@vymalo/opencode-lightbridge 0.18.1 → 0.20.0

package/README.md

@@ -83,8 +83,9 @@ Omitting `gateway`, `otel` and `register` is a valid, inert config — the plugi
 
 **One login, shared with oauth2.** Configure the same `id`/`issuer`/`clientId` as an
 `@vymalo/opencode-oauth2` server entry and logging in through either plugin makes the token
-available to both — no second device-code/browser flow. An existing pre-ADR-0017 install's cached
-login is migrated automatically on first use; no re-login is forced. See
+available to both — no second device-code/browser flow. The token lives in the durable OS **state**
+directory, not the cache directory ([ADR-0022](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/adr/0022-credentials-in-state-dir.md)).
+**Upgrading to that release needs one re-login** (no migration, no fallback read). See
 [`docs/lightbridge.md`](https://github.com/ADORSYS-GIS/lightbridge-opencode-toolbeit/blob/main/docs/lightbridge.md#one-login-shared-cache-with-oauth2-adr-0017).
 
 ## Scope: gateway + OTEL, not MCP

package/dist/lib.d.ts

@@ -1,4 +1,3 @@
 export { createLightbridgePlugin, LightbridgePlugin, PLUGIN_ID, type LightbridgePluginFactoryOptions, type LightbridgeRegisterHandle } from "./opencode.js";
-export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeCacheDir, rootCacheDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, EXCHANGE_STATE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeStateDir, rootCacheDir, rootStateDir, type LightbridgeRuntimeFactory, type LightbridgeRuntimeLike, type LightbridgeRuntimeOptions } from "./plugin.js";
 export { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions, type LightbridgeGatewayOptions, type LightbridgeOptions, type LightbridgeRegisterOptions, type ParsedLightbridgeOptions, type ProviderLookup } from "./config.js";
-export { migrateRootTokenIfNeeded } from "./migration.js";

package/dist/lib.js

@@ -1,6 +1,5 @@
 export { createLightbridgePlugin, LightbridgePlugin, PLUGIN_ID } from "./opencode.js";
-export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, DEFAULT_CACHE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeCacheDir, rootCacheDir } from "./plugin.js";
+export { LightbridgeRuntime, LIGHTBRIDGE_IDENTITY, EXCHANGE_STATE_NAMESPACE, DEFAULT_PROJECT_KEY, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, lightbridgeStateDir, rootCacheDir, rootStateDir } from "./plugin.js";
 export { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions } from "./config.js";
-export { migrateRootTokenIfNeeded } from "./migration.js";
 
 //# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SACE,yBACA,mBACA,iBAGK;AAEP,SACE,oBACA,sBACA,yBACA,qBACA,sBACA,oBACA,qBACA,oBAIK;AAEP,SACE,mBACA,mBACA,+BAMK;AAEP,SAAS,gCAAgC","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}
+{"mappings":"AAAA,SACE,yBACA,mBACA,iBAGK;AAEP,SACE,oBACA,sBACA,0BACA,qBACA,sBACA,oBACA,qBACA,cACA,oBAIK;AAEP,SACE,mBACA,mBACA,+BAMK","names":[],"sources":["../src/lib.ts"],"version":3,"file":"lib.js","sourceRoot":""}

package/dist/opencode.d.ts

@@ -18,8 +18,10 @@ export interface LightbridgePluginFactoryOptions {
 	/** Shared-runtime HTTP client (auth-core `TokenRuntime`). Tests only. */
 	fetchImpl?: typeof fetch;
 	onAuthorizationUrl?: (url: string) => Promise<void> | void;
-	/** Override the shared-runtime cache root (defaults to the OS cache dir). */
+	/** Override the CACHE root for the register module's disposable model list (defaults to the OS cache dir). */
 	cacheDir?: string;
+	/** Override the STATE root for credentials — tokens + refresh locks (defaults to the OS state dir, ADR-0022). */
+	stateDir?: string;
 	tokenExpirySkewMs?: number;
 	/**
 	* Build the shared `LightbridgeRuntimeLike` for `(auth, projectId)`.

package/dist/opencode.js

@@ -1,15 +1,16 @@
 import { hostname } from "node:os";
-import { join } from "node:path";
 import { Plugin } from "@opencode/plugin/effect";
 import { defaultTextMapSetter } from "@opentelemetry/api";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";
+import { isInteractiveAuthRequiredError } from "@vymalo/opencode-auth-core/lib";
 import { buildResource, createProviders, deferredAttribute, describeError, readVcsInfo, registerExitHandlers, resolveOtelConfig, TelemetryRecorder } from "@vymalo/opencode-core-otel";
 import { applyResponsesApiSettings, mergeDiscoveredModels, propagateCachedBearer, ProviderModelSyncEngine, resolveCachedBearer, resolveProviderPackage, upsertManagedProvider } from "@vymalo/opencode-provider-sync/lib";
 import { Effect, Stream } from "effect";
 import { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions } from "./config.js";
 import { captureHostContext, createEffectLogger, DEFAULT_LOG_LEVEL, resolveLogLevel, runInHost } from "./logging.js";
 import { adaptContext, adaptPermission, adaptPrompt, adaptToolAfter, adaptToolBefore, OtelEventAdapter } from "./otel-adapter.js";
-import { LightbridgeRuntime, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT } from "./plugin.js";
+import { LightbridgeRuntime, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, rootCacheDir, rootStateDir } from "./plugin.js";
+import { createSignInRegistration, createSignInRequiredNotifier, signInPath } from "./sign-in.js";
 /** Stable plugin id. v2 requires one and keys storage/registrations by it. */
 export const PLUGIN_ID = "vymalo.lightbridge";
 function errorMessage(error) {
@@ -37,13 +38,16 @@ function safeHostname() {
 * every export attempt, a later successful login resumes exporting on the
 * next flush with nothing to restart.
 */
-function createRuntimeTokenSource(runtime) {
+function createRuntimeTokenSource(runtime, onSignInRequired) {
 	return {
 		headers: async () => {
 			try {
-				const token = await runtime.getProjectToken({ interactive: false });
+				const token = await runtime.getProjectToken();
 				return { Authorization: `${token.tokenType || "Bearer"} ${token.accessToken}` };
-			} catch {
+			} catch (error) {
+				if (isInteractiveAuthRequiredError(error)) {
+					onSignInRequired("otel");
+				}
 				return undefined;
 			}
 		},
@@ -129,7 +133,7 @@ function warnIfTokenCommandConfigIgnored(otel, env, logger) {
 * handlers. Mirrors `@vymalo/opencode-otel`'s orchestration verbatim, minus
 * the standalone `tokenCommand` seam.
 */
-async function buildOtelModule(location, otelConfig, logger, factoryOptions, runtime) {
+async function buildOtelModule(location, otelConfig, logger, factoryOptions, runtime, onSignInRequired) {
 	const version = deferredAttribute(factoryOptions.deferredTimeoutMs);
 	const branch = deferredAttribute(factoryOptions.deferredTimeoutMs);
 	if (factoryOptions.hostInfo?.version) {
@@ -148,7 +152,7 @@ async function buildOtelModule(location, otelConfig, logger, factoryOptions, run
 		branch: branch.value,
 		vcs
 	});
-	const tokenSource = runtime ? createRuntimeTokenSource(runtime) : undefined;
+	const tokenSource = runtime ? createRuntimeTokenSource(runtime, onSignInRequired) : undefined;
 	const providers = createProviders(otelConfig, resource, logger, factoryOptions.exporters, tokenSource);
 	const recorder = new TelemetryRecorder({
 		providers,
@@ -249,15 +253,28 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 			// and the OTEL token source below. `undefined` only for a register/auth-only
 			// config.
 			const buildRuntime = factoryOptions.runtimeFactory ?? ((auth, pid, options) => new LightbridgeRuntime(auth, pid, options));
-			const sharedRuntime = wantsProjectToken ? buildRuntime(parsed.auth, parsed.projectId, {
+			// Built whenever a module needs a token OR the user must be able to sign in
+			// (device_code, ADR-0023): the sign-in method drives this same runtime.
+			const signInEnabled = parsed.auth.authFlow === "device_code";
+			const sharedRuntime = wantsProjectToken || signInEnabled ? buildRuntime(parsed.auth, parsed.projectId, {
 				logger,
 				fetchImpl: factoryOptions.fetchImpl,
 				onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
-				cacheDir: factoryOptions.cacheDir,
+				stateDir: factoryOptions.stateDir,
 				tokenExpirySkewMs: factoryOptions.tokenExpirySkewMs,
 				exchange: parsed.gateway?.exchange ?? false
 			}) : undefined;
 			const reloadProviders = () => runInHost(hostContext, ctx.provider.reload());
+			const signInName = parsed.register?.name ?? parsed.auth.id;
+			const signInNotice = createSignInRequiredNotifier(logger, signInName);
+			// Only meaningful when the Connect dialog can actually be used to fix it.
+			const notifySignInRequired = (source) => {
+				if (signInEnabled) {
+					signInNotice.notify(source);
+				}
+			};
+			// Set below when sign-in is registered; the gateway hook calls it (cached).
+			let observeConnectionCached = async () => {};
 			// ---- register module (ADR-0017 requirement 1) ----
 			let engine;
 			let registerChain = Promise.resolve();
@@ -282,10 +299,14 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					servers: [buildRegisterServerConfig(parsed.auth, register)],
 					cacheNamespace: ROOT_CACHE_NAMESPACE
 				}, {
+					// Sign-in happens only in the host's Connect dialog (ADR-0023): the
+					// engine's warmup, scheduler and token reads are refresh-only.
+					neverInteractive: true,
 					logger,
 					fetchImpl: factoryOptions.fetchImpl,
 					onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
-					cacheDir: factoryOptions.cacheDir ? join(factoryOptions.cacheDir, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE) : undefined,
+					cacheDir: factoryOptions.cacheDir ? rootCacheDir(factoryOptions.cacheDir) : undefined,
+					stateDir: factoryOptions.stateDir ? rootStateDir(factoryOptions.stateDir) : undefined,
 					cacheNamespaceSegment: ROOT_CACHE_SEGMENT,
 					serviceLabel: "opencode-lightbridge"
 				});
@@ -301,6 +322,17 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 				}
 				engine = next;
 				registerBearer = await resolveCachedBearer(parsed.auth.id, next, logger);
+				if (registerBearer === undefined && sharedRuntime) {
+					// resolveCachedBearer swallows why; ask the runtime so only a genuine
+					// "needs sign-in" (not a network/IdP outage) raises the notice.
+					try {
+						await sharedRuntime.ensureRootToken();
+					} catch (error) {
+						if (isInteractiveAuthRequiredError(error)) {
+							notifySignInRequired("register");
+						}
+					}
+				}
 				// Models and bearer are now known: ask the host to re-run transforms.
 				await reloadProviders();
 			};
@@ -355,6 +387,116 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					}
 				});
 			}
+			// ---- sign-in (ADR-0023): the ONLY place an interactive login can start ----
+			if (signInEnabled && sharedRuntime) {
+				const runtime = sharedRuntime;
+				const afterSignIn = async () => {
+					try {
+						// Pick up the new credential in the register module's engine and
+						// refresh the stamped bearer, then ask the host to re-run transforms.
+						if (engine) {
+							await engine.syncServer(parsed.auth.id);
+							registerBearer = await resolveCachedBearer(parsed.auth.id, engine, logger);
+						}
+					} catch (error) {
+						logger.warn("lightbridge_sign_in_sync_failed", { error: errorMessage(error) });
+					}
+					try {
+						await reloadProviders();
+					} catch (error) {
+						logger.warn("lightbridge_sign_in_reload_failed", { error: errorMessage(error) });
+					}
+				};
+				const registration = createSignInRegistration({
+					integrationID: parsed.auth.id,
+					runtime,
+					logger,
+					afterSignIn,
+					onSignedIn: () => signInNotice.reset(),
+					onSignInRequired: notifySignInRequired
+				});
+				// The integration id is `auth.id`, never the well-known URL's: the host
+				// loads the well-known manifest with `credentials.at(-1)` of ITS
+				// integration, and an oauth credential there would freeze it (ADR-0023).
+				yield* ctx.integration.transform((editor) => {
+					editor.update(parsed.auth.id, (integration) => {
+						integration.name = signInName;
+					});
+					editor.method.update(registration);
+				});
+				// ---- host disconnect => sign out (ADR-0023) ----
+				// TRANSITION-based: only a connection we saw present in THIS process and
+				// that is then gone signs us out. A host with no credential at startup is
+				// normal (users who signed in before sign-in moved into the dialog have a
+				// token and no host credential) and must keep working.
+				let connectionSeen = false;
+				let signingOut = false;
+				let lastObservedAt = 0;
+				const OBSERVE_CACHE_MS = 5e3;
+				const signOut = async () => {
+					logger.info("lightbridge_signed_out_by_host", { integrationID: parsed.auth.id });
+					try {
+						await runtime.reset();
+					} catch (error) {
+						logger.warn("lightbridge_sign_out_reset_failed", { error: errorMessage(error) });
+					}
+					// The engine keeps its token in memory even when the file is gone:
+					// drop it, and let the next transform build a fresh (signed-out) one.
+					stopEngine();
+					registerQueued = false;
+					signInNotice.reset();
+					notifySignInRequired("disconnect");
+					try {
+						await reloadProviders();
+					} catch (error) {
+						logger.warn("lightbridge_sign_out_reload_failed", { error: errorMessage(error) });
+					}
+				};
+				const onConnection = async (present) => {
+					if (present) {
+						connectionSeen = true;
+						return;
+					}
+					if (!connectionSeen || signingOut) {
+						return;
+					}
+					connectionSeen = false;
+					signingOut = true;
+					try {
+						await signOut();
+					} finally {
+						signingOut = false;
+					}
+				};
+				const observeConnection = (force) => {
+					if (!force && Date.now() - lastObservedAt < OBSERVE_CACHE_MS) {
+						return Promise.resolve();
+					}
+					lastObservedAt = Date.now();
+					return runInHost(hostContext, ctx.integration.connection.active(parsed.auth.id).pipe(Effect.flatMap((info) => Effect.promise(() => onConnection(info !== undefined))), Effect.ignore));
+				};
+				observeConnectionCached = () => observeConnection(false);
+				yield* Effect.forkScoped(Stream.runForEach(ctx.event.subscribe({ types: [
+					"credential.updated",
+					"credential.switched",
+					"integration.updated"
+				] }), () => Effect.promise(() => observeConnection(true))).pipe(Effect.tapError((error) => Effect.sync(() => logger.warn("lightbridge_connection_watch_failed", { error: errorMessage(error) }))), Effect.ignore));
+				void observeConnection(true);
+				// Report a missing sign-in once, up front, without any network on the
+				// signed-out path (a stored token may refresh, which is fine).
+				void runtime.ensureRootToken().catch((error) => {
+					if (isInteractiveAuthRequiredError(error)) {
+						notifySignInRequired("startup");
+					} else {
+						logger.debug("lightbridge_startup_token_check_failed", { error: errorMessage(error) });
+					}
+				});
+			} else if (parsed.auth.authFlow === "authorization_code") {
+				logger.warn("lightbridge_sign_in_unsupported_flow", {
+					authFlow: parsed.auth.authFlow,
+					message: `lightbridge signs in through the host's Connect dialog (${signInPath(signInName)}), which needs authFlow "device_code"`
+				});
+			}
 			// ---- gateway module ----
 			// `sharedRuntime` is always defined here: it is built whenever `gateway`
 			// or `otel` is configured (`wantsProjectToken`).
@@ -376,7 +518,8 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					}
 					return Effect.tryPromise({
 						try: async () => {
-							const token = await runtime.getProjectToken({ interactive: true });
+							await observeConnectionCached();
+							const token = await runtime.getProjectToken();
 							// Header names are case-insensitive: drop any variant already set
 							// (a stamped record header, the placeholder key's, a lowercase copy).
 							for (const key of Object.keys(event.headers)) {
@@ -388,10 +531,18 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 							logger.trace("lightbridge_gateway_bearer_injected", { providerId });
 						},
 						catch: (error) => error
-					}).pipe(Effect.tapError((error) => Effect.sync(() => logger.warn("lightbridge_gateway_no_bearer", {
-						providerId,
-						error: errorMessage(error)
-					}))), Effect.orDie);
+					}).pipe(Effect.tapError((error) => Effect.sync(() => {
+						const needsSignIn = isInteractiveAuthRequiredError(error);
+						// While signed out every request repeats this; the one-time
+						// lightbridge_sign_in_required warning already says what to do.
+						logger[needsSignIn && signInEnabled ? "debug" : "warn"]("lightbridge_gateway_no_bearer", {
+							providerId,
+							error: errorMessage(error)
+						});
+						if (needsSignIn) {
+							notifySignInRequired("gateway");
+						}
+					})), Effect.orDie);
 				});
 			}
 			// ---- otel module ----
@@ -404,7 +555,7 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					const built = yield* Effect.promise(() => buildOtelModule({
 						directory: ctx.location.directory,
 						projectId: ctx.location.project?.id
-					}, otelConfig, logger, factoryOptions, sharedRuntime));
+					}, otelConfig, logger, factoryOptions, sharedRuntime, notifySignInRequired));
 					otel = built;
 					const { recorder } = built;
 					const adapter = new OtelEventAdapter(recorder, factoryOptions.now);

package/dist/opencode.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAErB,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAE1C,SACE,eACA,iBACA,mBACA,eACA,aACA,sBACA,mBACA,yBAOK;AACP,SACE,2BACA,uBACA,uBACA,yBACA,qBACA,wBACA,6BAGK;AACP,SAAS,QAAQ,cAAc;AAE/B,SACE,mBACA,mBACA,+BAGK;AACP,SACE,oBACA,oBACA,mBAGA,iBACA,iBACK;AACP,SACE,cACA,iBACA,aACA,gBACA,iBAEA,wBACK;AACP,SACE,oBACA,sBACA,0BAIK;;AAGP,OAAO,MAAM,YAAY;AA2CzB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,yBAAyB,SAA8C;CAC9E,OAAO;EACL,SAAS,YAAyD;GAChE,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,MAAM,CAAC;IAClE,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,QAAQ;IACN,OAAO;GACT;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;;;AASA,SAAS,0BACP,MACA,UACsB;CACtB,OAAO;EACL,IAAI,KAAK;EACT,MAAM,SAAS,QAAQ,KAAK;EAC5B,QAAQ,KAAK;EACb,SAAS,SAAS;EAClB,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,QAAQ,KAAK;EACb,qBAAqB,SAAS,uBAAuB;EACrD,eAAe,SAAS,iBAAiB,CAAC;EAC1C,uBAAuB,KAAK;EAC5B,eAAe,KAAK;EACpB,6BAA6B,KAAK;EAClC,SAAS,KAAK;EACd,cAAc,KAAK;EACnB,UAAU,KAAK;EACf,MAAM,KAAK;EACX,oBAAoB,KAAK;EACzB,uBAAuB,KAAK;CAC9B;AACF;AAEA,SAAS,WAAW,OAAyC;CAC3D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,CAAC;AACP;;;;;;AAOA,SAAS,yBACP,QACA,YACA,UACA,QACM;CACN,MAAM,WAAW,OAAO,IAAI,UAAU,CAAC,EAAE;;;CAGzC,MAAM,eAAe,YAAY,SAAS,SAAS,aAAa,SAAS,OAAO;CAChF,sBAAsB,QAAQ,YAAY;EACxC,MAAM,gBAAgB,SAAS,QAAQ;EACvC,SAAS,uBAAuB,SAAS,WAAW;EACpD,UAAU,0BACR;GAAE,GAAG,WAAW,UAAU,QAAQ;GAAG,SAAS,SAAS;EAAQ,GAC/D,SAAS,aACT,YACA,MACF;CACF,CAAC;AACH;;;;;;;;;;;;;AAmBA,SAAS,gCACP,MACA,KACA,QACM;CACN,MAAM,WACJ,KAAK,iBAAiB,aACtB,KAAK,gBAAgB,aACrB,KAAK,gBAAgB,aACrB,QAAQ,IAAI,2BAA2B,KACvC,QAAQ,IAAI,0BAA0B,KACtC,QAAQ,IAAI,0BAA0B;CACxC,IAAI,UAAU;EACZ,OAAO,MAAM,0CAA0C,EACrD,QACE,mHACJ,CAAC;CACH;AACF;;;;;;;AAaA,eAAe,gBACb,UACA,YACA,QACA,gBACA,SACyE;CACzE,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,SAAS,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACtD,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,SAAS;EACtB,WAAW,SAAS;EACpB,UAAU,SAAS;EACnB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,OAAO,IAAI;CAClE,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;;EAEpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,GAAG,EACzD,aAAa,mBACf,CAAC;CACH;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;EAAU;CAAQ;AACjD;AAEA,MAAM,aAAa,IAAI,0BAA0B;;;;;AAMjD,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;AAmBA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GACpC;CACf,OAAO,OAAO,OAAO;EACnB,IAAI;EACJ,QAAQ,OAAO,GAAG,WAAW,KAAK;;;GAGhC,MAAM,WACJ,gBAAgB,IAAI,QAAQ,QAAQ,KACpC,gBAAgB,QAAQ,IAAI,kBAAkB,KAC9C;;;GAIF,MAAM,cAAc,OAAO;GAC3B,MAAM,SACJ,eAAe,UAAU,mBAAmB,mBAAmB,QAAQ;GAEzE,IAAI;GACJ,IAAI;IACF,SAAS,wBAAwB,IAAI,OAAO;GAC9C,SAAS,OAAO;;;IAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;IAC1E;GACF;GAEA,MAAM,oBAAoB,kBAAkB,MAAM;GAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;IAG1C,OAAO,KAAK,+BAA+B;KACzC,SAAS,QAAQ,OAAO,OAAO;KAC/B,MAAM,QAAQ,OAAO,IAAI;IAC3B,CAAC;GACH;;;;;GAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;GAC7C,MAAM,gBAAoD,oBACtD,aAAa,OAAO,MAAM,OAAO,WAAW;IAC1C;IACA,WAAW,eAAe;IAC1B,oBAAoB,eAAe;IACnC,UAAU,eAAe;IACzB,mBAAmB,eAAe;IAClC,UAAU,OAAO,SAAS,YAAY;GACxC,CAAC,IACD;GAEJ,MAAM,wBAAuC,UAAU,aAAa,IAAI,SAAS,OAAO,CAAC;;GAGzF,IAAI;GACJ,IAAI,gBAA+B,QAAQ,QAAQ;;GAEnD,IAAI,iBAAiB;;GAErB,IAAI,qBAAqB;GACzB,IAAI,aAAa;GACjB,IAAI;GACJ,MAAM,UAAU,IAAI,IAAoB;GAExC,MAAM,mBAAyB;IAC7B,QAAQ,KAAK;IACb,SAAS;IACT,iBAAiB;GACnB;GAEA,MAAM,sBAAsB,OAAO,aAAwD;;IAEzF,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,OAAO,IAAI,wBACf;KACE,SAAS,CAAC,0BAA0B,OAAO,MAAM,QAAQ,CAAC;KAC1D,gBAAgB;IAClB,GACA;KACE;KACA,WAAW,eAAe;KAC1B,oBAAoB,eAAe;KACnC,UAAU,eAAe,WACrB,KAAK,eAAe,UAAU,oBAAoB,oBAAoB,IACtE;KACJ,uBAAuB;KACvB,cAAc;IAChB,CACF;IACA,MAAM,KAAK,WAAW;IACtB,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC;IACjC,IAAI,oBAAoB;;KAEtB,KAAK,KAAK;KACV;IACF;IACA,SAAS;IACT,iBAAiB,MAAM,oBAAoB,OAAO,KAAK,IAAI,MAAM,MAAM;;IAEvE,MAAM,gBAAgB;GACxB;GAEA,IAAI,OAAO,UAAU;IACnB,MAAM,WAAW,OAAO;IACxB,MAAM,aAAa,OAAO,KAAK;IAE/B,eAAe,aAAa;KAC1B,MAAM,UAAU;MACd,IAAI;MACJ,GAAG;OACD,UAAU;OACV,MAAM;MACR,SAAS,YAAY;KACvB;KACA,cAAc;IAChB,CAAC;IAED,OAAO,IAAI,SAAS,WAAW,WAAW;KACxC,IAAI,kBAAkB,QAAQ,UAAU,GAAG;MACzC,qBAAqB;MACrB,iBAAiB;MACjB,WAAW;MACX,IAAI,CAAC,YAAY;OACf,aAAa;OACb,OAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC;MAC7E;MACA;KACF;KACA,qBAAqB;KAErB,yBAAyB,QAAQ,YAAY,UAAU,MAAM;KAC7D,IAAI,aAAa;KACjB,IAAI,QAAQ;MACV,IAAI;OACF,MAAM,SAAS,OAAO,gBAAgB,UAAU;OAChD,aAAa,OAAO;OACpB,IAAI,OAAO,SAAS,GAAG;QACrB,sBAAsB,QAAQ,YAAY,MAAM;OAClD;MACF,QAAQ,CAER;KACF;KACA,sBAAsB,QAAQ,YAAY,gBAAgB,QAAQ,OAAO;KACzE,OAAO,MAAM,uCAAuC;MAAE;MAAY;KAAW,CAAC;KAE9E,IAAI,CAAC,gBAAgB;MACnB,iBAAiB;MACjB,gBAAgB,cACb,WAAW,oBAAoB,QAAQ,CAAC,CAAC,CACzC,OAAO,UAAU;;OAEhB,iBAAiB;OACjB,OAAO,MAAM,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;MAClF,CAAC;KACL;IACF,CAAC;GACH;;;;GAKA,IAAI,OAAO,WAAW,eAAe;IACnC,MAAM,YAAY,IAAI,IAAI,OAAO,QAAQ,SAAS;IAClD,MAAM,UAAU;;;;;;;;IAQhB,OAAO,IAAI,QAAQ,KAAK,kBAAkB,UAAU;KAClD,MAAM,aAAa,MAAM,MAAM;KAC/B,IAAI,CAAC,UAAU,IAAI,UAAU,GAAG;MAC9B,OAAO,MAAM,6CAA6C,EAAE,WAAW,CAAC;MACxE,OAAO,OAAO;KAChB;KACA,OAAO,OAAO,WAAW;MACvB,KAAK,YAAY;OACf,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,KAAK,CAAC;;;OAGjE,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,OAAO,GAAG;QAC5C,IAAI,IAAI,YAAY,MAAM,iBAAiB;SACzC,OAAO,MAAM,QAAQ;QACvB;OACF;OACA,MAAM,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;OACtE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;MACpE;MACA,QAAQ,UAAU;KACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,iCAAiC;MAC3C;MACA,OAAO,aAAa,KAAK;KAC3B,CAAC,CACH,CACF,GACA,OAAO,KACT;IACF,CAAC;GACH;;GAGA,IAAI;GACJ,IAAI,OAAO,MAAM;IACf,MAAM,MAAM,eAAe,OAAO,QAAQ;IAC1C,MAAM,aAAa,kBAAkB,OAAO,MAAM,GAAG;IACrD,IAAI,WAAW,QAAQ;KACrB,gCAAgC,OAAO,MAAM,KAAK,MAAM;KACxD,MAAM,QAAQ,OAAO,OAAO,cAC1B,gBACE;MAAE,WAAW,IAAI,SAAS;MAAW,WAAW,IAAI,SAAS,SAAS;KAAG,GACzE,YACA,QACA,gBACA,aACF,CACF;KACA,OAAO;KACP,MAAM,EAAE,aAAa;KACrB,MAAM,UAAU,IAAI,iBAAiB,UAAU,eAAe,GAAG;KAEjE,OAAO,OAAO,WACZ,OAAO,WAAW,IAAI,MAAM,UAAU,EAAE,OAAO,iBAAiB,CAAC,IAAI,UACnE,OAAO,WAAW,QAAQ,OAAO,KAA6B,CAAC,CACjE,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,wCAAwC,EAClD,OAAO,aAAa,KAAK,EAC3B,CAAC,CACH,CACF,GACA,OAAO,MACT,CACF;KAEA,OAAO,IAAI,QAAQ,KAAK,WAAW,UACjC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,YAAY,KAAK;MACzC,SAAS,cAAc,OAAO,MAAM;KACtC,CAAC,CACH;KACA,OAAO,IAAI,QAAQ,KAAK,YAAY,UAClC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,aAAa,KAAK;MAC1C,SAAS,aAAa,OAAO,MAAM;KACrC,CAAC,CACH;KACA,OAAO,IAAI,KAAK,KAAK,mBAAmB,UACtC,OAAO,WAAW,SAAS,aAAa,gBAAgB,KAAK,CAAC,CAAC,CACjE;KACA,OAAO,IAAI,KAAK,KAAK,kBAAkB,UACrC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,eAAe;OACrC,MAAM,MAAM;OACZ,WAAW,MAAM;OACjB,IAAI,MAAM;OACV,QAAQ,MAAM;OACd,QAAQ,MAAM,WAAW,cAAc,MAAM,SAAS;MACxD,CAAC;MACD,SAAS,YAAY,OAAO,MAAM;KACpC,CAAC,CACH;KACA,OAAO,IAAI,WAAW,KAAK,aAAa,UACtC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,gBAAgB,KAAK;MAC7C,SAAS,gBAAgB,OAAO,MAAM;KACxC,CAAC,CACH;KAEA,IAAI,WAAW,uBAAuB;;;MAGpC,OAAO,IAAI,QAAQ,KAAK,iBAAiB,UACvC,OAAO,WAAW;OAChB,MAAM,UAAU,SAAS,mBAAmB;OAC5C,IAAI,CAAC,SAAS;QACZ;OACF;OACA,MAAM,UAAkC,CAAC;OACzC,WAAW,OAAO,SAAS,SAAS,oBAAoB;OACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;;QAElD,IAAI,CAAC,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG;SACnC,MAAM,QAAQ,QAAQ,IAAI,KAAK,KAAK;QACtC;OACF;MACF,CAAC,CACH;MACA,OAAO,MAAM,4CAA4C,CAAC,CAAC;KAC7D;IACF,OAAO;KACL,OAAO,KAAK,6BAA6B;MACvC,SAAS,WAAW;MACpB,QAAQ,WAAW,UAAU,2BAA2B;KAC1D,CAAC;IACH;GACF;GAEA,OAAO,OAAO,mBACZ,OAAO,WAAW;IAChB,WAAW;;IAEX,MAAM,SAAS,QAAQ,EAAE,MAAM,2BAA2B,CAAC;GAC7D,CAAC,CACH;GAEA,OAAO,KAAK,4BAA4B;IACtC,SAAS,QAAQ,OAAO,WAAW,aAAa;IAChD,UAAU,OAAO,SAAS,YAAY;IACtC,MAAM,QAAQ,IAAI;IAClB,UAAU,QAAQ,OAAO,QAAQ;IACjC,WAAW,OAAO,cAAc,oBAAoB,cAAc;GACpE,CAAC;EACH,CAAC;CACH,CAAC;AACH;AAEA,OAAO,MAAM,oBAAmC,wBAAwB;AAExE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C,SACE,sCAEK;AACP,SACE,eACA,iBACA,mBACA,eACA,aACA,sBACA,mBACA,yBAOK;AACP,SACE,2BACA,uBACA,uBACA,yBACA,qBACA,wBACA,6BAGK;AACP,SAAS,QAAQ,cAAc;AAE/B,SACE,mBACA,mBACA,+BAGK;AACP,SACE,oBACA,oBACA,mBAGA,iBACA,iBACK;AACP,SACE,cACA,iBACA,aACA,gBACA,iBAEA,wBACK;AACP,SACE,oBACA,sBACA,oBACA,cACA,oBAIK;AACP,SAAS,0BAA0B,8BAA8B,kBAAkB;;AAGnF,OAAO,MAAM,YAAY;AA6CzB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,yBACP,SACA,kBACa;CACb,OAAO;EACL,SAAS,YAAyD;GAChE,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB;IAC5C,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,SAAS,OAAO;IACd,IAAI,+BAA+B,KAAK,GAAG;KACzC,iBAAiB,MAAM;IACzB;IACA,OAAO;GACT;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;;;AASA,SAAS,0BACP,MACA,UACsB;CACtB,OAAO;EACL,IAAI,KAAK;EACT,MAAM,SAAS,QAAQ,KAAK;EAC5B,QAAQ,KAAK;EACb,SAAS,SAAS;EAClB,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,QAAQ,KAAK;EACb,qBAAqB,SAAS,uBAAuB;EACrD,eAAe,SAAS,iBAAiB,CAAC;EAC1C,uBAAuB,KAAK;EAC5B,eAAe,KAAK;EACpB,6BAA6B,KAAK;EAClC,SAAS,KAAK;EACd,cAAc,KAAK;EACnB,UAAU,KAAK;EACf,MAAM,KAAK;EACX,oBAAoB,KAAK;EACzB,uBAAuB,KAAK;CAC9B;AACF;AAEA,SAAS,WAAW,OAAyC;CAC3D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,CAAC;AACP;;;;;;AAOA,SAAS,yBACP,QACA,YACA,UACA,QACM;CACN,MAAM,WAAW,OAAO,IAAI,UAAU,CAAC,EAAE;;;CAGzC,MAAM,eAAe,YAAY,SAAS,SAAS,aAAa,SAAS,OAAO;CAChF,sBAAsB,QAAQ,YAAY;EACxC,MAAM,gBAAgB,SAAS,QAAQ;EACvC,SAAS,uBAAuB,SAAS,WAAW;EACpD,UAAU,0BACR;GAAE,GAAG,WAAW,UAAU,QAAQ;GAAG,SAAS,SAAS;EAAQ,GAC/D,SAAS,aACT,YACA,MACF;CACF,CAAC;AACH;;;;;;;;;;;;;AAmBA,SAAS,gCACP,MACA,KACA,QACM;CACN,MAAM,WACJ,KAAK,iBAAiB,aACtB,KAAK,gBAAgB,aACrB,KAAK,gBAAgB,aACrB,QAAQ,IAAI,2BAA2B,KACvC,QAAQ,IAAI,0BAA0B,KACtC,QAAQ,IAAI,0BAA0B;CACxC,IAAI,UAAU;EACZ,OAAO,MAAM,0CAA0C,EACrD,QACE,mHACJ,CAAC;CACH;AACF;;;;;;;AAaA,eAAe,gBACb,UACA,YACA,QACA,gBACA,SACA,kBACyE;CACzE,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,SAAS,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACtD,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,SAAS;EACtB,WAAW,SAAS;EACpB,UAAU,SAAS;EACnB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,SAAS,gBAAgB,IAAI;CACpF,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;;EAEpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,GAAG,EACzD,aAAa,mBACf,CAAC;CACH;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;EAAU;CAAQ;AACjD;AAEA,MAAM,aAAa,IAAI,0BAA0B;;;;;AAMjD,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;AAmBA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GACpC;CACf,OAAO,OAAO,OAAO;EACnB,IAAI;EACJ,QAAQ,OAAO,GAAG,WAAW,KAAK;;;GAGhC,MAAM,WACJ,gBAAgB,IAAI,QAAQ,QAAQ,KACpC,gBAAgB,QAAQ,IAAI,kBAAkB,KAC9C;;;GAIF,MAAM,cAAc,OAAO;GAC3B,MAAM,SACJ,eAAe,UAAU,mBAAmB,mBAAmB,QAAQ;GAEzE,IAAI;GACJ,IAAI;IACF,SAAS,wBAAwB,IAAI,OAAO;GAC9C,SAAS,OAAO;;;IAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;IAC1E;GACF;GAEA,MAAM,oBAAoB,kBAAkB,MAAM;GAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;IAG1C,OAAO,KAAK,+BAA+B;KACzC,SAAS,QAAQ,OAAO,OAAO;KAC/B,MAAM,QAAQ,OAAO,IAAI;IAC3B,CAAC;GACH;;;;;GAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;;;GAG7C,MAAM,gBAAgB,OAAO,KAAK,aAAa;GAC/C,MAAM,gBACJ,qBAAqB,gBACjB,aAAa,OAAO,MAAM,OAAO,WAAW;IAC1C;IACA,WAAW,eAAe;IAC1B,oBAAoB,eAAe;IACnC,UAAU,eAAe;IACzB,mBAAmB,eAAe;IAClC,UAAU,OAAO,SAAS,YAAY;GACxC,CAAC,IACD;GAEN,MAAM,wBAAuC,UAAU,aAAa,IAAI,SAAS,OAAO,CAAC;GAEzF,MAAM,aAAa,OAAO,UAAU,QAAQ,OAAO,KAAK;GACxD,MAAM,eAAe,6BAA6B,QAAQ,UAAU;;GAEpE,MAAM,wBAAwB,WAAyB;IACrD,IAAI,eAAe;KACjB,aAAa,OAAO,MAAM;IAC5B;GACF;;GAEA,IAAI,0BAA+C,YAAY,CAAC;;GAGhE,IAAI;GACJ,IAAI,gBAA+B,QAAQ,QAAQ;;GAEnD,IAAI,iBAAiB;;GAErB,IAAI,qBAAqB;GACzB,IAAI,aAAa;GACjB,IAAI;GACJ,MAAM,UAAU,IAAI,IAAoB;GAExC,MAAM,mBAAyB;IAC7B,QAAQ,KAAK;IACb,SAAS;IACT,iBAAiB;GACnB;GAEA,MAAM,sBAAsB,OAAO,aAAwD;;IAEzF,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,OAAO,IAAI,wBACf;KACE,SAAS,CAAC,0BAA0B,OAAO,MAAM,QAAQ,CAAC;KAC1D,gBAAgB;IAClB,GACA;;;KAGE,kBAAkB;KAClB;KACA,WAAW,eAAe;KAC1B,oBAAoB,eAAe;KACnC,UAAU,eAAe,WAAW,aAAa,eAAe,QAAQ,IAAI;KAC5E,UAAU,eAAe,WAAW,aAAa,eAAe,QAAQ,IAAI;KAC5E,uBAAuB;KACvB,cAAc;IAChB,CACF;IACA,MAAM,KAAK,WAAW;IACtB,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC;IACjC,IAAI,oBAAoB;;KAEtB,KAAK,KAAK;KACV;IACF;IACA,SAAS;IACT,iBAAiB,MAAM,oBAAoB,OAAO,KAAK,IAAI,MAAM,MAAM;IACvE,IAAI,mBAAmB,aAAa,eAAe;;;KAGjD,IAAI;MACF,MAAM,cAAc,gBAAgB;KACtC,SAAS,OAAO;MACd,IAAI,+BAA+B,KAAK,GAAG;OACzC,qBAAqB,UAAU;MACjC;KACF;IACF;;IAEA,MAAM,gBAAgB;GACxB;GAEA,IAAI,OAAO,UAAU;IACnB,MAAM,WAAW,OAAO;IACxB,MAAM,aAAa,OAAO,KAAK;IAE/B,eAAe,aAAa;KAC1B,MAAM,UAAU;MACd,IAAI;MACJ,GAAG;OACD,UAAU;OACV,MAAM;MACR,SAAS,YAAY;KACvB;KACA,cAAc;IAChB,CAAC;IAED,OAAO,IAAI,SAAS,WAAW,WAAW;KACxC,IAAI,kBAAkB,QAAQ,UAAU,GAAG;MACzC,qBAAqB;MACrB,iBAAiB;MACjB,WAAW;MACX,IAAI,CAAC,YAAY;OACf,aAAa;OACb,OAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC;MAC7E;MACA;KACF;KACA,qBAAqB;KAErB,yBAAyB,QAAQ,YAAY,UAAU,MAAM;KAC7D,IAAI,aAAa;KACjB,IAAI,QAAQ;MACV,IAAI;OACF,MAAM,SAAS,OAAO,gBAAgB,UAAU;OAChD,aAAa,OAAO;OACpB,IAAI,OAAO,SAAS,GAAG;QACrB,sBAAsB,QAAQ,YAAY,MAAM;OAClD;MACF,QAAQ,CAER;KACF;KACA,sBAAsB,QAAQ,YAAY,gBAAgB,QAAQ,OAAO;KACzE,OAAO,MAAM,uCAAuC;MAAE;MAAY;KAAW,CAAC;KAE9E,IAAI,CAAC,gBAAgB;MACnB,iBAAiB;MACjB,gBAAgB,cACb,WAAW,oBAAoB,QAAQ,CAAC,CAAC,CACzC,OAAO,UAAU;;OAEhB,iBAAiB;OACjB,OAAO,MAAM,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;MAClF,CAAC;KACL;IACF,CAAC;GACH;;GAGA,IAAI,iBAAiB,eAAe;IAClC,MAAM,UAAU;IAChB,MAAM,cAAc,YAA2B;KAC7C,IAAI;;;MAGF,IAAI,QAAQ;OACV,MAAM,OAAO,WAAW,OAAO,KAAK,EAAE;OACtC,iBAAiB,MAAM,oBAAoB,OAAO,KAAK,IAAI,QAAQ,MAAM;MAC3E;KACF,SAAS,OAAO;MACd,OAAO,KAAK,mCAAmC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KAC/E;KACA,IAAI;MACF,MAAM,gBAAgB;KACxB,SAAS,OAAO;MACd,OAAO,KAAK,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KACjF;IACF;IACA,MAAM,eAAe,yBAAyB;KAC5C,eAAe,OAAO,KAAK;KAC3B;KACA;KACA;KACA,kBAAkB,aAAa,MAAM;KACrC,kBAAkB;IACpB,CAAC;;;;IAID,OAAO,IAAI,YAAY,WAAW,WAAW;KAC3C,OAAO,OAAO,OAAO,KAAK,KAAK,gBAAgB;MAC7C,YAAY,OAAO;KACrB,CAAC;KACD,OAAO,OAAO,OAAO,YAAY;IACnC,CAAC;;;;;;IAOD,IAAI,iBAAiB;IACrB,IAAI,aAAa;IACjB,IAAI,iBAAiB;IACrB,MAAM,mBAAmB;IACzB,MAAM,UAAU,YAA2B;KACzC,OAAO,KAAK,kCAAkC,EAAE,eAAe,OAAO,KAAK,GAAG,CAAC;KAC/E,IAAI;MACF,MAAM,QAAQ,MAAM;KACtB,SAAS,OAAO;MACd,OAAO,KAAK,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KACjF;;;KAGA,WAAW;KACX,iBAAiB;KACjB,aAAa,MAAM;KACnB,qBAAqB,YAAY;KACjC,IAAI;MACF,MAAM,gBAAgB;KACxB,SAAS,OAAO;MACd,OAAO,KAAK,sCAAsC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KAClF;IACF;IACA,MAAM,eAAe,OAAO,YAAoC;KAC9D,IAAI,SAAS;MACX,iBAAiB;MACjB;KACF;KACA,IAAI,CAAC,kBAAkB,YAAY;MACjC;KACF;KACA,iBAAiB;KACjB,aAAa;KACb,IAAI;MACF,MAAM,QAAQ;KAChB,UAAU;MACR,aAAa;KACf;IACF;IACA,MAAM,qBAAqB,UAAkC;KAC3D,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,iBAAiB,kBAAkB;MAC5D,OAAO,QAAQ,QAAQ;KACzB;KACA,iBAAiB,KAAK,IAAI;KAC1B,OAAO,UACL,aACA,IAAI,YAAY,WAAW,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,KAChD,OAAO,SAAS,SAAS,OAAO,cAAc,aAAa,SAAS,SAAS,CAAC,CAAC,GAC/E,OAAO,MACT,CACF;IACF;IACA,gCAAgC,kBAAkB,KAAK;IACvD,OAAO,OAAO,WACZ,OAAO,WACL,IAAI,MAAM,UAAU,EAClB,OAAO;KAAC;KAAsB;KAAuB;IAAqB,EAC5E,CAAC,SACK,OAAO,cAAc,kBAAkB,IAAI,CAAC,CACpD,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,uCAAuC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC,CACnF,CACF,GACA,OAAO,MACT,CACF;IACA,KAAK,kBAAkB,IAAI;;;IAI3B,KAAK,QAAQ,gBAAgB,CAAC,CAAC,OAAO,UAAmB;KACvD,IAAI,+BAA+B,KAAK,GAAG;MACzC,qBAAqB,SAAS;KAChC,OAAO;MACL,OAAO,MAAM,0CAA0C,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KACvF;IACF,CAAC;GACH,OAAO,IAAI,OAAO,KAAK,aAAa,sBAAsB;IACxD,OAAO,KAAK,wCAAwC;KAClD,UAAU,OAAO,KAAK;KACtB,SAAS,2DAA2D,WAAW,UAAU,EAAE;IAC7F,CAAC;GACH;;;;GAKA,IAAI,OAAO,WAAW,eAAe;IACnC,MAAM,YAAY,IAAI,IAAI,OAAO,QAAQ,SAAS;IAClD,MAAM,UAAU;;;;;;;;IAQhB,OAAO,IAAI,QAAQ,KAAK,kBAAkB,UAAU;KAClD,MAAM,aAAa,MAAM,MAAM;KAC/B,IAAI,CAAC,UAAU,IAAI,UAAU,GAAG;MAC9B,OAAO,MAAM,6CAA6C,EAAE,WAAW,CAAC;MACxE,OAAO,OAAO;KAChB;KACA,OAAO,OAAO,WAAW;MACvB,KAAK,YAAY;OACf,MAAM,wBAAwB;OAC9B,MAAM,QAAQ,MAAM,QAAQ,gBAAgB;;;OAG5C,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,OAAO,GAAG;QAC5C,IAAI,IAAI,YAAY,MAAM,iBAAiB;SACzC,OAAO,MAAM,QAAQ;QACvB;OACF;OACA,MAAM,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;OACtE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;MACpE;MACA,QAAQ,UAAU;KACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW;MAChB,MAAM,cAAc,+BAA+B,KAAK;;;MAGxD,OAAO,eAAe,gBAAgB,UAAU,OAAO,CACrD,iCACA;OAAE;OAAY,OAAO,aAAa,KAAK;MAAE,CAC3C;MACA,IAAI,aAAa;OACf,qBAAqB,SAAS;MAChC;KACF,CAAC,CACH,GACA,OAAO,KACT;IACF,CAAC;GACH;;GAGA,IAAI;GACJ,IAAI,OAAO,MAAM;IACf,MAAM,MAAM,eAAe,OAAO,QAAQ;IAC1C,MAAM,aAAa,kBAAkB,OAAO,MAAM,GAAG;IACrD,IAAI,WAAW,QAAQ;KACrB,gCAAgC,OAAO,MAAM,KAAK,MAAM;KACxD,MAAM,QAAQ,OAAO,OAAO,cAC1B,gBACE;MAAE,WAAW,IAAI,SAAS;MAAW,WAAW,IAAI,SAAS,SAAS;KAAG,GACzE,YACA,QACA,gBACA,eACA,oBACF,CACF;KACA,OAAO;KACP,MAAM,EAAE,aAAa;KACrB,MAAM,UAAU,IAAI,iBAAiB,UAAU,eAAe,GAAG;KAEjE,OAAO,OAAO,WACZ,OAAO,WAAW,IAAI,MAAM,UAAU,EAAE,OAAO,iBAAiB,CAAC,IAAI,UACnE,OAAO,WAAW,QAAQ,OAAO,KAA6B,CAAC,CACjE,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,wCAAwC,EAClD,OAAO,aAAa,KAAK,EAC3B,CAAC,CACH,CACF,GACA,OAAO,MACT,CACF;KAEA,OAAO,IAAI,QAAQ,KAAK,WAAW,UACjC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,YAAY,KAAK;MACzC,SAAS,cAAc,OAAO,MAAM;KACtC,CAAC,CACH;KACA,OAAO,IAAI,QAAQ,KAAK,YAAY,UAClC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,aAAa,KAAK;MAC1C,SAAS,aAAa,OAAO,MAAM;KACrC,CAAC,CACH;KACA,OAAO,IAAI,KAAK,KAAK,mBAAmB,UACtC,OAAO,WAAW,SAAS,aAAa,gBAAgB,KAAK,CAAC,CAAC,CACjE;KACA,OAAO,IAAI,KAAK,KAAK,kBAAkB,UACrC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,eAAe;OACrC,MAAM,MAAM;OACZ,WAAW,MAAM;OACjB,IAAI,MAAM;OACV,QAAQ,MAAM;OACd,QAAQ,MAAM,WAAW,cAAc,MAAM,SAAS;MACxD,CAAC;MACD,SAAS,YAAY,OAAO,MAAM;KACpC,CAAC,CACH;KACA,OAAO,IAAI,WAAW,KAAK,aAAa,UACtC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,gBAAgB,KAAK;MAC7C,SAAS,gBAAgB,OAAO,MAAM;KACxC,CAAC,CACH;KAEA,IAAI,WAAW,uBAAuB;;;MAGpC,OAAO,IAAI,QAAQ,KAAK,iBAAiB,UACvC,OAAO,WAAW;OAChB,MAAM,UAAU,SAAS,mBAAmB;OAC5C,IAAI,CAAC,SAAS;QACZ;OACF;OACA,MAAM,UAAkC,CAAC;OACzC,WAAW,OAAO,SAAS,SAAS,oBAAoB;OACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;;QAElD,IAAI,CAAC,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG;SACnC,MAAM,QAAQ,QAAQ,IAAI,KAAK,KAAK;QACtC;OACF;MACF,CAAC,CACH;MACA,OAAO,MAAM,4CAA4C,CAAC,CAAC;KAC7D;IACF,OAAO;KACL,OAAO,KAAK,6BAA6B;MACvC,SAAS,WAAW;MACpB,QAAQ,WAAW,UAAU,2BAA2B;KAC1D,CAAC;IACH;GACF;GAEA,OAAO,OAAO,mBACZ,OAAO,WAAW;IAChB,WAAW;;IAEX,MAAM,SAAS,QAAQ,EAAE,MAAM,2BAA2B,CAAC;GAC7D,CAAC,CACH;GAEA,OAAO,KAAK,4BAA4B;IACtC,SAAS,QAAQ,OAAO,WAAW,aAAa;IAChD,UAAU,OAAO,SAAS,YAAY;IACtC,MAAM,QAAQ,IAAI;IAClB,UAAU,QAAQ,OAAO,QAAQ;IACjC,WAAW,OAAO,cAAc,oBAAoB,cAAc;GACpE,CAAC;EACH,CAAC;CACH,CAAC;AACH;AAEA,OAAO,MAAM,oBAAmC,wBAAwB;AAExE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}

package/dist/plugin.d.ts

@@ -1,24 +1,28 @@
-import { type AuthServerConfig, type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
+import { type AuthServerConfig, type DeviceSignIn, type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
 /**
-* Legacy identity for the exchanged project-token store (UNCHANGED by
-* ADR-0017 — see `migration.ts`'s module doc for why only the ROOT token
-* relocated). Kept as a constant, not `auth.id`, because the exchanged-token
-* cache key has always been derived from this literal, independent of the
-* configured IdP's `id`.
+* Identity for the exchanged project-token store. Kept as a constant, not
+* `auth.id`, because the exchanged-token key has always been derived from this
+* literal, independent of the configured IdP's `id`.
 */
 export declare const LIGHTBRIDGE_IDENTITY = "lightbridge";
-/** Own cache namespace for the exchanged-token store — separate from oauth2/repo-auth/otel's. */
-export declare const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 /**
-* ADR-0017: the human ROOT token now lives in the SAME cache file
+* Own namespace for the exchanged-token store — separate from oauth2/repo-auth/
+* otel's. It sits under the durable STATE root (ADR-0022): a project token is a
+* credential, and is re-exchangeable only while the human root token survives.
+*/
+export declare const EXCHANGE_STATE_NAMESPACE = "opencode-lightbridge";
+/**
+* ADR-0017: the human ROOT token lives in the SAME credential file
 * `@vymalo/opencode-oauth2` uses for a server of this id —
-* `<cacheRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`, a fused
-* `CachedServerState` (token + discovered models). This is what lets a
-* developer who configures the same IdP (`auth.id` == an oauth2 `servers[].id`,
-* same issuer/clientId) log in ONCE and have both plugins read/write the same
-* on-disk state. The literals are pinned here (not imported from
-* `@vymalo/opencode-oauth2`, which lightbridge does not depend on) — see
-* `docs/adr/0017-lightbridge-all-in-one.md` for the shared-contract rationale.
+* `<stateRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`
+* (ADR-0022 moved the root from the cache dir to the state dir; the relative
+* path is unchanged). This is what lets a developer who configures the same
+* IdP (`auth.id` == an oauth2 `servers[].id`, same issuer/clientId) log in ONCE
+* and have both plugins read/write the same on-disk credential. The literals
+* are pinned here (not imported from `@vymalo/opencode-oauth2`, which
+* lightbridge does not depend on) — see `docs/adr/0017-lightbridge-all-in-one.md`
+* for the shared-contract rationale. The discovered-model list for that server
+* is a separate record in the CACHE root, owned by whichever engine syncs it.
 */
 export declare const ROOT_CACHE_SEGMENT = "opencode-oauth2";
 export declare const ROOT_CACHE_NAMESPACE = "opencode-oauth2-model-sync";
@@ -33,10 +37,10 @@ export interface LightbridgeRuntimeOptions {
 	logger?: Logger;
 	fetchImpl?: typeof fetch;
 	onAuthorizationUrl?: (url: string) => Promise<void> | void;
-	/** Override the cache ROOT (defaults to the OS cache dir convention) — both
-	*  the shared root-token store and the exchange-only store are joined from
-	*  this. Test seam; production callers omit it. */
-	cacheDir?: string;
+	/** Override the STATE root (defaults to the OS state dir convention, ADR-0022) —
+	*  both the shared root-token store and the exchange-only store are joined
+	*  from this. Test seam; production callers omit it. */
+	stateDir?: string;
 	tokenExpirySkewMs?: number;
 	/**
 	* Whether to perform the RFC 8693 exchange (ADR-0012) rather than use the
@@ -50,10 +54,28 @@ export interface LightbridgeRuntimeOptions {
 * `TokenRuntime` (no network, no disk).
 */
 export interface LightbridgeRuntimeLike {
-	getProjectToken(options?: {
-		interactive?: boolean;
+	/**
+	* A usable gateway/OTEL bearer. NEVER interactive (ADR-0023): when no usable
+	* token exists it rejects with `InteractiveAuthRequiredError` and the caller
+	* fails closed. The only way a human signs in is `beginDeviceSignIn`, driven
+	* from the host's Connect dialog.
+	*/
+	getProjectToken(): Promise<TokenSet>;
+	/**
+	* The shared human/IdP root token, refresh-only (never interactive).
+	* `minValidityMs` forces a real refresh when the cached token has less than
+	* that left (the host's 5-minute refresh window is wider than our skew).
+	*/
+	ensureRootToken(options?: {
+		minValidityMs?: number;
 	}): Promise<TokenSet>;
-	reset?(): Promise<void>;
+	/**
+	* Request a device code for the Connect dialog; `complete` polls and stores.
+	* `signal` cancels the device-authorization request.
+	*/
+	beginDeviceSignIn(signal?: AbortSignal): Promise<DeviceSignIn>;
+	/** Drop every stored token for this identity (the host disconnected it). */
+	reset(): Promise<void>;
 }
 /**
 * Builds a `LightbridgeRuntimeLike` for a given `(auth, projectId)` pair.
@@ -68,12 +90,11 @@ export type LightbridgeRuntimeFactory = (auth: AuthServerConfig, projectId: stri
 * BOTH the gateway (`chat.headers`) and OTEL (`TokenSource.headers()`).
 *
 * The human root token itself is no longer lightbridge-exclusive storage: it
-* lives in the SAME cache file `@vymalo/opencode-oauth2` writes for a server
-* of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`), so configuring
-* both plugins against the same IdP (`auth.id` matching an oauth2
-* `servers[].id`, same issuer/clientId) means logging in once. An upgrading
-* install's pre-existing root token is migrated in automatically — see
-* `migration.ts`.
+* lives in the SAME credential file `@vymalo/opencode-oauth2` writes for a
+* server of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`, under the
+* durable state root — ADR-0022), so configuring both plugins against the same
+* IdP (`auth.id` matching an oauth2 `servers[].id`, same issuer/clientId) means
+* logging in once.
 */
 export declare class LightbridgeRuntime implements LightbridgeRuntimeLike {
 	private readonly projectId;
@@ -83,20 +104,12 @@ export declare class LightbridgeRuntime implements LightbridgeRuntimeLike {
 	private readonly logger;
 	private readonly tokenExpirySkewMs;
 	private readonly exchange;
-	private readonly cacheRoot;
+	private readonly stateRoot;
 	private readonly serverId;
 	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
 	private readonly projectKey;
 	private inFlightExchange?;
-	private migration?;
 	constructor(auth: AuthServerConfig, projectId: string | undefined, options?: LightbridgeRuntimeOptions);
-	/**
-	* One-time (per instance) migration of a pre-ADR-0017 root token into the
-	* shared cache file — see `migration.ts`. Idempotent and cheap on every
-	* call after the first (the underlying function also short-circuits once
-	* the new location has ANY state).
-	*/
-	private ensureMigrated;
 	/** Non-network read of the cached project token, if any. */
 	getCachedProjectToken(): Promise<TokenSet | undefined>;
 	/**
@@ -122,20 +135,29 @@ export declare class LightbridgeRuntime implements LightbridgeRuntimeLike {
 	* invents a token: a failure propagates to the caller, which is expected to
 	* fail closed (no header / empty `headers()`).
 	*/
-	getProjectToken(options?: {
-		interactive?: boolean;
-	}): Promise<TokenSet>;
+	getProjectToken(): Promise<TokenSet>;
 	private performExchange;
+	/** See {@link LightbridgeRuntimeLike.ensureRootToken}. */
+	ensureRootToken(options?: {
+		minValidityMs?: number;
+	}): Promise<TokenSet>;
+	/**
+	* The ONLY interactive entry point (ADR-0023): the root runtime requests a
+	* device code and, on `complete`, stores the result through the shared
+	* credential file's single writer (`setCached` under the refresh lock).
+	*/
+	beginDeviceSignIn(signal?: AbortSignal): Promise<DeviceSignIn>;
 	/**
 	* Drop the cached tokens for this identity: the exchanged project token
-	* entirely (its own exclusive store), and the shared root token's `token`
-	* field only — NOT the whole shared cache file, which may also hold
-	* `@vymalo/opencode-oauth2`'s discovered models for this server id and must
-	* survive a lightbridge-side logout.
+	* entirely (its own exclusive store), and the shared root credential. The
+	* discovered-model record is a separate file in the cache root and is not
+	* touched, so oauth2's models survive a lightbridge-side logout.
 	*/
 	reset(): Promise<void>;
 }
-/** Absolute path to the lightbridge-exclusive (exchanged-token) cache directory. */
-export declare function lightbridgeCacheDir(cacheRoot: string): string;
-/** Absolute path to the SHARED root-token cache directory (ADR-0017). */
+/** Absolute path to the lightbridge-exclusive (exchanged-token) STATE directory. */
+export declare function lightbridgeStateDir(stateRoot: string): string;
+/** Absolute path to the SHARED root-credential STATE directory (ADR-0017, ADR-0022). */
+export declare function rootStateDir(stateRoot: string): string;
+/** Absolute path to the SHARED discovered-model CACHE directory (disposable; ADR-0022). */
 export declare function rootCacheDir(cacheRoot: string): string;

package/dist/plugin.js

@@ -1,27 +1,30 @@
 import { join } from "node:path";
-import { createJsonConsoleLogger, DEFAULT_TOKEN_EXPIRY_SKEW_MS, resolveCacheRoot, TokenRuntime } from "@vymalo/opencode-auth-core/lib";
-import { FileCacheStore as SharedFileCacheStore } from "@vymalo/opencode-provider-sync/lib";
-import { migrateRootTokenIfNeeded } from "./migration.js";
+import { createJsonConsoleLogger, DEFAULT_TOKEN_EXPIRY_SKEW_MS, resolveStateRoot, TokenRuntime } from "@vymalo/opencode-auth-core/lib";
+import { ServerCredentialStore } from "@vymalo/opencode-provider-sync/lib";
 /**
-* Legacy identity for the exchanged project-token store (UNCHANGED by
-* ADR-0017 — see `migration.ts`'s module doc for why only the ROOT token
-* relocated). Kept as a constant, not `auth.id`, because the exchanged-token
-* cache key has always been derived from this literal, independent of the
-* configured IdP's `id`.
+* Identity for the exchanged project-token store. Kept as a constant, not
+* `auth.id`, because the exchanged-token key has always been derived from this
+* literal, independent of the configured IdP's `id`.
 */
 export const LIGHTBRIDGE_IDENTITY = "lightbridge";
-/** Own cache namespace for the exchanged-token store — separate from oauth2/repo-auth/otel's. */
-export const DEFAULT_CACHE_NAMESPACE = "opencode-lightbridge";
 /**
-* ADR-0017: the human ROOT token now lives in the SAME cache file
+* Own namespace for the exchanged-token store — separate from oauth2/repo-auth/
+* otel's. It sits under the durable STATE root (ADR-0022): a project token is a
+* credential, and is re-exchangeable only while the human root token survives.
+*/
+export const EXCHANGE_STATE_NAMESPACE = "opencode-lightbridge";
+/**
+* ADR-0017: the human ROOT token lives in the SAME credential file
 * `@vymalo/opencode-oauth2` uses for a server of this id —
-* `<cacheRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`, a fused
-* `CachedServerState` (token + discovered models). This is what lets a
-* developer who configures the same IdP (`auth.id` == an oauth2 `servers[].id`,
-* same issuer/clientId) log in ONCE and have both plugins read/write the same
-* on-disk state. The literals are pinned here (not imported from
-* `@vymalo/opencode-oauth2`, which lightbridge does not depend on) — see
-* `docs/adr/0017-lightbridge-all-in-one.md` for the shared-contract rationale.
+* `<stateRoot>/opencode-oauth2/opencode-oauth2-model-sync/<id>.json`
+* (ADR-0022 moved the root from the cache dir to the state dir; the relative
+* path is unchanged). This is what lets a developer who configures the same
+* IdP (`auth.id` == an oauth2 `servers[].id`, same issuer/clientId) log in ONCE
+* and have both plugins read/write the same on-disk credential. The literals
+* are pinned here (not imported from `@vymalo/opencode-oauth2`, which
+* lightbridge does not depend on) — see `docs/adr/0017-lightbridge-all-in-one.md`
+* for the shared-contract rationale. The discovered-model list for that server
+* is a separate record in the CACHE root, owned by whichever engine syncs it.
 */
 export const ROOT_CACHE_SEGMENT = "opencode-oauth2";
 export const ROOT_CACHE_NAMESPACE = "opencode-oauth2-model-sync";
@@ -48,14 +51,19 @@ function isProjectTokenUsable(token, skewMs) {
 }
 /**
 * Build the ONE shared root `TokenRuntime` for `serverId`, persisting through
-* the SAME fused `CachedServerState` shape+location `ProviderModelSyncEngine`
-* uses (see `ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE` above) — mirroring the
-* override pattern in `@vymalo/opencode-provider-sync`'s
-* `ProviderModelSyncEngine.buildTokenRuntime` (extract `.token`, preserve
-* `.models`/`.rawModels` on write) but WITHOUT running that engine's
-* scheduler/model-discovery — this is a read/refresh-only participant in the
-* shared cache file, not a second poller (see ADR-0017's double-scheduling
-* guard, enforced inside the engine itself for the `register` path).
+* the SAME credential record `ProviderModelSyncEngine` uses (see
+* `ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE` above) — mirroring the override
+* pattern in `@vymalo/opencode-provider-sync`'s
+* `ProviderModelSyncEngine.buildTokenRuntime`, but WITHOUT running that
+* engine's scheduler/model-discovery — this is a read/refresh-only participant
+* in the shared credential file, not a second poller (see ADR-0017's
+* double-scheduling guard, enforced inside the engine itself for the `register`
+* path). It never touches the model-cache record, so a lightbridge-side write
+* can no longer clobber oauth2's discovered models.
+*
+* `stateDir` is the credential store's directory, so the cross-process refresh
+* lock (`<stateDir>/locks/<id>.lock`) sits beside the token it guards and is
+* the very lock oauth2's engine takes for the same id.
 *
 * Unlike `ProviderModelSyncEngine`, this performs no cross-process
 * "adopt-if-newer" reconciliation — every `getCached()` call here reads disk
@@ -65,28 +73,22 @@ function isProjectTokenUsable(token, skewMs) {
 * fallback), and refreshes are still coordinated via `TokenRuntime`'s own
 * cross-process file lock.
 */
-function buildSharedRootTokenRuntime(serverId, auth, sharedStore, options) {
+function buildSharedRootTokenRuntime(serverId, auth, credentials, options) {
 	return new TokenRuntime(serverId, auth, {
 		logger: options.logger,
 		fetchImpl: options.fetchImpl,
 		onAuthorizationUrl: options.onAuthorizationUrl,
 		tokenExpirySkewMs: options.tokenExpirySkewMs,
 		serviceLabel: "opencode-lightbridge",
-		getCached: async () => {
-			const state = await sharedStore.loadServerState(serverId);
-			return state?.token;
-		},
+		stateDir: credentials.directory,
+		getCached: async () => (await credentials.load(serverId))?.token,
 		setCached: async (token) => {
-			const existing = await sharedStore.loadServerState(serverId);
-			const next = {
-				serverId,
-				updatedAt: Date.now(),
-				lastSyncAt: existing?.lastSyncAt,
-				models: existing?.models ?? [],
-				rawModels: existing?.rawModels ?? [],
-				token
-			};
-			await sharedStore.saveServerState(next);
+			await credentials.save(serverId, token, Date.now());
+		},
+		// Compare-and-clear of a refresh token the IdP rejected is done by
+		// TokenRuntime under the lock; this only performs the removal.
+		clearCached: async () => {
+			await credentials.remove(serverId);
 		}
 	});
 }
@@ -98,12 +100,11 @@ function buildSharedRootTokenRuntime(serverId, auth, sharedStore, options) {
 * BOTH the gateway (`chat.headers`) and OTEL (`TokenSource.headers()`).
 *
 * The human root token itself is no longer lightbridge-exclusive storage: it
-* lives in the SAME cache file `@vymalo/opencode-oauth2` writes for a server
-* of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`), so configuring
-* both plugins against the same IdP (`auth.id` matching an oauth2
-* `servers[].id`, same issuer/clientId) means logging in once. An upgrading
-* install's pre-existing root token is migrated in automatically — see
-* `migration.ts`.
+* lives in the SAME credential file `@vymalo/opencode-oauth2` writes for a
+* server of this id (`ROOT_CACHE_SEGMENT`/`ROOT_CACHE_NAMESPACE`, under the
+* durable state root — ADR-0022), so configuring both plugins against the same
+* IdP (`auth.id` matching an oauth2 `servers[].id`, same issuer/clientId) means
+* logging in once.
 */
 export class LightbridgeRuntime {
 	projectId;
@@ -113,21 +114,20 @@ export class LightbridgeRuntime {
 	logger;
 	tokenExpirySkewMs;
 	exchange;
-	cacheRoot;
+	stateRoot;
 	serverId;
 	/** Token-cache key: the project id, or `DEFAULT_PROJECT_KEY` when unset. */
 	projectKey;
 	inFlightExchange;
-	migration;
 	constructor(auth, projectId, options = {}) {
 		this.projectId = projectId;
 		this.serverId = auth.id;
 		this.projectKey = projectId ?? DEFAULT_PROJECT_KEY;
 		this.logger = options.logger ?? createJsonConsoleLogger("info");
 		this.exchange = options.exchange ?? false;
-		this.cacheRoot = options.cacheDir ?? resolveCacheRoot();
+		this.stateRoot = options.stateDir ?? resolveStateRoot();
 		this.tokenExpirySkewMs = typeof options.tokenExpirySkewMs === "number" && Number.isFinite(options.tokenExpirySkewMs) && options.tokenExpirySkewMs > 0 ? options.tokenExpirySkewMs : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
-		this.sharedStore = new SharedFileCacheStore(join(this.cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE), this.logger);
+		this.sharedStore = new ServerCredentialStore(rootStateDir(this.stateRoot), this.logger);
 		this.rootRuntime = buildSharedRootTokenRuntime(this.serverId, auth, this.sharedStore, options);
 		// The exchange-only runtime keeps its OWN dedicated, lightbridge-exclusive
 		// store (unchanged location/shape) — there is no oauth2 equivalent for a
@@ -136,27 +136,11 @@ export class LightbridgeRuntime {
 			logger: this.logger,
 			fetchImpl: options.fetchImpl,
 			onAuthorizationUrl: options.onAuthorizationUrl,
-			cacheDir: join(this.cacheRoot, DEFAULT_CACHE_NAMESPACE),
+			stateDir: lightbridgeStateDir(this.stateRoot),
 			tokenExpirySkewMs: this.tokenExpirySkewMs,
 			serviceLabel: "opencode-lightbridge"
 		});
 	}
-	/**
-	* One-time (per instance) migration of a pre-ADR-0017 root token into the
-	* shared cache file — see `migration.ts`. Idempotent and cheap on every
-	* call after the first (the underlying function also short-circuits once
-	* the new location has ANY state).
-	*/
-	ensureMigrated() {
-		if (!this.migration) {
-			this.migration = migrateRootTokenIfNeeded(this.cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE, this.serverId, this.logger).catch((error) => {
-				// Never fatal: worst case is a fresh login, same as a first-ever
-				// install. Swallow so a migration hiccup can't break normal auth.
-				this.logger.debug("lightbridge_root_migration_error", { error: error instanceof Error ? error.message : String(error) });
-			});
-		}
-		return this.migration;
-	}
 	/** Non-network read of the cached project token, if any. */
 	async getCachedProjectToken() {
 		return this.exchangeRuntime.getExchangedByKey(this.projectKey);
@@ -184,10 +168,9 @@ export class LightbridgeRuntime {
 	* invents a token: a failure propagates to the caller, which is expected to
 	* fail closed (no header / empty `headers()`).
 	*/
-	async getProjectToken(options = {}) {
-		await this.ensureMigrated();
+	async getProjectToken() {
 		if (!this.exchange) {
-			return this.rootRuntime.ensure({ interactive: options.interactive });
+			return this.rootRuntime.ensure({ interactive: false });
 		}
 		const cached = await this.getCachedProjectToken();
 		if (isProjectTokenUsable(cached, this.tokenExpirySkewMs)) {
@@ -198,7 +181,7 @@ export class LightbridgeRuntime {
 		if (this.inFlightExchange) {
 			return this.inFlightExchange;
 		}
-		const exchange = this.performExchange(options);
+		const exchange = this.performExchange();
 		this.inFlightExchange = exchange;
 		try {
 			return await exchange;
@@ -208,8 +191,8 @@ export class LightbridgeRuntime {
 			}
 		}
 	}
-	async performExchange(options) {
-		const human = await this.rootRuntime.ensure({ interactive: options.interactive });
+	async performExchange() {
+		const human = await this.rootRuntime.ensure({ interactive: false });
 		this.logger.info("lightbridge_exchange_started", { projectId: this.projectId ?? "(default)" });
 		try {
 			// No `projectId` → send no `project_id` param; the backend mints a token
@@ -225,30 +208,41 @@ export class LightbridgeRuntime {
 			throw error;
 		}
 	}
+	/** See {@link LightbridgeRuntimeLike.ensureRootToken}. */
+	async ensureRootToken(options = {}) {
+		return this.rootRuntime.ensure({
+			interactive: false,
+			minValidityMs: options.minValidityMs
+		});
+	}
+	/**
+	* The ONLY interactive entry point (ADR-0023): the root runtime requests a
+	* device code and, on `complete`, stores the result through the shared
+	* credential file's single writer (`setCached` under the refresh lock).
+	*/
+	async beginDeviceSignIn(signal) {
+		return this.rootRuntime.beginDeviceSignIn(signal);
+	}
 	/**
 	* Drop the cached tokens for this identity: the exchanged project token
-	* entirely (its own exclusive store), and the shared root token's `token`
-	* field only — NOT the whole shared cache file, which may also hold
-	* `@vymalo/opencode-oauth2`'s discovered models for this server id and must
-	* survive a lightbridge-side logout.
+	* entirely (its own exclusive store), and the shared root credential. The
+	* discovered-model record is a separate file in the cache root and is not
+	* touched, so oauth2's models survive a lightbridge-side logout.
 	*/
 	async reset() {
 		await this.exchangeRuntime.reset();
-		const existing = await this.sharedStore.loadServerState(this.serverId);
-		if (existing?.token) {
-			await this.sharedStore.saveServerState({
-				...existing,
-				updatedAt: Date.now(),
-				token: undefined
-			});
-		}
+		await this.sharedStore.remove(this.serverId);
 	}
 }
-/** Absolute path to the lightbridge-exclusive (exchanged-token) cache directory. */
-export function lightbridgeCacheDir(cacheRoot) {
-	return join(cacheRoot, DEFAULT_CACHE_NAMESPACE);
+/** Absolute path to the lightbridge-exclusive (exchanged-token) STATE directory. */
+export function lightbridgeStateDir(stateRoot) {
+	return join(stateRoot, EXCHANGE_STATE_NAMESPACE);
+}
+/** Absolute path to the SHARED root-credential STATE directory (ADR-0017, ADR-0022). */
+export function rootStateDir(stateRoot) {
+	return join(stateRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE);
 }
-/** Absolute path to the SHARED root-token cache directory (ADR-0017). */
+/** Absolute path to the SHARED discovered-model CACHE directory (disposable; ADR-0022). */
 export function rootCacheDir(cacheRoot) {
 	return join(cacheRoot, ROOT_CACHE_SEGMENT, ROOT_CACHE_NAMESPACE);
 }

package/dist/plugin.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;AACP,SACE,kBAAkB,4BAEb;AAEP,SAAS,gCAAgC;;;;;;;;AASzC,OAAO,MAAM,uBAAuB;;AAGpC,OAAO,MAAM,0BAA0B;;;;;;;;;;;;AAavC,OAAO,MAAM,qBAAqB;AAClC,OAAO,MAAM,uBAAuB;;;;;;;AAQpC,OAAO,MAAM,sBAAsB;;;;;;AA2CnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,4BACP,UACA,MACA,aACA,SACc;CACd,OAAO,IAAI,aAAa,UAAU,MAAM;EACtC,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,cAAc;EACd,WAAW,YAAY;GACrB,MAAM,QAAQ,MAAM,YAAY,gBAAgB,QAAQ;GACxD,OAAO,OAAO;EAChB;EACA,WAAW,OAAO,UAAU;GAC1B,MAAM,WAAW,MAAM,YAAY,gBAAgB,QAAQ;GAC3D,MAAM,OAA0B;IAC9B;IACA,WAAW,KAAK,IAAI;IACpB,YAAY,UAAU;IACtB,QAAQ,UAAU,UAAU,CAAC;IAC7B,WAAW,UAAU,aAAa,CAAC;IACnC;GACF;GACA,MAAM,YAAY,gBAAgB,IAAI;EACxC;CACF,CAAC;AACH;;;;;;;;;;;;;;;;AAiBA,OAAO,MAAM,mBAAqD;CAgB7C;CAfnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CACR,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,WAAW,KAAK;EACrB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,WAAW,QAAQ,YAAY;EACpC,KAAK,YAAY,QAAQ,YAAY,iBAAiB;EACtD,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,cAAc,IAAI,qBACrB,KAAK,KAAK,WAAW,oBAAoB,oBAAoB,GAC7D,KAAK,MACP;EACA,KAAK,cAAc,4BAA4B,KAAK,UAAU,MAAM,KAAK,aAAa,OAAO;;;;EAK7F,KAAK,kBAAkB,IAAI,aAAa,sBAAsB,MAAM;GAClE,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,KAAK,KAAK,WAAW,uBAAuB;GACtD,mBAAmB,KAAK;GACxB,cAAc;EAChB,CAAC;CACH;;;;;;;CAQA,AAAQ,iBAAgC;EACtC,IAAI,CAAC,KAAK,WAAW;GACnB,KAAK,YAAY,yBACf,KAAK,WACL,oBACA,sBACA,KAAK,UACL,KAAK,MACP,CAAC,CAAC,OAAO,UAAU;;;IAGjB,KAAK,OAAO,MAAM,oCAAoC,EACpD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACH;EACA,OAAO,KAAK;CACd;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,gBAAgB,kBAAkB,KAAK,UAAU;CAC/D;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,MAAM,KAAK,eAAe;EAE1B,IAAI,CAAC,KAAK,UAAU;GAClB,OAAO,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EACrE;EAEA,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAChF,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,gBAAgB,WAC3C,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;;;;;;;CASA,MAAM,QAAuB;EAC3B,MAAM,KAAK,gBAAgB,MAAM;EACjC,MAAM,WAAW,MAAM,KAAK,YAAY,gBAAgB,KAAK,QAAQ;EACrE,IAAI,UAAU,OAAO;GACnB,MAAM,KAAK,YAAY,gBAAgB;IACrC,GAAG;IACH,WAAW,KAAK,IAAI;IACpB,OAAO;GACT,CAAC;EACH;CACF;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,uBAAuB;AAChD;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAKK;AACP,SAAS,6BAA6B;;;;;;AAOtC,OAAO,MAAM,uBAAuB;;;;;;AAOpC,OAAO,MAAM,2BAA2B;;;;;;;;;;;;;;AAexC,OAAO,MAAM,qBAAqB;AAClC,OAAO,MAAM,uBAAuB;;;;;;;AAQpC,OAAO,MAAM,sBAAsB;;;;;;AA6DnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAS,4BACP,UACA,MACA,aACA,SACc;CACd,OAAO,IAAI,aAAa,UAAU,MAAM;EACtC,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,cAAc;EACd,UAAU,YAAY;EACtB,WAAW,aAAa,MAAM,YAAY,KAAK,QAAQ,EAAC,AAAC,EAAE;EAC3D,WAAW,OAAO,UAAU;GAC1B,MAAM,YAAY,KAAK,UAAU,OAAO,KAAK,IAAI,CAAC;EACpD;;;EAGA,aAAa,YAAY;GACvB,MAAM,YAAY,OAAO,QAAQ;EACnC;CACF,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,OAAO,MAAM,mBAAqD;CAe7C;CAdnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,WAAW,KAAK;EACrB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,WAAW,QAAQ,YAAY;EACpC,KAAK,YAAY,QAAQ,YAAY,iBAAiB;EACtD,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,cAAc,IAAI,sBAAsB,aAAa,KAAK,SAAS,GAAG,KAAK,MAAM;EACtF,KAAK,cAAc,4BAA4B,KAAK,UAAU,MAAM,KAAK,aAAa,OAAO;;;;EAK7F,KAAK,kBAAkB,IAAI,aAAa,sBAAsB,MAAM;GAClE,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,oBAAoB,KAAK,SAAS;GAC5C,mBAAmB,KAAK;GACxB,cAAc;EAChB,CAAC;CACH;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,gBAAgB,kBAAkB,KAAK,UAAU;CAC/D;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,MAAM,kBAAqC;EACzC,IAAI,CAAC,KAAK,UAAU;GAClB,OAAO,KAAK,YAAY,OAAO,EAAE,aAAa,MAAM,CAAC;EACvD;EAEA,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB;EACtC,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,kBAAqC;EACjD,MAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,EAAE,aAAa,MAAM,CAAC;EAClE,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,gBAAgB,WAC3C,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;CAGA,MAAM,gBAAgB,UAAsC,CAAC,GAAsB;EACjF,OAAO,KAAK,YAAY,OAAO;GAAE,aAAa;GAAO,eAAe,QAAQ;EAAc,CAAC;CAC7F;;;;;;CAOA,MAAM,kBAAkB,QAA6C;EACnE,OAAO,KAAK,YAAY,kBAAkB,MAAM;CAClD;;;;;;;CAQA,MAAM,QAAuB;EAC3B,MAAM,KAAK,gBAAgB,MAAM;EACjC,MAAM,KAAK,YAAY,OAAO,KAAK,QAAQ;CAC7C;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,wBAAwB;AACjD;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/dist/sign-in.d.ts

@@ -0,0 +1,70 @@
+import type { Credential, Plugin } from "@opencode/plugin/effect";
+import { type TokenSet } from "@vymalo/opencode-auth-core/lib";
+import type { Logger } from "./logging.js";
+import type { LightbridgeRuntimeLike } from "./plugin.js";
+type IntegrationEditor = Parameters<Parameters<Plugin.Context["integration"]["transform"]>[0]>[0];
+/** The host's oauth-method registration shape (the package does not export it by name). */
+export type IntegrationOAuthMethodRegistration = Extract<Parameters<IntegrationEditor["method"]["update"]>[0], {
+	method: {
+		type: "oauth";
+	};
+}>;
+/** Id of the one sign-in method lightbridge registers on its integration (ADR-0023). */
+export declare const SIGN_IN_METHOD_ID = "device";
+/** Label of the button the host renders for that method. */
+export declare const SIGN_IN_METHOD_LABEL = "Sign in";
+/** The host calls a method's `refresh` once the credential is within this of `expires`. */
+export declare const HOST_REFRESH_WINDOW_MS: number;
+/** The exact path a user follows to sign in, for the `lightbridge_sign_in_required` hint. */
+export declare function signInPath(name: string): string;
+/**
+* Display-only account label (email / username) read from the access token's
+* claims. Deliberately UNVERIFIED: nothing security-relevant ever reads it, it
+* only decorates the host's connection row. Opaque (non-JWT) tokens and any
+* decoding problem yield `undefined`.
+*/
+export declare function accountLabel(accessToken: string): string | undefined;
+/**
+* The host-side projection of our token: a "connected" marker plus the current
+* access token. CUSTODY RULE (ADR-0023): `refresh` is ALWAYS `""` — the refresh
+* token never leaves lightbridge's own state file, so a host credential-store
+* leak or a host-driven refresh cannot replay (and thereby rotate away) it.
+*/
+export declare function projectCredential(token: TokenSet, now?: number): Credential.OAuth;
+export interface SignInDependencies {
+	integrationID: string;
+	runtime: LightbridgeRuntimeLike;
+	logger: Logger;
+	/**
+	* Runs after the projection was handed back (kick the model sync, reload the
+	* host's providers). Detached: the dialog closes without waiting for it, and
+	* a failure or a late interrupt cannot undo the sign-in.
+	*/
+	afterSignIn: () => Promise<void>;
+	/** Called synchronously on a successful sign-in (re-arms the sign-in notice). */
+	onSignedIn?: () => void;
+	/** Called when a sign-in-related call finds no usable token (refresh-only failure). */
+	onSignInRequired?: (source: string) => void;
+}
+/**
+* The oauth method registration behind the host's "Connect" dialog (ADR-0023).
+* `authorize` requests a device code and hands the host the URL + code to show;
+* `callback` awaits the user's approval (interruptible: the host closing the
+* dialog interrupts it, which aborts the polling) and returns the projection.
+*/
+export declare function createSignInRegistration(deps: SignInDependencies): IntegrationOAuthMethodRegistration;
+export interface SignInNotice {
+	/** Warn (once until re-armed) that sign-in is needed; always records the source at debug. */
+	notify(source: string): void;
+	/** Re-arm: the next `notify` warns again (after a sign-in, or a host disconnect). */
+	reset(): void;
+}
+/**
+* Emit `lightbridge_sign_in_required` at most once per arming, naming the exact
+* path to sign in. Every non-interactive caller that finds no usable token
+* (startup check, gateway header, OTEL token source, the register sync) reports
+* through this one latch; each call is also recorded at `debug` as
+* `lightbridge_sign_in_required_seen` so the sources stay observable.
+*/
+export declare function createSignInRequiredNotifier(logger: Logger, name: string): SignInNotice;
+export {};

package/dist/sign-in.js

@@ -0,0 +1,152 @@
+import { isInteractiveAuthRequiredError } from "@vymalo/opencode-auth-core/lib";
+import { Effect } from "effect";
+/** Id of the one sign-in method lightbridge registers on its integration (ADR-0023). */
+export const SIGN_IN_METHOD_ID = "device";
+/** Label of the button the host renders for that method. */
+export const SIGN_IN_METHOD_LABEL = "Sign in";
+/** Fallback lifetime for a token the IdP gave no `expires_in` for. */
+const FALLBACK_LIFETIME_MS = 60 * 60 * 1e3;
+const MAX_LABEL_CHARS = 80;
+/** The host calls a method's `refresh` once the credential is within this of `expires`. */
+export const HOST_REFRESH_WINDOW_MS = 5 * 60 * 1e3;
+/** The exact path a user follows to sign in, for the `lightbridge_sign_in_required` hint. */
+export function signInPath(name) {
+	return `Settings → Providers → Show more providers → (Integrations dialog) search "${name}" → Sign in`;
+}
+/**
+* Display-only account label (email / username) read from the access token's
+* claims. Deliberately UNVERIFIED: nothing security-relevant ever reads it, it
+* only decorates the host's connection row. Opaque (non-JWT) tokens and any
+* decoding problem yield `undefined`.
+*/
+export function accountLabel(accessToken) {
+	const parts = accessToken.split(".");
+	if (parts.length !== 3 || !parts[1]) {
+		return undefined;
+	}
+	try {
+		const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		for (const key of ["email", "preferred_username"]) {
+			const value = claims[key];
+			if (typeof value === "string" && value.trim().length > 0) {
+				return value.trim().slice(0, MAX_LABEL_CHARS);
+			}
+		}
+	} catch {}
+	return undefined;
+}
+/**
+* The host-side projection of our token: a "connected" marker plus the current
+* access token. CUSTODY RULE (ADR-0023): `refresh` is ALWAYS `""` — the refresh
+* token never leaves lightbridge's own state file, so a host credential-store
+* leak or a host-driven refresh cannot replay (and thereby rotate away) it.
+*/
+export function projectCredential(token, now = Date.now()) {
+	const label = accountLabel(token.accessToken);
+	return {
+		type: "oauth",
+		methodID: SIGN_IN_METHOD_ID,
+		access: token.accessToken,
+		refresh: "",
+		expires: Math.floor(token.expiresAt ?? now + FALLBACK_LIFETIME_MS),
+		...label ? { metadata: { label } } : {}
+	};
+}
+/**
+* The oauth method registration behind the host's "Connect" dialog (ADR-0023).
+* `authorize` requests a device code and hands the host the URL + code to show;
+* `callback` awaits the user's approval (interruptible: the host closing the
+* dialog interrupts it, which aborts the polling) and returns the projection.
+*/
+export function createSignInRegistration(deps) {
+	const { integrationID, runtime, logger } = deps;
+	return {
+		integrationID,
+		method: {
+			id: SIGN_IN_METHOD_ID,
+			type: "oauth",
+			label: SIGN_IN_METHOD_LABEL
+		},
+		authorize: () => Effect.tryPromise({
+			// The effect's signal aborts when the host abandons the attempt, which
+			// also cancels the device-authorization request.
+			try: (signal) => runtime.beginDeviceSignIn(signal),
+			catch: (error) => error
+		}).pipe(Effect.tapError((error) => Effect.sync(() => logger.error("lightbridge_sign_in_begin_failed", errorFields(error)))), Effect.map((session) => ({
+			url: session.verificationUriComplete ?? session.verificationUri,
+			instructions: `Confirm the code ${session.userCode} on the page that opens, then approve the request.`,
+			expiresAt: session.expiresAt,
+			mode: "auto",
+			callback: Effect.tryPromise({
+				try: (signal) => session.complete(signal),
+				catch: (error) => error
+			}).pipe(Effect.tapError((error) => Effect.sync(() => logger.warn("lightbridge_sign_in_failed", errorFields(error)))), Effect.onInterrupt(() => Effect.sync(() => logger.info("lightbridge_sign_in_cancelled", { integrationID }))), Effect.map((token) => {
+				logger.info("lightbridge_sign_in_completed", { integrationID });
+				deps.onSignedIn?.();
+				// Detached on purpose (see `afterSignIn`).
+				void (async () => {
+					try {
+						await deps.afterSignIn();
+					} catch (error) {
+						logger.warn("lightbridge_sign_in_followup_failed", errorFields(error));
+					}
+				})();
+				return projectCredential(token);
+			}))
+		}))),
+		// The host calls this within HOST_REFRESH_WINDOW_MS of `expires`. Whatever it
+		// holds is ignored (it has no refresh token): the truth is our own runtime,
+		// forced to a real, non-interactive refresh through the single writer. A
+		// revoked/cleared root fails here - it never starts a flow.
+		refresh: () => Effect.tryPromise({
+			try: () => runtime.ensureRootToken({ minValidityMs: HOST_REFRESH_WINDOW_MS }),
+			catch: (error) => error
+		}).pipe(Effect.tapError((error) => Effect.sync(() => {
+			logger.warn("lightbridge_sign_in_refresh_failed", errorFields(error));
+			if (isInteractiveAuthRequiredError(error)) {
+				deps.onSignInRequired?.("refresh");
+			}
+		})), Effect.tap((token) => Effect.sync(() => {
+			// A refresh that "succeeds" with a token still inside the window means
+			// the refresh itself failed and we served what was left.
+			if (token.expiresAt !== undefined && token.expiresAt - Date.now() <= HOST_REFRESH_WINDOW_MS) {
+				logger.warn("lightbridge_sign_in_refresh_failed", { error: "refresh returned a token still inside the host refresh window" });
+			}
+		})), Effect.map((token) => projectCredential(token))),
+		label: (credential) => {
+			const label = credential.metadata?.label;
+			return typeof label === "string" ? label : undefined;
+		}
+	};
+}
+function errorFields(error) {
+	return { error: error instanceof Error ? error.message : String(error) };
+}
+/**
+* Emit `lightbridge_sign_in_required` at most once per arming, naming the exact
+* path to sign in. Every non-interactive caller that finds no usable token
+* (startup check, gateway header, OTEL token source, the register sync) reports
+* through this one latch; each call is also recorded at `debug` as
+* `lightbridge_sign_in_required_seen` so the sources stay observable.
+*/
+export function createSignInRequiredNotifier(logger, name) {
+	let notified = false;
+	return {
+		notify(source) {
+			logger.debug("lightbridge_sign_in_required_seen", { source });
+			if (notified) {
+				return;
+			}
+			notified = true;
+			logger.warn("lightbridge_sign_in_required", {
+				source,
+				message: `lightbridge is not signed in: open ${signInPath(name)}`
+			});
+		},
+		reset() {
+			notified = false;
+		}
+	};
+}
+
+//# sourceMappingURL=sign-in.js.map

package/dist/sign-in.js.map

@@ -0,0 +1 @@
+{"mappings":"AACA,SAAS,sCAAqD;AAC9D,SAAS,cAAc;;AAcvB,OAAO,MAAM,oBAAoB;;AAGjC,OAAO,MAAM,uBAAuB;;AAGpC,MAAM,uBAAuB,KAAK,KAAK;AAEvC,MAAM,kBAAkB;;AAGxB,OAAO,MAAM,yBAAiC,IAAI,KAAK;;AAGvD,OAAO,SAAS,WAAW,MAAsB;CAC/C,OAAO,8EAA8E,KAAK;AAC5F;;;;;;;AAQA,OAAO,SAAS,aAAa,aAAyC;CACpE,MAAM,QAAQ,YAAY,MAAM,GAAG;CACnC,IAAI,MAAM,WAAW,KAAK,CAAC,MAAM,IAAI;EACnC,OAAO;CACT;CACA,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAI7E,KAAK,MAAM,OAAO,CAAC,SAAS,oBAAoB,GAAG;GACjD,MAAM,QAAQ,OAAO;GACrB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,GAAG;IACxD,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,eAAe;GAC9C;EACF;CACF,QAAQ,CAER;CACA,OAAO;AACT;;;;;;;AAQA,OAAO,SAAS,kBAAkB,OAAiB,MAAc,KAAK,IAAI,GAAqB;CAC7F,MAAM,QAAQ,aAAa,MAAM,WAAW;CAC5C,OAAO;EACL,MAAM;EACN,UAAU;EACV,QAAQ,MAAM;EACd,SAAS;EACT,SAAS,KAAK,MAAM,MAAM,aAAa,MAAM,oBAAoB;EACjE,GAAI,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC;CACzC;AACF;;;;;;;AAwBA,OAAO,SAAS,yBACd,MACoC;CACpC,MAAM,EAAE,eAAe,SAAS,WAAW;CAC3C,OAAO;EACL;EACA,QAAQ;GAAE,IAAI;GAAmB,MAAM;GAAS,OAAO;EAAqB;EAC5E,iBACE,OAAO,WAAW;;;GAGhB,MAAM,WAAwB,QAAQ,kBAAkB,MAAM;GAC9D,QAAQ,UAAU;EACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW,OAAO,MAAM,oCAAoC,YAAY,KAAK,CAAC,CAAC,CACxF,GACA,OAAO,KAAK,aAAa;GACvB,KAAK,QAAQ,2BAA2B,QAAQ;GAChD,cAAc,oBAAoB,QAAQ,SAAS;GACnD,WAAW,QAAQ;GACnB,MAAM;GACN,UAAU,OAAO,WAAW;IAC1B,MAAM,WAAwB,QAAQ,SAAS,MAAM;IACrD,QAAQ,UAAU;GACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW,OAAO,KAAK,8BAA8B,YAAY,KAAK,CAAC,CAAC,CACjF,GACA,OAAO,kBACL,OAAO,WAAW,OAAO,KAAK,iCAAiC,EAAE,cAAc,CAAC,CAAC,CACnF,GACA,OAAO,KAAK,UAAU;IACpB,OAAO,KAAK,iCAAiC,EAAE,cAAc,CAAC;IAC9D,KAAK,aAAa;;IAElB,MAAM,YAAY;KAChB,IAAI;MACF,MAAM,KAAK,YAAY;KACzB,SAAS,OAAO;MACd,OAAO,KAAK,uCAAuC,YAAY,KAAK,CAAC;KACvE;IACF,EAAC,AAAC,CAAC;IACH,OAAO,kBAAkB,KAAK;GAChC,CAAC,CACH;EACF,EAAE,CACJ;;;;;EAKF,eACE,OAAO,WAAW;GAChB,WAAW,QAAQ,gBAAgB,EAAE,eAAe,uBAAuB,CAAC;GAC5E,QAAQ,UAAU;EACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW;GAChB,OAAO,KAAK,sCAAsC,YAAY,KAAK,CAAC;GACpE,IAAI,+BAA+B,KAAK,GAAG;IACzC,KAAK,mBAAmB,SAAS;GACnC;EACF,CAAC,CACH,GACA,OAAO,KAAK,UACV,OAAO,WAAW;;;GAGhB,IACE,MAAM,cAAc,aACpB,MAAM,YAAY,KAAK,IAAI,KAAK,wBAChC;IACA,OAAO,KAAK,sCAAsC,EAChD,OAAO,gEACT,CAAC;GACH;EACF,CAAC,CACH,GACA,OAAO,KAAK,UAAU,kBAAkB,KAAK,CAAC,CAChD;EACF,QAAQ,eAAe;GACrB,MAAM,QAAQ,WAAW,UAAU;GACnC,OAAO,OAAO,UAAU,WAAW,QAAQ;EAC7C;CACF;AACF;AAEA,SAAS,YAAY,OAAmC;CACtD,OAAO,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AACzE;;;;;;;;AAgBA,OAAO,SAAS,6BAA6B,QAAgB,MAA4B;CACvF,IAAI,WAAW;CACf,OAAO;EACL,OAAO,QAAQ;GACb,OAAO,MAAM,qCAAqC,EAAE,OAAO,CAAC;GAC5D,IAAI,UAAU;IACZ;GACF;GACA,WAAW;GACX,OAAO,KAAK,gCAAgC;IAC1C;IACA,SAAS,sCAAsC,WAAW,IAAI;GAChE,CAAC;EACH;EACA,QAAQ;GACN,WAAW;EACb;CACF;AACF","names":[],"sources":["../src/sign-in.ts"],"version":3,"file":"sign-in.js","sourceRoot":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vymalo/opencode-lightbridge",
-  "version": "0.18.1",
+  "version": "0.20.0",
   "description": "Umbrella OpenCode plugin for ADR-0012: one shared credential (TokenRuntime) drives both the LLM gateway bearer and OTEL export, so a developer authenticates once and every egress rides the same project-scoped token.",
   "license": "MIT",
   "author": "vymalo contributors",
@@ -54,9 +54,9 @@
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.222.0",
     "@opentelemetry/core": "^2.11.0",
-    "@vymalo/opencode-auth-core": "0.18.1",
-    "@vymalo/opencode-provider-sync": "0.18.1",
-    "@vymalo/opencode-core-otel": "0.18.1"
+    "@vymalo/opencode-auth-core": "0.20.0",
+    "@vymalo/opencode-provider-sync": "0.20.0",
+    "@vymalo/opencode-core-otel": "0.20.0"
   },
   "devDependencies": {
     "@opentelemetry/sdk-logs": "^0.222.0",

package/dist/migration.d.ts

@@ -1,31 +0,0 @@
-import { type Logger } from "@vymalo/opencode-auth-core/lib";
-/**
-* One-time migration read-path (ADR-0017, mandatory — not optional polish).
-*
-* v0.17 moves lightbridge's human root token from its own bespoke file
-* (`<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`) to
-* the SAME fused `CachedServerState` file `@vymalo/opencode-oauth2` uses
-* (`<cacheRoot>/<sharedSegment>/<sharedNamespace>/<serverId>.json`) so the two
-* plugins can share one login (ADR-0017 §"one login, shared cache"). An
-* install that already has a valid old-format token must NOT be forced
-* through a fresh device-code/browser login just because the file moved.
-*
-* Behaviour:
-* - If the NEW location already has a persisted state (with or without a
-*   token), this is a no-op — never clobbers a fresher state (e.g. one
-*   oauth2 has already been writing to, with real discovered models).
-* - Else, read the OLD location. If it holds a structurally usable token
-*   (`accessToken` + `tokenType` present — possibly expired; an expired
-*   token with a refresh token is still worth adopting, since `TokenRuntime`
-*   will refresh it transparently), write it into the NEW location as a
-*   fresh `CachedServerState` (empty `models`/`rawModels` — nothing to carry
-*   over, since the old shape never tracked models).
-* - Else (no old file, or it's empty/malformed) this is a no-op; the caller
-*   proceeds to a normal login.
-*
-* The old file is left in place (non-destructive) — this function only ever
-* ADDS the new file, never deletes/mutates the old one. Safe to call more
-* than once: the "new location already has a state" check makes every call
-* after the first a cheap no-op.
-*/
-export declare function migrateRootTokenIfNeeded(cacheRoot: string, sharedSegment: string, sharedNamespace: string, serverId: string, logger: Logger): Promise<void>;

package/dist/migration.js

@@ -1,91 +0,0 @@
-import { join } from "node:path";
-import { FileCacheStore as LegacyFileCacheStore } from "@vymalo/opencode-auth-core/lib";
-import { FileCacheStore as SharedFileCacheStore } from "@vymalo/opencode-provider-sync/lib";
-/**
-* The pre-ADR-0017 on-disk location of lightbridge's human root token:
-* `<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`
-* (see the OLD `LIGHTBRIDGE_IDENTITY`/`DEFAULT_CACHE_NAMESPACE` in `plugin.ts`,
-* which are still used verbatim for the exchanged project-token store — only
-* the ROOT token relocated).
-*/
-const OLD_ROOT_CACHE_NAMESPACE = "opencode-lightbridge";
-const OLD_ROOT_KEY = "lightbridge";
-function hasUsableTokenShape(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) {
-		return false;
-	}
-	const candidate = value;
-	return typeof candidate.accessToken === "string" && candidate.accessToken.length > 0 && typeof candidate.tokenType === "string" && candidate.tokenType.length > 0;
-}
-/**
-* One-time migration read-path (ADR-0017, mandatory — not optional polish).
-*
-* v0.17 moves lightbridge's human root token from its own bespoke file
-* (`<cacheRoot>/opencode-lightbridge/lightbridge.json`, a bare `TokenSet`) to
-* the SAME fused `CachedServerState` file `@vymalo/opencode-oauth2` uses
-* (`<cacheRoot>/<sharedSegment>/<sharedNamespace>/<serverId>.json`) so the two
-* plugins can share one login (ADR-0017 §"one login, shared cache"). An
-* install that already has a valid old-format token must NOT be forced
-* through a fresh device-code/browser login just because the file moved.
-*
-* Behaviour:
-* - If the NEW location already has a persisted state (with or without a
-*   token), this is a no-op — never clobbers a fresher state (e.g. one
-*   oauth2 has already been writing to, with real discovered models).
-* - Else, read the OLD location. If it holds a structurally usable token
-*   (`accessToken` + `tokenType` present — possibly expired; an expired
-*   token with a refresh token is still worth adopting, since `TokenRuntime`
-*   will refresh it transparently), write it into the NEW location as a
-*   fresh `CachedServerState` (empty `models`/`rawModels` — nothing to carry
-*   over, since the old shape never tracked models).
-* - Else (no old file, or it's empty/malformed) this is a no-op; the caller
-*   proceeds to a normal login.
-*
-* The old file is left in place (non-destructive) — this function only ever
-* ADDS the new file, never deletes/mutates the old one. Safe to call more
-* than once: the "new location already has a state" check makes every call
-* after the first a cheap no-op.
-*/
-export async function migrateRootTokenIfNeeded(cacheRoot, sharedSegment, sharedNamespace, serverId, logger) {
-	const sharedStore = new SharedFileCacheStore(join(cacheRoot, sharedSegment, sharedNamespace), logger);
-	let alreadyMigrated;
-	try {
-		alreadyMigrated = await sharedStore.loadServerState(serverId);
-	} catch (error) {
-		logger.debug("lightbridge_root_migration_check_failed", { error: error instanceof Error ? error.message : String(error) });
-		return;
-	}
-	if (alreadyMigrated) {
-		// New location already has SOME state (with or without a token) — either
-		// a previous migration ran, or oauth2/register already populated it.
-		// Never overwrite it from the old file.
-		return;
-	}
-	const legacyStore = new LegacyFileCacheStore(join(cacheRoot, OLD_ROOT_CACHE_NAMESPACE), logger);
-	let legacyToken;
-	try {
-		legacyToken = await legacyStore.load(OLD_ROOT_KEY);
-	} catch (error) {
-		logger.debug("lightbridge_root_migration_legacy_read_failed", { error: error instanceof Error ? error.message : String(error) });
-		return;
-	}
-	if (!hasUsableTokenShape(legacyToken)) {
-		logger.trace("lightbridge_root_migration_nothing_to_adopt", { serverId });
-		return;
-	}
-	const migrated = {
-		serverId,
-		updatedAt: Date.now(),
-		models: [],
-		rawModels: [],
-		token: legacyToken
-	};
-	await sharedStore.ensureReady();
-	await sharedStore.saveServerState(migrated);
-	logger.info("lightbridge_root_migration_adopted", {
-		serverId,
-		hadRefreshToken: Boolean(legacyToken.refreshToken)
-	});
-}
-
-//# sourceMappingURL=migration.js.map

package/dist/migration.js.map

@@ -1 +0,0 @@
-{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,kBAAkB,4BAGb;AACP,SACE,kBAAkB,4BAEb;;;;;;;;AASP,MAAM,2BAA2B;AACjC,MAAM,eAAe;AAErB,SAAS,oBAAoB,OAAmC;CAC9D,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EAC/D,OAAO;CACT;CACA,MAAM,YAAY;CAClB,OACE,OAAO,UAAU,gBAAgB,YACjC,UAAU,YAAY,SAAS,KAC/B,OAAO,UAAU,cAAc,YAC/B,UAAU,UAAU,SAAS;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,eAAe,yBACpB,WACA,eACA,iBACA,UACA,QACe;CACf,MAAM,cAAc,IAAI,qBACtB,KAAK,WAAW,eAAe,eAAe,GAC9C,MACF;CAEA,IAAI;CACJ,IAAI;EACF,kBAAkB,MAAM,YAAY,gBAAgB,QAAQ;CAC9D,SAAS,OAAO;EACd,OAAO,MAAM,2CAA2C,EACtD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD;CACF;CACA,IAAI,iBAAiB;;;;EAInB;CACF;CAEA,MAAM,cAAc,IAAI,qBAAqB,KAAK,WAAW,wBAAwB,GAAG,MAAM;CAC9F,IAAI;CACJ,IAAI;EACF,cAAc,MAAM,YAAY,KAAe,YAAY;CAC7D,SAAS,OAAO;EACd,OAAO,MAAM,iDAAiD,EAC5D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD;CACF;CAEA,IAAI,CAAC,oBAAoB,WAAW,GAAG;EACrC,OAAO,MAAM,+CAA+C,EAAE,SAAS,CAAC;EACxE;CACF;CAEA,MAAM,WAA8B;EAClC;EACA,WAAW,KAAK,IAAI;EACpB,QAAQ,CAAC;EACT,WAAW,CAAC;EACZ,OAAO;CACT;CAEA,MAAM,YAAY,YAAY;CAC9B,MAAM,YAAY,gBAAgB,QAAQ;CAC1C,OAAO,KAAK,sCAAsC;EAChD;EACA,iBAAiB,QAAQ,YAAY,YAAY;CACnD,CAAC;AACH","names":[],"sources":["../src/migration.ts"],"version":3,"file":"migration.js","sourceRoot":""}