@vymalo/opencode-lightbridge 0.16.1 → 0.18.0

package/dist/plugin.js

@@ -1,13 +1,31 @@
 import { join } from "node:path";
 import { createJsonConsoleLogger, DEFAULT_TOKEN_EXPIRY_SKEW_MS, resolveCacheRoot, TokenRuntime } from "@vymalo/opencode-auth-core/lib";
+import { FileCacheStore as SharedFileCacheStore } from "@vymalo/opencode-provider-sync/lib";
+import { migrateRootTokenIfNeeded } from "./migration.js";
 /**
-* Identity for the umbrella's single `TokenRuntime` (ADR-0012). Constant
-* because v1 is single-IdP, same rationale as repo-auth's `HUMAN_IDENTITY`.
+* Legacy identity for the exchanged project-token store (UNCHANGED by
+* ADR-0017 — see `migration.ts`'s module doc for why only the ROOT token
+* relocated). Kept as a constant, not `auth.id`, because the exchanged-token
+* cache key has always been derived from this literal, independent of the
+* configured IdP's `id`.
 */
 export const LIGHTBRIDGE_IDENTITY = "lightbridge";
-/** Own cache namespace — separate from oauth2/repo-auth/otel's stores. */
+/** Own cache namespace for the exchanged-token store — separate from oauth2/repo-auth/otel's. */
 export const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 /**
+* ADR-0017: the human ROOT token now lives in the SAME cache file
+* `@vymalo/opencode-oauth2` uses for a server of this id —
+* `<cacheRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`, a fused
+* `CachedServerState` (token + discovered models). This is what lets a
+* developer who configures the same IdP (`auth.id` == an oauth2 `servers[].id`,
+* same issuer/clientId) log in ONCE and have both plugins read/write the same
+* on-disk state. The literals are pinned here (not imported from
+* `@vymalo/opencode-oauth2`, which lightbridge does not depend on) — see
+* `docs/adr/0017-lightbridge-all-in-one.md` for the shared-contract rationale.
+*/
+export const ROOT_CACHE_SEGMENT = "opencode-oauth2";
+export const ROOT_CACHE_NAMESPACE = "opencode-oauth2-model-sync";
+/**
 * Cache key for the default-project token — used when no `projectId` is
 * configured, so the exchange sends no `project_id` and the backend mints a
 * token for the caller's default project (ADR-0012). Distinct from any real
@@ -15,10 +33,9 @@ export const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 */
 export const DEFAULT_PROJECT_KEY = "__default__";
 /**
-* Whether a cached project token is usable. Mirrors repo-auth's
-* `isProjectTokenUsable`: the project token carries no refresh token, so an
-* undefined `expiresAt` must be treated as expired (re-exchange), never as
-* non-expiring.
+* Whether a cached project token is usable. The project token carries no
+* refresh token, so an undefined `expiresAt` must be treated as expired
+* (re-exchange), never as non-expiring.
 */
 function isProjectTokenUsable(token, skewMs) {
 	if (!token?.accessToken) {
@@ -30,59 +47,148 @@ function isProjectTokenUsable(token, skewMs) {
 	return Date.now() + skewMs < token.expiresAt;
 }
 /**
-* The ONE shared `TokenRuntime` the umbrella plugin builds (ADR-0012): a
-* single human login, reused as the subject token for a project-scoped RFC
-* 8693 exchange whose result is consumed by BOTH the gateway (`chat.headers`)
-* and OTEL (`TokenSource.headers()`) — that sharing is the entire point of
-* the plugin. Lifecycle mirrors `@vymalo/opencode-repo-auth`'s "model b"
-* (`RepoAuthPlugin.resolveProjectToken`): auth-core has no higher-level
-* primitive for this yet, so the umbrella keeps its own thin copy rather than
-* reaching into a sibling package's internals.
+* Build the ONE shared root `TokenRuntime` for `serverId`, persisting through
+* the SAME fused `CachedServerState` shape+location `ProviderModelSyncEngine`
+* uses (see `ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE` above) — mirroring the
+* override pattern in `@vymalo/opencode-provider-sync`'s
+* `ProviderModelSyncEngine.buildTokenRuntime` (extract `.token`, preserve
+* `.models`/`.rawModels` on write) but WITHOUT running that engine's
+* scheduler/model-discovery — this is a read/refresh-only participant in the
+* shared cache file, not a second poller (see ADR-0017's double-scheduling
+* guard, enforced inside the engine itself for the `register` path).
+*
+* Unlike `ProviderModelSyncEngine`, this performs no cross-process
+* "adopt-if-newer" reconciliation — every `getCached()` call here reads disk
+* fresh and takes it as-is. That is deliberately simpler (no in-memory
+* snapshot to reconcile against) and still safe: a momentarily unreadable/
+* missing file degrades to "no cached token" (a safe, if suboptimal,
+* fallback), and refreshes are still coordinated via `TokenRuntime`'s own
+* cross-process file lock.
+*/
+function buildSharedRootTokenRuntime(serverId, auth, sharedStore, options) {
+	return new TokenRuntime(serverId, auth, {
+		logger: options.logger,
+		fetchImpl: options.fetchImpl,
+		onAuthorizationUrl: options.onAuthorizationUrl,
+		tokenExpirySkewMs: options.tokenExpirySkewMs,
+		serviceLabel: "opencode-lightbridge",
+		getCached: async () => {
+			const state = await sharedStore.loadServerState(serverId);
+			return state?.token;
+		},
+		setCached: async (token) => {
+			const existing = await sharedStore.loadServerState(serverId);
+			const next = {
+				serverId,
+				updatedAt: Date.now(),
+				lastSyncAt: existing?.lastSyncAt,
+				models: existing?.models ?? [],
+				rawModels: existing?.rawModels ?? [],
+				token
+			};
+			await sharedStore.saveServerState(next);
+		}
+	});
+}
+/**
+* The ONE shared runtime the umbrella plugin builds (ADR-0012, amended by
+* ADR-0017): a single human login, reused as the subject token for a
+* project-scoped RFC 8693 exchange (when `gateway.exchange` is `true`) or
+* used directly as the gateway/OTEL bearer (the new default) — consumed by
+* BOTH the gateway (`chat.headers`) and OTEL (`TokenSource.headers()`).
+*
+* The human root token itself is no longer lightbridge-exclusive storage: it
+* lives in the SAME cache file `@vymalo/opencode-oauth2` writes for a server
+* of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`), so configuring
+* both plugins against the same IdP (`auth.id` matching an oauth2
+* `servers[].id`, same issuer/clientId) means logging in once. An upgrading
+* install's pre-existing root token is migrated in automatically — see
+* `migration.ts`.
 */
 export class LightbridgeRuntime {
 	projectId;
-	runtime;
+	rootRuntime;
+	sharedStore;
+	exchangeRuntime;
 	logger;
 	tokenExpirySkewMs;
+	exchange;
+	cacheRoot;
+	serverId;
 	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
 	projectKey;
 	inFlightExchange;
+	migration;
 	constructor(auth, projectId, options = {}) {
 		this.projectId = projectId;
+		this.serverId = auth.id;
 		this.projectKey = projectId ?? DEFAULT_PROJECT_KEY;
 		this.logger = options.logger ?? createJsonConsoleLogger("info");
+		this.exchange = options.exchange ?? false;
+		this.cacheRoot = options.cacheDir ?? resolveCacheRoot();
 		this.tokenExpirySkewMs = typeof options.tokenExpirySkewMs === "number" && Number.isFinite(options.tokenExpirySkewMs) && options.tokenExpirySkewMs > 0 ? options.tokenExpirySkewMs : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
-		this.runtime = new TokenRuntime(LIGHTBRIDGE_IDENTITY, auth, {
+		this.sharedStore = new SharedFileCacheStore(join(this.cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE), this.logger);
+		this.rootRuntime = buildSharedRootTokenRuntime(this.serverId, auth, this.sharedStore, options);
+		// The exchange-only runtime keeps its OWN dedicated, lightbridge-exclusive
+		// store (unchanged location/shape) — there is no oauth2 equivalent for a
+		// project-scoped exchanged token, so nothing to share here.
+		this.exchangeRuntime = new TokenRuntime(LIGHTBRIDGE_IDENTITY, auth, {
 			logger: this.logger,
 			fetchImpl: options.fetchImpl,
 			onAuthorizationUrl: options.onAuthorizationUrl,
-			cacheDir: options.cacheDir ?? join(resolveCacheRoot(), DEFAULT_CACHE_NAMESPACE),
-			tokenExpirySkewMs: this.tokenExpirySkewMs
+			cacheDir: join(this.cacheRoot, DEFAULT_CACHE_NAMESPACE),
+			tokenExpirySkewMs: this.tokenExpirySkewMs,
+			serviceLabel: "opencode-lightbridge"
 		});
 	}
+	/**
+	* One-time (per instance) migration of a pre-ADR-0017 root token into the
+	* shared cache file — see `migration.ts`. Idempotent and cheap on every
+	* call after the first (the underlying function also short-circuits once
+	* the new location has ANY state).
+	*/
+	ensureMigrated() {
+		if (!this.migration) {
+			this.migration = migrateRootTokenIfNeeded(this.cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE, this.serverId, this.logger).catch((error) => {
+				// Never fatal: worst case is a fresh login, same as a first-ever
+				// install. Swallow so a migration hiccup can't break normal auth.
+				this.logger.debug("lightbridge_root_migration_error", { error: error instanceof Error ? error.message : String(error) });
+			});
+		}
+		return this.migration;
+	}
 	/** Non-network read of the cached project token, if any. */
 	async getCachedProjectToken() {
-		return this.runtime.getExchangedByKey(this.projectKey);
+		return this.exchangeRuntime.getExchangedByKey(this.projectKey);
 	}
 	/**
-	* Resolve a usable project token, shared by every caller (gateway
-	* `chat.headers`, OTEL `TokenSource.headers()`):
+	* Resolve a usable gateway/OTEL bearer, shared by every caller (gateway
+	* `chat.headers`, OTEL `TokenSource.headers()`).
+	*
+	* `gateway.exchange: false` (default, ADR-0017): the IdP access token IS
+	* the bearer — just `ensure()` the shared root token (refresh-only unless
+	* `interactive`).
+	*
+	* `gateway.exchange: true` (ADR-0012, unchanged):
 	*
-	*   cached usable? ──yes──▶ return it
+	*   cached exchanged token usable? ──yes──▶ return it
 	*         │ no
 	*         ▼
-	*   ensure human root (refresh-only unless `interactive`)
+	*   ensure shared human root (refresh-only unless `interactive`)
 	*         ▼
 	*   exchangeTo(projectKey, humanToken, projectId ? { project_id } : {})
 	*         ▼           (no projectId → backend picks the default project)
 	*   cache + return
 	*
-	* Concurrent callers (a chat request racing an OTEL export) share the
-	* in-flight exchange — at most one exchange POST per cache-miss window.
-	* Never invents a token: an exchange failure propagates to the caller,
-	* which is expected to fail closed (no header / empty `headers()`).
+	* Concurrent callers share the in-flight exchange in either mode. Never
+	* invents a token: a failure propagates to the caller, which is expected to
+	* fail closed (no header / empty `headers()`).
 	*/
 	async getProjectToken(options = {}) {
+		await this.ensureMigrated();
+		if (!this.exchange) {
+			return this.rootRuntime.ensure({ interactive: options.interactive });
+		}
 		const cached = await this.getCachedProjectToken();
 		if (isProjectTokenUsable(cached, this.tokenExpirySkewMs)) {
 			this.logger.trace("lightbridge_exchange_cache_hit", { projectId: this.projectId });
@@ -103,12 +209,12 @@ export class LightbridgeRuntime {
 		}
 	}
 	async performExchange(options) {
-		const human = await this.runtime.ensure({ interactive: options.interactive });
+		const human = await this.rootRuntime.ensure({ interactive: options.interactive });
 		this.logger.info("lightbridge_exchange_started", { projectId: this.projectId ?? "(default)" });
 		try {
 			// No `projectId` → send no `project_id` param; the backend mints a token
 			// for the caller's default project (ADR-0012).
-			const exchanged = await this.runtime.exchangeTo(this.projectKey, human.accessToken, this.projectId ? { project_id: this.projectId } : {});
+			const exchanged = await this.exchangeRuntime.exchangeTo(this.projectKey, human.accessToken, this.projectId ? { project_id: this.projectId } : {});
 			this.logger.info("lightbridge_exchange_success", { projectId: this.projectId ?? "(default)" });
 			return exchanged;
 		} catch (error) {
@@ -119,14 +225,32 @@ export class LightbridgeRuntime {
 			throw error;
 		}
 	}
-	/** Drop the on-disk human + project tokens for this identity. */
+	/**
+	* Drop the cached tokens for this identity: the exchanged project token
+	* entirely (its own exclusive store), and the shared root token's `token`
+	* field only — NOT the whole shared cache file, which may also hold
+	* `@vymalo/opencode-oauth2`'s discovered models for this server id and must
+	* survive a lightbridge-side logout.
+	*/
 	async reset() {
-		await this.runtime.reset();
+		await this.exchangeRuntime.reset();
+		const existing = await this.sharedStore.loadServerState(this.serverId);
+		if (existing?.token) {
+			await this.sharedStore.saveServerState({
+				...existing,
+				updatedAt: Date.now(),
+				token: undefined
+			});
+		}
 	}
 }
-/** Absolute path to the lightbridge cache directory (for diagnostics / tests). */
+/** Absolute path to the lightbridge-exclusive (exchanged-token) cache directory. */
 export function lightbridgeCacheDir(cacheRoot) {
 	return join(cacheRoot, DEFAULT_CACHE_NAMESPACE);
 }
+/** Absolute path to the SHARED root-token cache directory (ADR-0017). */
+export function rootCacheDir(cacheRoot) {
+	return join(cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE);
+}
 
 //# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;;;;;AAMP,OAAO,MAAM,uBAAuB;;AAGpC,OAAO,MAAM,0BAA0B;;;;;;;AAQvC,OAAO,MAAM,sBAAsB;;;;;;;AAqCnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;AAYA,OAAO,MAAM,mBAAqD;CAU7C;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,UAAU,IAAI,aAAa,sBAAsB,MAAM;GAC1D,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,QAAQ,YAAY,KAAK,iBAAiB,GAAG,uBAAuB;GAC9E,mBAAmB,KAAK;EAC1B,CAAC;CACH;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,QAAQ,kBAAkB,KAAK,UAAU;CACvD;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAC5E,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,QAAQ,WACnC,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;CAGA,MAAM,QAAuB;EAC3B,MAAM,KAAK,QAAQ,MAAM;CAC3B;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,uBAAuB;AAChD","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;AACP,SACE,kBAAkB,4BAEb;AAEP,SAAS,gCAAgC;;;;;;;;AASzC,OAAO,MAAM,uBAAuB;;AAGpC,OAAO,MAAM,0BAA0B;;;;;;;;;;;;AAavC,OAAO,MAAM,qBAAqB;AAClC,OAAO,MAAM,uBAAuB;;;;;;;AAQpC,OAAO,MAAM,sBAAsB;;;;;;AA2CnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,4BACP,UACA,MACA,aACA,SACc;CACd,OAAO,IAAI,aAAa,UAAU,MAAM;EACtC,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,cAAc;EACd,WAAW,YAAY;GACrB,MAAM,QAAQ,MAAM,YAAY,gBAAgB,QAAQ;GACxD,OAAO,OAAO;EAChB;EACA,WAAW,OAAO,UAAU;GAC1B,MAAM,WAAW,MAAM,YAAY,gBAAgB,QAAQ;GAC3D,MAAM,OAA0B;IAC9B;IACA,WAAW,KAAK,IAAI;IACpB,YAAY,UAAU;IACtB,QAAQ,UAAU,UAAU,CAAC;IAC7B,WAAW,UAAU,aAAa,CAAC;IACnC;GACF;GACA,MAAM,YAAY,gBAAgB,IAAI;EACxC;CACF,CAAC;AACH;;;;;;;;;;;;;;;;AAiBA,OAAO,MAAM,mBAAqD;CAgB7C;CAfnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CACR,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,WAAW,KAAK;EACrB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,WAAW,QAAQ,YAAY;EACpC,KAAK,YAAY,QAAQ,YAAY,iBAAiB;EACtD,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,cAAc,IAAI,qBACrB,KAAK,KAAK,WAAW,oBAAoB,oBAAoB,GAC7D,KAAK,MACP;EACA,KAAK,cAAc,4BAA4B,KAAK,UAAU,MAAM,KAAK,aAAa,OAAO;;;;EAK7F,KAAK,kBAAkB,IAAI,aAAa,sBAAsB,MAAM;GAClE,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,KAAK,KAAK,WAAW,uBAAuB;GACtD,mBAAmB,KAAK;GACxB,cAAc;EAChB,CAAC;CACH;;;;;;;CAQA,AAAQ,iBAAgC;EACtC,IAAI,CAAC,KAAK,WAAW;GACnB,KAAK,YAAY,yBACf,KAAK,WACL,oBACA,sBACA,KAAK,UACL,KAAK,MACP,CAAC,CAAC,OAAO,UAAU;;;IAGjB,KAAK,OAAO,MAAM,oCAAoC,EACpD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACH;EACA,OAAO,KAAK;CACd;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,gBAAgB,kBAAkB,KAAK,UAAU;CAC/D;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,MAAM,KAAK,eAAe;EAE1B,IAAI,CAAC,KAAK,UAAU;GAClB,OAAO,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EACrE;EAEA,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAChF,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,gBAAgB,WAC3C,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;;;;;;;CASA,MAAM,QAAuB;EAC3B,MAAM,KAAK,gBAAgB,MAAM;EACjC,MAAM,WAAW,MAAM,KAAK,YAAY,gBAAgB,KAAK,QAAQ;EACrE,IAAI,UAAU,OAAO;GACnB,MAAM,KAAK,YAAY,gBAAgB;IACrC,GAAG;IACH,WAAW,KAAK,IAAI;IACpB,OAAO;GACT,CAAC;EACH;CACF;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,uBAAuB;AAChD;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vymalo/opencode-lightbridge",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "Umbrella OpenCode plugin for ADR-0012: one shared credential (TokenRuntime) drives both the LLM gateway bearer and OTEL export, so a developer authenticates once and every egress rides the same project-scoped token.",
   "license": "MIT",
   "author": "vymalo contributors",
@@ -50,17 +50,23 @@
     "access": "public"
   },
   "dependencies": {
-    "@opencode-ai/plugin": "1.15.10",
+    "@opencode/plugin": "2.2.6",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/api-logs": "^0.221.0",
-    "@vymalo/opencode-auth-core": "0.16.1",
-    "@vymalo/opencode-core-otel": "0.16.1"
+    "@opentelemetry/api-logs": "^0.222.0",
+    "@opentelemetry/core": "^2.11.0",
+    "@vymalo/opencode-auth-core": "0.18.0",
+    "@vymalo/opencode-core-otel": "0.18.0",
+    "@vymalo/opencode-provider-sync": "0.18.0"
   },
   "devDependencies": {
-    "@opentelemetry/sdk-logs": "^0.221.0",
-    "@opentelemetry/sdk-trace": "^2.10.0",
-    "vite": "^8.2.1",
-    "vitest": "^4.1.7"
+    "@opentelemetry/sdk-logs": "^0.222.0",
+    "@opentelemetry/sdk-trace": "^2.11.0",
+    "effect": "4.1.0",
+    "vite": "^8.3.0",
+    "vitest": "^5.0.1"
+  },
+  "peerDependencies": {
+    "effect": "^4.0.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",