@bivy/bivy 0.10.1-staging.185 → 0.10.1-staging.186

package/dist/{runtime/pi-auth.js → credentials/api.js}

@@ -1,22 +1,26 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright (c) 2026 Petter André Sjulstad
-// Model-provider auth surface for the daemon (the "Models & providers" screen).
+// The daemon credential API — Bivy's OWN model-provider auth surface (the
+// "Models & providers" screen). This is the one entry every mutation flows
+// through, so the CLI and PWA can't drift.
 //
-// Storage is Bivy's own (credential-store.ts): set / remove / export / import all
-// operate directly on the encrypted vault with no Pi involvement. The one thing
-// that legitimately comes from Pi is the model-provider *catalog* — the list of
-// providers and their display names / OAuth capability — which the isolated
-// pi-oauth bridge supplies (Bivy has no model catalog of its own).
-import { createCredentialVault } from "./credential-store.js";
-import { listPiProviders } from "./pi-oauth.js";
-import { inferReferenceBackend, normalizeLabel, defaultSyncFor, DEFAULT_LABEL, } from "../credentials/records.js";
+// Deliberately Pi-FREE: every function here operates on Bivy's own encrypted
+// vault (credential-store.ts) with zero Pi involvement, so the service compiles
+// and tests without Pi. The one thing that legitimately comes from Pi — the
+// model-provider *catalog* (Bivy has none of its own) — is INJECTED:
+// `joinProviderCatalog` takes the catalog as a parameter, and the thin
+// `runtime/provider-catalog.ts` bridge supplies Pi's. See
+// docs/credentials-service-plan.md §3.1.
+import { createCredentialVault } from "../runtime/credential-store.js";
+import { inferReferenceBackend, normalizeLabel, defaultSyncFor, DEFAULT_LABEL, } from "./records.js";
 /**
- * Enumerate model providers with their current auth status. The catalog + status
- * come from Pi's provider list (joined with our injected store); the stored
- * credential `kind` comes from Bivy's vault.
+ * Join a provider catalog with the vault's stored auth status → the "Models &
+ * providers" rows. Pure w.r.t. Pi: the catalog is passed in (see
+ * `runtime/provider-catalog.ts`, which supplies Pi's). The stored credential
+ * `kind`/`expiresAt` come from Bivy's own vault.
  */
-export async function listProviders(credsDir, piDir) {
-    const [catalog, stored] = await Promise.all([listPiProviders(credsDir, piDir), createCredentialVault(credsDir).list()]);
+export async function joinProviderCatalog(credsDir, catalog) {
+    const stored = await createCredentialVault(credsDir).list();
     const infoById = new Map(stored.map((info) => [info.providerId, info]));
     return catalog.map((provider) => ({
         id: provider.id,

package/dist/credentials/index.js

@@ -22,7 +22,7 @@ export { parsePresets, loadPresets, defaultPresetsPath, PRESETS_FILENAME, parseI
 export { createCredentialVault, migrateVaultDir, preferIncomingCredential, tombstoneWins, BivyCredentialStore, } from "../runtime/credential-store.js";
 // --- The node resolver + agent env representation ---------------------------
 export { createCredentialStore, buildAgentCredentialEnv, apiKeyEnvVar, NodeCredentialResolver, } from "../runtime/credentials.js";
-// --- The daemon credential API (ours — currently named pi-auth.ts) ----------
-// Phase 5 renames the file to `src/credentials/api.ts`; the facade keeps the
-// import path stable so call sites don't churn when it moves.
-export { listProviders, exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, setProviderApiKey, setProviderCredential, setProviderReference, removeProvider, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, } from "../runtime/pi-auth.js";
+// --- The daemon credential API (ours — Pi-free) -----------------------------
+export { exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, setProviderApiKey, setProviderCredential, setProviderReference, removeProvider, listCredentialRecords, setProviderApiKeyLabeled, setProviderReferenceLabeled, removeProviderCredential, joinProviderCatalog, } from "./api.js";
+// --- The Pi-catalog bridge (the one Pi-coupled provider listing) ------------
+export { listProviders } from "../runtime/provider-catalog.js";

package/dist/runtime/provider-catalog.js

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (c) 2026 Petter André Sjulstad
+// The Pi-catalog bridge: the single place the credential API's provider listing
+// is joined with Pi's model-provider catalog.
+//
+// The credential API (src/credentials/api.ts) is deliberately Pi-free and takes
+// the catalog as data (`joinProviderCatalog`). This thin module is the injection
+// point — it fetches Pi's catalog and hands it in. Swapping Pi for a Bivy-owned
+// catalog later is a change here and nowhere else.
+import { listPiProviders } from "./pi-oauth.js";
+import { joinProviderCatalog } from "../credentials/api.js";
+/** Enumerate model providers with their current auth status (catalog from Pi). */
+export async function listProviders(credsDir, piDir) {
+    return joinProviderCatalog(credsDir, await listPiProviders(credsDir, piDir));
+}

package/dist/server.js

@@ -35,7 +35,8 @@ import { decideOAuthLoginSweep } from "./runtime/oauth/oauth-login-sweep.js";
 import { listCodexSessions, loadCodexTranscript } from "./runtime/codex-sessions.js";
 import { dedupeSessionSummaries } from "./session-identity.js";
 import { deriveSessionState } from "./session/session-state.js";
-import { exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, listProviders, removeProvider, setProviderApiKey, setProviderCredential } from "./runtime/pi-auth.js";
+import { exportProviderAuth, exportProviderAuthTombstones, importProviderAuth, removeProvider, setProviderApiKey, setProviderCredential } from "./credentials/api.js";
+import { listProviders } from "./runtime/provider-catalog.js";
 import { loadLocalModels, upsertLocalProvider, removeLocalProviderEntry, listLocalProviderSummaries, exportLocalModels, importLocalModels, toPiModelsConfig, normalizeProviderId, } from "./runtime/local-model-store.js";
 import { execEphemeralRequest } from "./ephemeral-exec.js";
 import { ApprovalManager } from "./approval.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.185",
+  "version": "0.10.1-staging.186",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",