@vymalo/opencode-lightbridge 0.14.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vymalo contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,85 @@
+# `@vymalo/opencode-lightbridge`
+
+[![npm](https://img.shields.io/npm/v/@vymalo/opencode-lightbridge?label=npm&color=CB3837&logo=npm)](https://www.npmjs.com/package/@vymalo/opencode-lightbridge)
+
+**One login, every egress.** The umbrella OpenCode plugin for [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md):
+a single shared `TokenRuntime` drives **both** the LLM gateway bearer and the OTEL export
+credential, because both validate the same `lightbridge-authz` issuer + `aud=lightbridge-api-key`.
+Log in once as yourself; every egress that needs a project-scoped credential rides the same token.
+
+Part of the [OpenCode Toolbelt](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit).
+
+## Why this instead of `opencode-repo-auth` + `opencode-otel`
+
+Running both standalone plugins works, but each holds its **own** credential in its **own** cache
+namespace — two logins, two token stores, no relationship between them. `@vymalo/opencode-lightbridge`
+composes `@vymalo/opencode-auth-core` (the OAuth/token-exchange primitive) and
+`@vymalo/opencode-core-otel` (the OTel engine) over **one** `TokenRuntime`, so the project-scoped
+token minted for the gateway is the exact same token OTEL presents to the collector. No forked
+engine logic — this package is a thin composition layer over its two sibling libraries.
+
+## Install
+
+```sh
+npm install @vymalo/opencode-lightbridge
+```
+
+```jsonc
+// opencode.json
+{
+  "plugin": [
+    ["@vymalo/opencode-lightbridge", {
+      "auth": {
+        "id": "lightbridge",
+        "issuer": "https://authz.example.com/realms/lightbridge",
+        "clientId": "opencode-cli",
+        "scopes": ["openid", "offline_access"],
+        "authFlow": "device_code"
+      },
+      "gateway": {
+        "projectId": "proj-123",
+        "providers": ["gateway"]
+      },
+      "otel": {
+        "endpoint": "http://localhost:4318"
+      }
+    }]
+  ]
+}
+```
+
+- **`auth`** (required) — the one IdP login, an `AuthServerConfigInput` (same shape as
+  `opencode-oauth2`/`opencode-repo-auth`'s per-provider auth block).
+- **`gateway`** (optional) — the OpenCode provider ids to inject `Authorization: Bearer
+  <project-token>` on, per request (plus an optional `projectId`).
+- **`otel`** (optional) — the same `OtelPluginOptions` shape as `@vymalo/opencode-otel`
+  (`endpoint`, `exporters`, `serviceName`, …), minus `tokenCommand`/`tokenHeader`/`tokenPrefix`: the
+  shared runtime supersedes that seam entirely.
+- **`projectId`** (optional, top-level or under `gateway`) — **fully optional**: omit it and the
+  exchange sends no `project_id`, so the backend mints a token for your **default project**. An
+  explicit top-level `projectId` wins over `gateway.projectId`.
+
+Omitting both `gateway` and `otel` is a valid, inert config — the plugin logs and no-ops.
+
+## Scope: gateway + OTEL, not MCP
+
+MCP is deliberately out of scope. OpenCode mints its own per-server MCP OAuth token into
+`mcp-auth.json`, and `McpRemoteConfig.headers` is a static map with no per-request hook — sharing
+this plugin's credential there would need a stdio credential-proxy sidecar, which isn't worth the
+complexity today. MCP keeps using OpenCode's native per-server OAuth. See
+[ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md)
+for the full reasoning.
+
+## Full reference
+
+- [`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md)
+  — the one-credential design, full config reference, the three egresses.
+- [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md)
+  — why one runtime, why MCP is excluded, the alternatives considered.
+- [`docs/repo-auth.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/repo-auth.md)
+  and [`docs/otel.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/otel.md)
+  — the two standalone plugins this package composes; useful for the config shapes it reuses.
+
+## License
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,55 @@
+import { type AuthServerConfig, type AuthServerConfigInput } from "@vymalo/opencode-auth-core/lib";
+import type { OtelPluginOptions } from "@vymalo/opencode-core-otel";
+/** The `gateway` opt-in: which providers get the shared project bearer. */
+export interface LightbridgeGatewayOptions {
+	/** OpenCode provider ids to inject `Authorization: Bearer <project-token>` on. */
+	providers: string[];
+	/**
+	* Optional project id for the shared RFC 8693 exchange (ADR-0012). When
+	* omitted, the exchange sends no `project_id` and the backend mints a token
+	* for the caller's **default project**.
+	*/
+	projectId?: string;
+}
+/**
+* Plugin options as written under the `opencode-lightbridge` entry of
+* `plugin` in `opencode.json` (or served through `.well-known/opencode`).
+* `auth` is the one IdP login every egress rides on; `gateway` and `otel` are
+* each independently optional — omitting both is a valid, inert config (the
+* plugin logs and no-ops). See ADR-0012.
+*/
+export interface LightbridgeOptions {
+	auth: AuthServerConfigInput;
+	gateway?: LightbridgeGatewayOptions;
+	otel?: OtelPluginOptions;
+	/**
+	* Optional project id for the shared project-scoped token exchange. Fully
+	* optional: when omitted, the exchange sends no `project_id` and the backend
+	* mints a token for the caller's **default project**. An explicit `projectId`
+	* here wins over `gateway.projectId` when both are set.
+	*/
+	projectId?: string;
+}
+/** `LightbridgeOptions` after parsing: `auth` fully validated + defaulted. */
+export interface ParsedLightbridgeOptions {
+	auth: AuthServerConfig;
+	gateway?: LightbridgeGatewayOptions;
+	otel?: OtelPluginOptions;
+	/** Resolved project id (`projectId` ?? `gateway.projectId`), if either was set. */
+	projectId?: string;
+}
+/**
+* Parse + validate the plugin's `pluginOptions` (2nd factory arg). `auth` is
+* required and validated eagerly via auth-core's `validateAuthConfig` so a
+* malformed IdP block fails fast with a field-level error — mirroring
+* repo-auth/oauth2. `gateway` and `otel` are each optional and independently
+* activate their module (see `opencode.ts`); an only-`auth` config is valid
+* and inert.
+*/
+export declare function parseLightbridgeOptions(raw: unknown): ParsedLightbridgeOptions;
+/**
+* Whether the parsed config has a module (gateway or otel) that needs the
+* shared token — project-scoped when `projectId` is set, else a default-project
+* token. Determines whether the one shared runtime is built.
+*/
+export declare function needsProjectToken(options: ParsedLightbridgeOptions): boolean;

package/dist/config.js

@@ -0,0 +1,78 @@
+import { validateAuthConfig } from "@vymalo/opencode-auth-core/lib";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asNonEmptyString(value, path) {
+	if (typeof value !== "string" || value.trim().length === 0) {
+		throw new Error(`${path} must be a non-empty string`);
+	}
+	return value.trim();
+}
+function asProviderList(value, path) {
+	if (!Array.isArray(value) || value.length === 0) {
+		throw new Error(`${path} must be a non-empty array of provider ids`);
+	}
+	return value.map((entry, index) => asNonEmptyString(entry, `${path}[${index}]`));
+}
+function parseGateway(raw, path) {
+	if (raw === undefined || raw === null) {
+		return undefined;
+	}
+	if (!isRecord(raw)) {
+		throw new Error(`${path} must be an object with \`providers\` (and an optional \`projectId\`)`);
+	}
+	const projectId = raw.projectId === undefined || raw.projectId === null ? undefined : asNonEmptyString(raw.projectId, `${path}.projectId`);
+	return {
+		providers: asProviderList(raw.providers, `${path}.providers`),
+		...projectId ? { projectId } : {}
+	};
+}
+function parseOtel(raw, path) {
+	if (raw === undefined || raw === null) {
+		return undefined;
+	}
+	if (!isRecord(raw)) {
+		throw new Error(`${path} must be an object (OtelPluginOptions)`);
+	}
+	// Deep validation of the otel block itself is `resolveOtelConfig`'s job
+	// (it never throws — malformed/missing fields fall back to defaults); this
+	// parser only guards the block's own shape.
+	return raw;
+}
+/**
+* Parse + validate the plugin's `pluginOptions` (2nd factory arg). `auth` is
+* required and validated eagerly via auth-core's `validateAuthConfig` so a
+* malformed IdP block fails fast with a field-level error — mirroring
+* repo-auth/oauth2. `gateway` and `otel` are each optional and independently
+* activate their module (see `opencode.ts`); an only-`auth` config is valid
+* and inert.
+*/
+export function parseLightbridgeOptions(raw) {
+	if (!isRecord(raw)) {
+		throw new Error("@vymalo/opencode-lightbridge options must be an object with at least an `auth` block");
+	}
+	if (!isRecord(raw.auth)) {
+		throw new Error("lightbridge.auth is required and must be an object (AuthServerConfigInput)");
+	}
+	const auth = validateAuthConfig(raw.auth);
+	const gateway = parseGateway(raw.gateway, "lightbridge.gateway");
+	const otel = parseOtel(raw.otel, "lightbridge.otel");
+	const explicitProjectId = typeof raw.projectId === "string" && raw.projectId.trim().length > 0 ? raw.projectId.trim() : undefined;
+	const projectId = explicitProjectId ?? gateway?.projectId;
+	return {
+		auth,
+		gateway,
+		otel,
+		projectId
+	};
+}
+/**
+* Whether the parsed config has a module (gateway or otel) that needs the
+* shared token — project-scoped when `projectId` is set, else a default-project
+* token. Determines whether the one shared runtime is built.
+*/
+export function needsProjectToken(options) {
+	return Boolean(options.gateway) || Boolean(options.otel);
+}
+
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SACE,0BAGK;AA4CP,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,MAAsB;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CACtD;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,SAAS,eAAe,OAAgB,MAAwB;CAC9D,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;EAC/C,MAAM,IAAI,MAAM,GAAG,KAAK,2CAA2C;CACrE;CACA,OAAO,MAAM,KAAK,OAAO,UAAU,iBAAiB,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AACjF;AAEA,SAAS,aAAa,KAAc,MAAqD;CACvF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,sEAAsE;CAChG;CACA,MAAM,YACJ,IAAI,cAAc,aAAa,IAAI,cAAc,OAC7C,YACA,iBAAiB,IAAI,WAAW,GAAG,KAAK,WAAW;CACzD,OAAO;EACL,WAAW,eAAe,IAAI,WAAW,GAAG,KAAK,WAAW;EAC5D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;AAEA,SAAS,UAAU,KAAc,MAA6C;CAC5E,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,uCAAuC;CACjE;;;;CAIA,OAAO;AACT;;;;;;;;;AAUA,OAAO,SAAS,wBAAwB,KAAwC;CAC9E,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MACR,sFACF;CACF;CACA,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG;EACvB,MAAM,IAAI,MAAM,4EAA4E;CAC9F;CAEA,MAAM,OAAO,mBAAmB,IAAI,IAAwC;CAC5E,MAAM,UAAU,aAAa,IAAI,SAAS,qBAAqB;CAC/D,MAAM,OAAO,UAAU,IAAI,MAAM,kBAAkB;CAEnD,MAAM,oBACJ,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS,IAC/D,IAAI,UAAU,KAAK,IACnB;CACN,MAAM,YAAY,qBAAqB,SAAS;CAEhD,OAAO;EAAE;EAAM;EAAS;EAAM;CAAU;AAC1C;;;;;;AAOA,OAAO,SAAS,kBAAkB,SAA4C;CAC5E,OAAO,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,IAAI;AACzD","names":[],"sources":["../src/config.ts"],"version":3,"file":"config.js","sourceRoot":""}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { default } from "./opencode.js";

package/dist/index.js

@@ -0,0 +1,7 @@
+// Intentionally tiny. OpenCode iterates every named export of the main entry
+// and rejects anything that isn't a `Plugin` function, so the only thing this
+// module exposes is the default plugin. Library/utility exports live in
+// `./lib` (see lib.ts), which OpenCode never inspects.
+export { default } from "./opencode.js";
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"mappings":";;;;AAIA,SAAS,eAAe","names":[],"sources":["../src/index.ts"],"version":3,"file":"index.js","sourceRoot":""}

package/dist/lib.d.ts

@@ -0,0 +1,3 @@
+export { createLightbridgePlugin, LightbridgePlugin, type LightbridgePluginFactoryOptions } from "./opencode.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, lightbridgeCacheDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
+export { parseLightbridgeOptions, needsProjectToken, type LightbridgeGatewayOptions, type LightbridgeOptions, type ParsedLightbridgeOptions } from "./config.js";

package/dist/lib.js

@@ -0,0 +1,5 @@
+export { createLightbridgePlugin, LightbridgePlugin } from "./opencode.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, lightbridgeCacheDir } from "./plugin.js";
+export { parseLightbridgeOptions, needsProjectToken } from "./config.js";
+
+//# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SACE,yBACA,yBAEK;AAEP,SACE,oBACA,sBACA,yBACA,qBACA,2BAIK;AAEP,SACE,yBACA,yBAIK","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}

package/dist/opencode.d.ts

@@ -0,0 +1,49 @@
+import type { Hooks, Plugin } from "@opencode-ai/plugin";
+import { type Logger } from "@vymalo/opencode-auth-core/lib";
+import { type EnvSource, type ExporterFactories } from "@vymalo/opencode-core-otel";
+import { type LightbridgeRuntimeFactory } from "./plugin.js";
+type OpenCodeConfig = Parameters<NonNullable<Hooks["config"]>>[0];
+export interface LightbridgePluginFactoryOptions {
+	logger?: Logger;
+	/** Shared-runtime HTTP client (auth-core `TokenRuntime`). Tests only. */
+	fetchImpl?: typeof fetch;
+	onAuthorizationUrl?: (url: string) => Promise<void> | void;
+	/** Override the shared-runtime cache root (defaults to the OS cache dir). */
+	cacheDir?: string;
+	tokenExpirySkewMs?: number;
+	/**
+	* Build the shared `LightbridgeRuntimeLike` for `(auth, projectId)`.
+	* Defaults to a real `LightbridgeRuntime`; tests substitute a spy/fake so
+	* neither module ever touches the network.
+	*/
+	runtimeFactory?: LightbridgeRuntimeFactory;
+	/** Injected environment; defaults to `process.env`. */
+	env?: EnvSource;
+	/** Substitute exporters (tests use in-memory ones). */
+	exporters?: ExporterFactories;
+	/** Injectable clock; defaults to `Date.now`. */
+	now?: () => number;
+	/** Skip `beforeExit`/`SIGINT`/`SIGTERM` registration (tests). */
+	registerProcessHandlers?: boolean;
+	/** Override the resolved host metadata (hostname, version) for tests. */
+	hostInfo?: {
+		hostname?: string;
+		version?: string;
+	};
+	/** How long a deferred resource attribute waits for its event. */
+	deferredTimeoutMs?: number;
+}
+/**
+* Create the `@vymalo/opencode-lightbridge` umbrella plugin (ADR-0012): ONE
+* shared `TokenRuntime`, built once from `auth`, drives both the gateway
+* bearer (`gateway`) and the OTEL export credential (`otel`) — each module
+* activates independently, and an `auth`-only config is a valid, inert
+* plugin. `config` runs both modules' config-time logic (host log level +
+* OTEL trace propagation); `chat.headers` is the gateway injector;
+* `event`/`chat.message`/`tool.execute.*`/`chat.params`/`permission.ask`/
+* `experimental.*` are the OTEL observers.
+*/
+export declare function createLightbridgePlugin(factoryOptions?: LightbridgePluginFactoryOptions): Plugin;
+export declare const LightbridgePlugin: Plugin;
+export default LightbridgePlugin;
+export type { OpenCodeConfig };

package/dist/opencode.js

@@ -0,0 +1,283 @@
+import { hostname } from "node:os";
+import { createJsonConsoleLogger, DEFAULT_LOG_LEVEL, LOG_LEVEL_PRIORITY } from "@vymalo/opencode-auth-core/lib";
+import { buildResource, createProviders, deferredAttribute, describeError, fromOpenCodeLogLevel, installTracePropagation, readVcsInfo, resolveOtelConfig, TelemetryRecorder } from "@vymalo/opencode-core-otel";
+import { needsProjectToken, parseLightbridgeOptions } from "./config.js";
+import { LightbridgeRuntime } from "./plugin.js";
+const PLUGIN_SERVICE_NAME = "opencode-lightbridge-plugin";
+/**
+* Pipe plugin logs through OpenCode's `client.app.log`, JSON console as
+* fallback. Mirrors every other plugin in the suite.
+*/
+function createOpenCodeLogger(client, getMinLevel) {
+	const fallback = createJsonConsoleLogger("debug");
+	const consoleAll = /^(1|true|yes|on)$/i.test(process.env.VYMALO_PLUGIN_CONSOLE_LOG ?? "");
+	const write = (level, event, fields) => {
+		if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[getMinLevel()]) {
+			return;
+		}
+		if (consoleAll || level === "warn" || level === "error") {
+			fallback[level](event, fields);
+		}
+		const hostLevel = level === "trace" ? "debug" : level;
+		void client.app.log({ body: {
+			service: PLUGIN_SERVICE_NAME,
+			level: hostLevel,
+			message: event,
+			extra: fields
+		} }).catch(() => {
+			// best-effort forwarding; console logger is the reliable fallback.
+		});
+	};
+	return {
+		trace: (event, fields) => write("trace", event, fields),
+		debug: (event, fields) => write("debug", event, fields),
+		info: (event, fields) => write("info", event, fields),
+		warn: (event, fields) => write("warn", event, fields),
+		error: (event, fields) => write("error", event, fields)
+	};
+}
+function safeHostname() {
+	try {
+		return hostname() || undefined;
+	} catch {
+		return undefined;
+	}
+}
+/**
+* Drain buffered telemetry on process exit — same rationale as
+* `@vymalo/opencode-otel`'s `registerExitHandlers`: the plugin API has no
+* dispose hook, so without this a short CLI invocation loses everything still
+* in a batch processor.
+*/
+function registerExitHandlers(providers, logger, deferred) {
+	let done = false;
+	const drain = () => {
+		if (done) {
+			return;
+		}
+		done = true;
+		for (const attribute of deferred) {
+			attribute.abandon();
+		}
+		void providers.shutdown().catch((error) => {
+			logger.warn("lightbridge_otel_shutdown_failed", { error: describeError(error) });
+		});
+	};
+	process.once("beforeExit", drain);
+	process.once("SIGINT", drain);
+	process.once("SIGTERM", drain);
+}
+/**
+* Build the umbrella's `TokenSource` for `createProviders`'s 5th argument: an
+* async factory over the SHARED runtime, superseding otel's standalone
+* `tokenCommand` path entirely (ADR-0012 — one credential, not two seams).
+* Never throws — the OTLP exporters require that of every `headers()` call —
+* so an exchange failure degrades to an unauthenticated export, which the
+* collector then rejects (fail closed, same posture as the gateway header).
+*/
+function createRuntimeTokenSource(runtime) {
+	return {
+		headers: async () => {
+			try {
+				const token = await runtime.getProjectToken({ interactive: false });
+				return { Authorization: `${token.tokenType || "Bearer"} ${token.accessToken}` };
+			} catch {
+				return {};
+			}
+		},
+		// v1: no-op. The project token is short-lived and `getProjectToken`
+		// re-exchanges on its own expiry check every call — there is no stale
+		// in-memory copy for `invalidate` to drop, unlike the credential-helper
+		// `TokenSource` this replaces. See ADR-0012.
+		invalidate: () => {}
+	};
+}
+/**
+* Build the gateway's `chat.headers` hook: inject the shared project bearer
+* on `gateway.providers` only, fail closed on any exchange error (mirrors
+* `@vymalo/opencode-repo-auth`'s `chat.headers`).
+*/
+function createGatewayChatHeaders(providers, runtime, logger) {
+	return async (input, output) => {
+		const providerId = input.model?.providerID ?? input.provider?.info?.id;
+		if (!providerId || !providers.has(providerId)) {
+			logger.trace("lightbridge_gateway_chat_headers_skipped", { providerId });
+			return;
+		}
+		try {
+			const token = await runtime.getProjectToken({ interactive: true });
+			output.headers.Authorization = `${token.tokenType || "Bearer"} ${token.accessToken}`;
+			logger.trace("lightbridge_gateway_bearer_injected", { providerId });
+		} catch {
+			logger.trace("lightbridge_gateway_no_bearer", { providerId });
+		}
+	};
+}
+/**
+* Build the OTEL module: resource, providers (with the runtime-backed
+* `TokenSource` when a shared runtime is available), recorder and exit
+* handlers. Mirrors `@vymalo/opencode-otel`'s `createOtelPlugin` orchestration
+* verbatim, minus the standalone `tokenCommand` seam.
+*/
+async function buildOtelModule(input, otelConfig, logger, factoryOptions, runtime) {
+	const version = deferredAttribute(factoryOptions.deferredTimeoutMs);
+	const branch = deferredAttribute(factoryOptions.deferredTimeoutMs);
+	if (factoryOptions.hostInfo?.version) {
+		version.settle(factoryOptions.hostInfo.version);
+	}
+	const vcs = otelConfig.collectVcs ? await readVcsInfo(input.worktree ?? input.directory).catch(() => ({})) : {};
+	if (vcs.ref) {
+		branch.settle(vcs.ref);
+	}
+	const resource = buildResource(otelConfig, {
+		version: version.value,
+		hostname: factoryOptions.hostInfo?.hostname ?? safeHostname(),
+		projectName: input.project?.id,
+		directory: input.directory,
+		worktree: input.worktree,
+		branch: branch.value,
+		vcs
+	});
+	const tokenSource = runtime ? createRuntimeTokenSource(runtime) : undefined;
+	const providers = createProviders(otelConfig, resource, logger, factoryOptions.exporters, tokenSource);
+	const recorder = new TelemetryRecorder({
+		providers,
+		config: otelConfig,
+		logger,
+		now: factoryOptions.now,
+		resourceSinks: {
+			version: (value) => version.settle(value),
+			branch: (value) => branch.settle(value)
+		}
+	});
+	if (factoryOptions.registerProcessHandlers !== false) {
+		registerExitHandlers(providers, logger, [version, branch]);
+	}
+	logger.info("lightbridge_otel_enabled", {
+		serviceName: otelConfig.serviceName,
+		exporters: otelConfig.exporters,
+		endpoint: otelConfig.endpoint,
+		runtimeBackedTokenSource: Boolean(tokenSource)
+	});
+	return {
+		config: otelConfig,
+		recorder
+	};
+}
+function registerOtelHooks(hooks, otel) {
+	const { recorder } = otel;
+	hooks.event = async ({ event }) => {
+		recorder.onEvent(event);
+	};
+	hooks["chat.message"] = async (chatInput, chatOutput) => {
+		recorder.onChatMessage(chatInput, chatOutput);
+	};
+	hooks["tool.execute.before"] = async (toolInput) => {
+		recorder.onToolBefore(toolInput);
+	};
+	hooks["tool.execute.after"] = async (toolInput, toolOutput) => {
+		recorder.onToolAfter(toolInput, toolOutput);
+	};
+	hooks["chat.params"] = async (paramsInput, paramsOutput) => {
+		recorder.onChatParams(paramsInput, paramsOutput);
+	};
+	hooks["permission.ask"] = async (permissionInput, permissionOutput) => {
+		recorder.onPermissionAsk(permissionInput, permissionOutput);
+	};
+	hooks["experimental.text.complete"] = async (textInput, textOutput) => {
+		recorder.onTextComplete(textInput, textOutput);
+	};
+	hooks["experimental.compaction.autocontinue"] = async (compactionInput, compactionOutput) => {
+		recorder.onCompactionAutocontinue(compactionInput, compactionOutput);
+	};
+}
+/**
+* Create the `@vymalo/opencode-lightbridge` umbrella plugin (ADR-0012): ONE
+* shared `TokenRuntime`, built once from `auth`, drives both the gateway
+* bearer (`gateway`) and the OTEL export credential (`otel`) — each module
+* activates independently, and an `auth`-only config is a valid, inert
+* plugin. `config` runs both modules' config-time logic (host log level +
+* OTEL trace propagation); `chat.headers` is the gateway injector;
+* `event`/`chat.message`/`tool.execute.*`/`chat.params`/`permission.ask`/
+* `experimental.*` are the OTEL observers.
+*/
+export function createLightbridgePlugin(factoryOptions = {}) {
+	return async (input, pluginOptions) => {
+		let currentLogLevel = DEFAULT_LOG_LEVEL;
+		const logger = factoryOptions.logger ?? createOpenCodeLogger(input.client, () => currentLogLevel);
+		let parsed;
+		try {
+			parsed = parseLightbridgeOptions(pluginOptions);
+		} catch (error) {
+			// A malformed config must not take down every other plugin's load —
+			// log and return inert hooks rather than throwing out of the factory.
+			logger.error("lightbridge_config_invalid", { error: describeError(error) });
+			return { config: async (hostConfig) => {
+				currentLogLevel = fromOpenCodeLogLevel(hostConfig.logLevel) ?? DEFAULT_LOG_LEVEL;
+			} };
+		}
+		const wantsProjectToken = needsProjectToken(parsed);
+		if (wantsProjectToken && !parsed.projectId) {
+			// `projectId` is fully optional — the exchange omits `project_id` and the
+			// backend mints a token for the caller's default project (ADR-0012).
+			logger.info("lightbridge_default_project", {
+				gateway: Boolean(parsed.gateway),
+				otel: Boolean(parsed.otel)
+			});
+		}
+		// The ONE shared runtime (ADR-0012) — constructed exactly once whenever a
+		// module (gateway/otel) needs a token, reused by both the gateway injector
+		// and the OTEL token source below. `projectId` is optional (undefined →
+		// default project). `undefined` runtime only for an auth-only config.
+		const buildRuntime = factoryOptions.runtimeFactory ?? ((auth, pid, options) => new LightbridgeRuntime(auth, pid, options));
+		const sharedRuntime = wantsProjectToken ? buildRuntime(parsed.auth, parsed.projectId, {
+			logger,
+			fetchImpl: factoryOptions.fetchImpl,
+			onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
+			cacheDir: factoryOptions.cacheDir,
+			tokenExpirySkewMs: factoryOptions.tokenExpirySkewMs
+		}) : undefined;
+		const hooks = {};
+		// ---- gateway module ----
+		// `sharedRuntime` is always defined here: it is built whenever `gateway`
+		// or `otel` is configured (`wantsProjectToken`).
+		if (parsed.gateway && sharedRuntime) {
+			hooks["chat.headers"] = createGatewayChatHeaders(new Set(parsed.gateway.providers), sharedRuntime, logger);
+		}
+		// ---- otel module ----
+		let otel;
+		if (parsed.otel) {
+			const otelConfig = resolveOtelConfig(parsed.otel, factoryOptions.env ?? process.env);
+			if (otelConfig.active) {
+				otel = await buildOtelModule(input, otelConfig, logger, factoryOptions, sharedRuntime);
+				registerOtelHooks(hooks, otel);
+			} else {
+				logger.info("lightbridge_otel_inactive", {
+					enabled: otelConfig.enabled,
+					reason: otelConfig.enabled ? "no_exporter_configured" : "disabled"
+				});
+			}
+		}
+		hooks.config = async (hostConfig) => {
+			currentLogLevel = fromOpenCodeLogLevel(hostConfig.logLevel) ?? DEFAULT_LOG_LEVEL;
+			if (otel?.config.propagateTraceContext) {
+				const activeOtel = otel;
+				const wrapped = installTracePropagation(hostConfig, {
+					getContext: () => activeOtel.recorder.currentChatContext(),
+					logger
+				});
+				logger.debug("lightbridge_otel_trace_propagation_ready", { providerCount: wrapped });
+			}
+		};
+		logger.info("lightbridge_plugin_ready", {
+			gateway: Boolean(hooks["chat.headers"]),
+			otel: Boolean(otel),
+			projectId: parsed.projectId ?? (wantsProjectToken ? "(default)" : undefined)
+		});
+		return hooks;
+	};
+}
+export const LightbridgePlugin = createLightbridgePlugin();
+export default LightbridgePlugin;
+
+//# sourceMappingURL=opencode.js.map

package/dist/opencode.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SAAS,gBAAgB;AAIzB,SACE,yBACA,mBACA,0BAKK;AAEP,SACE,eACA,iBACA,mBACA,eACA,sBACA,yBACA,aACA,mBACA,yBASK;AAEP,SACE,mBACA,+BAEK;AACP,SACE,0BAIK;AAEP,MAAM,sBAAsB;;;;;AAsC5B,SAAS,qBAAqB,QAA+B,aAAqC;CAChG,MAAM,WAAW,wBAAwB,OAAO;CAChD,MAAM,aAAa,qBAAqB,KAAK,QAAQ,IAAI,6BAA6B,EAAE;CAExF,MAAM,SAAS,OAAiB,OAAe,WAAuB;EACpE,IAAI,mBAAmB,SAAS,mBAAmB,YAAY,IAAI;GACjE;EACF;EACA,IAAI,cAAc,UAAU,UAAU,UAAU,SAAS;GACvD,SAAS,MAAM,CAAC,OAAO,MAAM;EAC/B;EACA,MAAM,YAAY,UAAU,UAAU,UAAU;EAChD,KAAK,OAAO,IACT,IAAI,EACH,MAAM;GAAE,SAAS;GAAqB,OAAO;GAAW,SAAS;GAAO,OAAO;EAAO,EACxF,CAAC,CAAC,CACD,YAAY;;EAEb,CAAC;CACL;CAEA,OAAO;EACL,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;CACxD;AACF;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;AAQA,SAAS,qBACP,WACA,QACA,UACM;CACN,IAAI,OAAO;CACX,MAAM,cAAc;EAClB,IAAI,MAAM;GACR;EACF;EACA,OAAO;EACP,KAAK,MAAM,aAAa,UAAU;GAChC,UAAU,QAAQ;EACpB;EACA,KAAK,UAAU,SAAS,CAAC,CAAC,OAAO,UAAU;GACzC,OAAO,KAAK,oCAAoC,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;EACjF,CAAC;CACH;CACA,QAAQ,KAAK,cAAc,KAAK;CAChC,QAAQ,KAAK,UAAU,KAAK;CAC5B,QAAQ,KAAK,WAAW,KAAK;AAC/B;;;;;;;;;AAUA,SAAS,yBAAyB,SAA8C;CAC9E,OAAO;EACL,SAAS,YAA6C;GACpD,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,MAAM,CAAC;IAClE,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,QAAQ;IACN,OAAO,CAAC;GACV;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;AAOA,SAAS,yBACP,WACA,SACA,QACoC;CACpC,OAAO,OAAO,OAAO,WAAW;EAC9B,MAAM,aAAa,MAAM,OAAO,cAAc,MAAM,UAAU,MAAM;EACpE,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,UAAU,GAAG;GAC7C,OAAO,MAAM,4CAA4C,EAAE,WAAW,CAAC;GACvE;EACF;EACA,IAAI;GACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,KAAK,CAAC;GACjE,OAAO,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;GACvE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;EACpE,QAAQ;GACN,OAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC;EAC9D;CACF;AACF;;;;;;;AAaA,eAAe,gBACb,OACA,YACA,QACA,gBACA,SACqB;CACrB,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,MAAM,YAAY,MAAM,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACrE,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,MAAM,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,OAAO,IAAI;CAClE,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;EACpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,CAAC;CAC3D;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;CAAS;AACxC;AAEA,SAAS,kBAAkB,OAAc,MAAwB;CAC/D,MAAM,EAAE,aAAa;CACrB,MAAM,QAAQ,OAAO,EAAE,YAAY;EACjC,SAAS,QAAQ,KAAK;CACxB;CACA,MAAM,kBAAkB,OAAO,WAAW,eAAe;EACvD,SAAS,cAAc,WAAW,UAAU;CAC9C;CACA,MAAM,yBAAyB,OAAO,cAAc;EAClD,SAAS,aAAa,SAAS;CACjC;CACA,MAAM,wBAAwB,OAAO,WAAW,eAAe;EAC7D,SAAS,YAAY,WAAW,UAAU;CAC5C;CACA,MAAM,iBAAiB,OAAO,aAAa,iBAAiB;EAC1D,SAAS,aAAa,aAAa,YAAY;CACjD;CACA,MAAM,oBAAoB,OAAO,iBAAiB,qBAAqB;EACrE,SAAS,gBAAgB,iBAAiB,gBAAgB;CAC5D;CACA,MAAM,gCAAgC,OAAO,WAAW,eAAe;EACrE,SAAS,eAAe,WAAW,UAAU;CAC/C;CACA,MAAM,0CAA0C,OAAO,iBAAiB,qBAAqB;EAC3F,SAAS,yBAAyB,iBAAiB,gBAAgB;CACrE;AACF;;;;;;;;;;;AAYA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GAC3C;CACR,OAAO,OAAO,OAAoB,kBAAkC;EAClE,IAAI,kBAA4B;EAChC,MAAM,SACJ,eAAe,UAAU,qBAAqB,MAAM,cAAc,eAAe;EAEnF,IAAI;EACJ,IAAI;GACF,SAAS,wBAAwB,aAAa;EAChD,SAAS,OAAO;;;GAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;GAC1E,OAAO,EACL,QAAQ,OAAO,eAA+B;IAC5C,kBAAkB,qBAAqB,WAAW,QAAQ,KAAK;GACjE,EACF;EACF;EAEA,MAAM,oBAAoB,kBAAkB,MAAM;EAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;GAG1C,OAAO,KAAK,+BAA+B;IACzC,SAAS,QAAQ,OAAO,OAAO;IAC/B,MAAM,QAAQ,OAAO,IAAI;GAC3B,CAAC;EACH;;;;;EAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;EAC7C,MAAM,gBAAoD,oBACtD,aAAa,OAAO,MAAM,OAAO,WAAW;GAC1C;GACA,WAAW,eAAe;GAC1B,oBAAoB,eAAe;GACnC,UAAU,eAAe;GACzB,mBAAmB,eAAe;EACpC,CAAC,IACD;EAEJ,MAAM,QAAe,CAAC;;;;EAKtB,IAAI,OAAO,WAAW,eAAe;GACnC,MAAM,kBAAkB,yBACtB,IAAI,IAAI,OAAO,QAAQ,SAAS,GAChC,eACA,MACF;EACF;;EAGA,IAAI;EACJ,IAAI,OAAO,MAAM;GACf,MAAM,aAAa,kBAAkB,OAAO,MAAM,eAAe,OAAO,QAAQ,GAAG;GACnF,IAAI,WAAW,QAAQ;IACrB,OAAO,MAAM,gBAAgB,OAAO,YAAY,QAAQ,gBAAgB,aAAa;IACrF,kBAAkB,OAAO,IAAI;GAC/B,OAAO;IACL,OAAO,KAAK,6BAA6B;KACvC,SAAS,WAAW;KACpB,QAAQ,WAAW,UAAU,2BAA2B;IAC1D,CAAC;GACH;EACF;EAEA,MAAM,SAAS,OAAO,eAA+B;GACnD,kBAAkB,qBAAqB,WAAW,QAAQ,KAAK;GAC/D,IAAI,MAAM,OAAO,uBAAuB;IACtC,MAAM,aAAa;IACnB,MAAM,UAAU,wBAAwB,YAAsC;KAC5E,kBAAkB,WAAW,SAAS,mBAAmB;KACzD;IACF,CAAC;IACD,OAAO,MAAM,4CAA4C,EAAE,eAAe,QAAQ,CAAC;GACrF;EACF;EAEA,OAAO,KAAK,4BAA4B;GACtC,SAAS,QAAQ,MAAM,eAAe;GACtC,MAAM,QAAQ,IAAI;GAClB,WAAW,OAAO,cAAc,oBAAoB,cAAc;EACpE,CAAC;EAED,OAAO;CACT;AACF;AAEA,OAAO,MAAM,oBAA4B,wBAAwB;AAEjE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}

package/dist/plugin.d.ts

@@ -0,0 +1,87 @@
+import { type AuthServerConfig, type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
+/**
+* Identity for the umbrella's single `TokenRuntime` (ADR-0012). Constant
+* because v1 is single-IdP, same rationale as repo-auth's `HUMAN_IDENTITY`.
+*/
+export declare const LIGHTBRIDGE_IDENTITY = "lightbridge";
+/** Own cache namespace — separate from oauth2/repo-auth/otel's stores. */
+export declare const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
+/**
+* Cache key for the default-project token — used when no `projectId` is
+* configured, so the exchange sends no `project_id` and the backend mints a
+* token for the caller's default project (ADR-0012). Distinct from any real
+* project id so the two never collide in the token cache.
+*/
+export declare const DEFAULT_PROJECT_KEY = "__default__";
+export interface LightbridgeRuntimeOptions {
+	logger?: Logger;
+	fetchImpl?: typeof fetch;
+	onAuthorizationUrl?: (url: string) => Promise<void> | void;
+	/** Override the cache root (defaults to the OS cache dir convention). */
+	cacheDir?: string;
+	tokenExpirySkewMs?: number;
+}
+/**
+* The minimal surface `opencode.ts` needs from the shared runtime — narrow on
+* purpose so tests can inject a spy/fake without constructing a real
+* `TokenRuntime` (no network, no disk).
+*/
+export interface LightbridgeRuntimeLike {
+	getProjectToken(options?: {
+		interactive?: boolean;
+	}): Promise<TokenSet>;
+	reset?(): Promise<void>;
+}
+/**
+* Builds a `LightbridgeRuntimeLike` for a given `(auth, projectId)` pair.
+* `projectId` is optional — `undefined` mints a default-project token.
+*/
+export type LightbridgeRuntimeFactory = (auth: AuthServerConfig, projectId: string | undefined, options: LightbridgeRuntimeOptions) => LightbridgeRuntimeLike;
+/**
+* The ONE shared `TokenRuntime` the umbrella plugin builds (ADR-0012): a
+* single human login, reused as the subject token for a project-scoped RFC
+* 8693 exchange whose result is consumed by BOTH the gateway (`chat.headers`)
+* and OTEL (`TokenSource.headers()`) — that sharing is the entire point of
+* the plugin. Lifecycle mirrors `@vymalo/opencode-repo-auth`'s "model b"
+* (`RepoAuthPlugin.resolveProjectToken`): auth-core has no higher-level
+* primitive for this yet, so the umbrella keeps its own thin copy rather than
+* reaching into a sibling package's internals.
+*/
+export declare class LightbridgeRuntime implements LightbridgeRuntimeLike {
+	private readonly projectId;
+	private readonly runtime;
+	private readonly logger;
+	private readonly tokenExpirySkewMs;
+	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
+	private readonly projectKey;
+	private inFlightExchange?;
+	constructor(auth: AuthServerConfig, projectId: string | undefined, options?: LightbridgeRuntimeOptions);
+	/** Non-network read of the cached project token, if any. */
+	getCachedProjectToken(): Promise<TokenSet | undefined>;
+	/**
+	* Resolve a usable project token, shared by every caller (gateway
+	* `chat.headers`, OTEL `TokenSource.headers()`):
+	*
+	*   cached usable? ──yes──▶ return it
+	*         │ no
+	*         ▼
+	*   ensure human root (refresh-only unless `interactive`)
+	*         ▼
+	*   exchangeTo(projectKey, humanToken, projectId ? { project_id } : {})
+	*         ▼           (no projectId → backend picks the default project)
+	*   cache + return
+	*
+	* Concurrent callers (a chat request racing an OTEL export) share the
+	* in-flight exchange — at most one exchange POST per cache-miss window.
+	* Never invents a token: an exchange failure propagates to the caller,
+	* which is expected to fail closed (no header / empty `headers()`).
+	*/
+	getProjectToken(options?: {
+		interactive?: boolean;
+	}): Promise<TokenSet>;
+	private performExchange;
+	/** Drop the on-disk human + project tokens for this identity. */
+	reset(): Promise<void>;
+}
+/** Absolute path to the lightbridge cache directory (for diagnostics / tests). */
+export declare function lightbridgeCacheDir(cacheRoot: string): string;

package/dist/plugin.js

@@ -0,0 +1,132 @@
+import { join } from "node:path";
+import { createJsonConsoleLogger, DEFAULT_TOKEN_EXPIRY_SKEW_MS, resolveCacheRoot, TokenRuntime } from "@vymalo/opencode-auth-core/lib";
+/**
+* Identity for the umbrella's single `TokenRuntime` (ADR-0012). Constant
+* because v1 is single-IdP, same rationale as repo-auth's `HUMAN_IDENTITY`.
+*/
+export const LIGHTBRIDGE_IDENTITY = "lightbridge";
+/** Own cache namespace — separate from oauth2/repo-auth/otel's stores. */
+export const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
+/**
+* Cache key for the default-project token — used when no `projectId` is
+* configured, so the exchange sends no `project_id` and the backend mints a
+* token for the caller's default project (ADR-0012). Distinct from any real
+* project id so the two never collide in the token cache.
+*/
+export const DEFAULT_PROJECT_KEY = "__default__";
+/**
+* Whether a cached project token is usable. Mirrors repo-auth's
+* `isProjectTokenUsable`: the project token carries no refresh token, so an
+* undefined `expiresAt` must be treated as expired (re-exchange), never as
+* non-expiring.
+*/
+function isProjectTokenUsable(token, skewMs) {
+	if (!token?.accessToken) {
+		return false;
+	}
+	if (token.expiresAt === undefined) {
+		return false;
+	}
+	return Date.now() + skewMs < token.expiresAt;
+}
+/**
+* The ONE shared `TokenRuntime` the umbrella plugin builds (ADR-0012): a
+* single human login, reused as the subject token for a project-scoped RFC
+* 8693 exchange whose result is consumed by BOTH the gateway (`chat.headers`)
+* and OTEL (`TokenSource.headers()`) — that sharing is the entire point of
+* the plugin. Lifecycle mirrors `@vymalo/opencode-repo-auth`'s "model b"
+* (`RepoAuthPlugin.resolveProjectToken`): auth-core has no higher-level
+* primitive for this yet, so the umbrella keeps its own thin copy rather than
+* reaching into a sibling package's internals.
+*/
+export class LightbridgeRuntime {
+	projectId;
+	runtime;
+	logger;
+	tokenExpirySkewMs;
+	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
+	projectKey;
+	inFlightExchange;
+	constructor(auth, projectId, options = {}) {
+		this.projectId = projectId;
+		this.projectKey = projectId ?? DEFAULT_PROJECT_KEY;
+		this.logger = options.logger ?? createJsonConsoleLogger("info");
+		this.tokenExpirySkewMs = typeof options.tokenExpirySkewMs === "number" && Number.isFinite(options.tokenExpirySkewMs) && options.tokenExpirySkewMs > 0 ? options.tokenExpirySkewMs : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
+		this.runtime = new TokenRuntime(LIGHTBRIDGE_IDENTITY, auth, {
+			logger: this.logger,
+			fetchImpl: options.fetchImpl,
+			onAuthorizationUrl: options.onAuthorizationUrl,
+			cacheDir: options.cacheDir ?? join(resolveCacheRoot(), DEFAULT_CACHE_NAMESPACE),
+			tokenExpirySkewMs: this.tokenExpirySkewMs
+		});
+	}
+	/** Non-network read of the cached project token, if any. */
+	async getCachedProjectToken() {
+		return this.runtime.getExchangedByKey(this.projectKey);
+	}
+	/**
+	* Resolve a usable project token, shared by every caller (gateway
+	* `chat.headers`, OTEL `TokenSource.headers()`):
+	*
+	*   cached usable? ──yes──▶ return it
+	*         │ no
+	*         ▼
+	*   ensure human root (refresh-only unless `interactive`)
+	*         ▼
+	*   exchangeTo(projectKey, humanToken, projectId ? { project_id } : {})
+	*         ▼           (no projectId → backend picks the default project)
+	*   cache + return
+	*
+	* Concurrent callers (a chat request racing an OTEL export) share the
+	* in-flight exchange — at most one exchange POST per cache-miss window.
+	* Never invents a token: an exchange failure propagates to the caller,
+	* which is expected to fail closed (no header / empty `headers()`).
+	*/
+	async getProjectToken(options = {}) {
+		const cached = await this.getCachedProjectToken();
+		if (isProjectTokenUsable(cached, this.tokenExpirySkewMs)) {
+			this.logger.trace("lightbridge_exchange_cache_hit", { projectId: this.projectId });
+			return cached;
+		}
+		this.logger.trace("lightbridge_exchange_cache_miss", { projectId: this.projectId });
+		if (this.inFlightExchange) {
+			return this.inFlightExchange;
+		}
+		const exchange = this.performExchange(options);
+		this.inFlightExchange = exchange;
+		try {
+			return await exchange;
+		} finally {
+			if (this.inFlightExchange === exchange) {
+				this.inFlightExchange = undefined;
+			}
+		}
+	}
+	async performExchange(options) {
+		const human = await this.runtime.ensure({ interactive: options.interactive });
+		this.logger.info("lightbridge_exchange_started", { projectId: this.projectId ?? "(default)" });
+		try {
+			// No `projectId` → send no `project_id` param; the backend mints a token
+			// for the caller's default project (ADR-0012).
+			const exchanged = await this.runtime.exchangeTo(this.projectKey, human.accessToken, this.projectId ? { project_id: this.projectId } : {});
+			this.logger.info("lightbridge_exchange_success", { projectId: this.projectId ?? "(default)" });
+			return exchanged;
+		} catch (error) {
+			this.logger.error("lightbridge_exchange_failed", {
+				projectId: this.projectId,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			throw error;
+		}
+	}
+	/** Drop the on-disk human + project tokens for this identity. */
+	async reset() {
+		await this.runtime.reset();
+	}
+}
+/** Absolute path to the lightbridge cache directory (for diagnostics / tests). */
+export function lightbridgeCacheDir(cacheRoot) {
+	return join(cacheRoot, DEFAULT_CACHE_NAMESPACE);
+}
+
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;;;;;AAMP,OAAO,MAAM,uBAAuB;;AAGpC,OAAO,MAAM,0BAA0B;;;;;;;AAQvC,OAAO,MAAM,sBAAsB;;;;;;;AAqCnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;AAYA,OAAO,MAAM,mBAAqD;CAU7C;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,UAAU,IAAI,aAAa,sBAAsB,MAAM;GAC1D,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,QAAQ,YAAY,KAAK,iBAAiB,GAAG,uBAAuB;GAC9E,mBAAmB,KAAK;EAC1B,CAAC;CACH;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,QAAQ,kBAAkB,KAAK,UAAU;CACvD;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAC5E,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,QAAQ,WACnC,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;CAGA,MAAM,QAAuB;EAC3B,MAAM,KAAK,QAAQ,MAAM;CAC3B;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,uBAAuB;AAChD","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@vymalo/opencode-lightbridge",
+  "version": "0.14.1",
+  "description": "Umbrella OpenCode plugin for ADR-0012: one shared credential (TokenRuntime) drives both the LLM gateway bearer and OTEL export, so a developer authenticates once and every egress rides the same project-scoped token.",
+  "license": "MIT",
+  "author": "vymalo contributors",
+  "homepage": "https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit.git",
+    "directory": "packages/opencode-lightbridge"
+  },
+  "bugs": {
+    "url": "https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/issues"
+  },
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "oauth2",
+    "token-exchange",
+    "project",
+    "gateway",
+    "opentelemetry",
+    "otel",
+    "otlp",
+    "observability"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./lib": {
+      "types": "./dist/lib.d.ts",
+      "import": "./dist/lib.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@opencode-ai/plugin": "1.15.10",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/api-logs": "^0.221.0",
+    "@vymalo/opencode-auth-core": "0.14.1",
+    "@vymalo/opencode-core-otel": "0.14.1"
+  },
+  "devDependencies": {
+    "@opentelemetry/sdk-logs": "^0.221.0",
+    "@opentelemetry/sdk-trace": "^2.10.0",
+    "vite": "^8.2.1",
+    "vitest": "^4.1.7"
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-package.mjs",
+    "lint": "biome lint .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "coverage": "vitest run --coverage",
+    "format": "biome format --write .",
+    "format:check": "biome format ."
+  }
+}