@vymalo/opencode-lightbridge 0.16.0 → 0.17.0

package/README.md

@@ -2,21 +2,25 @@
 
 [![npm](https://img.shields.io/npm/v/@vymalo/opencode-lightbridge?label=npm&color=CB3837&logo=npm)](https://www.npmjs.com/package/@vymalo/opencode-lightbridge)
 
-**One login, every egress.** The umbrella OpenCode plugin for [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md):
-a single shared `TokenRuntime` drives **both** the LLM gateway bearer and the OTEL export
-credential, because both validate the same `lightbridge-authz` issuer + `aud=lightbridge-api-key`.
-Log in once as yourself; every egress that needs a project-scoped credential rides the same token.
+**The all-in-one plugin.** One credential drives everything: provider registration + model
+discovery ([`register`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md) —
+"everything `@vymalo/opencode-oauth2` does"), the LLM gateway bearer (`gateway`), and the OTEL
+export credential (`otel`) — see [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md)
+and [ADR-0017](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md).
+Log in once as yourself; every module that needs a credential rides the same login — and since
+ADR-0017, that login is shared with `@vymalo/opencode-oauth2` too, when both target the same IdP.
 
 Part of the [OpenCode Toolbelt](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit).
 
-## Why this instead of `opencode-repo-auth` + `opencode-otel`
+## Why this instead of `opencode-oauth2` + `opencode-repo-auth` + `opencode-otel`
 
-Running both standalone plugins works, but each holds its **own** credential in its **own** cache
-namespace — two logins, two token stores, no relationship between them. `@vymalo/opencode-lightbridge`
-composes `@vymalo/opencode-auth-core` (the OAuth/token-exchange primitive) and
-`@vymalo/opencode-core-otel` (the OTel engine) over **one** `TokenRuntime`, so the project-scoped
-token minted for the gateway is the exact same token OTEL presents to the collector. No forked
-engine logic — this package is a thin composition layer over its two sibling libraries.
+Running the standalone plugins works, but each holds its **own** credential in its **own** cache
+namespace — up to three logins, three token stores, no relationship between them.
+`@vymalo/opencode-lightbridge` composes `@vymalo/opencode-provider-sync` (the model-sync engine,
+for `register`), `@vymalo/opencode-auth-core` (the OAuth/token-exchange primitive), and
+`@vymalo/opencode-core-otel` (the OTel engine) over **one shared credential**, so the same token
+that registers your provider is the one the gateway injects and OTEL presents to the collector. No
+forked engine logic — this package composes its sibling libraries.
 
 ## Install
 
@@ -37,11 +41,14 @@ npm install @vymalo/opencode-lightbridge
         "authFlow": "device_code"
       },
       "gateway": {
-        "projectId": "proj-123",
-        "providers": ["gateway"]
+        "providers": ["gateway"],
+        "exchange": false
       },
       "otel": {
         "endpoint": "http://localhost:4318"
+      },
+      "register": {
+        "baseURL": "https://gateway.example.com/v1"
       }
     }]
   ]
@@ -49,17 +56,30 @@ npm install @vymalo/opencode-lightbridge
 ```
 
 - **`auth`** (required) — the one IdP login, an `AuthServerConfigInput` (same shape as
-  `opencode-oauth2`/`opencode-repo-auth`'s per-provider auth block).
-- **`gateway`** (optional) — the OpenCode provider ids to inject `Authorization: Bearer
-  <project-token>` on, per request (plus an optional `projectId`).
+  `opencode-oauth2`/`opencode-repo-auth`'s per-provider auth block). `auth.id` also doubles as the
+  OpenCode provider id `register` uses and the shared cache identity (see below).
+- **`register`** (optional, [ADR-0017](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md)) —
+  register `auth`'s IdP as an OpenCode provider and keep its models in sync, via the same
+  `@vymalo/opencode-provider-sync` engine `opencode-oauth2` uses. Requires `register.baseURL`.
+- **`gateway`** (optional) — the OpenCode provider ids to inject a bearer on, per request (plus an
+  optional `gateway.exchange`/`projectId`).
+- **`gateway.exchange`** (optional, default `false`) — `false`: use the IdP access token directly.
+  `true`: RFC 8693-exchange it for a project-scoped token first (ADR-0012's original behaviour).
 - **`otel`** (optional) — the same `OtelPluginOptions` shape as `@vymalo/opencode-otel`
   (`endpoint`, `exporters`, `serviceName`, …), minus `tokenCommand`/`tokenHeader`/`tokenPrefix`: the
   shared runtime supersedes that seam entirely.
-- **`projectId`** (optional, top-level or under `gateway`) — **fully optional**: omit it and the
-  exchange sends no `project_id`, so the backend mints a token for your **default project**. An
-  explicit top-level `projectId` wins over `gateway.projectId`.
+- **`projectId`** (optional, top-level or under `gateway`) — only meaningful when
+  `gateway.exchange: true`. **Fully optional**: omit it and the exchange sends no `project_id`, so
+  the backend mints a token for your **default project**. An explicit top-level `projectId` wins
+  over `gateway.projectId`.
+
+Omitting `gateway`, `otel` and `register` is a valid, inert config — the plugin logs and no-ops.
 
-Omitting both `gateway` and `otel` is a valid, inert config — the plugin logs and no-ops.
+**One login, shared with oauth2.** Configure the same `id`/`issuer`/`clientId` as an
+`@vymalo/opencode-oauth2` server entry and logging in through either plugin makes the token
+available to both — no second device-code/browser flow. An existing pre-ADR-0017 install's cached
+login is migrated automatically on first use; no re-login is forced. See
+[`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md#one-login-shared-cache-with-oauth2-adr-0017).
 
 ## Scope: gateway + OTEL, not MCP
 
@@ -73,12 +93,15 @@ for the full reasoning.
 ## Full reference
 
 - [`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md)
-  — the one-credential design, full config reference, the three egresses.
+  — the all-in-one design, full config reference, migration notes.
 - [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md)
   — why one runtime, why MCP is excluded, the alternatives considered.
-- [`docs/repo-auth.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/repo-auth.md)
-  and [`docs/otel.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/otel.md)
-  — the two standalone plugins this package composes; useful for the config shapes it reuses.
+- [ADR-0017](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md)
+  — `register`, the shared cache with oauth2, and the exchange becoming opt-in.
+- [`docs/repo-auth.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/repo-auth.md),
+  [`docs/otel.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/otel.md) and
+  [`docs/architecture.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/architecture.md)
+  (oauth2) — the standalone plugins this package composes; useful for the config shapes it reuses.
 
 ## License
 

package/dist/config.d.ts

@@ -7,9 +7,49 @@ export interface LightbridgeGatewayOptions {
 	/**
 	* Optional project id for the shared RFC 8693 exchange (ADR-0012). When
 	* omitted, the exchange sends no `project_id` and the backend mints a token
-	* for the caller's **default project**.
+	* for the caller's **default project**. Only meaningful when `exchange` is
+	* `true` — ignored otherwise (there is no exchange call to attach it to).
 	*/
 	projectId?: string;
+	/**
+	* Whether to perform the RFC 8693 token exchange (ADR-0012) before using
+	* the result as the gateway bearer. Defaults to `false` (ADR-0017 amends
+	* ADR-0012): most IdP setups hand out an access token that is already
+	* scoped for the gateway, and an unconditional exchange fails outright for
+	* a client that has no `token-exchange` grant registered (`unauthorized_client`).
+	*
+	* - `false` (default): the IdP access token from `auth` is used directly
+	*   as `Authorization: Bearer <token>` — no second network call, no extra
+	*   grant required.
+	* - `true`: today's ADR-0012 behaviour, unchanged — the human token is
+	*   exchanged for a project-scoped token (optionally carrying `project_id`)
+	*   and THAT is used as the bearer.
+	*/
+	exchange?: boolean;
+}
+/**
+* The `register` opt-in (ADR-0017): register `auth`'s IdP as an OpenCode
+* provider and keep its model list in sync via the SAME
+* `@vymalo/opencode-provider-sync` engine `@vymalo/opencode-oauth2` uses —
+* "everything oauth2 does", now available from lightbridge too. Independent
+* of `gateway` (header injection) and `otel`: a config can register a
+* provider without ever using it as the gateway bearer target, though the
+* common case sets `gateway.providers` to the same id.
+*/
+export interface LightbridgeRegisterOptions {
+	/** Base URL of the OpenAI-compatible (or Responses) inference endpoint. */
+	baseURL: string;
+	/** Display name for the registered OpenCode provider. Defaults to `auth.id`. */
+	name?: string;
+	/** Raw model id -> display name overrides, applied at discovery time. */
+	nameOverrides?: Record<string, string>;
+	/** Minutes between model-discovery syncs. Defaults to 60 (matches oauth2). */
+	syncIntervalMinutes?: number;
+	/**
+	* Route inference through the OpenAI Responses API instead of Chat
+	* Completions — see `@vymalo/opencode-provider-sync`'s `resolveProviderNpm`.
+	*/
+	responseApi?: boolean;
 }
 /**
 * Plugin options as written under the `opencode-lightbridge` entry of
@@ -26,9 +66,12 @@ export interface LightbridgeOptions {
 	* Optional project id for the shared project-scoped token exchange. Fully
 	* optional: when omitted, the exchange sends no `project_id` and the backend
 	* mints a token for the caller's **default project**. An explicit `projectId`
-	* here wins over `gateway.projectId` when both are set.
+	* here wins over `gateway.projectId` when both are set. Only meaningful
+	* when `gateway.exchange` is `true`.
 	*/
 	projectId?: string;
+	/** NEW (ADR-0017): register `auth`'s IdP as an OpenCode provider + sync its models. */
+	register?: LightbridgeRegisterOptions;
 }
 /** `LightbridgeOptions` after parsing: `auth` fully validated + defaulted. */
 export interface ParsedLightbridgeOptions {
@@ -37,6 +80,7 @@ export interface ParsedLightbridgeOptions {
 	otel?: OtelPluginOptions;
 	/** Resolved project id (`projectId` ?? `gateway.projectId`), if either was set. */
 	projectId?: string;
+	register?: LightbridgeRegisterOptions;
 }
 /**
 * Parse + validate the plugin's `pluginOptions` (2nd factory arg). `auth` is
@@ -49,7 +93,26 @@ export interface ParsedLightbridgeOptions {
 export declare function parseLightbridgeOptions(raw: unknown): ParsedLightbridgeOptions;
 /**
 * Whether the parsed config has a module (gateway or otel) that needs the
-* shared token — project-scoped when `projectId` is set, else a default-project
-* token. Determines whether the one shared runtime is built.
+* shared token — project-scoped when `projectId` is set (and `gateway.exchange`
+* is `true`), else the raw IdP token. Determines whether the one shared
+* runtime is built. `register` doesn't gate this: it drives a separate
+* `ProviderModelSyncEngine`, not `LightbridgeRuntime`.
 */
 export declare function needsProjectToken(options: ParsedLightbridgeOptions): boolean;
+export interface OpenCodeConfigLike {
+	provider?: unknown;
+	pluginConfig?: unknown;
+}
+/**
+* Provider ids managed by `@vymalo/opencode-oauth2` via its
+* `pluginConfig.oauth2ModelSync.servers` channel.
+*/
+export declare function oauth2ManagedProviderIds(config: OpenCodeConfigLike): Set<string>;
+/**
+* Whether `providerId` is (also) managed by `@vymalo/opencode-oauth2` —
+* either via that provider's own `options.oauth2` / `options.oauth2ModelSync`
+* block, or via the `pluginConfig.oauth2ModelSync.servers` channel. Used by
+* lightbridge's `register` module to skip registering/owning a provider
+* oauth2 already claims (logged at `debug` — see `opencode.ts`).
+*/
+export declare function hasOAuth2Conflict(config: OpenCodeConfigLike, providerId: string): boolean;

package/dist/config.js

@@ -14,6 +14,15 @@ function asProviderList(value, path) {
 	}
 	return value.map((entry, index) => asNonEmptyString(entry, `${path}[${index}]`));
 }
+function asBoolean(value, path) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (typeof value !== "boolean") {
+		throw new Error(`${path} must be a boolean (received ${JSON.stringify(value)})`);
+	}
+	return value;
+}
 function parseGateway(raw, path) {
 	if (raw === undefined || raw === null) {
 		return undefined;
@@ -22,11 +31,44 @@ function parseGateway(raw, path) {
 		throw new Error(`${path} must be an object with \`providers\` (and an optional \`projectId\`)`);
 	}
 	const projectId = raw.projectId === undefined || raw.projectId === null ? undefined : asNonEmptyString(raw.projectId, `${path}.projectId`);
+	// Opt-in (ADR-0017, amends ADR-0012): defaults to `false` — see
+	// `LightbridgeGatewayOptions.exchange`'s doc comment for the rationale.
+	const exchange = asBoolean(raw.exchange, `${path}.exchange`) ?? false;
 	return {
 		providers: asProviderList(raw.providers, `${path}.providers`),
+		exchange,
 		...projectId ? { projectId } : {}
 	};
 }
+function asStringMap(value, path) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (!isRecord(value)) {
+		throw new Error(`${path} must be an object mapping model id -> display name`);
+	}
+	const normalized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		normalized[key] = asNonEmptyString(entry, `${path}.${key}`);
+	}
+	return normalized;
+}
+function parseRegister(raw, path) {
+	if (raw === undefined || raw === null) {
+		return undefined;
+	}
+	if (!isRecord(raw)) {
+		throw new Error(`${path} must be an object with at least \`baseURL\``);
+	}
+	const syncIntervalMinutes = typeof raw.syncIntervalMinutes === "number" && Number.isFinite(raw.syncIntervalMinutes) && raw.syncIntervalMinutes > 0 ? raw.syncIntervalMinutes : undefined;
+	return {
+		baseURL: asNonEmptyString(raw.baseURL, `${path}.baseURL`),
+		name: raw.name === undefined || raw.name === null ? undefined : asNonEmptyString(raw.name, `${path}.name`),
+		nameOverrides: asStringMap(raw.nameOverrides, `${path}.nameOverrides`),
+		syncIntervalMinutes,
+		responseApi: asBoolean(raw.responseApi, `${path}.responseApi`)
+	};
+}
 function parseOtel(raw, path) {
 	if (raw === undefined || raw === null) {
 		return undefined;
@@ -57,22 +99,72 @@ export function parseLightbridgeOptions(raw) {
 	const auth = validateAuthConfig(raw.auth);
 	const gateway = parseGateway(raw.gateway, "lightbridge.gateway");
 	const otel = parseOtel(raw.otel, "lightbridge.otel");
+	const register = parseRegister(raw.register, "lightbridge.register");
 	const explicitProjectId = typeof raw.projectId === "string" && raw.projectId.trim().length > 0 ? raw.projectId.trim() : undefined;
 	const projectId = explicitProjectId ?? gateway?.projectId;
 	return {
 		auth,
 		gateway,
 		otel,
-		projectId
+		projectId,
+		register
 	};
 }
 /**
 * Whether the parsed config has a module (gateway or otel) that needs the
-* shared token — project-scoped when `projectId` is set, else a default-project
-* token. Determines whether the one shared runtime is built.
+* shared token — project-scoped when `projectId` is set (and `gateway.exchange`
+* is `true`), else the raw IdP token. Determines whether the one shared
+* runtime is built. `register` doesn't gate this: it drives a separate
+* `ProviderModelSyncEngine`, not `LightbridgeRuntime`.
 */
 export function needsProjectToken(options) {
 	return Boolean(options.gateway) || Boolean(options.otel);
 }
+// ---- oauth2 provider-id collision guard (ADR-0017 requirement 4) ----------
+//
+// If a developer configures BOTH `@vymalo/opencode-oauth2` and lightbridge's
+// `register` block against the SAME OpenCode provider id, they must not both
+// register/own it — mirrors `@vymalo/opencode-repo-auth`'s
+// `hasOAuth2Conflict`/`oauth2ManagedProviderIds` (which defers to oauth2 the
+// same way). Kept as a lightbridge-local copy rather than a shared import:
+// each consumer's own config-key literals are intentionally NOT centralized
+// (see `@vymalo/opencode-provider-sync`'s `opencode-helpers.ts` module doc).
+const OAUTH2_OPTION_KEYS = ["oauth2", "oauth2ModelSync"];
+/**
+* Provider ids managed by `@vymalo/opencode-oauth2` via its
+* `pluginConfig.oauth2ModelSync.servers` channel.
+*/
+export function oauth2ManagedProviderIds(config) {
+	const ids = new Set();
+	const pluginConfig = isRecord(config.pluginConfig) ? config.pluginConfig : undefined;
+	const oauth2ModelSync = isRecord(pluginConfig?.oauth2ModelSync) ? pluginConfig?.oauth2ModelSync : undefined;
+	const servers = oauth2ModelSync?.servers;
+	if (Array.isArray(servers)) {
+		for (const raw of servers) {
+			const entry = isRecord(raw) ? raw : undefined;
+			const id = typeof entry?.id === "string" ? entry.id : undefined;
+			if (id) {
+				ids.add(id);
+			}
+		}
+	}
+	return ids;
+}
+/**
+* Whether `providerId` is (also) managed by `@vymalo/opencode-oauth2` —
+* either via that provider's own `options.oauth2` / `options.oauth2ModelSync`
+* block, or via the `pluginConfig.oauth2ModelSync.servers` channel. Used by
+* lightbridge's `register` module to skip registering/owning a provider
+* oauth2 already claims (logged at `debug` — see `opencode.ts`).
+*/
+export function hasOAuth2Conflict(config, providerId) {
+	const providers = isRecord(config.provider) ? config.provider : undefined;
+	const providerEntry = providers ? providers[providerId] : undefined;
+	const providerOptions = isRecord(providerEntry) && isRecord(providerEntry.options) ? providerEntry.options : undefined;
+	if (providerOptions && OAUTH2_OPTION_KEYS.some((key) => isRecord(providerOptions[key]))) {
+		return true;
+	}
+	return oauth2ManagedProviderIds(config).has(providerId);
+}
 
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SACE,0BAGK;AA4CP,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,MAAsB;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CACtD;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,SAAS,eAAe,OAAgB,MAAwB;CAC9D,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;EAC/C,MAAM,IAAI,MAAM,GAAG,KAAK,2CAA2C;CACrE;CACA,OAAO,MAAM,KAAK,OAAO,UAAU,iBAAiB,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AACjF;AAEA,SAAS,aAAa,KAAc,MAAqD;CACvF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,sEAAsE;CAChG;CACA,MAAM,YACJ,IAAI,cAAc,aAAa,IAAI,cAAc,OAC7C,YACA,iBAAiB,IAAI,WAAW,GAAG,KAAK,WAAW;CACzD,OAAO;EACL,WAAW,eAAe,IAAI,WAAW,GAAG,KAAK,WAAW;EAC5D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;AAEA,SAAS,UAAU,KAAc,MAA6C;CAC5E,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,uCAAuC;CACjE;;;;CAIA,OAAO;AACT;;;;;;;;;AAUA,OAAO,SAAS,wBAAwB,KAAwC;CAC9E,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MACR,sFACF;CACF;CACA,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG;EACvB,MAAM,IAAI,MAAM,4EAA4E;CAC9F;CAEA,MAAM,OAAO,mBAAmB,IAAI,IAAwC;CAC5E,MAAM,UAAU,aAAa,IAAI,SAAS,qBAAqB;CAC/D,MAAM,OAAO,UAAU,IAAI,MAAM,kBAAkB;CAEnD,MAAM,oBACJ,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS,IAC/D,IAAI,UAAU,KAAK,IACnB;CACN,MAAM,YAAY,qBAAqB,SAAS;CAEhD,OAAO;EAAE;EAAM;EAAS;EAAM;CAAU;AAC1C;;;;;;AAOA,OAAO,SAAS,kBAAkB,SAA4C;CAC5E,OAAO,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,IAAI;AACzD","names":[],"sources":["../src/config.ts"],"version":3,"file":"config.js","sourceRoot":""}
+{"mappings":"AAAA,SACE,0BAGK;AAyFP,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,MAAsB;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CACtD;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,SAAS,eAAe,OAAgB,MAAwB;CAC9D,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;EAC/C,MAAM,IAAI,MAAM,GAAG,KAAK,2CAA2C;CACrE;CACA,OAAO,MAAM,KAAK,OAAO,UAAU,iBAAiB,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AACjF;AAEA,SAAS,UAAU,OAAgB,MAAmC;CACpE,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,OAAO,UAAU,WAAW;EAC9B,MAAM,IAAI,MAAM,GAAG,KAAK,+BAA+B,KAAK,UAAU,KAAK,EAAE,EAAE;CACjF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,KAAc,MAAqD;CACvF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,sEAAsE;CAChG;CACA,MAAM,YACJ,IAAI,cAAc,aAAa,IAAI,cAAc,OAC7C,YACA,iBAAiB,IAAI,WAAW,GAAG,KAAK,WAAW;;;CAGzD,MAAM,WAAW,UAAU,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK;CAChE,OAAO;EACL,WAAW,eAAe,IAAI,WAAW,GAAG,KAAK,WAAW;EAC5D;EACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;AAEA,SAAS,YAAY,OAAgB,MAAkD;CACrF,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,KAAK,GAAG;EACpB,MAAM,IAAI,MAAM,GAAG,KAAK,oDAAoD;CAC9E;CACA,MAAM,aAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,WAAW,OAAO,iBAAiB,OAAO,GAAG,KAAK,GAAG,KAAK;CAC5D;CACA,OAAO;AACT;AAEA,SAAS,cAAc,KAAc,MAAsD;CACzF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,6CAA6C;CACvE;CAEA,MAAM,sBACJ,OAAO,IAAI,wBAAwB,YACnC,OAAO,SAAS,IAAI,mBAAmB,KACvC,IAAI,sBAAsB,IACtB,IAAI,sBACJ;CAEN,OAAO;EACL,SAAS,iBAAiB,IAAI,SAAS,GAAG,KAAK,SAAS;EACxD,MACE,IAAI,SAAS,aAAa,IAAI,SAAS,OACnC,YACA,iBAAiB,IAAI,MAAM,GAAG,KAAK,MAAM;EAC/C,eAAe,YAAY,IAAI,eAAe,GAAG,KAAK,eAAe;EACrE;EACA,aAAa,UAAU,IAAI,aAAa,GAAG,KAAK,aAAa;CAC/D;AACF;AAEA,SAAS,UAAU,KAAc,MAA6C;CAC5E,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,uCAAuC;CACjE;;;;CAIA,OAAO;AACT;;;;;;;;;AAUA,OAAO,SAAS,wBAAwB,KAAwC;CAC9E,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MACR,sFACF;CACF;CACA,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG;EACvB,MAAM,IAAI,MAAM,4EAA4E;CAC9F;CAEA,MAAM,OAAO,mBAAmB,IAAI,IAAwC;CAC5E,MAAM,UAAU,aAAa,IAAI,SAAS,qBAAqB;CAC/D,MAAM,OAAO,UAAU,IAAI,MAAM,kBAAkB;CACnD,MAAM,WAAW,cAAc,IAAI,UAAU,sBAAsB;CAEnE,MAAM,oBACJ,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS,IAC/D,IAAI,UAAU,KAAK,IACnB;CACN,MAAM,YAAY,qBAAqB,SAAS;CAEhD,OAAO;EAAE;EAAM;EAAS;EAAM;EAAW;CAAS;AACpD;;;;;;;;AASA,OAAO,SAAS,kBAAkB,SAA4C;CAC5E,OAAO,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,IAAI;AACzD;;;;;;;;;;AAYA,MAAM,qBAAqB,CAAC,UAAU,iBAAiB;;;;;AAWvD,OAAO,SAAS,yBAAyB,QAAyC;CAChF,MAAM,MAAM,IAAI,IAAY;CAC5B,MAAM,eAAe,SAAS,OAAO,YAAY,IAAI,OAAO,eAAe;CAC3E,MAAM,kBAAkB,SAAS,cAAc,eAAe,IAC1D,cAAc,kBACd;CACJ,MAAM,UAAU,iBAAiB;CACjC,IAAI,MAAM,QAAQ,OAAO,GAAG;EAC1B,KAAK,MAAM,OAAO,SAAS;GACzB,MAAM,QAAQ,SAAS,GAAG,IAAI,MAAM;GACpC,MAAM,KAAK,OAAO,OAAO,OAAO,WAAW,MAAM,KAAK;GACtD,IAAI,IAAI;IACN,IAAI,IAAI,EAAE;GACZ;EACF;CACF;CACA,OAAO;AACT;;;;;;;;AASA,OAAO,SAAS,kBAAkB,QAA4B,YAA6B;CACzF,MAAM,YAAY,SAAS,OAAO,QAAQ,IAAI,OAAO,WAAW;CAChE,MAAM,gBAAgB,YAAa,UAAsC,cAAc;CACvF,MAAM,kBACJ,SAAS,aAAa,KAAK,SAAS,cAAc,OAAO,IAAI,cAAc,UAAU;CAEvF,IAAI,mBAAmB,mBAAmB,MAAM,QAAQ,SAAS,gBAAgB,IAAI,CAAC,GAAG;EACvF,OAAO;CACT;CACA,OAAO,yBAAyB,MAAM,CAAC,CAAC,IAAI,UAAU;AACxD","names":[],"sources":["../src/config.ts"],"version":3,"file":"config.js","sourceRoot":""}

package/dist/lib.d.ts

@@ -1,3 +1,4 @@
 export { createLightbridgePlugin, LightbridgePlugin, type LightbridgePluginFactoryOptions } from "./opencode.js";
-export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, lightbridgeCacheDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
-export { parseLightbridgeOptions, needsProjectToken, type LightbridgeGatewayOptions, type LightbridgeOptions, type ParsedLightbridgeOptions } from "./config.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeCacheDir, rootCacheDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
+export { hasOAuth2Conflict, needsProjectToken, oauth2ManagedProviderIds, parseLightbridgeOptions, type LightbridgeGatewayOptions, type LightbridgeOptions, type LightbridgeRegisterOptions, type OpenCodeConfigLike, type ParsedLightbridgeOptions } from "./config.js";
+export { migrateRootTokenIfNeeded } from "./migration.js";

package/dist/lib.js

@@ -1,5 +1,6 @@
 export { createLightbridgePlugin, LightbridgePlugin } from "./opencode.js";
-export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, lightbridgeCacheDir } from "./plugin.js";
-export { parseLightbridgeOptions, needsProjectToken } from "./config.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeCacheDir, rootCacheDir } from "./plugin.js";
+export { hasOAuth2Conflict, needsProjectToken, oauth2ManagedProviderIds, parseLightbridgeOptions } from "./config.js";
+export { migrateRootTokenIfNeeded } from "./migration.js";
 
 //# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SACE,yBACA,yBAEK;AAEP,SACE,oBACA,sBACA,yBACA,qBACA,2BAIK;AAEP,SACE,yBACA,yBAIK","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}
+{"mappings":"AAAA,SACE,yBACA,yBAEK;AAEP,SACE,oBACA,sBACA,yBACA,qBACA,sBACA,oBACA,qBACA,oBAIK;AAEP,SACE,mBACA,mBACA,0BACA,+BAMK;AAEP,SAAS,gCAAgC","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}

package/dist/migration.d.ts

@@ -0,0 +1,31 @@
+import { type Logger } from "@vymalo/opencode-auth-core/lib";
+/**
+* One-time migration read-path (ADR-0017, mandatory — not optional polish).
+*
+* v0.17 moves lightbridge's human root token from its own bespoke file
+* (`<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`) to
+* the SAME fused `CachedServerState` file `@vymalo/opencode-oauth2` uses
+* (`<cacheRoot>/<sharedSegment>/<sharedNamespace>/<serverId>.json`) so the two
+* plugins can share one login (ADR-0017 §"one login, shared cache"). An
+* install that already has a valid old-format token must NOT be forced
+* through a fresh device-code/browser login just because the file moved.
+*
+* Behaviour:
+* - If the NEW location already has a persisted state (with or without a
+*   token), this is a no-op — never clobbers a fresher state (e.g. one
+*   oauth2 has already been writing to, with real discovered models).
+* - Else, read the OLD location. If it holds a structurally usable token
+*   (`accessToken` + `tokenType` present — possibly expired; an expired
+*   token with a refresh token is still worth adopting, since `TokenRuntime`
+*   will refresh it transparently), write it into the NEW location as a
+*   fresh `CachedServerState` (empty `models`/`rawModels` — nothing to carry
+*   over, since the old shape never tracked models).
+* - Else (no old file, or it's empty/malformed) this is a no-op; the caller
+*   proceeds to a normal login.
+*
+* The old file is left in place (non-destructive) — this function only ever
+* ADDS the new file, never deletes/mutates the old one. Safe to call more
+* than once: the "new location already has a state" check makes every call
+* after the first a cheap no-op.
+*/
+export declare function migrateRootTokenIfNeeded(cacheRoot: string, sharedSegment: string, sharedNamespace: string, serverId: string, logger: Logger): Promise<void>;

package/dist/migration.js

@@ -0,0 +1,91 @@
+import { join } from "node:path";
+import { FileCacheStore as LegacyFileCacheStore } from "@vymalo/opencode-auth-core/lib";
+import { FileCacheStore as SharedFileCacheStore } from "@vymalo/opencode-provider-sync/lib";
+/**
+* The pre-ADR-0017 on-disk location of lightbridge's human root token:
+* `<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`
+* (see the OLD `LIGHTBRIDGE_IDENTITY`/`DEFAULT_CACHE_NAMESPACE` in `plugin.ts`,
+* which are still used verbatim for the exchanged project-token store — only
+* the ROOT token relocated).
+*/
+const OLD_ROOT_CACHE_NAMESPACE = "opencode-lightbridge";
+const OLD_ROOT_KEY = "lightbridge";
+function hasUsableTokenShape(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		return false;
+	}
+	const candidate = value;
+	return typeof candidate.accessToken === "string" && candidate.accessToken.length > 0 && typeof candidate.tokenType === "string" && candidate.tokenType.length > 0;
+}
+/**
+* One-time migration read-path (ADR-0017, mandatory — not optional polish).
+*
+* v0.17 moves lightbridge's human root token from its own bespoke file
+* (`<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`) to
+* the SAME fused `CachedServerState` file `@vymalo/opencode-oauth2` uses
+* (`<cacheRoot>/<sharedSegment>/<sharedNamespace>/<serverId>.json`) so the two
+* plugins can share one login (ADR-0017 §"one login, shared cache"). An
+* install that already has a valid old-format token must NOT be forced
+* through a fresh device-code/browser login just because the file moved.
+*
+* Behaviour:
+* - If the NEW location already has a persisted state (with or without a
+*   token), this is a no-op — never clobbers a fresher state (e.g. one
+*   oauth2 has already been writing to, with real discovered models).
+* - Else, read the OLD location. If it holds a structurally usable token
+*   (`accessToken` + `tokenType` present — possibly expired; an expired
+*   token with a refresh token is still worth adopting, since `TokenRuntime`
+*   will refresh it transparently), write it into the NEW location as a
+*   fresh `CachedServerState` (empty `models`/`rawModels` — nothing to carry
+*   over, since the old shape never tracked models).
+* - Else (no old file, or it's empty/malformed) this is a no-op; the caller
+*   proceeds to a normal login.
+*
+* The old file is left in place (non-destructive) — this function only ever
+* ADDS the new file, never deletes/mutates the old one. Safe to call more
+* than once: the "new location already has a state" check makes every call
+* after the first a cheap no-op.
+*/
+export async function migrateRootTokenIfNeeded(cacheRoot, sharedSegment, sharedNamespace, serverId, logger) {
+	const sharedStore = new SharedFileCacheStore(join(cacheRoot, sharedSegment, sharedNamespace), logger);
+	let alreadyMigrated;
+	try {
+		alreadyMigrated = await sharedStore.loadServerState(serverId);
+	} catch (error) {
+		logger.debug("lightbridge_root_migration_check_failed", { error: error instanceof Error ? error.message : String(error) });
+		return;
+	}
+	if (alreadyMigrated) {
+		// New location already has SOME state (with or without a token) — either
+		// a previous migration ran, or oauth2/register already populated it.
+		// Never overwrite it from the old file.
+		return;
+	}
+	const legacyStore = new LegacyFileCacheStore(join(cacheRoot, OLD_ROOT_CACHE_NAMESPACE), logger);
+	let legacyToken;
+	try {
+		legacyToken = await legacyStore.load(OLD_ROOT_KEY);
+	} catch (error) {
+		logger.debug("lightbridge_root_migration_legacy_read_failed", { error: error instanceof Error ? error.message : String(error) });
+		return;
+	}
+	if (!hasUsableTokenShape(legacyToken)) {
+		logger.trace("lightbridge_root_migration_nothing_to_adopt", { serverId });
+		return;
+	}
+	const migrated = {
+		serverId,
+		updatedAt: Date.now(),
+		models: [],
+		rawModels: [],
+		token: legacyToken
+	};
+	await sharedStore.ensureReady();
+	await sharedStore.saveServerState(migrated);
+	logger.info("lightbridge_root_migration_adopted", {
+		serverId,
+		hadRefreshToken: Boolean(legacyToken.refreshToken)
+	});
+}
+
+//# sourceMappingURL=migration.js.map

package/dist/migration.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,kBAAkB,4BAGb;AACP,SACE,kBAAkB,4BAEb;;;;;;;;AASP,MAAM,2BAA2B;AACjC,MAAM,eAAe;AAErB,SAAS,oBAAoB,OAAmC;CAC9D,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EAC/D,OAAO;CACT;CACA,MAAM,YAAY;CAClB,OACE,OAAO,UAAU,gBAAgB,YACjC,UAAU,YAAY,SAAS,KAC/B,OAAO,UAAU,cAAc,YAC/B,UAAU,UAAU,SAAS;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,eAAe,yBACpB,WACA,eACA,iBACA,UACA,QACe;CACf,MAAM,cAAc,IAAI,qBACtB,KAAK,WAAW,eAAe,eAAe,GAC9C,MACF;CAEA,IAAI;CACJ,IAAI;EACF,kBAAkB,MAAM,YAAY,gBAAgB,QAAQ;CAC9D,SAAS,OAAO;EACd,OAAO,MAAM,2CAA2C,EACtD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD;CACF;CACA,IAAI,iBAAiB;;;;EAInB;CACF;CAEA,MAAM,cAAc,IAAI,qBAAqB,KAAK,WAAW,wBAAwB,GAAG,MAAM;CAC9F,IAAI;CACJ,IAAI;EACF,cAAc,MAAM,YAAY,KAAe,YAAY;CAC7D,SAAS,OAAO;EACd,OAAO,MAAM,iDAAiD,EAC5D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD;CACF;CAEA,IAAI,CAAC,oBAAoB,WAAW,GAAG;EACrC,OAAO,MAAM,+CAA+C,EAAE,SAAS,CAAC;EACxE;CACF;CAEA,MAAM,WAA8B;EAClC;EACA,WAAW,KAAK,IAAI;EACpB,QAAQ,CAAC;EACT,WAAW,CAAC;EACZ,OAAO;CACT;CAEA,MAAM,YAAY,YAAY;CAC9B,MAAM,YAAY,gBAAgB,QAAQ;CAC1C,OAAO,KAAK,sCAAsC;EAChD;EACA,iBAAiB,QAAQ,YAAY,YAAY;CACnD,CAAC;AACH","names":[],"sources":["../src/migration.ts"],"version":3,"file":"migration.js","sourceRoot":""}

package/dist/opencode.js

@@ -1,12 +1,23 @@
 import { hostname } from "node:os";
+import { join } from "node:path";
 import { createJsonConsoleLogger, DEFAULT_LOG_LEVEL, LOG_LEVEL_PRIORITY } from "@vymalo/opencode-auth-core/lib";
 import { buildResource, createProviders, deferredAttribute, describeError, fromOpenCodeLogLevel, installTracePropagation, readVcsInfo, resolveOtelConfig, TelemetryRecorder } from "@vymalo/opencode-core-otel";
-import { needsProjectToken, parseLightbridgeOptions } from "./config.js";
-import { LightbridgeRuntime } from "./plugin.js";
+import { applyResponsesApiOptions, mergeDiscoveredModels, ProviderModelSyncEngine, resolveProviderNpm } from "@vymalo/opencode-provider-sync/lib";
+import { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions } from "./config.js";
+import { LightbridgeRuntime, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT } from "./plugin.js";
 const PLUGIN_SERVICE_NAME = "opencode-lightbridge-plugin";
 /**
 * Pipe plugin logs through OpenCode's `client.app.log`, JSON console as
 * fallback. Mirrors every other plugin in the suite.
+*
+* This plugin mutates the session (gateway bearer injection, OTEL export), so
+* it might seem like a warn/error printed to the terminal would be actionable
+* developer feedback. It is not: no plugin in this suite may write to the
+* user's TUI (ADR-0014, superseding ADR-0013's narrower per-plugin scope).
+* Every record still reaches `client.app.log` at its true level, so the
+* diagnostic is always persisted to OpenCode's own log — just not on the
+* developer's screen. Set `VYMALO_PLUGIN_CONSOLE_LOG=1` (`consoleAll` below)
+* to opt back into the console mirror for every level.
 */
 function createOpenCodeLogger(client, getMinLevel) {
 	const fallback = createJsonConsoleLogger("debug");
@@ -15,7 +26,7 @@ function createOpenCodeLogger(client, getMinLevel) {
 		if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[getMinLevel()]) {
 			return;
 		}
-		if (consoleAll || level === "warn" || level === "error") {
+		if (consoleAll) {
 			fallback[level](event, fields);
 		}
 		const hostLevel = level === "trace" ? "debug" : level;
@@ -72,8 +83,15 @@ function registerExitHandlers(providers, logger, deferred) {
 * async factory over the SHARED runtime, superseding otel's standalone
 * `tokenCommand` path entirely (ADR-0012 — one credential, not two seams).
 * Never throws — the OTLP exporters require that of every `headers()` call —
-* so an exchange failure degrades to an unauthenticated export, which the
-* collector then rejects (fail closed, same posture as the gateway header).
+* so an exchange failure resolves `headers()` to `undefined` rather than `{}`.
+* That distinction is load-bearing (ADR-0015): `{}` would still let the export
+* fire with no `Authorization` header, which the collector then rejects at the
+* network — the exact bug this fixes. `undefined` tells the shared gate in
+* `@vymalo/opencode-core-otel` (`withFailureLogging`) to skip the export
+* before any request goes out, so a logged-out session goes quiet instead of
+* hammering the collector with 401s. Because `headers()` is called fresh on
+* every export attempt, a later successful login resumes exporting on the
+* next flush with nothing to restart.
 */
 function createRuntimeTokenSource(runtime) {
 	return {
@@ -82,7 +100,7 @@ function createRuntimeTokenSource(runtime) {
 				const token = await runtime.getProjectToken({ interactive: false });
 				return { Authorization: `${token.tokenType || "Bearer"} ${token.accessToken}` };
 			} catch {
-				return {};
+				return undefined;
 			}
 		},
 		// v1: no-op. The project token is short-lived and `getProjectToken`
@@ -114,6 +132,117 @@ function createGatewayChatHeaders(providers, runtime, logger) {
 	};
 }
 /**
+* Translate `auth` (already-validated `AuthServerConfig`) + `register` into
+* the ONE `ProviderServerConfig` the shared `ProviderModelSyncEngine` needs
+* (ADR-0017 requirement 1 — "everything oauth2 does"). `auth.id` is the
+* provider id AND the shared cache identity (see `plugin.ts`'s
+* `ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`).
+*/
+function buildRegisterServerConfig(auth, register) {
+	return {
+		id: auth.id,
+		name: register.name ?? auth.id,
+		issuer: auth.issuer,
+		baseURL: register.baseURL,
+		clientId: auth.clientId,
+		clientSecret: auth.clientSecret,
+		scopes: auth.scopes,
+		syncIntervalMinutes: register.syncIntervalMinutes ?? 60,
+		nameOverrides: register.nameOverrides ?? {},
+		authorizationEndpoint: auth.authorizationEndpoint,
+		tokenEndpoint: auth.tokenEndpoint,
+		deviceAuthorizationEndpoint: auth.deviceAuthorizationEndpoint,
+		jwksUri: auth.jwksUri,
+		redirectPort: auth.redirectPort,
+		authFlow: auth.authFlow,
+		pkce: auth.pkce,
+		subjectTokenSource: auth.subjectTokenSource,
+		tokenExchangeAudience: auth.tokenExchangeAudience
+	};
+}
+/**
+* The `register` module (ADR-0017 requirement 1): register `auth`'s IdP as an
+* OpenCode provider and keep `config.provider[<auth.id>].models` in sync via
+* the SAME `ProviderModelSyncEngine` `@vymalo/opencode-oauth2` uses — built
+* ONCE (register's config is fixed at plugin-construction time, unlike
+* oauth2's, which is re-derived from the host config on every `config` hook),
+* then merged into the host config on every `config` hook call so a later
+* OpenCode config pass still sees the discovered models.
+*
+* Guard (requirement 4a): if `auth.id` is ALSO managed by
+* `@vymalo/opencode-oauth2` in this same host config, lightbridge must not
+* also register/own it — skip entirely (never construct the engine, never
+* touch `config.provider[id]`), logged at `debug` (ADR-0014: nothing reaches
+* the terminal), and fail safe (the gateway/OTEL bearer still works via
+* `LightbridgeRuntime`'s own lightweight, read/refresh-only participation in
+* the same shared cache file). The double-scheduling guard (requirement 4b —
+* two engine instances in one process ticking the same cache file) is
+* enforced generically inside `ProviderModelSyncEngine.start()` itself.
+*/
+async function applyRegisterModule(hostConfig, register, auth, state, logger, factoryOptions) {
+	const providerId = auth.id;
+	if (!state.engine && hasOAuth2Conflict(hostConfig, providerId)) {
+		if (!state.skippedForConflict) {
+			state.skippedForConflict = true;
+			logger.debug("lightbridge_register_skipped_oauth2_conflict", { providerId });
+		}
+		return;
+	}
+	if (!state.engine) {
+		state.engine = new ProviderModelSyncEngine({
+			servers: [buildRegisterServerConfig(auth, register)],
+			cacheNamespace: ROOT_CACHE_NAMESPACE
+		}, {
+			logger,
+			fetchImpl: factoryOptions.fetchImpl,
+			onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
+			cacheDir: factoryOptions.cacheDir ? join(factoryOptions.cacheDir, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE) : undefined,
+			cacheNamespaceSegment: ROOT_CACHE_SEGMENT,
+			serviceLabel: "opencode-lightbridge"
+		});
+	}
+	if (!state.started) {
+		await state.engine.initialize();
+		await state.engine.start({ warmup: true });
+		state.started = true;
+	}
+	const providers = hostConfig.provider ??= {};
+	const providerConfig = providers[providerId] ??= {};
+	const providerOptions = providerConfig.options ?? {};
+	providerConfig.npm = resolveProviderNpm(register.responseApi);
+	providerConfig.name = providerConfig.name ?? register.name ?? providerId;
+	providerConfig.options = applyResponsesApiOptions({
+		...providerOptions,
+		baseURL: register.baseURL
+	}, register.responseApi, providerId, logger);
+	const models = state.engine.getServerModels(providerId);
+	if (models.length > 0) {
+		mergeDiscoveredModels(providerConfig, models);
+	}
+	logger.trace("lightbridge_register_config_applied", {
+		providerId,
+		modelCount: models.length
+	});
+}
+/**
+* `otel.tokenCommand`/`tokenHeader`/`tokenPrefix` are accepted by
+* `parseLightbridgeOptions` (they are just `OtelPluginOptions` fields) but
+* never take effect here: `buildOtelModule` always injects the shared
+* runtime-backed `TokenSource` whenever a runtime exists, and that injected
+* source unconditionally wins over `config.tokenCommand` in
+* `createProviders` (see `providers.ts`). Silently accepting and ignoring a
+* credential-helper config is exactly the kind of no-op ADR-0015 calls out, so
+* this logs once at `debug` rather than staying quiet — `debug` because it's
+* an informational no-op, not a warning-worthy misconfiguration, and no
+* plugin in this suite prints to the terminal by default anyway (ADR-0014).
+*/
+function warnIfTokenCommandConfigIgnored(otel, env, logger) {
+	const explicit = otel.tokenCommand !== undefined || otel.tokenHeader !== undefined || otel.tokenPrefix !== undefined || Boolean(env.OPENCODE_OTEL_TOKEN_COMMAND) || Boolean(env.OPENCODE_OTEL_TOKEN_HEADER) || Boolean(env.OPENCODE_OTEL_TOKEN_PREFIX);
+	if (explicit) {
+		logger.debug("lightbridge_otel_token_command_ignored", { reason: "otel.tokenCommand/tokenHeader/tokenPrefix are ignored — the shared lightbridge auth token always supersedes them" });
+	}
+}
+/**
 * Build the OTEL module: resource, providers (with the runtime-backed
 * `TokenSource` when a shared runtime is available), recorder and exit
 * handlers. Mirrors `@vymalo/opencode-otel`'s `createOtelPlugin` orchestration
@@ -235,9 +364,15 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 			fetchImpl: factoryOptions.fetchImpl,
 			onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
 			cacheDir: factoryOptions.cacheDir,
-			tokenExpirySkewMs: factoryOptions.tokenExpirySkewMs
+			tokenExpirySkewMs: factoryOptions.tokenExpirySkewMs,
+			exchange: parsed.gateway?.exchange ?? false
 		}) : undefined;
 		const hooks = {};
+		// ---- register module (ADR-0017 requirement 1) ----
+		const registerState = {
+			started: false,
+			skippedForConflict: false
+		};
 		// ---- gateway module ----
 		// `sharedRuntime` is always defined here: it is built whenever `gateway`
 		// or `otel` is configured (`wantsProjectToken`).
@@ -249,6 +384,7 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 		if (parsed.otel) {
 			const otelConfig = resolveOtelConfig(parsed.otel, factoryOptions.env ?? process.env);
 			if (otelConfig.active) {
+				warnIfTokenCommandConfigIgnored(parsed.otel, factoryOptions.env ?? process.env, logger);
 				otel = await buildOtelModule(input, otelConfig, logger, factoryOptions, sharedRuntime);
 				registerOtelHooks(hooks, otel);
 			} else {
@@ -260,6 +396,9 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 		}
 		hooks.config = async (hostConfig) => {
 			currentLogLevel = fromOpenCodeLogLevel(hostConfig.logLevel) ?? DEFAULT_LOG_LEVEL;
+			if (parsed.register) {
+				await applyRegisterModule(hostConfig, parsed.register, parsed.auth, registerState, logger, factoryOptions);
+			}
 			if (otel?.config.propagateTraceContext) {
 				const activeOtel = otel;
 				const wrapped = installTracePropagation(hostConfig, {
@@ -271,7 +410,9 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 		};
 		logger.info("lightbridge_plugin_ready", {
 			gateway: Boolean(hooks["chat.headers"]),
+			exchange: parsed.gateway?.exchange ?? false,
 			otel: Boolean(otel),
+			register: Boolean(parsed.register),
 			projectId: parsed.projectId ?? (wantsProjectToken ? "(default)" : undefined)
 		});
 		return hooks;

package/dist/opencode.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,gBAAgB;AAIzB,SACE,yBACA,mBACA,0BAKK;AAEP,SACE,eACA,iBACA,mBACA,eACA,sBACA,yBACA,aACA,mBACA,yBASK;AAEP,SACE,mBACA,+BAEK;AACP,SACE,0BAIK;AAEP,MAAM,sBAAsB;;;;;AAsC5B,SAAS,qBAAqB,QAA+B,aAAqC;CAChG,MAAM,WAAW,wBAAwB,OAAO;CAChD,MAAM,aAAa,qBAAqB,KAAK,QAAQ,IAAI,6BAA6B,EAAE;CAExF,MAAM,SAAS,OAAiB,OAAe,WAAuB;EACpE,IAAI,mBAAmB,SAAS,mBAAmB,YAAY,IAAI;GACjE;EACF;EACA,IAAI,cAAc,UAAU,UAAU,UAAU,SAAS;GACvD,SAAS,MAAM,CAAC,OAAO,MAAM;EAC/B;EACA,MAAM,YAAY,UAAU,UAAU,UAAU;EAChD,KAAK,OAAO,IACT,IAAI,EACH,MAAM;GAAE,SAAS;GAAqB,OAAO;GAAW,SAAS;GAAO,OAAO;EAAO,EACxF,CAAC,CAAC,CACD,YAAY;;EAEb,CAAC;CACL;CAEA,OAAO;EACL,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;CACxD;AACF;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;AAQA,SAAS,qBACP,WACA,QACA,UACM;CACN,IAAI,OAAO;CACX,MAAM,cAAc;EAClB,IAAI,MAAM;GACR;EACF;EACA,OAAO;EACP,KAAK,MAAM,aAAa,UAAU;GAChC,UAAU,QAAQ;EACpB;EACA,KAAK,UAAU,SAAS,CAAC,CAAC,OAAO,UAAU;GACzC,OAAO,KAAK,oCAAoC,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;EACjF,CAAC;CACH;CACA,QAAQ,KAAK,cAAc,KAAK;CAChC,QAAQ,KAAK,UAAU,KAAK;CAC5B,QAAQ,KAAK,WAAW,KAAK;AAC/B;;;;;;;;;AAUA,SAAS,yBAAyB,SAA8C;CAC9E,OAAO;EACL,SAAS,YAA6C;GACpD,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,MAAM,CAAC;IAClE,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,QAAQ;IACN,OAAO,CAAC;GACV;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;AAOA,SAAS,yBACP,WACA,SACA,QACoC;CACpC,OAAO,OAAO,OAAO,WAAW;EAC9B,MAAM,aAAa,MAAM,OAAO,cAAc,MAAM,UAAU,MAAM;EACpE,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,UAAU,GAAG;GAC7C,OAAO,MAAM,4CAA4C,EAAE,WAAW,CAAC;GACvE;EACF;EACA,IAAI;GACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,KAAK,CAAC;GACjE,OAAO,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;GACvE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;EACpE,QAAQ;GACN,OAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC;EAC9D;CACF;AACF;;;;;;;AAaA,eAAe,gBACb,OACA,YACA,QACA,gBACA,SACqB;CACrB,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,MAAM,YAAY,MAAM,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACrE,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,MAAM,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,OAAO,IAAI;CAClE,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;EACpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,CAAC;CAC3D;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;CAAS;AACxC;AAEA,SAAS,kBAAkB,OAAc,MAAwB;CAC/D,MAAM,EAAE,aAAa;CACrB,MAAM,QAAQ,OAAO,EAAE,YAAY;EACjC,SAAS,QAAQ,KAAK;CACxB;CACA,MAAM,kBAAkB,OAAO,WAAW,eAAe;EACvD,SAAS,cAAc,WAAW,UAAU;CAC9C;CACA,MAAM,yBAAyB,OAAO,cAAc;EAClD,SAAS,aAAa,SAAS;CACjC;CACA,MAAM,wBAAwB,OAAO,WAAW,eAAe;EAC7D,SAAS,YAAY,WAAW,UAAU;CAC5C;CACA,MAAM,iBAAiB,OAAO,aAAa,iBAAiB;EAC1D,SAAS,aAAa,aAAa,YAAY;CACjD;CACA,MAAM,oBAAoB,OAAO,iBAAiB,qBAAqB;EACrE,SAAS,gBAAgB,iBAAiB,gBAAgB;CAC5D;CACA,MAAM,gCAAgC,OAAO,WAAW,eAAe;EACrE,SAAS,eAAe,WAAW,UAAU;CAC/C;CACA,MAAM,0CAA0C,OAAO,iBAAiB,qBAAqB;EAC3F,SAAS,yBAAyB,iBAAiB,gBAAgB;CACrE;AACF;;;;;;;;;;;AAYA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GAC3C;CACR,OAAO,OAAO,OAAoB,kBAAkC;EAClE,IAAI,kBAA4B;EAChC,MAAM,SACJ,eAAe,UAAU,qBAAqB,MAAM,cAAc,eAAe;EAEnF,IAAI;EACJ,IAAI;GACF,SAAS,wBAAwB,aAAa;EAChD,SAAS,OAAO;;;GAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;GAC1E,OAAO,EACL,QAAQ,OAAO,eAA+B;IAC5C,kBAAkB,qBAAqB,WAAW,QAAQ,KAAK;GACjE,EACF;EACF;EAEA,MAAM,oBAAoB,kBAAkB,MAAM;EAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;GAG1C,OAAO,KAAK,+BAA+B;IACzC,SAAS,QAAQ,OAAO,OAAO;IAC/B,MAAM,QAAQ,OAAO,IAAI;GAC3B,CAAC;EACH;;;;;EAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;EAC7C,MAAM,gBAAoD,oBACtD,aAAa,OAAO,MAAM,OAAO,WAAW;GAC1C;GACA,WAAW,eAAe;GAC1B,oBAAoB,eAAe;GACnC,UAAU,eAAe;GACzB,mBAAmB,eAAe;EACpC,CAAC,IACD;EAEJ,MAAM,QAAe,CAAC;;;;EAKtB,IAAI,OAAO,WAAW,eAAe;GACnC,MAAM,kBAAkB,yBACtB,IAAI,IAAI,OAAO,QAAQ,SAAS,GAChC,eACA,MACF;EACF;;EAGA,IAAI;EACJ,IAAI,OAAO,MAAM;GACf,MAAM,aAAa,kBAAkB,OAAO,MAAM,eAAe,OAAO,QAAQ,GAAG;GACnF,IAAI,WAAW,QAAQ;IACrB,OAAO,MAAM,gBAAgB,OAAO,YAAY,QAAQ,gBAAgB,aAAa;IACrF,kBAAkB,OAAO,IAAI;GAC/B,OAAO;IACL,OAAO,KAAK,6BAA6B;KACvC,SAAS,WAAW;KACpB,QAAQ,WAAW,UAAU,2BAA2B;IAC1D,CAAC;GACH;EACF;EAEA,MAAM,SAAS,OAAO,eAA+B;GACnD,kBAAkB,qBAAqB,WAAW,QAAQ,KAAK;GAC/D,IAAI,MAAM,OAAO,uBAAuB;IACtC,MAAM,aAAa;IACnB,MAAM,UAAU,wBAAwB,YAAsC;KAC5E,kBAAkB,WAAW,SAAS,mBAAmB;KACzD;IACF,CAAC;IACD,OAAO,MAAM,4CAA4C,EAAE,eAAe,QAAQ,CAAC;GACrF;EACF;EAEA,OAAO,KAAK,4BAA4B;GACtC,SAAS,QAAQ,MAAM,eAAe;GACtC,MAAM,QAAQ,IAAI;GAClB,WAAW,OAAO,cAAc,oBAAoB,cAAc;EACpE,CAAC;EAED,OAAO;CACT;AACF;AAEA,OAAO,MAAM,oBAA4B,wBAAwB;AAEjE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAIrB,SACE,yBACA,mBACA,0BAKK;AAEP,SACE,eACA,iBACA,mBACA,eACA,sBACA,yBACA,aACA,mBACA,yBAUK;AAEP,SACE,0BACA,uBACA,yBACA,0BAGK;AAEP,SACE,mBACA,mBACA,+BAIK;AACP,SACE,oBACA,sBACA,0BAIK;AAEP,MAAM,sBAAsB;;;;;;;;;;;;;;AA+C5B,SAAS,qBAAqB,QAA+B,aAAqC;CAChG,MAAM,WAAW,wBAAwB,OAAO;CAChD,MAAM,aAAa,qBAAqB,KAAK,QAAQ,IAAI,6BAA6B,EAAE;CAExF,MAAM,SAAS,OAAiB,OAAe,WAAuB;EACpE,IAAI,mBAAmB,SAAS,mBAAmB,YAAY,IAAI;GACjE;EACF;EACA,IAAI,YAAY;GACd,SAAS,MAAM,CAAC,OAAO,MAAM;EAC/B;EACA,MAAM,YAAY,UAAU,UAAU,UAAU;EAChD,KAAK,OAAO,IACT,IAAI,EACH,MAAM;GAAE,SAAS;GAAqB,OAAO;GAAW,SAAS;GAAO,OAAO;EAAO,EACxF,CAAC,CAAC,CACD,YAAY;;EAEb,CAAC;CACL;CAEA,OAAO;EACL,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;CACxD;AACF;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;AAQA,SAAS,qBACP,WACA,QACA,UACM;CACN,IAAI,OAAO;CACX,MAAM,cAAc;EAClB,IAAI,MAAM;GACR;EACF;EACA,OAAO;EACP,KAAK,MAAM,aAAa,UAAU;GAChC,UAAU,QAAQ;EACpB;EACA,KAAK,UAAU,SAAS,CAAC,CAAC,OAAO,UAAU;GACzC,OAAO,KAAK,oCAAoC,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;EACjF,CAAC;CACH;CACA,QAAQ,KAAK,cAAc,KAAK;CAChC,QAAQ,KAAK,UAAU,KAAK;CAC5B,QAAQ,KAAK,WAAW,KAAK;AAC/B;;;;;;;;;;;;;;;;AAiBA,SAAS,yBAAyB,SAA8C;CAC9E,OAAO;EACL,SAAS,YAAyD;GAChE,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,MAAM,CAAC;IAClE,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,QAAQ;IACN,OAAO;GACT;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;AAOA,SAAS,yBACP,WACA,SACA,QACoC;CACpC,OAAO,OAAO,OAAO,WAAW;EAC9B,MAAM,aAAa,MAAM,OAAO,cAAc,MAAM,UAAU,MAAM;EACpE,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,UAAU,GAAG;GAC7C,OAAO,MAAM,4CAA4C,EAAE,WAAW,CAAC;GACvE;EACF;EACA,IAAI;GACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,KAAK,CAAC;GACjE,OAAO,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;GACvE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;EACpE,QAAQ;GACN,OAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC;EAC9D;CACF;AACF;;;;;;;;AASA,SAAS,0BACP,MACA,UACsB;CACtB,OAAO;EACL,IAAI,KAAK;EACT,MAAM,SAAS,QAAQ,KAAK;EAC5B,QAAQ,KAAK;EACb,SAAS,SAAS;EAClB,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,QAAQ,KAAK;EACb,qBAAqB,SAAS,uBAAuB;EACrD,eAAe,SAAS,iBAAiB,CAAC;EAC1C,uBAAuB,KAAK;EAC5B,eAAe,KAAK;EACpB,6BAA6B,KAAK;EAClC,SAAS,KAAK;EACd,cAAc,KAAK;EACnB,UAAU,KAAK;EACf,MAAM,KAAK;EACX,oBAAoB,KAAK;EACzB,uBAAuB,KAAK;CAC9B;AACF;;;;;;;;;;;;;;;;;;;;AA2BA,eAAe,oBACb,YACA,UACA,MACA,OACA,QACA,gBACe;CACf,MAAM,aAAa,KAAK;CAExB,IAAI,CAAC,MAAM,UAAU,kBAAkB,YAAY,UAAU,GAAG;EAC9D,IAAI,CAAC,MAAM,oBAAoB;GAC7B,MAAM,qBAAqB;GAC3B,OAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC;EAC7E;EACA;CACF;CAEA,IAAI,CAAC,MAAM,QAAQ;EACjB,MAAM,SAAS,IAAI,wBACjB;GACE,SAAS,CAAC,0BAA0B,MAAM,QAAQ,CAAC;GACnD,gBAAgB;EAClB,GACA;GACE;GACA,WAAW,eAAe;GAC1B,oBAAoB,eAAe;GACnC,UAAU,eAAe,WACrB,KAAK,eAAe,UAAU,oBAAoB,oBAAoB,IACtE;GACJ,uBAAuB;GACvB,cAAc;EAChB,CACF;CACF;CAEA,IAAI,CAAC,MAAM,SAAS;EAClB,MAAM,MAAM,OAAO,WAAW;EAC9B,MAAM,MAAM,OAAO,MAAM,EAAE,QAAQ,KAAK,CAAC;EACzC,MAAM,UAAU;CAClB;CAEA,MAAM,YAAa,WAAW,aAAa,CAAC;CAC5C,MAAM,iBAAkB,UAAU,gBAAgB,CAAC;CACnD,MAAM,kBAAmB,eAAe,WAAW,CAAC;CAEpD,eAAe,MAAM,mBAAmB,SAAS,WAAW;CAC5D,eAAe,OAAO,eAAe,QAAQ,SAAS,QAAQ;CAC9D,eAAe,UAAU,yBACvB;EAAE,GAAG;EAAiB,SAAS,SAAS;CAAQ,GAChD,SAAS,aACT,YACA,MACF;CAEA,MAAM,SAAS,MAAM,OAAO,gBAAgB,UAAU;CACtD,IAAI,OAAO,SAAS,GAAG;EACrB,sBAAsB,gBAAgB,MAAM;CAC9C;CAEA,OAAO,MAAM,uCAAuC;EAAE;EAAY,YAAY,OAAO;CAAO,CAAC;AAC/F;;;;;;;;;;;;;AAmBA,SAAS,gCACP,MACA,KACA,QACM;CACN,MAAM,WACJ,KAAK,iBAAiB,aACtB,KAAK,gBAAgB,aACrB,KAAK,gBAAgB,aACrB,QAAQ,IAAI,2BAA2B,KACvC,QAAQ,IAAI,0BAA0B,KACtC,QAAQ,IAAI,0BAA0B;CACxC,IAAI,UAAU;EACZ,OAAO,MAAM,0CAA0C,EACrD,QACE,mHACJ,CAAC;CACH;AACF;;;;;;;AAQA,eAAe,gBACb,OACA,YACA,QACA,gBACA,SACqB;CACrB,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,MAAM,YAAY,MAAM,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACrE,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,MAAM,SAAS;EAC5B,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,OAAO,IAAI;CAClE,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;EACpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,CAAC;CAC3D;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;CAAS;AACxC;AAEA,SAAS,kBAAkB,OAAc,MAAwB;CAC/D,MAAM,EAAE,aAAa;CACrB,MAAM,QAAQ,OAAO,EAAE,YAAY;EACjC,SAAS,QAAQ,KAAK;CACxB;CACA,MAAM,kBAAkB,OAAO,WAAW,eAAe;EACvD,SAAS,cAAc,WAAW,UAAU;CAC9C;CACA,MAAM,yBAAyB,OAAO,cAAc;EAClD,SAAS,aAAa,SAAS;CACjC;CACA,MAAM,wBAAwB,OAAO,WAAW,eAAe;EAC7D,SAAS,YAAY,WAAW,UAAU;CAC5C;CACA,MAAM,iBAAiB,OAAO,aAAa,iBAAiB;EAC1D,SAAS,aAAa,aAAa,YAAY;CACjD;CACA,MAAM,oBAAoB,OAAO,iBAAiB,qBAAqB;EACrE,SAAS,gBAAgB,iBAAiB,gBAAgB;CAC5D;CACA,MAAM,gCAAgC,OAAO,WAAW,eAAe;EACrE,SAAS,eAAe,WAAW,UAAU;CAC/C;CACA,MAAM,0CAA0C,OAAO,iBAAiB,qBAAqB;EAC3F,SAAS,yBAAyB,iBAAiB,gBAAgB;CACrE;AACF;;;;;;;;;;;AAYA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GAC3C;CACR,OAAO,OAAO,OAAoB,kBAAkC;EAClE,IAAI,kBAA4B;EAChC,MAAM,SACJ,eAAe,UAAU,qBAAqB,MAAM,cAAc,eAAe;EAEnF,IAAI;EACJ,IAAI;GACF,SAAS,wBAAwB,aAAa;EAChD,SAAS,OAAO;;;GAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;GAC1E,OAAO,EACL,QAAQ,OAAO,eAA+B;IAC5C,kBAAkB,qBAAqB,WAAW,QAAQ,KAAK;GACjE,EACF;EACF;EAEA,MAAM,oBAAoB,kBAAkB,MAAM;EAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;GAG1C,OAAO,KAAK,+BAA+B;IACzC,SAAS,QAAQ,OAAO,OAAO;IAC/B,MAAM,QAAQ,OAAO,IAAI;GAC3B,CAAC;EACH;;;;;EAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;EAC7C,MAAM,gBAAoD,oBACtD,aAAa,OAAO,MAAM,OAAO,WAAW;GAC1C;GACA,WAAW,eAAe;GAC1B,oBAAoB,eAAe;GACnC,UAAU,eAAe;GACzB,mBAAmB,eAAe;GAClC,UAAU,OAAO,SAAS,YAAY;EACxC,CAAC,IACD;EAEJ,MAAM,QAAe,CAAC;;EAGtB,MAAM,gBAAqC;GAAE,SAAS;GAAO,oBAAoB;EAAM;;;;EAKvF,IAAI,OAAO,WAAW,eAAe;GACnC,MAAM,kBAAkB,yBACtB,IAAI,IAAI,OAAO,QAAQ,SAAS,GAChC,eACA,MACF;EACF;;EAGA,IAAI;EACJ,IAAI,OAAO,MAAM;GACf,MAAM,aAAa,kBAAkB,OAAO,MAAM,eAAe,OAAO,QAAQ,GAAG;GACnF,IAAI,WAAW,QAAQ;IACrB,gCAAgC,OAAO,MAAM,eAAe,OAAO,QAAQ,KAAK,MAAM;IACtF,OAAO,MAAM,gBAAgB,OAAO,YAAY,QAAQ,gBAAgB,aAAa;IACrF,kBAAkB,OAAO,IAAI;GAC/B,OAAO;IACL,OAAO,KAAK,6BAA6B;KACvC,SAAS,WAAW;KACpB,QAAQ,WAAW,UAAU,2BAA2B;IAC1D,CAAC;GACH;EACF;EAEA,MAAM,SAAS,OAAO,eAA+B;GACnD,kBAAkB,qBAAqB,WAAW,QAAQ,KAAK;GAE/D,IAAI,OAAO,UAAU;IACnB,MAAM,oBACJ,YAGA,OAAO,UACP,OAAO,MACP,eACA,QACA,cACF;GACF;GAEA,IAAI,MAAM,OAAO,uBAAuB;IACtC,MAAM,aAAa;IACnB,MAAM,UAAU,wBAAwB,YAAsC;KAC5E,kBAAkB,WAAW,SAAS,mBAAmB;KACzD;IACF,CAAC;IACD,OAAO,MAAM,4CAA4C,EAAE,eAAe,QAAQ,CAAC;GACrF;EACF;EAEA,OAAO,KAAK,4BAA4B;GACtC,SAAS,QAAQ,MAAM,eAAe;GACtC,UAAU,OAAO,SAAS,YAAY;GACtC,MAAM,QAAQ,IAAI;GAClB,UAAU,QAAQ,OAAO,QAAQ;GACjC,WAAW,OAAO,cAAc,oBAAoB,cAAc;EACpE,CAAC;EAED,OAAO;CACT;AACF;AAEA,OAAO,MAAM,oBAA4B,wBAAwB;AAEjE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}

package/dist/plugin.d.ts

@@ -1,12 +1,28 @@
 import { type AuthServerConfig, type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
 /**
-* Identity for the umbrella's single `TokenRuntime` (ADR-0012). Constant
-* because v1 is single-IdP, same rationale as repo-auth's `HUMAN_IDENTITY`.
+* Legacy identity for the exchanged project-token store (UNCHANGED by
+* ADR-0017 — see `migration.ts`'s module doc for why only the ROOT token
+* relocated). Kept as a constant, not `auth.id`, because the exchanged-token
+* cache key has always been derived from this literal, independent of the
+* configured IdP's `id`.
 */
 export declare const LIGHTBRIDGE_IDENTITY = "lightbridge";
-/** Own cache namespace — separate from oauth2/repo-auth/otel's stores. */
+/** Own cache namespace for the exchanged-token store — separate from oauth2/repo-auth/otel's. */
 export declare const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 /**
+* ADR-0017: the human ROOT token now lives in the SAME cache file
+* `@vymalo/opencode-oauth2` uses for a server of this id —
+* `<cacheRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`, a fused
+* `CachedServerState` (token + discovered models). This is what lets a
+* developer who configures the same IdP (`auth.id` == an oauth2 `servers[].id`,
+* same issuer/clientId) log in ONCE and have both plugins read/write the same
+* on-disk state. The literals are pinned here (not imported from
+* `@vymalo/opencode-oauth2`, which lightbridge does not depend on) — see
+* `docs/adr/0017-lightbridge-all-in-one.md` for the shared-contract rationale.
+*/
+export declare const ROOT_CACHE_SEGMENT = "opencode-oauth2";
+export declare const ROOT_CACHE_NAMESPACE = "opencode-oauth2-model-sync";
+/**
 * Cache key for the default-project token — used when no `projectId` is
 * configured, so the exchange sends no `project_id` and the backend mints a
 * token for the caller's default project (ADR-0012). Distinct from any real
@@ -17,9 +33,16 @@ export interface LightbridgeRuntimeOptions {
 	logger?: Logger;
 	fetchImpl?: typeof fetch;
 	onAuthorizationUrl?: (url: string) => Promise<void> | void;
-	/** Override the cache root (defaults to the OS cache dir convention). */
+	/** Override the cache ROOT (defaults to the OS cache dir convention) — both
+	*  the shared root-token store and the exchange-only store are joined from
+	*  this. Test seam; production callers omit it. */
 	cacheDir?: string;
 	tokenExpirySkewMs?: number;
+	/**
+	* Whether to perform the RFC 8693 exchange (ADR-0012) rather than use the
+	* IdP access token directly as the bearer. Defaults to `false` (ADR-0017).
+	*/
+	exchange?: boolean;
 }
 /**
 * The minimal surface `opencode.ts` needs from the shared runtime — narrow on
@@ -38,50 +61,81 @@ export interface LightbridgeRuntimeLike {
 */
 export type LightbridgeRuntimeFactory = (auth: AuthServerConfig, projectId: string | undefined, options: LightbridgeRuntimeOptions) => LightbridgeRuntimeLike;
 /**
-* The ONE shared `TokenRuntime` the umbrella plugin builds (ADR-0012): a
-* single human login, reused as the subject token for a project-scoped RFC
-* 8693 exchange whose result is consumed by BOTH the gateway (`chat.headers`)
-* and OTEL (`TokenSource.headers()`) — that sharing is the entire point of
-* the plugin. Lifecycle mirrors `@vymalo/opencode-repo-auth`'s "model b"
-* (`RepoAuthPlugin.resolveProjectToken`): auth-core has no higher-level
-* primitive for this yet, so the umbrella keeps its own thin copy rather than
-* reaching into a sibling package's internals.
+* The ONE shared runtime the umbrella plugin builds (ADR-0012, amended by
+* ADR-0017): a single human login, reused as the subject token for a
+* project-scoped RFC 8693 exchange (when `gateway.exchange` is `true`) or
+* used directly as the gateway/OTEL bearer (the new default) — consumed by
+* BOTH the gateway (`chat.headers`) and OTEL (`TokenSource.headers()`).
+*
+* The human root token itself is no longer lightbridge-exclusive storage: it
+* lives in the SAME cache file `@vymalo/opencode-oauth2` writes for a server
+* of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`), so configuring
+* both plugins against the same IdP (`auth.id` matching an oauth2
+* `servers[].id`, same issuer/clientId) means logging in once. An upgrading
+* install's pre-existing root token is migrated in automatically — see
+* `migration.ts`.
 */
 export declare class LightbridgeRuntime implements LightbridgeRuntimeLike {
 	private readonly projectId;
-	private readonly runtime;
+	private readonly rootRuntime;
+	private readonly sharedStore;
+	private readonly exchangeRuntime;
 	private readonly logger;
 	private readonly tokenExpirySkewMs;
+	private readonly exchange;
+	private readonly cacheRoot;
+	private readonly serverId;
 	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
 	private readonly projectKey;
 	private inFlightExchange?;
+	private migration?;
 	constructor(auth: AuthServerConfig, projectId: string | undefined, options?: LightbridgeRuntimeOptions);
+	/**
+	* One-time (per instance) migration of a pre-ADR-0017 root token into the
+	* shared cache file — see `migration.ts`. Idempotent and cheap on every
+	* call after the first (the underlying function also short-circuits once
+	* the new location has ANY state).
+	*/
+	private ensureMigrated;
 	/** Non-network read of the cached project token, if any. */
 	getCachedProjectToken(): Promise<TokenSet | undefined>;
 	/**
-	* Resolve a usable project token, shared by every caller (gateway
-	* `chat.headers`, OTEL `TokenSource.headers()`):
+	* Resolve a usable gateway/OTEL bearer, shared by every caller (gateway
+	* `chat.headers`, OTEL `TokenSource.headers()`).
+	*
+	* `gateway.exchange: false` (default, ADR-0017): the IdP access token IS
+	* the bearer — just `ensure()` the shared root token (refresh-only unless
+	* `interactive`).
+	*
+	* `gateway.exchange: true` (ADR-0012, unchanged):
 	*
-	*   cached usable? ──yes──▶ return it
+	*   cached exchanged token usable? ──yes──▶ return it
 	*         │ no
 	*         ▼
-	*   ensure human root (refresh-only unless `interactive`)
+	*   ensure shared human root (refresh-only unless `interactive`)
 	*         ▼
 	*   exchangeTo(projectKey, humanToken, projectId ? { project_id } : {})
 	*         ▼           (no projectId → backend picks the default project)
 	*   cache + return
 	*
-	* Concurrent callers (a chat request racing an OTEL export) share the
-	* in-flight exchange — at most one exchange POST per cache-miss window.
-	* Never invents a token: an exchange failure propagates to the caller,
-	* which is expected to fail closed (no header / empty `headers()`).
+	* Concurrent callers share the in-flight exchange in either mode. Never
+	* invents a token: a failure propagates to the caller, which is expected to
+	* fail closed (no header / empty `headers()`).
 	*/
 	getProjectToken(options?: {
 		interactive?: boolean;
 	}): Promise<TokenSet>;
 	private performExchange;
-	/** Drop the on-disk human + project tokens for this identity. */
+	/**
+	* Drop the cached tokens for this identity: the exchanged project token
+	* entirely (its own exclusive store), and the shared root token's `token`
+	* field only — NOT the whole shared cache file, which may also hold
+	* `@vymalo/opencode-oauth2`'s discovered models for this server id and must
+	* survive a lightbridge-side logout.
+	*/
 	reset(): Promise<void>;
 }
-/** Absolute path to the lightbridge cache directory (for diagnostics / tests). */
+/** Absolute path to the lightbridge-exclusive (exchanged-token) cache directory. */
 export declare function lightbridgeCacheDir(cacheRoot: string): string;
+/** Absolute path to the SHARED root-token cache directory (ADR-0017). */
+export declare function rootCacheDir(cacheRoot: string): string;

package/dist/plugin.js

@@ -1,13 +1,31 @@
 import { join } from "node:path";
 import { createJsonConsoleLogger, DEFAULT_TOKEN_EXPIRY_SKEW_MS, resolveCacheRoot, TokenRuntime } from "@vymalo/opencode-auth-core/lib";
+import { FileCacheStore as SharedFileCacheStore } from "@vymalo/opencode-provider-sync/lib";
+import { migrateRootTokenIfNeeded } from "./migration.js";
 /**
-* Identity for the umbrella's single `TokenRuntime` (ADR-0012). Constant
-* because v1 is single-IdP, same rationale as repo-auth's `HUMAN_IDENTITY`.
+* Legacy identity for the exchanged project-token store (UNCHANGED by
+* ADR-0017 — see `migration.ts`'s module doc for why only the ROOT token
+* relocated). Kept as a constant, not `auth.id`, because the exchanged-token
+* cache key has always been derived from this literal, independent of the
+* configured IdP's `id`.
 */
 export const LIGHTBRIDGE_IDENTITY = "lightbridge";
-/** Own cache namespace — separate from oauth2/repo-auth/otel's stores. */
+/** Own cache namespace for the exchanged-token store — separate from oauth2/repo-auth/otel's. */
 export const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 /**
+* ADR-0017: the human ROOT token now lives in the SAME cache file
+* `@vymalo/opencode-oauth2` uses for a server of this id —
+* `<cacheRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`, a fused
+* `CachedServerState` (token + discovered models). This is what lets a
+* developer who configures the same IdP (`auth.id` == an oauth2 `servers[].id`,
+* same issuer/clientId) log in ONCE and have both plugins read/write the same
+* on-disk state. The literals are pinned here (not imported from
+* `@vymalo/opencode-oauth2`, which lightbridge does not depend on) — see
+* `docs/adr/0017-lightbridge-all-in-one.md` for the shared-contract rationale.
+*/
+export const ROOT_CACHE_SEGMENT = "opencode-oauth2";
+export const ROOT_CACHE_NAMESPACE = "opencode-oauth2-model-sync";
+/**
 * Cache key for the default-project token — used when no `projectId` is
 * configured, so the exchange sends no `project_id` and the backend mints a
 * token for the caller's default project (ADR-0012). Distinct from any real
@@ -15,10 +33,9 @@ export const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 */
 export const DEFAULT_PROJECT_KEY = "__default__";
 /**
-* Whether a cached project token is usable. Mirrors repo-auth's
-* `isProjectTokenUsable`: the project token carries no refresh token, so an
-* undefined `expiresAt` must be treated as expired (re-exchange), never as
-* non-expiring.
+* Whether a cached project token is usable. The project token carries no
+* refresh token, so an undefined `expiresAt` must be treated as expired
+* (re-exchange), never as non-expiring.
 */
 function isProjectTokenUsable(token, skewMs) {
 	if (!token?.accessToken) {
@@ -30,59 +47,148 @@ function isProjectTokenUsable(token, skewMs) {
 	return Date.now() + skewMs < token.expiresAt;
 }
 /**
-* The ONE shared `TokenRuntime` the umbrella plugin builds (ADR-0012): a
-* single human login, reused as the subject token for a project-scoped RFC
-* 8693 exchange whose result is consumed by BOTH the gateway (`chat.headers`)
-* and OTEL (`TokenSource.headers()`) — that sharing is the entire point of
-* the plugin. Lifecycle mirrors `@vymalo/opencode-repo-auth`'s "model b"
-* (`RepoAuthPlugin.resolveProjectToken`): auth-core has no higher-level
-* primitive for this yet, so the umbrella keeps its own thin copy rather than
-* reaching into a sibling package's internals.
+* Build the ONE shared root `TokenRuntime` for `serverId`, persisting through
+* the SAME fused `CachedServerState` shape+location `ProviderModelSyncEngine`
+* uses (see `ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE` above) — mirroring the
+* override pattern in `@vymalo/opencode-provider-sync`'s
+* `ProviderModelSyncEngine.buildTokenRuntime` (extract `.token`, preserve
+* `.models`/`.rawModels` on write) but WITHOUT running that engine's
+* scheduler/model-discovery — this is a read/refresh-only participant in the
+* shared cache file, not a second poller (see ADR-0017's double-scheduling
+* guard, enforced inside the engine itself for the `register` path).
+*
+* Unlike `ProviderModelSyncEngine`, this performs no cross-process
+* "adopt-if-newer" reconciliation — every `getCached()` call here reads disk
+* fresh and takes it as-is. That is deliberately simpler (no in-memory
+* snapshot to reconcile against) and still safe: a momentarily unreadable/
+* missing file degrades to "no cached token" (a safe, if suboptimal,
+* fallback), and refreshes are still coordinated via `TokenRuntime`'s own
+* cross-process file lock.
+*/
+function buildSharedRootTokenRuntime(serverId, auth, sharedStore, options) {
+	return new TokenRuntime(serverId, auth, {
+		logger: options.logger,
+		fetchImpl: options.fetchImpl,
+		onAuthorizationUrl: options.onAuthorizationUrl,
+		tokenExpirySkewMs: options.tokenExpirySkewMs,
+		serviceLabel: "opencode-lightbridge",
+		getCached: async () => {
+			const state = await sharedStore.loadServerState(serverId);
+			return state?.token;
+		},
+		setCached: async (token) => {
+			const existing = await sharedStore.loadServerState(serverId);
+			const next = {
+				serverId,
+				updatedAt: Date.now(),
+				lastSyncAt: existing?.lastSyncAt,
+				models: existing?.models ?? [],
+				rawModels: existing?.rawModels ?? [],
+				token
+			};
+			await sharedStore.saveServerState(next);
+		}
+	});
+}
+/**
+* The ONE shared runtime the umbrella plugin builds (ADR-0012, amended by
+* ADR-0017): a single human login, reused as the subject token for a
+* project-scoped RFC 8693 exchange (when `gateway.exchange` is `true`) or
+* used directly as the gateway/OTEL bearer (the new default) — consumed by
+* BOTH the gateway (`chat.headers`) and OTEL (`TokenSource.headers()`).
+*
+* The human root token itself is no longer lightbridge-exclusive storage: it
+* lives in the SAME cache file `@vymalo/opencode-oauth2` writes for a server
+* of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`), so configuring
+* both plugins against the same IdP (`auth.id` matching an oauth2
+* `servers[].id`, same issuer/clientId) means logging in once. An upgrading
+* install's pre-existing root token is migrated in automatically — see
+* `migration.ts`.
 */
 export class LightbridgeRuntime {
 	projectId;
-	runtime;
+	rootRuntime;
+	sharedStore;
+	exchangeRuntime;
 	logger;
 	tokenExpirySkewMs;
+	exchange;
+	cacheRoot;
+	serverId;
 	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
 	projectKey;
 	inFlightExchange;
+	migration;
 	constructor(auth, projectId, options = {}) {
 		this.projectId = projectId;
+		this.serverId = auth.id;
 		this.projectKey = projectId ?? DEFAULT_PROJECT_KEY;
 		this.logger = options.logger ?? createJsonConsoleLogger("info");
+		this.exchange = options.exchange ?? false;
+		this.cacheRoot = options.cacheDir ?? resolveCacheRoot();
 		this.tokenExpirySkewMs = typeof options.tokenExpirySkewMs === "number" && Number.isFinite(options.tokenExpirySkewMs) && options.tokenExpirySkewMs > 0 ? options.tokenExpirySkewMs : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
-		this.runtime = new TokenRuntime(LIGHTBRIDGE_IDENTITY, auth, {
+		this.sharedStore = new SharedFileCacheStore(join(this.cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE), this.logger);
+		this.rootRuntime = buildSharedRootTokenRuntime(this.serverId, auth, this.sharedStore, options);
+		// The exchange-only runtime keeps its OWN dedicated, lightbridge-exclusive
+		// store (unchanged location/shape) — there is no oauth2 equivalent for a
+		// project-scoped exchanged token, so nothing to share here.
+		this.exchangeRuntime = new TokenRuntime(LIGHTBRIDGE_IDENTITY, auth, {
 			logger: this.logger,
 			fetchImpl: options.fetchImpl,
 			onAuthorizationUrl: options.onAuthorizationUrl,
-			cacheDir: options.cacheDir ?? join(resolveCacheRoot(), DEFAULT_CACHE_NAMESPACE),
-			tokenExpirySkewMs: this.tokenExpirySkewMs
+			cacheDir: join(this.cacheRoot, DEFAULT_CACHE_NAMESPACE),
+			tokenExpirySkewMs: this.tokenExpirySkewMs,
+			serviceLabel: "opencode-lightbridge"
 		});
 	}
+	/**
+	* One-time (per instance) migration of a pre-ADR-0017 root token into the
+	* shared cache file — see `migration.ts`. Idempotent and cheap on every
+	* call after the first (the underlying function also short-circuits once
+	* the new location has ANY state).
+	*/
+	ensureMigrated() {
+		if (!this.migration) {
+			this.migration = migrateRootTokenIfNeeded(this.cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE, this.serverId, this.logger).catch((error) => {
+				// Never fatal: worst case is a fresh login, same as a first-ever
+				// install. Swallow so a migration hiccup can't break normal auth.
+				this.logger.debug("lightbridge_root_migration_error", { error: error instanceof Error ? error.message : String(error) });
+			});
+		}
+		return this.migration;
+	}
 	/** Non-network read of the cached project token, if any. */
 	async getCachedProjectToken() {
-		return this.runtime.getExchangedByKey(this.projectKey);
+		return this.exchangeRuntime.getExchangedByKey(this.projectKey);
 	}
 	/**
-	* Resolve a usable project token, shared by every caller (gateway
-	* `chat.headers`, OTEL `TokenSource.headers()`):
+	* Resolve a usable gateway/OTEL bearer, shared by every caller (gateway
+	* `chat.headers`, OTEL `TokenSource.headers()`).
+	*
+	* `gateway.exchange: false` (default, ADR-0017): the IdP access token IS
+	* the bearer — just `ensure()` the shared root token (refresh-only unless
+	* `interactive`).
+	*
+	* `gateway.exchange: true` (ADR-0012, unchanged):
 	*
-	*   cached usable? ──yes──▶ return it
+	*   cached exchanged token usable? ──yes──▶ return it
 	*         │ no
 	*         ▼
-	*   ensure human root (refresh-only unless `interactive`)
+	*   ensure shared human root (refresh-only unless `interactive`)
 	*         ▼
 	*   exchangeTo(projectKey, humanToken, projectId ? { project_id } : {})
 	*         ▼           (no projectId → backend picks the default project)
 	*   cache + return
 	*
-	* Concurrent callers (a chat request racing an OTEL export) share the
-	* in-flight exchange — at most one exchange POST per cache-miss window.
-	* Never invents a token: an exchange failure propagates to the caller,
-	* which is expected to fail closed (no header / empty `headers()`).
+	* Concurrent callers share the in-flight exchange in either mode. Never
+	* invents a token: a failure propagates to the caller, which is expected to
+	* fail closed (no header / empty `headers()`).
 	*/
 	async getProjectToken(options = {}) {
+		await this.ensureMigrated();
+		if (!this.exchange) {
+			return this.rootRuntime.ensure({ interactive: options.interactive });
+		}
 		const cached = await this.getCachedProjectToken();
 		if (isProjectTokenUsable(cached, this.tokenExpirySkewMs)) {
 			this.logger.trace("lightbridge_exchange_cache_hit", { projectId: this.projectId });
@@ -103,12 +209,12 @@ export class LightbridgeRuntime {
 		}
 	}
 	async performExchange(options) {
-		const human = await this.runtime.ensure({ interactive: options.interactive });
+		const human = await this.rootRuntime.ensure({ interactive: options.interactive });
 		this.logger.info("lightbridge_exchange_started", { projectId: this.projectId ?? "(default)" });
 		try {
 			// No `projectId` → send no `project_id` param; the backend mints a token
 			// for the caller's default project (ADR-0012).
-			const exchanged = await this.runtime.exchangeTo(this.projectKey, human.accessToken, this.projectId ? { project_id: this.projectId } : {});
+			const exchanged = await this.exchangeRuntime.exchangeTo(this.projectKey, human.accessToken, this.projectId ? { project_id: this.projectId } : {});
 			this.logger.info("lightbridge_exchange_success", { projectId: this.projectId ?? "(default)" });
 			return exchanged;
 		} catch (error) {
@@ -119,14 +225,32 @@ export class LightbridgeRuntime {
 			throw error;
 		}
 	}
-	/** Drop the on-disk human + project tokens for this identity. */
+	/**
+	* Drop the cached tokens for this identity: the exchanged project token
+	* entirely (its own exclusive store), and the shared root token's `token`
+	* field only — NOT the whole shared cache file, which may also hold
+	* `@vymalo/opencode-oauth2`'s discovered models for this server id and must
+	* survive a lightbridge-side logout.
+	*/
 	async reset() {
-		await this.runtime.reset();
+		await this.exchangeRuntime.reset();
+		const existing = await this.sharedStore.loadServerState(this.serverId);
+		if (existing?.token) {
+			await this.sharedStore.saveServerState({
+				...existing,
+				updatedAt: Date.now(),
+				token: undefined
+			});
+		}
 	}
 }
-/** Absolute path to the lightbridge cache directory (for diagnostics / tests). */
+/** Absolute path to the lightbridge-exclusive (exchanged-token) cache directory. */
 export function lightbridgeCacheDir(cacheRoot) {
 	return join(cacheRoot, DEFAULT_CACHE_NAMESPACE);
 }
+/** Absolute path to the SHARED root-token cache directory (ADR-0017). */
+export function rootCacheDir(cacheRoot) {
+	return join(cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE);
+}
 
 //# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;;;;;AAMP,OAAO,MAAM,uBAAuB;;AAGpC,OAAO,MAAM,0BAA0B;;;;;;;AAQvC,OAAO,MAAM,sBAAsB;;;;;;;AAqCnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;AAYA,OAAO,MAAM,mBAAqD;CAU7C;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,UAAU,IAAI,aAAa,sBAAsB,MAAM;GAC1D,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,QAAQ,YAAY,KAAK,iBAAiB,GAAG,uBAAuB;GAC9E,mBAAmB,KAAK;EAC1B,CAAC;CACH;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,QAAQ,kBAAkB,KAAK,UAAU;CACvD;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAC5E,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,QAAQ,WACnC,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;CAGA,MAAM,QAAuB;EAC3B,MAAM,KAAK,QAAQ,MAAM;CAC3B;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,uBAAuB;AAChD","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;AACP,SACE,kBAAkB,4BAEb;AAEP,SAAS,gCAAgC;;;;;;;;AASzC,OAAO,MAAM,uBAAuB;;AAGpC,OAAO,MAAM,0BAA0B;;;;;;;;;;;;AAavC,OAAO,MAAM,qBAAqB;AAClC,OAAO,MAAM,uBAAuB;;;;;;;AAQpC,OAAO,MAAM,sBAAsB;;;;;;AA2CnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,4BACP,UACA,MACA,aACA,SACc;CACd,OAAO,IAAI,aAAa,UAAU,MAAM;EACtC,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,cAAc;EACd,WAAW,YAAY;GACrB,MAAM,QAAQ,MAAM,YAAY,gBAAgB,QAAQ;GACxD,OAAO,OAAO;EAChB;EACA,WAAW,OAAO,UAAU;GAC1B,MAAM,WAAW,MAAM,YAAY,gBAAgB,QAAQ;GAC3D,MAAM,OAA0B;IAC9B;IACA,WAAW,KAAK,IAAI;IACpB,YAAY,UAAU;IACtB,QAAQ,UAAU,UAAU,CAAC;IAC7B,WAAW,UAAU,aAAa,CAAC;IACnC;GACF;GACA,MAAM,YAAY,gBAAgB,IAAI;EACxC;CACF,CAAC;AACH;;;;;;;;;;;;;;;;AAiBA,OAAO,MAAM,mBAAqD;CAgB7C;CAfnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CACR,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,WAAW,KAAK;EACrB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,WAAW,QAAQ,YAAY;EACpC,KAAK,YAAY,QAAQ,YAAY,iBAAiB;EACtD,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,cAAc,IAAI,qBACrB,KAAK,KAAK,WAAW,oBAAoB,oBAAoB,GAC7D,KAAK,MACP;EACA,KAAK,cAAc,4BAA4B,KAAK,UAAU,MAAM,KAAK,aAAa,OAAO;;;;EAK7F,KAAK,kBAAkB,IAAI,aAAa,sBAAsB,MAAM;GAClE,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,KAAK,KAAK,WAAW,uBAAuB;GACtD,mBAAmB,KAAK;GACxB,cAAc;EAChB,CAAC;CACH;;;;;;;CAQA,AAAQ,iBAAgC;EACtC,IAAI,CAAC,KAAK,WAAW;GACnB,KAAK,YAAY,yBACf,KAAK,WACL,oBACA,sBACA,KAAK,UACL,KAAK,MACP,CAAC,CAAC,OAAO,UAAU;;;IAGjB,KAAK,OAAO,MAAM,oCAAoC,EACpD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACH;EACA,OAAO,KAAK;CACd;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,gBAAgB,kBAAkB,KAAK,UAAU;CAC/D;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,MAAM,KAAK,eAAe;EAE1B,IAAI,CAAC,KAAK,UAAU;GAClB,OAAO,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EACrE;EAEA,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAChF,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,gBAAgB,WAC3C,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;;;;;;;CASA,MAAM,QAAuB;EAC3B,MAAM,KAAK,gBAAgB,MAAM;EACjC,MAAM,WAAW,MAAM,KAAK,YAAY,gBAAgB,KAAK,QAAQ;EACrE,IAAI,UAAU,OAAO;GACnB,MAAM,KAAK,YAAY,gBAAgB;IACrC,GAAG;IACH,WAAW,KAAK,IAAI;IACpB,OAAO;GACT,CAAC;EACH;CACF;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,uBAAuB;AAChD;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vymalo/opencode-lightbridge",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Umbrella OpenCode plugin for ADR-0012: one shared credential (TokenRuntime) drives both the LLM gateway bearer and OTEL export, so a developer authenticates once and every egress rides the same project-scoped token.",
   "license": "MIT",
   "author": "vymalo contributors",
@@ -53,8 +53,9 @@
     "@opencode-ai/plugin": "1.15.10",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.221.0",
-    "@vymalo/opencode-core-otel": "0.16.0",
-    "@vymalo/opencode-auth-core": "0.16.0"
+    "@vymalo/opencode-auth-core": "0.17.0",
+    "@vymalo/opencode-core-otel": "0.17.0",
+    "@vymalo/opencode-provider-sync": "0.17.0"
   },
   "devDependencies": {
     "@opentelemetry/sdk-logs": "^0.221.0",