an agent runs on, as fastagent inherits it: the skills and prompt templates this box provides — found
- * by pi's own Agent Skills discovery, installed pi packages included — and pi's engine settings.
- *
- * An agent inherits its machine the way it already inherits the `PATH`: `bash` runs whatever is installed, and a
- * skill in `~/.pi/agent/skills` is available the same way. Deploying ships the project scope — the workspace — and
- * nothing here is compared against a deployment, the same way nobody is told their local `ffmpeg` is not in the image.
- *
- * READ ONCE per process, like the environment it is. The definition is what stays live (`dev` re-reads it per turn,
- * because it is what an author edits); a skill installed after boot arrives on the next start.
- */
-import { DefaultResourceLoader, SettingsManager } from "@earendil-works/pi-coding-agent";
-/** pi's own shapes, taken from its loader rather than re-declared. */
-export type MachineSkill = ReturnType<DefaultResourceLoader["getSkills"]>["skills"][number];
-export type MachinePrompt = ReturnType<DefaultResourceLoader["getPrompts"]>["prompts"][number];
-/** The Pi built-in extensions a definition loads, each unless the machine's settings disable it. */
-export declare const BUILTIN_EXTENSIONS: readonly ["codemode", "tool-search"];
-/**
- * The way in for an authored tool the model is not given up front, by its exposure: the built-in extension that
- * provides it and the tool that extension registers. A `codemode` tool is called from codemode scripts, a `deferred`
- * one is loaded by tool_search — the rule Pi's MCP extension applies to its own tools (`ensureDiscoveryActive`).
- * Without that extension the tool has no way in at all.
- */
-export declare const DISCOVERY: {
-    readonly codemode: {
-        readonly extension: "codemode";
-        readonly tool: "codemode";
-    };
-    readonly deferred: {
-        readonly extension: "tool-search";
-        readonly tool: "tool_search";
-    };
-};
-/** What this box lends an agent. */
-export interface Machine {
-    skills: MachineSkill[];
-    prompts: MachinePrompt[];
-    /**
-     * The {@link BUILTIN_EXTENSIONS} left enabled, by Pi's own rule: `"extensions": ["-builtin:codemode"]` in the user
-     * settings disables one, and the workspace's `.pi/settings.json` overrides that either way.
-     */
-    builtinExtensions: string[];
-    /** pi's engine settings (retry, compaction, cache warming, …) as read at boot — a fresh manager per caller. */
-    settingsManager(): SettingsManager;
-}
-/** This process's one read of the machine, shared by the run plane and `commands()` so the two cannot disagree. */
-export declare function readMachine(workspace: string): Promise<Machine>;
-/** The definition's names win: vendoring a skill into `skills/` is how an author overrides the machine's. */
-export declare function withMachine<Own extends {
-    name: string;
-}, Lent extends {
-    name: string;
-}>(own: readonly Own[], lent: readonly Lent[]): (Own | Lent)[];

package/dist/engines/pi/machine.js

@@ -1,137 +0,0 @@
-/**
- * THE MACHINE an agent runs on, as fastagent inherits it: the skills and prompt templates this box provides — found
- * by pi's own Agent Skills discovery, installed pi packages included — and pi's engine settings.
- *
- * An agent inherits its machine the way it already inherits the `PATH`: `bash` runs whatever is installed, and a
- * skill in `~/.pi/agent/skills` is available the same way. Deploying ships the project scope — the workspace — and
- * nothing here is compared against a deployment, the same way nobody is told their local `ffmpeg` is not in the image.
- *
- * READ ONCE per process, like the environment it is. The definition is what stays live (`dev` re-reads it per turn,
- * because it is what an author edits); a skill installed after boot arrives on the next start.
- */
-import { DefaultPackageManager, DefaultResourceLoader, SettingsManager, getAgentDir, } from "@earendil-works/pi-coding-agent";
-import { log } from "../../log.js";
-/** The Pi built-in extensions a definition loads, each unless the machine's settings disable it. */
-// Not `mcp`: its server connections live as long as a session, and a served session lives one turn, so every turn
-// would start every configured server.
-export const BUILTIN_EXTENSIONS = ["codemode", "tool-search"];
-/**
- * The way in for an authored tool the model is not given up front, by its exposure: the built-in extension that
- * provides it and the tool that extension registers. A `codemode` tool is called from codemode scripts, a `deferred`
- * one is loaded by tool_search — the rule Pi's MCP extension applies to its own tools (`ensureDiscoveryActive`).
- * Without that extension the tool has no way in at all.
- */
-export const DISCOVERY = {
-    codemode: { extension: "codemode", tool: "codemode" },
-    deferred: { extension: "tool-search", tool: "tool_search" },
-};
-/** Keyed by the two places it reads: the workspace (project scope) and pi's own directory (user scope). */
-const reads = new Map();
-/** This process's one read of the machine, shared by the run plane and `commands()` so the two cannot disagree. */
-export function readMachine(workspace) {
-    // pi's own answer for where its user-level resources live — asked, not spelled, since `PI_CODING_AGENT_DIR` moves it.
-    const agentDir = getAgentDir();
-    const key = `${workspace}\u0000${agentDir}`;
-    const cached = reads.get(key);
-    if (cached)
-        return cached;
-    const reading = read(workspace, agentDir);
-    reads.set(key, reading);
-    return reading;
-}
-async function read(workspace, agentDir) {
-    const files = SettingsManager.create(workspace, agentDir);
-    // pi reads an unparseable or locked settings file as `{}` and keeps the error for whoever asks. Nobody did, so a
-    // trailing comma in `~/.pi/agent/settings.json` — or pi's own TUI holding the lock at that moment — left this whole
-    // process on pi's defaults, silently: the read happens once.
-    for (const { scope, path, error } of files.drainErrors()) {
-        log.warn(`[fastagent] pi ${scope} settings${path ? ` (${path})` : ""} could not be read, so pi's defaults apply: ${error.message}`);
-    }
-    // INSTALLED PACKAGES, NEVER AN INSTALL. pi's loader resolves `packages` itself and installs a missing one
-    // (`npm install`, `git clone`), throwing out of `reload()` when that fails — measured. So fastagent resolves them
-    // here, telling pi to skip what is absent, and hands the loader a packageless copy of the settings so its own
-    // resolve has nothing to do.
-    const manager = new DefaultPackageManager({
-        cwd: workspace,
-        agentDir,
-        settingsManager: files,
-        builtinExtensions: [...BUILTIN_EXTENSIONS],
-    });
-    const packages = await manager.resolve(async () => "skip");
-    // A package skipped is said, once: its skills would otherwise just not be there. Asked of the configured list, not
-    // of `onMissing` — pi never calls that under `PI_OFFLINE`, so the warning would vanish exactly when offline.
-    for (const { source } of manager.listConfiguredPackages().filter((configured) => !configured.installedPath)) {
-        log.warn(`[fastagent] pi package ${source} is not installed, so its skills and prompts are not loaded`);
-    }
-    const settings = {
-        global: withoutPackages(files.getGlobalSettings()),
-        project: withoutPackages(files.getProjectSettings()),
-    };
-    const loader = new DefaultResourceLoader({
-        cwd: workspace,
-        agentDir,
-        settingsManager: scopedSettings(settings),
-        additionalSkillPaths: fromPackages(packages.skills),
-        additionalPromptTemplatePaths: fromPackages(packages.prompts),
-        // The machine's extensions are its owner's setup, not this agent's (agent-session-factory.ts loads only the
-        // definition's own); context files are fastagent's own (segment ②).
-        noExtensions: true,
-        noContextFiles: true,
-    });
-    await loader.reload();
-    const { skills, diagnostics: skillDiagnostics } = loader.getSkills();
-    const { prompts, diagnostics: promptDiagnostics } = loader.getPrompts();
-    // Said once — this is the process's only read. A `SKILL.md` with no description, or a prompt template whose
-    // frontmatter does not parse, is otherwise simply absent.
-    for (const [kind, diagnostics] of [
-        ["skill", skillDiagnostics],
-        ["prompt template", promptDiagnostics],
-    ]) {
-        for (const diagnostic of diagnostics) {
-            log.warn(`[fastagent] ${kind} ${diagnostic.type}: ${diagnostic.message}${diagnostic.path ? ` (${diagnostic.path})` : ""}`);
-        }
-    }
-    // A `/` in a skill's name names the context it comes from (definition.ts), and pi only warns about one. The
-    // machine's own skill spelled that way is left out rather than let collide with a context's.
-    const lent = skills.filter((skill) => {
-        if (!skill.name.includes("/"))
-            return true;
-        log.warn(`[fastagent] machine skill "${skill.name}" (${skill.filePath}) is not loaded: a skill's name may not contain "/", ` +
-            `which names the context a skill comes from`);
-        return false;
-    });
-    const builtinExtensions = packages.extensions
-        .filter((resource) => resource.enabled && resource.metadata.source === "builtin")
-        .map((resource) => resource.path.slice("builtin:".length));
-    return { skills: lent, prompts, builtinExtensions, settingsManager: () => scopedSettings(settings) };
-}
-/** A package's enabled resources; the loader discovers the top-level ones itself. */
-function fromPackages(resources) {
-    return resources.filter((r) => r.enabled && r.metadata.origin === "package").map((r) => r.path);
-}
-function withoutPackages({ packages: _, ...rest }) {
-    return rest;
-}
-/**
- * A SettingsManager over the boot snapshot. TWO scopes, not `SettingsManager.inMemory`'s one: pi deep-merges the
- * project file over the global one (a project `retry.enabled` keeps the global `retry.maxRetries`), and flattening
- * them first would change that. A write stays in memory — a served turn never edits the operator's files.
- */
-function scopedSettings(snapshot) {
-    const stored = {
-        global: JSON.stringify(snapshot.global),
-        project: JSON.stringify(snapshot.project),
-    };
-    return SettingsManager.fromStorage({
-        withLock(scope, fn) {
-            const next = fn(stored[scope]);
-            if (next !== undefined)
-                stored[scope] = next;
-        },
-    });
-}
-/** The definition's names win: vendoring a skill into `skills/` is how an author overrides the machine's. */
-export function withMachine(own, lent) {
-    const names = new Set(own.map((item) => item.name));
-    return [...own, ...lent.filter((item) => !names.has(item.name))];
-}