@vymalo/opencode-lightbridge 0.16.1 → 0.18.0

package/README.md

@@ -2,21 +2,25 @@
 
 [![npm](https://img.shields.io/npm/v/@vymalo/opencode-lightbridge?label=npm&color=CB3837&logo=npm)](https://www.npmjs.com/package/@vymalo/opencode-lightbridge)
 
-**One login, every egress.** The umbrella OpenCode plugin for [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md):
-a single shared `TokenRuntime` drives **both** the LLM gateway bearer and the OTEL export
-credential, because both validate the same `lightbridge-authz` issuer + `aud=lightbridge-api-key`.
-Log in once as yourself; every egress that needs a project-scoped credential rides the same token.
+**The all-in-one plugin.** One credential drives everything: provider registration + model
+discovery ([`register`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md) —
+"everything `@vymalo/opencode-oauth2` does"), the LLM gateway bearer (`gateway`), and the OTEL
+export credential (`otel`) — see [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md)
+and [ADR-0017](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md).
+Log in once as yourself; every module that needs a credential rides the same login — and since
+ADR-0017, that login is shared with `@vymalo/opencode-oauth2` too, when both target the same IdP.
 
 Part of the [OpenCode Toolbelt](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit).
 
-## Why this instead of `opencode-repo-auth` + `opencode-otel`
+## Why this instead of `opencode-oauth2` + `opencode-repo-auth` + `opencode-otel`
 
-Running both standalone plugins works, but each holds its **own** credential in its **own** cache
-namespace — two logins, two token stores, no relationship between them. `@vymalo/opencode-lightbridge`
-composes `@vymalo/opencode-auth-core` (the OAuth/token-exchange primitive) and
-`@vymalo/opencode-core-otel` (the OTel engine) over **one** `TokenRuntime`, so the project-scoped
-token minted for the gateway is the exact same token OTEL presents to the collector. No forked
-engine logic — this package is a thin composition layer over its two sibling libraries.
+Running the standalone plugins works, but each holds its **own** credential in its **own** cache
+namespace — up to three logins, three token stores, no relationship between them.
+`@vymalo/opencode-lightbridge` composes `@vymalo/opencode-provider-sync` (the model-sync engine,
+for `register`), `@vymalo/opencode-auth-core` (the OAuth/token-exchange primitive), and
+`@vymalo/opencode-core-otel` (the OTel engine) over **one shared credential**, so the same token
+that registers your provider is the one the gateway injects and OTEL presents to the collector. No
+forked engine logic — this package composes its sibling libraries.
 
 ## Install
 
@@ -27,39 +31,61 @@ npm install @vymalo/opencode-lightbridge
 ```jsonc
 // opencode.json
 {
-  "plugin": [
-    ["@vymalo/opencode-lightbridge", {
-      "auth": {
-        "id": "lightbridge",
-        "issuer": "https://authz.example.com/realms/lightbridge",
-        "clientId": "opencode-cli",
-        "scopes": ["openid", "offline_access"],
-        "authFlow": "device_code"
-      },
-      "gateway": {
-        "projectId": "proj-123",
-        "providers": ["gateway"]
-      },
-      "otel": {
-        "endpoint": "http://localhost:4318"
+  "plugins": [
+    {
+      "package": "@vymalo/opencode-lightbridge",
+      "options": {
+        "auth": {
+          "id": "lightbridge",
+          "issuer": "https://authz.example.com/realms/lightbridge",
+          "clientId": "opencode-cli",
+          "scopes": ["openid", "offline_access"],
+          "authFlow": "device_code"
+        },
+        "gateway": {
+          "providers": ["gateway"],
+          "exchange": false
+        },
+        "otel": {
+          "endpoint": "http://localhost:4318"
+        },
+        "register": {
+          "baseURL": "https://gateway.example.com/v1"
+        }
       }
-    }]
+    }
   ]
 }
 ```
 
+If you also run `@vymalo/opencode-oauth2`, list it **before** lightbridge: lightbridge detects an
+oauth2-managed provider id from the `settings.oauth2` marker oauth2 stamps on the provider record.
+
 - **`auth`** (required) — the one IdP login, an `AuthServerConfigInput` (same shape as
-  `opencode-oauth2`/`opencode-repo-auth`'s per-provider auth block).
-- **`gateway`** (optional) — the OpenCode provider ids to inject `Authorization: Bearer
-  <project-token>` on, per request (plus an optional `projectId`).
+  `opencode-oauth2`/`opencode-repo-auth`'s per-provider auth block). `auth.id` also doubles as the
+  OpenCode provider id `register` uses and the shared cache identity (see below).
+- **`register`** (optional, [ADR-0017](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md)) —
+  register `auth`'s IdP as an OpenCode provider and keep its models in sync, via the same
+  `@vymalo/opencode-provider-sync` engine `opencode-oauth2` uses. Requires `register.baseURL`.
+- **`gateway`** (optional) — the OpenCode provider ids to inject a bearer on, per request (plus an
+  optional `gateway.exchange`/`projectId`).
+- **`gateway.exchange`** (optional, default `false`) — `false`: use the IdP access token directly.
+  `true`: RFC 8693-exchange it for a project-scoped token first (ADR-0012's original behaviour).
 - **`otel`** (optional) — the same `OtelPluginOptions` shape as `@vymalo/opencode-otel`
   (`endpoint`, `exporters`, `serviceName`, …), minus `tokenCommand`/`tokenHeader`/`tokenPrefix`: the
   shared runtime supersedes that seam entirely.
-- **`projectId`** (optional, top-level or under `gateway`) — **fully optional**: omit it and the
-  exchange sends no `project_id`, so the backend mints a token for your **default project**. An
-  explicit top-level `projectId` wins over `gateway.projectId`.
+- **`projectId`** (optional, top-level or under `gateway`) — only meaningful when
+  `gateway.exchange: true`. **Fully optional**: omit it and the exchange sends no `project_id`, so
+  the backend mints a token for your **default project**. An explicit top-level `projectId` wins
+  over `gateway.projectId`.
+
+Omitting `gateway`, `otel` and `register` is a valid, inert config — the plugin logs and no-ops.
 
-Omitting both `gateway` and `otel` is a valid, inert config — the plugin logs and no-ops.
+**One login, shared with oauth2.** Configure the same `id`/`issuer`/`clientId` as an
+`@vymalo/opencode-oauth2` server entry and logging in through either plugin makes the token
+available to both — no second device-code/browser flow. An existing pre-ADR-0017 install's cached
+login is migrated automatically on first use; no re-login is forced. See
+[`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md#one-login-shared-cache-with-oauth2-adr-0017).
 
 ## Scope: gateway + OTEL, not MCP
 
@@ -73,13 +99,50 @@ for the full reasoning.
 ## Full reference
 
 - [`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md)
-  — the one-credential design, full config reference, the three egresses.
+  — the all-in-one design, full config reference, migration notes.
 - [ADR-0012](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0012-single-auth-across-gateway-and-otel.md)
   — why one runtime, why MCP is excluded, the alternatives considered.
-- [`docs/repo-auth.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/repo-auth.md)
-  and [`docs/otel.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/otel.md)
-  — the two standalone plugins this package composes; useful for the config shapes it reuses.
+- [ADR-0017](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0017-lightbridge-all-in-one.md)
+  — `register`, the shared cache with oauth2, and the exchange becoming opt-in.
+- [`docs/repo-auth.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/repo-auth.md),
+  [`docs/otel.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/otel.md) and
+  [`docs/architecture.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/architecture.md)
+  (oauth2) — the standalone plugins this package composes; useful for the config shapes it reuses.
 
 ## License
 
 MIT
+
+## Migrating from v1
+
+`0.18.0` targets the OpenCode **v2** plugin API; `0.17.x` was the last v1 release. See
+[ADR-0019](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0019-opencode-v2-cutover.md)
+for why there is no dual-support build.
+
+| v1 | v2 |
+| --- | --- |
+| `"plugin": [["@vymalo/opencode-lightbridge", { ... }]]` | `"plugins": [{ "package": "@vymalo/opencode-lightbridge", "options": { ... } }]` |
+| `config.provider[<auth.id>]` registered by `register` | provider editor: `package: "aisdk:@ai-sdk/openai-compatible"`, `settings.baseURL` |
+| `chat.headers` (gateway bearer) | `session.hook("model.request")` |
+| OTEL observers (`event`, `chat.message`, `tool.execute.*`, …) | `event.subscribe` + `prompt` / `context` / `tool` / `permission` hooks |
+| trace propagation via `options.fetch` | `session.hook("http.request")` |
+| host `config.logLevel` | `options.logLevel`, else `OPENCODE_LOG_LEVEL` |
+| oauth2 collision via `pluginConfig` / `options.oauth2` | `settings.oauth2` marker on the provider record |
+
+The `auth`, `gateway`, `otel` and `register` option blocks are unchanged, as is every event name
+except where listed below.
+
+### Behaviour changes in v2
+
+- **Gateway failures now refuse the request.** A failed token resolution used to leave the request
+  to go out bearer-less (the gateway 401'd); it now dies the hook so a stale stamped `Authorization`
+  cannot ride along (`lightbridge_gateway_no_bearer`, now `warn`).
+- **List oauth2 before lightbridge** so the oauth2 collision marker is visible on the first pass.
+- **`session.diff`, `todo.updated` and `command.executed` are no longer observed** (no v2 mapping):
+  the lines-of-code metric and `opencode.file_edited` event stop being produced.
+- `experimental.compaction.autocontinue` is gone with no v2 equivalent.
+- `./lib` drops `oauth2ManagedProviderIds` and `OpenCodeConfigLike`; `hasOAuth2Conflict` now takes
+  a provider editor.
+
+The full list is in
+[`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md#behaviour-changes-in-v2).

package/dist/config.d.ts

@@ -7,9 +7,49 @@ export interface LightbridgeGatewayOptions {
 	/**
 	* Optional project id for the shared RFC 8693 exchange (ADR-0012). When
 	* omitted, the exchange sends no `project_id` and the backend mints a token
-	* for the caller's **default project**.
+	* for the caller's **default project**. Only meaningful when `exchange` is
+	* `true` — ignored otherwise (there is no exchange call to attach it to).
 	*/
 	projectId?: string;
+	/**
+	* Whether to perform the RFC 8693 token exchange (ADR-0012) before using
+	* the result as the gateway bearer. Defaults to `false` (ADR-0017 amends
+	* ADR-0012): most IdP setups hand out an access token that is already
+	* scoped for the gateway, and an unconditional exchange fails outright for
+	* a client that has no `token-exchange` grant registered (`unauthorized_client`).
+	*
+	* - `false` (default): the IdP access token from `auth` is used directly
+	*   as `Authorization: Bearer <token>` — no second network call, no extra
+	*   grant required.
+	* - `true`: today's ADR-0012 behaviour, unchanged — the human token is
+	*   exchanged for a project-scoped token (optionally carrying `project_id`)
+	*   and THAT is used as the bearer.
+	*/
+	exchange?: boolean;
+}
+/**
+* The `register` opt-in (ADR-0017): register `auth`'s IdP as an OpenCode
+* provider and keep its model list in sync via the SAME
+* `@vymalo/opencode-provider-sync` engine `@vymalo/opencode-oauth2` uses —
+* "everything oauth2 does", now available from lightbridge too. Independent
+* of `gateway` (header injection) and `otel`: a config can register a
+* provider without ever using it as the gateway bearer target, though the
+* common case sets `gateway.providers` to the same id.
+*/
+export interface LightbridgeRegisterOptions {
+	/** Base URL of the OpenAI-compatible (or Responses) inference endpoint. */
+	baseURL: string;
+	/** Display name for the registered OpenCode provider. Defaults to `auth.id`. */
+	name?: string;
+	/** Raw model id -> display name overrides, applied at discovery time. */
+	nameOverrides?: Record<string, string>;
+	/** Minutes between model-discovery syncs. Defaults to 60 (matches oauth2). */
+	syncIntervalMinutes?: number;
+	/**
+	* Route inference through the OpenAI Responses API instead of Chat
+	* Completions — see `@vymalo/opencode-provider-sync`'s `resolveProviderPackage`.
+	*/
+	responseApi?: boolean;
 }
 /**
 * Plugin options as written under the `opencode-lightbridge` entry of
@@ -26,9 +66,12 @@ export interface LightbridgeOptions {
 	* Optional project id for the shared project-scoped token exchange. Fully
 	* optional: when omitted, the exchange sends no `project_id` and the backend
 	* mints a token for the caller's **default project**. An explicit `projectId`
-	* here wins over `gateway.projectId` when both are set.
+	* here wins over `gateway.projectId` when both are set. Only meaningful
+	* when `gateway.exchange` is `true`.
 	*/
 	projectId?: string;
+	/** NEW (ADR-0017): register `auth`'s IdP as an OpenCode provider + sync its models. */
+	register?: LightbridgeRegisterOptions;
 }
 /** `LightbridgeOptions` after parsing: `auth` fully validated + defaulted. */
 export interface ParsedLightbridgeOptions {
@@ -37,6 +80,7 @@ export interface ParsedLightbridgeOptions {
 	otel?: OtelPluginOptions;
 	/** Resolved project id (`projectId` ?? `gateway.projectId`), if either was set. */
 	projectId?: string;
+	register?: LightbridgeRegisterOptions;
 }
 /**
 * Parse + validate the plugin's `pluginOptions` (2nd factory arg). `auth` is
@@ -49,7 +93,29 @@ export interface ParsedLightbridgeOptions {
 export declare function parseLightbridgeOptions(raw: unknown): ParsedLightbridgeOptions;
 /**
 * Whether the parsed config has a module (gateway or otel) that needs the
-* shared token — project-scoped when `projectId` is set, else a default-project
-* token. Determines whether the one shared runtime is built.
+* shared token — project-scoped when `projectId` is set (and `gateway.exchange`
+* is `true`), else the raw IdP token. Determines whether the one shared
+* runtime is built. `register` doesn't gate this: it drives a separate
+* `ProviderModelSyncEngine`, not `LightbridgeRuntime`.
 */
 export declare function needsProjectToken(options: ParsedLightbridgeOptions): boolean;
+/** The slice of a `ProviderEditor` the collision guard reads. */
+export interface ProviderLookup {
+	get(id: string): {
+		readonly provider: {
+			readonly settings?: unknown;
+		};
+	} | undefined;
+}
+/**
+* Whether `providerId` is (also) managed by `@vymalo/opencode-oauth2`, judged
+* from the provider record's `settings.oauth2` / `settings.oauth2ModelSync`
+* block. Used by lightbridge's `register` module to skip registering or owning
+* a provider oauth2 already claims (logged at `debug`).
+*
+* Order-sensitive: oauth2 stamps its marker inside its own provider transform,
+* so oauth2 must be listed BEFORE lightbridge in `plugin` for lightbridge to
+* see it on the first pass. A later pass (oauth2's own `provider.reload()`)
+* still detects it and lightbridge then stands its engine down.
+*/
+export declare function hasOAuth2Conflict(editor: ProviderLookup, providerId: string): boolean;

package/dist/config.js

@@ -14,6 +14,15 @@ function asProviderList(value, path) {
 	}
 	return value.map((entry, index) => asNonEmptyString(entry, `${path}[${index}]`));
 }
+function asBoolean(value, path) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (typeof value !== "boolean") {
+		throw new Error(`${path} must be a boolean (received ${JSON.stringify(value)})`);
+	}
+	return value;
+}
 function parseGateway(raw, path) {
 	if (raw === undefined || raw === null) {
 		return undefined;
@@ -22,11 +31,44 @@ function parseGateway(raw, path) {
 		throw new Error(`${path} must be an object with \`providers\` (and an optional \`projectId\`)`);
 	}
 	const projectId = raw.projectId === undefined || raw.projectId === null ? undefined : asNonEmptyString(raw.projectId, `${path}.projectId`);
+	// Opt-in (ADR-0017, amends ADR-0012): defaults to `false` — see
+	// `LightbridgeGatewayOptions.exchange`'s doc comment for the rationale.
+	const exchange = asBoolean(raw.exchange, `${path}.exchange`) ?? false;
 	return {
 		providers: asProviderList(raw.providers, `${path}.providers`),
+		exchange,
 		...projectId ? { projectId } : {}
 	};
 }
+function asStringMap(value, path) {
+	if (value === undefined || value === null) {
+		return undefined;
+	}
+	if (!isRecord(value)) {
+		throw new Error(`${path} must be an object mapping model id -> display name`);
+	}
+	const normalized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		normalized[key] = asNonEmptyString(entry, `${path}.${key}`);
+	}
+	return normalized;
+}
+function parseRegister(raw, path) {
+	if (raw === undefined || raw === null) {
+		return undefined;
+	}
+	if (!isRecord(raw)) {
+		throw new Error(`${path} must be an object with at least \`baseURL\``);
+	}
+	const syncIntervalMinutes = typeof raw.syncIntervalMinutes === "number" && Number.isFinite(raw.syncIntervalMinutes) && raw.syncIntervalMinutes > 0 ? raw.syncIntervalMinutes : undefined;
+	return {
+		baseURL: asNonEmptyString(raw.baseURL, `${path}.baseURL`),
+		name: raw.name === undefined || raw.name === null ? undefined : asNonEmptyString(raw.name, `${path}.name`),
+		nameOverrides: asStringMap(raw.nameOverrides, `${path}.nameOverrides`),
+		syncIntervalMinutes,
+		responseApi: asBoolean(raw.responseApi, `${path}.responseApi`)
+	};
+}
 function parseOtel(raw, path) {
 	if (raw === undefined || raw === null) {
 		return undefined;
@@ -57,22 +99,53 @@ export function parseLightbridgeOptions(raw) {
 	const auth = validateAuthConfig(raw.auth);
 	const gateway = parseGateway(raw.gateway, "lightbridge.gateway");
 	const otel = parseOtel(raw.otel, "lightbridge.otel");
+	const register = parseRegister(raw.register, "lightbridge.register");
 	const explicitProjectId = typeof raw.projectId === "string" && raw.projectId.trim().length > 0 ? raw.projectId.trim() : undefined;
 	const projectId = explicitProjectId ?? gateway?.projectId;
 	return {
 		auth,
 		gateway,
 		otel,
-		projectId
+		projectId,
+		register
 	};
 }
 /**
 * Whether the parsed config has a module (gateway or otel) that needs the
-* shared token — project-scoped when `projectId` is set, else a default-project
-* token. Determines whether the one shared runtime is built.
+* shared token — project-scoped when `projectId` is set (and `gateway.exchange`
+* is `true`), else the raw IdP token. Determines whether the one shared
+* runtime is built. `register` doesn't gate this: it drives a separate
+* `ProviderModelSyncEngine`, not `LightbridgeRuntime`.
 */
 export function needsProjectToken(options) {
 	return Boolean(options.gateway) || Boolean(options.otel);
 }
+// ---- oauth2 provider-id collision guard (ADR-0017 requirement 4) ----------
+//
+// If a developer configures BOTH `@vymalo/opencode-oauth2` and lightbridge's
+// `register` block against the SAME OpenCode provider id, they must not both
+// register/own it. v1 read oauth2's private `pluginConfig` off the shared
+// config object; v2 plugins cannot see each other's options, so the signal is
+// the provider RECORD: oauth2 stamps `settings.oauth2` (a user block, or the
+// marker `{ managed: true, source: "options.servers" }`) on every provider it
+// manages. Kept as a lightbridge-local literal rather than a shared import:
+// each consumer's own settings-key literals are intentionally NOT centralized
+// (see `@vymalo/opencode-provider-sync`'s `opencode-helpers.ts` module doc).
+const OAUTH2_SETTINGS_KEYS = ["oauth2", "oauth2ModelSync"];
+/**
+* Whether `providerId` is (also) managed by `@vymalo/opencode-oauth2`, judged
+* from the provider record's `settings.oauth2` / `settings.oauth2ModelSync`
+* block. Used by lightbridge's `register` module to skip registering or owning
+* a provider oauth2 already claims (logged at `debug`).
+*
+* Order-sensitive: oauth2 stamps its marker inside its own provider transform,
+* so oauth2 must be listed BEFORE lightbridge in `plugin` for lightbridge to
+* see it on the first pass. A later pass (oauth2's own `provider.reload()`)
+* still detects it and lightbridge then stands its engine down.
+*/
+export function hasOAuth2Conflict(editor, providerId) {
+	const settings = editor.get(providerId)?.provider.settings;
+	return isRecord(settings) && OAUTH2_SETTINGS_KEYS.some((key) => isRecord(settings[key]));
+}
 
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SACE,0BAGK;AA4CP,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,MAAsB;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CACtD;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,SAAS,eAAe,OAAgB,MAAwB;CAC9D,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;EAC/C,MAAM,IAAI,MAAM,GAAG,KAAK,2CAA2C;CACrE;CACA,OAAO,MAAM,KAAK,OAAO,UAAU,iBAAiB,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AACjF;AAEA,SAAS,aAAa,KAAc,MAAqD;CACvF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,sEAAsE;CAChG;CACA,MAAM,YACJ,IAAI,cAAc,aAAa,IAAI,cAAc,OAC7C,YACA,iBAAiB,IAAI,WAAW,GAAG,KAAK,WAAW;CACzD,OAAO;EACL,WAAW,eAAe,IAAI,WAAW,GAAG,KAAK,WAAW;EAC5D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;AAEA,SAAS,UAAU,KAAc,MAA6C;CAC5E,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,uCAAuC;CACjE;;;;CAIA,OAAO;AACT;;;;;;;;;AAUA,OAAO,SAAS,wBAAwB,KAAwC;CAC9E,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MACR,sFACF;CACF;CACA,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG;EACvB,MAAM,IAAI,MAAM,4EAA4E;CAC9F;CAEA,MAAM,OAAO,mBAAmB,IAAI,IAAwC;CAC5E,MAAM,UAAU,aAAa,IAAI,SAAS,qBAAqB;CAC/D,MAAM,OAAO,UAAU,IAAI,MAAM,kBAAkB;CAEnD,MAAM,oBACJ,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS,IAC/D,IAAI,UAAU,KAAK,IACnB;CACN,MAAM,YAAY,qBAAqB,SAAS;CAEhD,OAAO;EAAE;EAAM;EAAS;EAAM;CAAU;AAC1C;;;;;;AAOA,OAAO,SAAS,kBAAkB,SAA4C;CAC5E,OAAO,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,IAAI;AACzD","names":[],"sources":["../src/config.ts"],"version":3,"file":"config.js","sourceRoot":""}
+{"mappings":"AAAA,SACE,0BAGK;AAyFP,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAgB,MAAsB;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,GAAG,KAAK,4BAA4B;CACtD;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,SAAS,eAAe,OAAgB,MAAwB;CAC9D,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;EAC/C,MAAM,IAAI,MAAM,GAAG,KAAK,2CAA2C;CACrE;CACA,OAAO,MAAM,KAAK,OAAO,UAAU,iBAAiB,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AACjF;AAEA,SAAS,UAAU,OAAgB,MAAmC;CACpE,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,OAAO,UAAU,WAAW;EAC9B,MAAM,IAAI,MAAM,GAAG,KAAK,+BAA+B,KAAK,UAAU,KAAK,EAAE,EAAE;CACjF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,KAAc,MAAqD;CACvF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,sEAAsE;CAChG;CACA,MAAM,YACJ,IAAI,cAAc,aAAa,IAAI,cAAc,OAC7C,YACA,iBAAiB,IAAI,WAAW,GAAG,KAAK,WAAW;;;CAGzD,MAAM,WAAW,UAAU,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK;CAChE,OAAO;EACL,WAAW,eAAe,IAAI,WAAW,GAAG,KAAK,WAAW;EAC5D;EACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;AAEA,SAAS,YAAY,OAAgB,MAAkD;CACrF,IAAI,UAAU,aAAa,UAAU,MAAM;EACzC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,KAAK,GAAG;EACpB,MAAM,IAAI,MAAM,GAAG,KAAK,oDAAoD;CAC9E;CACA,MAAM,aAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,WAAW,OAAO,iBAAiB,OAAO,GAAG,KAAK,GAAG,KAAK;CAC5D;CACA,OAAO;AACT;AAEA,SAAS,cAAc,KAAc,MAAsD;CACzF,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,6CAA6C;CACvE;CAEA,MAAM,sBACJ,OAAO,IAAI,wBAAwB,YACnC,OAAO,SAAS,IAAI,mBAAmB,KACvC,IAAI,sBAAsB,IACtB,IAAI,sBACJ;CAEN,OAAO;EACL,SAAS,iBAAiB,IAAI,SAAS,GAAG,KAAK,SAAS;EACxD,MACE,IAAI,SAAS,aAAa,IAAI,SAAS,OACnC,YACA,iBAAiB,IAAI,MAAM,GAAG,KAAK,MAAM;EAC/C,eAAe,YAAY,IAAI,eAAe,GAAG,KAAK,eAAe;EACrE;EACA,aAAa,UAAU,IAAI,aAAa,GAAG,KAAK,aAAa;CAC/D;AACF;AAEA,SAAS,UAAU,KAAc,MAA6C;CAC5E,IAAI,QAAQ,aAAa,QAAQ,MAAM;EACrC,OAAO;CACT;CACA,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MAAM,GAAG,KAAK,uCAAuC;CACjE;;;;CAIA,OAAO;AACT;;;;;;;;;AAUA,OAAO,SAAS,wBAAwB,KAAwC;CAC9E,IAAI,CAAC,SAAS,GAAG,GAAG;EAClB,MAAM,IAAI,MACR,sFACF;CACF;CACA,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG;EACvB,MAAM,IAAI,MAAM,4EAA4E;CAC9F;CAEA,MAAM,OAAO,mBAAmB,IAAI,IAAwC;CAC5E,MAAM,UAAU,aAAa,IAAI,SAAS,qBAAqB;CAC/D,MAAM,OAAO,UAAU,IAAI,MAAM,kBAAkB;CACnD,MAAM,WAAW,cAAc,IAAI,UAAU,sBAAsB;CAEnE,MAAM,oBACJ,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS,IAC/D,IAAI,UAAU,KAAK,IACnB;CACN,MAAM,YAAY,qBAAqB,SAAS;CAEhD,OAAO;EAAE;EAAM;EAAS;EAAM;EAAW;CAAS;AACpD;;;;;;;;AASA,OAAO,SAAS,kBAAkB,SAA4C;CAC5E,OAAO,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,IAAI;AACzD;;;;;;;;;;;;AAaA,MAAM,uBAAuB,CAAC,UAAU,iBAAiB;;;;;;;;;;;;AAkBzD,OAAO,SAAS,kBAAkB,QAAwB,YAA6B;CACrF,MAAM,WAAW,OAAO,IAAI,UAAU,CAAC,EAAE,SAAS;CAClD,OAAO,SAAS,QAAQ,KAAK,qBAAqB,MAAM,QAAQ,SAAS,SAAS,IAAI,CAAC;AACzF","names":[],"sources":["../src/config.ts"],"version":3,"file":"config.js","sourceRoot":""}

package/dist/lib.d.ts

@@ -1,3 +1,4 @@
-export { createLightbridgePlugin, LightbridgePlugin, type LightbridgePluginFactoryOptions } from "./opencode.js";
-export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, lightbridgeCacheDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
-export { parseLightbridgeOptions, needsProjectToken, type LightbridgeGatewayOptions, type LightbridgeOptions, type ParsedLightbridgeOptions } from "./config.js";
+export { createLightbridgePlugin, LightbridgePlugin, PLUGIN_ID, type LightbridgePluginFactoryOptions, type LightbridgeRegisterHandle } from "./opencode.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeCacheDir, rootCacheDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
+export { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions, type LightbridgeGatewayOptions, type LightbridgeOptions, type LightbridgeRegisterOptions, type ParsedLightbridgeOptions, type ProviderLookup } from "./config.js";
+export { migrateRootTokenIfNeeded } from "./migration.js";

package/dist/lib.js

@@ -1,5 +1,6 @@
-export { createLightbridgePlugin, LightbridgePlugin } from "./opencode.js";
-export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, lightbridgeCacheDir } from "./plugin.js";
-export { parseLightbridgeOptions, needsProjectToken } from "./config.js";
+export { createLightbridgePlugin, LightbridgePlugin, PLUGIN_ID } from "./opencode.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeCacheDir, rootCacheDir } from "./plugin.js";
+export { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions } from "./config.js";
+export { migrateRootTokenIfNeeded } from "./migration.js";
 
 //# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SACE,yBACA,yBAEK;AAEP,SACE,oBACA,sBACA,yBACA,qBACA,2BAIK;AAEP,SACE,yBACA,yBAIK","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}
+{"mappings":"AAAA,SACE,yBACA,mBACA,iBAGK;AAEP,SACE,oBACA,sBACA,yBACA,qBACA,sBACA,oBACA,qBACA,oBAIK;AAEP,SACE,mBACA,mBACA,+BAMK;AAEP,SAAS,gCAAgC","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}

package/dist/logging.d.ts

@@ -0,0 +1,44 @@
+import { createJsonConsoleLogger, LOG_LEVEL_PRIORITY, type LogFields, type Logger, type LogLevel } from "@vymalo/opencode-auth-core/lib";
+import { type Context as EffectContext, Effect } from "effect";
+import { DEFAULT_LOG_LEVEL } from "@vymalo/opencode-auth-core/lib";
+export { createJsonConsoleLogger, DEFAULT_LOG_LEVEL, LOG_LEVEL_PRIORITY };
+export type { LogFields, Logger, LogLevel };
+/**
+* Capture the host's Effect context from inside the plugin's own fiber. The
+* returned value is what {@link createEffectLogger} (and {@link runInHost})
+* needs to put a record on the host's logger rather than on a default one.
+*
+* OpenCode installs its file logger as a `Logger.layer(...)` on the runtime
+* that runs plugin setup, and Effect carries loggers as fiber-level references
+* — so the context captured here is the only route to that sink. A bare
+* `Effect.runFork` would log to Effect's default logger (the terminal) instead,
+* which is exactly what ADR-0014 forbids.
+*/
+export declare const captureHostContext: Effect.Effect<EffectContext.Context<never>>;
+/**
+* Structured logger that writes through the host's Effect logger — the v2
+* replacement for v1's `client.app.log`.
+*
+* ADR-0014 (no plugin writes to the user's TUI) is preserved: OpenCode's own
+* logger is a `Logger.toFile` sink over the shared `opencode-<channel>.log`,
+* so records land in the host log stream and never on the terminal. The event
+* name becomes the log message and `fields` become log annotations.
+*
+* Host-side severity filtering is Effect's job (`OPENCODE_LOG_LEVEL`); the
+* `getMinLevel` gate here is only this plugin's own `logLevel` option, applied
+* before the record is built so a filtered-out call costs nothing.
+*/
+export declare function createEffectLogger(context: EffectContext.Context<never>, getMinLevel: () => LogLevel): Logger;
+/**
+* Run an Effect from a detached callback (a timer, a promise continuation)
+* inside the captured host context, so anything it logs reaches the host
+* logger instead of Effect's default one (ADR-0014).
+*/
+export declare function runInHost(context: EffectContext.Context<never>, effect: Effect.Effect<void>): Promise<void>;
+/**
+* Resolve this plugin's log level from its own `logLevel` option, falling back
+* to the host's `OPENCODE_LOG_LEVEL` env var. v2 gives plugins no `config`
+* object, so the v1 `config.logLevel` channel is gone. Replaces v1's
+* `fromOpenCodeLogLevel`.
+*/
+export declare function resolveLogLevel(value: unknown): LogLevel | undefined;

package/dist/logging.js

@@ -0,0 +1,100 @@
+import { createJsonConsoleLogger, LOG_LEVEL_PRIORITY } from "@vymalo/opencode-auth-core/lib";
+import { Effect } from "effect";
+import { DEFAULT_LOG_LEVEL } from "@vymalo/opencode-auth-core/lib";
+export { createJsonConsoleLogger, DEFAULT_LOG_LEVEL, LOG_LEVEL_PRIORITY };
+function redactFields(fields) {
+	if (!fields) {
+		return undefined;
+	}
+	const redacted = {};
+	for (const [key, value] of Object.entries(fields)) {
+		if (/token|secret|password|authorization/i.test(key)) {
+			redacted[key] = "[redacted]";
+			continue;
+		}
+		redacted[key] = value;
+	}
+	return redacted;
+}
+/**
+* Capture the host's Effect context from inside the plugin's own fiber. The
+* returned value is what {@link createEffectLogger} (and {@link runInHost})
+* needs to put a record on the host's logger rather than on a default one.
+*
+* OpenCode installs its file logger as a `Logger.layer(...)` on the runtime
+* that runs plugin setup, and Effect carries loggers as fiber-level references
+* — so the context captured here is the only route to that sink. A bare
+* `Effect.runFork` would log to Effect's default logger (the terminal) instead,
+* which is exactly what ADR-0014 forbids.
+*/
+export const captureHostContext = Effect.withFiber((fiber) => Effect.succeed(fiber.context));
+/**
+* Structured logger that writes through the host's Effect logger — the v2
+* replacement for v1's `client.app.log`.
+*
+* ADR-0014 (no plugin writes to the user's TUI) is preserved: OpenCode's own
+* logger is a `Logger.toFile` sink over the shared `opencode-<channel>.log`,
+* so records land in the host log stream and never on the terminal. The event
+* name becomes the log message and `fields` become log annotations.
+*
+* Host-side severity filtering is Effect's job (`OPENCODE_LOG_LEVEL`); the
+* `getMinLevel` gate here is only this plugin's own `logLevel` option, applied
+* before the record is built so a filtered-out call costs nothing.
+*/
+export function createEffectLogger(context, getMinLevel) {
+	// `VYMALO_PLUGIN_CONSOLE_LOG=1` mirrors to stdout for local debugging. Off by
+	// default precisely because stdout is the user's terminal (ADR-0014).
+	const consoleAll = /^(1|true|yes|on)$/i.test(process.env.VYMALO_PLUGIN_CONSOLE_LOG ?? "");
+	const fallback = createJsonConsoleLogger("trace");
+	const write = (level, event, fields) => {
+		if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[getMinLevel()]) {
+			return;
+		}
+		if (consoleAll) {
+			fallback[level](event, fields);
+		}
+		const redacted = redactFields(fields);
+		// Effect has no `trace` severity below `debug`; fold the most-verbose tier
+		// onto debug, as the v1 adapter did for the host log API (ADR-0008).
+		const record = level === "trace" || level === "debug" ? Effect.logDebug(event) : level === "info" ? Effect.logInfo(event) : level === "warn" ? Effect.logWarning(event) : Effect.logError(event);
+		const annotated = redacted ? Effect.annotateLogs(record, redacted) : record;
+		Effect.runFork(Effect.provideContext(annotated, context));
+	};
+	return {
+		trace: (event, fields) => write("trace", event, fields),
+		debug: (event, fields) => write("debug", event, fields),
+		info: (event, fields) => write("info", event, fields),
+		warn: (event, fields) => write("warn", event, fields),
+		error: (event, fields) => write("error", event, fields)
+	};
+}
+/**
+* Run an Effect from a detached callback (a timer, a promise continuation)
+* inside the captured host context, so anything it logs reaches the host
+* logger instead of Effect's default one (ADR-0014).
+*/
+export function runInHost(context, effect) {
+	return Effect.runPromise(Effect.provideContext(effect, context));
+}
+/**
+* Resolve this plugin's log level from its own `logLevel` option, falling back
+* to the host's `OPENCODE_LOG_LEVEL` env var. v2 gives plugins no `config`
+* object, so the v1 `config.logLevel` channel is gone. Replaces v1's
+* `fromOpenCodeLogLevel`.
+*/
+export function resolveLogLevel(value) {
+	if (typeof value !== "string") {
+		return undefined;
+	}
+	switch (value.toUpperCase()) {
+		// DEBUG unlocks the most-verbose `trace` tier (host has no finer level).
+		case "DEBUG":
+		case "TRACE": return "trace";
+		case "INFO": return "info";
+		case "WARN": return "warn";
+		case "ERROR": return "error";
+		default: return undefined;
+	}
+}
+
+//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -0,0 +1 @@
+{"mappings":"AAAA,SACE,yBACA,0BAIK;AACP,SAAwC,cAAc;AAEtD,SAAS,yBAAyB;AAElC,SAAS,yBAAyB,mBAAmB;AAGrD,SAAS,aAAa,QAA2C;CAC/D,IAAI,CAAC,QAAQ;EACX,OAAO;CACT;CACA,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EACjD,IAAI,uCAAuC,KAAK,GAAG,GAAG;GACpD,SAAS,OAAO;GAChB;EACF;EACA,SAAS,OAAO;CAClB;CACA,OAAO;AACT;;;;;;;;;;;;AAaA,OAAO,MAAM,qBAAkE,OAAO,WACnF,UAAU,OAAO,QAAQ,MAAM,OAAO,CACzC;;;;;;;;;;;;;;AAeA,OAAO,SAAS,mBACd,SACA,aACQ;;;CAGR,MAAM,aAAa,qBAAqB,KAAK,QAAQ,IAAI,6BAA6B,EAAE;CACxF,MAAM,WAAW,wBAAwB,OAAO;CAEhD,MAAM,SAAS,OAAiB,OAAe,WAA6B;EAC1E,IAAI,mBAAmB,SAAS,mBAAmB,YAAY,IAAI;GACjE;EACF;EACA,IAAI,YAAY;GACd,SAAS,MAAM,CAAC,OAAO,MAAM;EAC/B;EAEA,MAAM,WAAW,aAAa,MAAM;;;EAGpC,MAAM,SACJ,UAAU,WAAW,UAAU,UAC3B,OAAO,SAAS,KAAK,IACrB,UAAU,SACR,OAAO,QAAQ,KAAK,IACpB,UAAU,SACR,OAAO,WAAW,KAAK,IACvB,OAAO,SAAS,KAAK;EAE/B,MAAM,YAAY,WAAW,OAAO,aAAa,QAAQ,QAAQ,IAAI;EACrE,OAAO,QAAQ,OAAO,eAAe,WAAW,OAAO,CAAC;CAC1D;CAEA,OAAO;EACL,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;EACtD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,OAAO,OAAO,WAAW,MAAM,QAAQ,OAAO,MAAM;EACpD,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM;CACxD;AACF;;;;;;AAOA,OAAO,SAAS,UACd,SACA,QACe;CACf,OAAO,OAAO,WAAW,OAAO,eAAe,QAAQ,OAAO,CAAC;AACjE;;;;;;;AAQA,OAAO,SAAS,gBAAgB,OAAsC;CACpE,IAAI,OAAO,UAAU,UAAU;EAC7B,OAAO;CACT;CACA,QAAQ,MAAM,YAAY,GAA1B;;EAEE,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK,QACH,OAAO;EACT,KAAK,QACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF","names":[],"sources":["../src/logging.ts"],"version":3,"file":"logging.js","sourceRoot":""}

package/dist/migration.d.ts

@@ -0,0 +1,31 @@
+import { type Logger } from "@vymalo/opencode-auth-core/lib";
+/**
+* One-time migration read-path (ADR-0017, mandatory — not optional polish).
+*
+* v0.17 moves lightbridge's human root token from its own bespoke file
+* (`<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`) to
+* the SAME fused `CachedServerState` file `@vymalo/opencode-oauth2` uses
+* (`<cacheRoot>/<sharedSegment>/<sharedNamespace>/<serverId>.json`) so the two
+* plugins can share one login (ADR-0017 §"one login, shared cache"). An
+* install that already has a valid old-format token must NOT be forced
+* through a fresh device-code/browser login just because the file moved.
+*
+* Behaviour:
+* - If the NEW location already has a persisted state (with or without a
+*   token), this is a no-op — never clobbers a fresher state (e.g. one
+*   oauth2 has already been writing to, with real discovered models).
+* - Else, read the OLD location. If it holds a structurally usable token
+*   (`accessToken` + `tokenType` present — possibly expired; an expired
+*   token with a refresh token is still worth adopting, since `TokenRuntime`
+*   will refresh it transparently), write it into the NEW location as a
+*   fresh `CachedServerState` (empty `models`/`rawModels` — nothing to carry
+*   over, since the old shape never tracked models).
+* - Else (no old file, or it's empty/malformed) this is a no-op; the caller
+*   proceeds to a normal login.
+*
+* The old file is left in place (non-destructive) — this function only ever
+* ADDS the new file, never deletes/mutates the old one. Safe to call more
+* than once: the "new location already has a state" check makes every call
+* after the first a cheap no-op.
+*/
+export declare function migrateRootTokenIfNeeded(cacheRoot: string, sharedSegment: string, sharedNamespace: string, serverId: string, logger: Logger): Promise<void>;