@vymalo/opencode-lightbridge 0.19.0 → 0.20.0

package/dist/opencode.js

@@ -2,6 +2,7 @@ import { hostname } from "node:os";
 import { Plugin } from "@opencode/plugin/effect";
 import { defaultTextMapSetter } from "@opentelemetry/api";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";
+import { isInteractiveAuthRequiredError } from "@vymalo/opencode-auth-core/lib";
 import { buildResource, createProviders, deferredAttribute, describeError, readVcsInfo, registerExitHandlers, resolveOtelConfig, TelemetryRecorder } from "@vymalo/opencode-core-otel";
 import { applyResponsesApiSettings, mergeDiscoveredModels, propagateCachedBearer, ProviderModelSyncEngine, resolveCachedBearer, resolveProviderPackage, upsertManagedProvider } from "@vymalo/opencode-provider-sync/lib";
 import { Effect, Stream } from "effect";
@@ -9,6 +10,7 @@ import { hasOAuth2Conflict, needsProjectToken, parseLightbridgeOptions } from ".
 import { captureHostContext, createEffectLogger, DEFAULT_LOG_LEVEL, resolveLogLevel, runInHost } from "./logging.js";
 import { adaptContext, adaptPermission, adaptPrompt, adaptToolAfter, adaptToolBefore, OtelEventAdapter } from "./otel-adapter.js";
 import { LightbridgeRuntime, ROOT_CACHE_NAMESPACE, ROOT_CACHE_SEGMENT, rootCacheDir, rootStateDir } from "./plugin.js";
+import { createSignInRegistration, createSignInRequiredNotifier, signInPath } from "./sign-in.js";
 /** Stable plugin id. v2 requires one and keys storage/registrations by it. */
 export const PLUGIN_ID = "vymalo.lightbridge";
 function errorMessage(error) {
@@ -36,13 +38,16 @@ function safeHostname() {
 * every export attempt, a later successful login resumes exporting on the
 * next flush with nothing to restart.
 */
-function createRuntimeTokenSource(runtime) {
+function createRuntimeTokenSource(runtime, onSignInRequired) {
 	return {
 		headers: async () => {
 			try {
-				const token = await runtime.getProjectToken({ interactive: false });
+				const token = await runtime.getProjectToken();
 				return { Authorization: `${token.tokenType || "Bearer"} ${token.accessToken}` };
-			} catch {
+			} catch (error) {
+				if (isInteractiveAuthRequiredError(error)) {
+					onSignInRequired("otel");
+				}
 				return undefined;
 			}
 		},
@@ -128,7 +133,7 @@ function warnIfTokenCommandConfigIgnored(otel, env, logger) {
 * handlers. Mirrors `@vymalo/opencode-otel`'s orchestration verbatim, minus
 * the standalone `tokenCommand` seam.
 */
-async function buildOtelModule(location, otelConfig, logger, factoryOptions, runtime) {
+async function buildOtelModule(location, otelConfig, logger, factoryOptions, runtime, onSignInRequired) {
 	const version = deferredAttribute(factoryOptions.deferredTimeoutMs);
 	const branch = deferredAttribute(factoryOptions.deferredTimeoutMs);
 	if (factoryOptions.hostInfo?.version) {
@@ -147,7 +152,7 @@ async function buildOtelModule(location, otelConfig, logger, factoryOptions, run
 		branch: branch.value,
 		vcs
 	});
-	const tokenSource = runtime ? createRuntimeTokenSource(runtime) : undefined;
+	const tokenSource = runtime ? createRuntimeTokenSource(runtime, onSignInRequired) : undefined;
 	const providers = createProviders(otelConfig, resource, logger, factoryOptions.exporters, tokenSource);
 	const recorder = new TelemetryRecorder({
 		providers,
@@ -248,7 +253,10 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 			// and the OTEL token source below. `undefined` only for a register/auth-only
 			// config.
 			const buildRuntime = factoryOptions.runtimeFactory ?? ((auth, pid, options) => new LightbridgeRuntime(auth, pid, options));
-			const sharedRuntime = wantsProjectToken ? buildRuntime(parsed.auth, parsed.projectId, {
+			// Built whenever a module needs a token OR the user must be able to sign in
+			// (device_code, ADR-0023): the sign-in method drives this same runtime.
+			const signInEnabled = parsed.auth.authFlow === "device_code";
+			const sharedRuntime = wantsProjectToken || signInEnabled ? buildRuntime(parsed.auth, parsed.projectId, {
 				logger,
 				fetchImpl: factoryOptions.fetchImpl,
 				onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
@@ -257,6 +265,16 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 				exchange: parsed.gateway?.exchange ?? false
 			}) : undefined;
 			const reloadProviders = () => runInHost(hostContext, ctx.provider.reload());
+			const signInName = parsed.register?.name ?? parsed.auth.id;
+			const signInNotice = createSignInRequiredNotifier(logger, signInName);
+			// Only meaningful when the Connect dialog can actually be used to fix it.
+			const notifySignInRequired = (source) => {
+				if (signInEnabled) {
+					signInNotice.notify(source);
+				}
+			};
+			// Set below when sign-in is registered; the gateway hook calls it (cached).
+			let observeConnectionCached = async () => {};
 			// ---- register module (ADR-0017 requirement 1) ----
 			let engine;
 			let registerChain = Promise.resolve();
@@ -281,6 +299,9 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					servers: [buildRegisterServerConfig(parsed.auth, register)],
 					cacheNamespace: ROOT_CACHE_NAMESPACE
 				}, {
+					// Sign-in happens only in the host's Connect dialog (ADR-0023): the
+					// engine's warmup, scheduler and token reads are refresh-only.
+					neverInteractive: true,
 					logger,
 					fetchImpl: factoryOptions.fetchImpl,
 					onAuthorizationUrl: factoryOptions.onAuthorizationUrl,
@@ -301,6 +322,17 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 				}
 				engine = next;
 				registerBearer = await resolveCachedBearer(parsed.auth.id, next, logger);
+				if (registerBearer === undefined && sharedRuntime) {
+					// resolveCachedBearer swallows why; ask the runtime so only a genuine
+					// "needs sign-in" (not a network/IdP outage) raises the notice.
+					try {
+						await sharedRuntime.ensureRootToken();
+					} catch (error) {
+						if (isInteractiveAuthRequiredError(error)) {
+							notifySignInRequired("register");
+						}
+					}
+				}
 				// Models and bearer are now known: ask the host to re-run transforms.
 				await reloadProviders();
 			};
@@ -355,6 +387,116 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					}
 				});
 			}
+			// ---- sign-in (ADR-0023): the ONLY place an interactive login can start ----
+			if (signInEnabled && sharedRuntime) {
+				const runtime = sharedRuntime;
+				const afterSignIn = async () => {
+					try {
+						// Pick up the new credential in the register module's engine and
+						// refresh the stamped bearer, then ask the host to re-run transforms.
+						if (engine) {
+							await engine.syncServer(parsed.auth.id);
+							registerBearer = await resolveCachedBearer(parsed.auth.id, engine, logger);
+						}
+					} catch (error) {
+						logger.warn("lightbridge_sign_in_sync_failed", { error: errorMessage(error) });
+					}
+					try {
+						await reloadProviders();
+					} catch (error) {
+						logger.warn("lightbridge_sign_in_reload_failed", { error: errorMessage(error) });
+					}
+				};
+				const registration = createSignInRegistration({
+					integrationID: parsed.auth.id,
+					runtime,
+					logger,
+					afterSignIn,
+					onSignedIn: () => signInNotice.reset(),
+					onSignInRequired: notifySignInRequired
+				});
+				// The integration id is `auth.id`, never the well-known URL's: the host
+				// loads the well-known manifest with `credentials.at(-1)` of ITS
+				// integration, and an oauth credential there would freeze it (ADR-0023).
+				yield* ctx.integration.transform((editor) => {
+					editor.update(parsed.auth.id, (integration) => {
+						integration.name = signInName;
+					});
+					editor.method.update(registration);
+				});
+				// ---- host disconnect => sign out (ADR-0023) ----
+				// TRANSITION-based: only a connection we saw present in THIS process and
+				// that is then gone signs us out. A host with no credential at startup is
+				// normal (users who signed in before sign-in moved into the dialog have a
+				// token and no host credential) and must keep working.
+				let connectionSeen = false;
+				let signingOut = false;
+				let lastObservedAt = 0;
+				const OBSERVE_CACHE_MS = 5e3;
+				const signOut = async () => {
+					logger.info("lightbridge_signed_out_by_host", { integrationID: parsed.auth.id });
+					try {
+						await runtime.reset();
+					} catch (error) {
+						logger.warn("lightbridge_sign_out_reset_failed", { error: errorMessage(error) });
+					}
+					// The engine keeps its token in memory even when the file is gone:
+					// drop it, and let the next transform build a fresh (signed-out) one.
+					stopEngine();
+					registerQueued = false;
+					signInNotice.reset();
+					notifySignInRequired("disconnect");
+					try {
+						await reloadProviders();
+					} catch (error) {
+						logger.warn("lightbridge_sign_out_reload_failed", { error: errorMessage(error) });
+					}
+				};
+				const onConnection = async (present) => {
+					if (present) {
+						connectionSeen = true;
+						return;
+					}
+					if (!connectionSeen || signingOut) {
+						return;
+					}
+					connectionSeen = false;
+					signingOut = true;
+					try {
+						await signOut();
+					} finally {
+						signingOut = false;
+					}
+				};
+				const observeConnection = (force) => {
+					if (!force && Date.now() - lastObservedAt < OBSERVE_CACHE_MS) {
+						return Promise.resolve();
+					}
+					lastObservedAt = Date.now();
+					return runInHost(hostContext, ctx.integration.connection.active(parsed.auth.id).pipe(Effect.flatMap((info) => Effect.promise(() => onConnection(info !== undefined))), Effect.ignore));
+				};
+				observeConnectionCached = () => observeConnection(false);
+				yield* Effect.forkScoped(Stream.runForEach(ctx.event.subscribe({ types: [
+					"credential.updated",
+					"credential.switched",
+					"integration.updated"
+				] }), () => Effect.promise(() => observeConnection(true))).pipe(Effect.tapError((error) => Effect.sync(() => logger.warn("lightbridge_connection_watch_failed", { error: errorMessage(error) }))), Effect.ignore));
+				void observeConnection(true);
+				// Report a missing sign-in once, up front, without any network on the
+				// signed-out path (a stored token may refresh, which is fine).
+				void runtime.ensureRootToken().catch((error) => {
+					if (isInteractiveAuthRequiredError(error)) {
+						notifySignInRequired("startup");
+					} else {
+						logger.debug("lightbridge_startup_token_check_failed", { error: errorMessage(error) });
+					}
+				});
+			} else if (parsed.auth.authFlow === "authorization_code") {
+				logger.warn("lightbridge_sign_in_unsupported_flow", {
+					authFlow: parsed.auth.authFlow,
+					message: `lightbridge signs in through the host's Connect dialog (${signInPath(signInName)}), which needs authFlow "device_code"`
+				});
+			}
 			// ---- gateway module ----
 			// `sharedRuntime` is always defined here: it is built whenever `gateway`
 			// or `otel` is configured (`wantsProjectToken`).
@@ -376,7 +518,8 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					}
 					return Effect.tryPromise({
 						try: async () => {
-							const token = await runtime.getProjectToken({ interactive: true });
+							await observeConnectionCached();
+							const token = await runtime.getProjectToken();
 							// Header names are case-insensitive: drop any variant already set
 							// (a stamped record header, the placeholder key's, a lowercase copy).
 							for (const key of Object.keys(event.headers)) {
@@ -388,10 +531,18 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 							logger.trace("lightbridge_gateway_bearer_injected", { providerId });
 						},
 						catch: (error) => error
-					}).pipe(Effect.tapError((error) => Effect.sync(() => logger.warn("lightbridge_gateway_no_bearer", {
-						providerId,
-						error: errorMessage(error)
-					}))), Effect.orDie);
+					}).pipe(Effect.tapError((error) => Effect.sync(() => {
+						const needsSignIn = isInteractiveAuthRequiredError(error);
+						// While signed out every request repeats this; the one-time
+						// lightbridge_sign_in_required warning already says what to do.
+						logger[needsSignIn && signInEnabled ? "debug" : "warn"]("lightbridge_gateway_no_bearer", {
+							providerId,
+							error: errorMessage(error)
+						});
+						if (needsSignIn) {
+							notifySignInRequired("gateway");
+						}
+					})), Effect.orDie);
 				});
 			}
 			// ---- otel module ----
@@ -404,7 +555,7 @@ export function createLightbridgePlugin(factoryOptions = {}) {
 					const built = yield* Effect.promise(() => buildOtelModule({
 						directory: ctx.location.directory,
 						projectId: ctx.location.project?.id
-					}, otelConfig, logger, factoryOptions, sharedRuntime));
+					}, otelConfig, logger, factoryOptions, sharedRuntime, notifySignInRequired));
 					otel = built;
 					const { recorder } = built;
 					const adapter = new OtelEventAdapter(recorder, factoryOptions.now);

package/dist/opencode.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAE1C,SACE,eACA,iBACA,mBACA,eACA,aACA,sBACA,mBACA,yBAOK;AACP,SACE,2BACA,uBACA,uBACA,yBACA,qBACA,wBACA,6BAGK;AACP,SAAS,QAAQ,cAAc;AAE/B,SACE,mBACA,mBACA,+BAGK;AACP,SACE,oBACA,oBACA,mBAGA,iBACA,iBACK;AACP,SACE,cACA,iBACA,aACA,gBACA,iBAEA,wBACK;AACP,SACE,oBACA,sBACA,oBACA,cACA,oBAIK;;AAGP,OAAO,MAAM,YAAY;AA6CzB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,yBAAyB,SAA8C;CAC9E,OAAO;EACL,SAAS,YAAyD;GAChE,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,MAAM,CAAC;IAClE,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,QAAQ;IACN,OAAO;GACT;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;;;AASA,SAAS,0BACP,MACA,UACsB;CACtB,OAAO;EACL,IAAI,KAAK;EACT,MAAM,SAAS,QAAQ,KAAK;EAC5B,QAAQ,KAAK;EACb,SAAS,SAAS;EAClB,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,QAAQ,KAAK;EACb,qBAAqB,SAAS,uBAAuB;EACrD,eAAe,SAAS,iBAAiB,CAAC;EAC1C,uBAAuB,KAAK;EAC5B,eAAe,KAAK;EACpB,6BAA6B,KAAK;EAClC,SAAS,KAAK;EACd,cAAc,KAAK;EACnB,UAAU,KAAK;EACf,MAAM,KAAK;EACX,oBAAoB,KAAK;EACzB,uBAAuB,KAAK;CAC9B;AACF;AAEA,SAAS,WAAW,OAAyC;CAC3D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,CAAC;AACP;;;;;;AAOA,SAAS,yBACP,QACA,YACA,UACA,QACM;CACN,MAAM,WAAW,OAAO,IAAI,UAAU,CAAC,EAAE;;;CAGzC,MAAM,eAAe,YAAY,SAAS,SAAS,aAAa,SAAS,OAAO;CAChF,sBAAsB,QAAQ,YAAY;EACxC,MAAM,gBAAgB,SAAS,QAAQ;EACvC,SAAS,uBAAuB,SAAS,WAAW;EACpD,UAAU,0BACR;GAAE,GAAG,WAAW,UAAU,QAAQ;GAAG,SAAS,SAAS;EAAQ,GAC/D,SAAS,aACT,YACA,MACF;CACF,CAAC;AACH;;;;;;;;;;;;;AAmBA,SAAS,gCACP,MACA,KACA,QACM;CACN,MAAM,WACJ,KAAK,iBAAiB,aACtB,KAAK,gBAAgB,aACrB,KAAK,gBAAgB,aACrB,QAAQ,IAAI,2BAA2B,KACvC,QAAQ,IAAI,0BAA0B,KACtC,QAAQ,IAAI,0BAA0B;CACxC,IAAI,UAAU;EACZ,OAAO,MAAM,0CAA0C,EACrD,QACE,mHACJ,CAAC;CACH;AACF;;;;;;;AAaA,eAAe,gBACb,UACA,YACA,QACA,gBACA,SACyE;CACzE,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,SAAS,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACtD,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,SAAS;EACtB,WAAW,SAAS;EACpB,UAAU,SAAS;EACnB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,OAAO,IAAI;CAClE,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;;EAEpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,GAAG,EACzD,aAAa,mBACf,CAAC;CACH;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;EAAU;CAAQ;AACjD;AAEA,MAAM,aAAa,IAAI,0BAA0B;;;;;AAMjD,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;AAmBA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GACpC;CACf,OAAO,OAAO,OAAO;EACnB,IAAI;EACJ,QAAQ,OAAO,GAAG,WAAW,KAAK;;;GAGhC,MAAM,WACJ,gBAAgB,IAAI,QAAQ,QAAQ,KACpC,gBAAgB,QAAQ,IAAI,kBAAkB,KAC9C;;;GAIF,MAAM,cAAc,OAAO;GAC3B,MAAM,SACJ,eAAe,UAAU,mBAAmB,mBAAmB,QAAQ;GAEzE,IAAI;GACJ,IAAI;IACF,SAAS,wBAAwB,IAAI,OAAO;GAC9C,SAAS,OAAO;;;IAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;IAC1E;GACF;GAEA,MAAM,oBAAoB,kBAAkB,MAAM;GAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;IAG1C,OAAO,KAAK,+BAA+B;KACzC,SAAS,QAAQ,OAAO,OAAO;KAC/B,MAAM,QAAQ,OAAO,IAAI;IAC3B,CAAC;GACH;;;;;GAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;GAC7C,MAAM,gBAAoD,oBACtD,aAAa,OAAO,MAAM,OAAO,WAAW;IAC1C;IACA,WAAW,eAAe;IAC1B,oBAAoB,eAAe;IACnC,UAAU,eAAe;IACzB,mBAAmB,eAAe;IAClC,UAAU,OAAO,SAAS,YAAY;GACxC,CAAC,IACD;GAEJ,MAAM,wBAAuC,UAAU,aAAa,IAAI,SAAS,OAAO,CAAC;;GAGzF,IAAI;GACJ,IAAI,gBAA+B,QAAQ,QAAQ;;GAEnD,IAAI,iBAAiB;;GAErB,IAAI,qBAAqB;GACzB,IAAI,aAAa;GACjB,IAAI;GACJ,MAAM,UAAU,IAAI,IAAoB;GAExC,MAAM,mBAAyB;IAC7B,QAAQ,KAAK;IACb,SAAS;IACT,iBAAiB;GACnB;GAEA,MAAM,sBAAsB,OAAO,aAAwD;;IAEzF,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,OAAO,IAAI,wBACf;KACE,SAAS,CAAC,0BAA0B,OAAO,MAAM,QAAQ,CAAC;KAC1D,gBAAgB;IAClB,GACA;KACE;KACA,WAAW,eAAe;KAC1B,oBAAoB,eAAe;KACnC,UAAU,eAAe,WAAW,aAAa,eAAe,QAAQ,IAAI;KAC5E,UAAU,eAAe,WAAW,aAAa,eAAe,QAAQ,IAAI;KAC5E,uBAAuB;KACvB,cAAc;IAChB,CACF;IACA,MAAM,KAAK,WAAW;IACtB,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC;IACjC,IAAI,oBAAoB;;KAEtB,KAAK,KAAK;KACV;IACF;IACA,SAAS;IACT,iBAAiB,MAAM,oBAAoB,OAAO,KAAK,IAAI,MAAM,MAAM;;IAEvE,MAAM,gBAAgB;GACxB;GAEA,IAAI,OAAO,UAAU;IACnB,MAAM,WAAW,OAAO;IACxB,MAAM,aAAa,OAAO,KAAK;IAE/B,eAAe,aAAa;KAC1B,MAAM,UAAU;MACd,IAAI;MACJ,GAAG;OACD,UAAU;OACV,MAAM;MACR,SAAS,YAAY;KACvB;KACA,cAAc;IAChB,CAAC;IAED,OAAO,IAAI,SAAS,WAAW,WAAW;KACxC,IAAI,kBAAkB,QAAQ,UAAU,GAAG;MACzC,qBAAqB;MACrB,iBAAiB;MACjB,WAAW;MACX,IAAI,CAAC,YAAY;OACf,aAAa;OACb,OAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC;MAC7E;MACA;KACF;KACA,qBAAqB;KAErB,yBAAyB,QAAQ,YAAY,UAAU,MAAM;KAC7D,IAAI,aAAa;KACjB,IAAI,QAAQ;MACV,IAAI;OACF,MAAM,SAAS,OAAO,gBAAgB,UAAU;OAChD,aAAa,OAAO;OACpB,IAAI,OAAO,SAAS,GAAG;QACrB,sBAAsB,QAAQ,YAAY,MAAM;OAClD;MACF,QAAQ,CAER;KACF;KACA,sBAAsB,QAAQ,YAAY,gBAAgB,QAAQ,OAAO;KACzE,OAAO,MAAM,uCAAuC;MAAE;MAAY;KAAW,CAAC;KAE9E,IAAI,CAAC,gBAAgB;MACnB,iBAAiB;MACjB,gBAAgB,cACb,WAAW,oBAAoB,QAAQ,CAAC,CAAC,CACzC,OAAO,UAAU;;OAEhB,iBAAiB;OACjB,OAAO,MAAM,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;MAClF,CAAC;KACL;IACF,CAAC;GACH;;;;GAKA,IAAI,OAAO,WAAW,eAAe;IACnC,MAAM,YAAY,IAAI,IAAI,OAAO,QAAQ,SAAS;IAClD,MAAM,UAAU;;;;;;;;IAQhB,OAAO,IAAI,QAAQ,KAAK,kBAAkB,UAAU;KAClD,MAAM,aAAa,MAAM,MAAM;KAC/B,IAAI,CAAC,UAAU,IAAI,UAAU,GAAG;MAC9B,OAAO,MAAM,6CAA6C,EAAE,WAAW,CAAC;MACxE,OAAO,OAAO;KAChB;KACA,OAAO,OAAO,WAAW;MACvB,KAAK,YAAY;OACf,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,EAAE,aAAa,KAAK,CAAC;;;OAGjE,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,OAAO,GAAG;QAC5C,IAAI,IAAI,YAAY,MAAM,iBAAiB;SACzC,OAAO,MAAM,QAAQ;QACvB;OACF;OACA,MAAM,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;OACtE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;MACpE;MACA,QAAQ,UAAU;KACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,iCAAiC;MAC3C;MACA,OAAO,aAAa,KAAK;KAC3B,CAAC,CACH,CACF,GACA,OAAO,KACT;IACF,CAAC;GACH;;GAGA,IAAI;GACJ,IAAI,OAAO,MAAM;IACf,MAAM,MAAM,eAAe,OAAO,QAAQ;IAC1C,MAAM,aAAa,kBAAkB,OAAO,MAAM,GAAG;IACrD,IAAI,WAAW,QAAQ;KACrB,gCAAgC,OAAO,MAAM,KAAK,MAAM;KACxD,MAAM,QAAQ,OAAO,OAAO,cAC1B,gBACE;MAAE,WAAW,IAAI,SAAS;MAAW,WAAW,IAAI,SAAS,SAAS;KAAG,GACzE,YACA,QACA,gBACA,aACF,CACF;KACA,OAAO;KACP,MAAM,EAAE,aAAa;KACrB,MAAM,UAAU,IAAI,iBAAiB,UAAU,eAAe,GAAG;KAEjE,OAAO,OAAO,WACZ,OAAO,WAAW,IAAI,MAAM,UAAU,EAAE,OAAO,iBAAiB,CAAC,IAAI,UACnE,OAAO,WAAW,QAAQ,OAAO,KAA6B,CAAC,CACjE,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,wCAAwC,EAClD,OAAO,aAAa,KAAK,EAC3B,CAAC,CACH,CACF,GACA,OAAO,MACT,CACF;KAEA,OAAO,IAAI,QAAQ,KAAK,WAAW,UACjC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,YAAY,KAAK;MACzC,SAAS,cAAc,OAAO,MAAM;KACtC,CAAC,CACH;KACA,OAAO,IAAI,QAAQ,KAAK,YAAY,UAClC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,aAAa,KAAK;MAC1C,SAAS,aAAa,OAAO,MAAM;KACrC,CAAC,CACH;KACA,OAAO,IAAI,KAAK,KAAK,mBAAmB,UACtC,OAAO,WAAW,SAAS,aAAa,gBAAgB,KAAK,CAAC,CAAC,CACjE;KACA,OAAO,IAAI,KAAK,KAAK,kBAAkB,UACrC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,eAAe;OACrC,MAAM,MAAM;OACZ,WAAW,MAAM;OACjB,IAAI,MAAM;OACV,QAAQ,MAAM;OACd,QAAQ,MAAM,WAAW,cAAc,MAAM,SAAS;MACxD,CAAC;MACD,SAAS,YAAY,OAAO,MAAM;KACpC,CAAC,CACH;KACA,OAAO,IAAI,WAAW,KAAK,aAAa,UACtC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,gBAAgB,KAAK;MAC7C,SAAS,gBAAgB,OAAO,MAAM;KACxC,CAAC,CACH;KAEA,IAAI,WAAW,uBAAuB;;;MAGpC,OAAO,IAAI,QAAQ,KAAK,iBAAiB,UACvC,OAAO,WAAW;OAChB,MAAM,UAAU,SAAS,mBAAmB;OAC5C,IAAI,CAAC,SAAS;QACZ;OACF;OACA,MAAM,UAAkC,CAAC;OACzC,WAAW,OAAO,SAAS,SAAS,oBAAoB;OACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;;QAElD,IAAI,CAAC,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG;SACnC,MAAM,QAAQ,QAAQ,IAAI,KAAK,KAAK;QACtC;OACF;MACF,CAAC,CACH;MACA,OAAO,MAAM,4CAA4C,CAAC,CAAC;KAC7D;IACF,OAAO;KACL,OAAO,KAAK,6BAA6B;MACvC,SAAS,WAAW;MACpB,QAAQ,WAAW,UAAU,2BAA2B;KAC1D,CAAC;IACH;GACF;GAEA,OAAO,OAAO,mBACZ,OAAO,WAAW;IAChB,WAAW;;IAEX,MAAM,SAAS,QAAQ,EAAE,MAAM,2BAA2B,CAAC;GAC7D,CAAC,CACH;GAEA,OAAO,KAAK,4BAA4B;IACtC,SAAS,QAAQ,OAAO,WAAW,aAAa;IAChD,UAAU,OAAO,SAAS,YAAY;IACtC,MAAM,QAAQ,IAAI;IAClB,UAAU,QAAQ,OAAO,QAAQ;IACjC,WAAW,OAAO,cAAc,oBAAoB,cAAc;GACpE,CAAC;EACH,CAAC;CACH,CAAC;AACH;AAEA,OAAO,MAAM,oBAAmC,wBAAwB;AAExE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C,SACE,sCAEK;AACP,SACE,eACA,iBACA,mBACA,eACA,aACA,sBACA,mBACA,yBAOK;AACP,SACE,2BACA,uBACA,uBACA,yBACA,qBACA,wBACA,6BAGK;AACP,SAAS,QAAQ,cAAc;AAE/B,SACE,mBACA,mBACA,+BAGK;AACP,SACE,oBACA,oBACA,mBAGA,iBACA,iBACK;AACP,SACE,cACA,iBACA,aACA,gBACA,iBAEA,wBACK;AACP,SACE,oBACA,sBACA,oBACA,cACA,oBAIK;AACP,SAAS,0BAA0B,8BAA8B,kBAAkB;;AAGnF,OAAO,MAAM,YAAY;AA6CzB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,eAAmC;CAC1C,IAAI;EACF,OAAO,SAAS,KAAK;CACvB,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,yBACP,SACA,kBACa;CACb,OAAO;EACL,SAAS,YAAyD;GAChE,IAAI;IACF,MAAM,QAAQ,MAAM,QAAQ,gBAAgB;IAC5C,OAAO,EAAE,eAAe,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM,cAAc;GAChF,SAAS,OAAO;IACd,IAAI,+BAA+B,KAAK,GAAG;KACzC,iBAAiB,MAAM;IACzB;IACA,OAAO;GACT;EACF;;;;;EAKA,kBAAkB,CAAC;CACrB;AACF;;;;;;;;AASA,SAAS,0BACP,MACA,UACsB;CACtB,OAAO;EACL,IAAI,KAAK;EACT,MAAM,SAAS,QAAQ,KAAK;EAC5B,QAAQ,KAAK;EACb,SAAS,SAAS;EAClB,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,QAAQ,KAAK;EACb,qBAAqB,SAAS,uBAAuB;EACrD,eAAe,SAAS,iBAAiB,CAAC;EAC1C,uBAAuB,KAAK;EAC5B,eAAe,KAAK;EACpB,6BAA6B,KAAK;EAClC,SAAS,KAAK;EACd,cAAc,KAAK;EACnB,UAAU,KAAK;EACf,MAAM,KAAK;EACX,oBAAoB,KAAK;EACzB,uBAAuB,KAAK;CAC9B;AACF;AAEA,SAAS,WAAW,OAAyC;CAC3D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,CAAC;AACP;;;;;;AAOA,SAAS,yBACP,QACA,YACA,UACA,QACM;CACN,MAAM,WAAW,OAAO,IAAI,UAAU,CAAC,EAAE;;;CAGzC,MAAM,eAAe,YAAY,SAAS,SAAS,aAAa,SAAS,OAAO;CAChF,sBAAsB,QAAQ,YAAY;EACxC,MAAM,gBAAgB,SAAS,QAAQ;EACvC,SAAS,uBAAuB,SAAS,WAAW;EACpD,UAAU,0BACR;GAAE,GAAG,WAAW,UAAU,QAAQ;GAAG,SAAS,SAAS;EAAQ,GAC/D,SAAS,aACT,YACA,MACF;CACF,CAAC;AACH;;;;;;;;;;;;;AAmBA,SAAS,gCACP,MACA,KACA,QACM;CACN,MAAM,WACJ,KAAK,iBAAiB,aACtB,KAAK,gBAAgB,aACrB,KAAK,gBAAgB,aACrB,QAAQ,IAAI,2BAA2B,KACvC,QAAQ,IAAI,0BAA0B,KACtC,QAAQ,IAAI,0BAA0B;CACxC,IAAI,UAAU;EACZ,OAAO,MAAM,0CAA0C,EACrD,QACE,mHACJ,CAAC;CACH;AACF;;;;;;;AAaA,eAAe,gBACb,UACA,YACA,QACA,gBACA,SACA,kBACyE;CACzE,MAAM,UAAU,kBAAkB,eAAe,iBAAiB;CAClE,MAAM,SAAS,kBAAkB,eAAe,iBAAiB;CACjE,IAAI,eAAe,UAAU,SAAS;EACpC,QAAQ,OAAO,eAAe,SAAS,OAAO;CAChD;CAEA,MAAM,MAAe,WAAW,aAC5B,MAAM,YAAY,SAAS,SAAS,CAAC,CAAC,aAAa,CAAC,EAAE,IACtD,CAAC;CACL,IAAI,IAAI,KAAK;EACX,OAAO,OAAO,IAAI,GAAG;CACvB;CAEA,MAAM,WAAW,cAAc,YAAY;EACzC,SAAS,QAAQ;EACjB,UAAU,eAAe,UAAU,YAAY,aAAa;EAC5D,aAAa,SAAS;EACtB,WAAW,SAAS;EACpB,UAAU,SAAS;EACnB,QAAQ,OAAO;EACf;CACF,CAAC;CAED,MAAM,cAAc,UAAU,yBAAyB,SAAS,gBAAgB,IAAI;CACpF,MAAM,YAAY,gBAChB,YACA,UACA,QACA,eAAe,WACf,WACF;CACA,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,QAAQ;EACR;EACA,KAAK,eAAe;EACpB,eAAe;GACb,UAAU,UAAU,QAAQ,OAAO,KAAK;GACxC,SAAS,UAAU,OAAO,OAAO,KAAK;EACxC;CACF,CAAC;CAED,IAAI,eAAe,4BAA4B,OAAO;;EAEpD,qBAAqB,WAAW,QAAQ,CAAC,SAAS,MAAM,GAAG,EACzD,aAAa,mBACf,CAAC;CACH;CAEA,OAAO,KAAK,4BAA4B;EACtC,aAAa,WAAW;EACxB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,0BAA0B,QAAQ,WAAW;CAC/C,CAAC;CAED,OAAO;EAAE,QAAQ;EAAY;EAAU;CAAQ;AACjD;AAEA,MAAM,aAAa,IAAI,0BAA0B;;;;;AAMjD,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;AAmBA,OAAO,SAAS,wBACd,iBAAkD,CAAC,GACpC;CACf,OAAO,OAAO,OAAO;EACnB,IAAI;EACJ,QAAQ,OAAO,GAAG,WAAW,KAAK;;;GAGhC,MAAM,WACJ,gBAAgB,IAAI,QAAQ,QAAQ,KACpC,gBAAgB,QAAQ,IAAI,kBAAkB,KAC9C;;;GAIF,MAAM,cAAc,OAAO;GAC3B,MAAM,SACJ,eAAe,UAAU,mBAAmB,mBAAmB,QAAQ;GAEzE,IAAI;GACJ,IAAI;IACF,SAAS,wBAAwB,IAAI,OAAO;GAC9C,SAAS,OAAO;;;IAGd,OAAO,MAAM,8BAA8B,EAAE,OAAO,cAAc,KAAK,EAAE,CAAC;IAC1E;GACF;GAEA,MAAM,oBAAoB,kBAAkB,MAAM;GAClD,IAAI,qBAAqB,CAAC,OAAO,WAAW;;;IAG1C,OAAO,KAAK,+BAA+B;KACzC,SAAS,QAAQ,OAAO,OAAO;KAC/B,MAAM,QAAQ,OAAO,IAAI;IAC3B,CAAC;GACH;;;;;GAMA,MAAM,eACJ,eAAe,oBACb,MAAwB,KAAyB,YACjD,IAAI,mBAAmB,MAAM,KAAK,OAAO;;;GAG7C,MAAM,gBAAgB,OAAO,KAAK,aAAa;GAC/C,MAAM,gBACJ,qBAAqB,gBACjB,aAAa,OAAO,MAAM,OAAO,WAAW;IAC1C;IACA,WAAW,eAAe;IAC1B,oBAAoB,eAAe;IACnC,UAAU,eAAe;IACzB,mBAAmB,eAAe;IAClC,UAAU,OAAO,SAAS,YAAY;GACxC,CAAC,IACD;GAEN,MAAM,wBAAuC,UAAU,aAAa,IAAI,SAAS,OAAO,CAAC;GAEzF,MAAM,aAAa,OAAO,UAAU,QAAQ,OAAO,KAAK;GACxD,MAAM,eAAe,6BAA6B,QAAQ,UAAU;;GAEpE,MAAM,wBAAwB,WAAyB;IACrD,IAAI,eAAe;KACjB,aAAa,OAAO,MAAM;IAC5B;GACF;;GAEA,IAAI,0BAA+C,YAAY,CAAC;;GAGhE,IAAI;GACJ,IAAI,gBAA+B,QAAQ,QAAQ;;GAEnD,IAAI,iBAAiB;;GAErB,IAAI,qBAAqB;GACzB,IAAI,aAAa;GACjB,IAAI;GACJ,MAAM,UAAU,IAAI,IAAoB;GAExC,MAAM,mBAAyB;IAC7B,QAAQ,KAAK;IACb,SAAS;IACT,iBAAiB;GACnB;GAEA,MAAM,sBAAsB,OAAO,aAAwD;;IAEzF,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,OAAO,IAAI,wBACf;KACE,SAAS,CAAC,0BAA0B,OAAO,MAAM,QAAQ,CAAC;KAC1D,gBAAgB;IAClB,GACA;;;KAGE,kBAAkB;KAClB;KACA,WAAW,eAAe;KAC1B,oBAAoB,eAAe;KACnC,UAAU,eAAe,WAAW,aAAa,eAAe,QAAQ,IAAI;KAC5E,UAAU,eAAe,WAAW,aAAa,eAAe,QAAQ,IAAI;KAC5E,uBAAuB;KACvB,cAAc;IAChB,CACF;IACA,MAAM,KAAK,WAAW;IACtB,IAAI,oBAAoB;KACtB;IACF;IACA,MAAM,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC;IACjC,IAAI,oBAAoB;;KAEtB,KAAK,KAAK;KACV;IACF;IACA,SAAS;IACT,iBAAiB,MAAM,oBAAoB,OAAO,KAAK,IAAI,MAAM,MAAM;IACvE,IAAI,mBAAmB,aAAa,eAAe;;;KAGjD,IAAI;MACF,MAAM,cAAc,gBAAgB;KACtC,SAAS,OAAO;MACd,IAAI,+BAA+B,KAAK,GAAG;OACzC,qBAAqB,UAAU;MACjC;KACF;IACF;;IAEA,MAAM,gBAAgB;GACxB;GAEA,IAAI,OAAO,UAAU;IACnB,MAAM,WAAW,OAAO;IACxB,MAAM,aAAa,OAAO,KAAK;IAE/B,eAAe,aAAa;KAC1B,MAAM,UAAU;MACd,IAAI;MACJ,GAAG;OACD,UAAU;OACV,MAAM;MACR,SAAS,YAAY;KACvB;KACA,cAAc;IAChB,CAAC;IAED,OAAO,IAAI,SAAS,WAAW,WAAW;KACxC,IAAI,kBAAkB,QAAQ,UAAU,GAAG;MACzC,qBAAqB;MACrB,iBAAiB;MACjB,WAAW;MACX,IAAI,CAAC,YAAY;OACf,aAAa;OACb,OAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC;MAC7E;MACA;KACF;KACA,qBAAqB;KAErB,yBAAyB,QAAQ,YAAY,UAAU,MAAM;KAC7D,IAAI,aAAa;KACjB,IAAI,QAAQ;MACV,IAAI;OACF,MAAM,SAAS,OAAO,gBAAgB,UAAU;OAChD,aAAa,OAAO;OACpB,IAAI,OAAO,SAAS,GAAG;QACrB,sBAAsB,QAAQ,YAAY,MAAM;OAClD;MACF,QAAQ,CAER;KACF;KACA,sBAAsB,QAAQ,YAAY,gBAAgB,QAAQ,OAAO;KACzE,OAAO,MAAM,uCAAuC;MAAE;MAAY;KAAW,CAAC;KAE9E,IAAI,CAAC,gBAAgB;MACnB,iBAAiB;MACjB,gBAAgB,cACb,WAAW,oBAAoB,QAAQ,CAAC,CAAC,CACzC,OAAO,UAAU;;OAEhB,iBAAiB;OACjB,OAAO,MAAM,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;MAClF,CAAC;KACL;IACF,CAAC;GACH;;GAGA,IAAI,iBAAiB,eAAe;IAClC,MAAM,UAAU;IAChB,MAAM,cAAc,YAA2B;KAC7C,IAAI;;;MAGF,IAAI,QAAQ;OACV,MAAM,OAAO,WAAW,OAAO,KAAK,EAAE;OACtC,iBAAiB,MAAM,oBAAoB,OAAO,KAAK,IAAI,QAAQ,MAAM;MAC3E;KACF,SAAS,OAAO;MACd,OAAO,KAAK,mCAAmC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KAC/E;KACA,IAAI;MACF,MAAM,gBAAgB;KACxB,SAAS,OAAO;MACd,OAAO,KAAK,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KACjF;IACF;IACA,MAAM,eAAe,yBAAyB;KAC5C,eAAe,OAAO,KAAK;KAC3B;KACA;KACA;KACA,kBAAkB,aAAa,MAAM;KACrC,kBAAkB;IACpB,CAAC;;;;IAID,OAAO,IAAI,YAAY,WAAW,WAAW;KAC3C,OAAO,OAAO,OAAO,KAAK,KAAK,gBAAgB;MAC7C,YAAY,OAAO;KACrB,CAAC;KACD,OAAO,OAAO,OAAO,YAAY;IACnC,CAAC;;;;;;IAOD,IAAI,iBAAiB;IACrB,IAAI,aAAa;IACjB,IAAI,iBAAiB;IACrB,MAAM,mBAAmB;IACzB,MAAM,UAAU,YAA2B;KACzC,OAAO,KAAK,kCAAkC,EAAE,eAAe,OAAO,KAAK,GAAG,CAAC;KAC/E,IAAI;MACF,MAAM,QAAQ,MAAM;KACtB,SAAS,OAAO;MACd,OAAO,KAAK,qCAAqC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KACjF;;;KAGA,WAAW;KACX,iBAAiB;KACjB,aAAa,MAAM;KACnB,qBAAqB,YAAY;KACjC,IAAI;MACF,MAAM,gBAAgB;KACxB,SAAS,OAAO;MACd,OAAO,KAAK,sCAAsC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KAClF;IACF;IACA,MAAM,eAAe,OAAO,YAAoC;KAC9D,IAAI,SAAS;MACX,iBAAiB;MACjB;KACF;KACA,IAAI,CAAC,kBAAkB,YAAY;MACjC;KACF;KACA,iBAAiB;KACjB,aAAa;KACb,IAAI;MACF,MAAM,QAAQ;KAChB,UAAU;MACR,aAAa;KACf;IACF;IACA,MAAM,qBAAqB,UAAkC;KAC3D,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,iBAAiB,kBAAkB;MAC5D,OAAO,QAAQ,QAAQ;KACzB;KACA,iBAAiB,KAAK,IAAI;KAC1B,OAAO,UACL,aACA,IAAI,YAAY,WAAW,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,KAChD,OAAO,SAAS,SAAS,OAAO,cAAc,aAAa,SAAS,SAAS,CAAC,CAAC,GAC/E,OAAO,MACT,CACF;IACF;IACA,gCAAgC,kBAAkB,KAAK;IACvD,OAAO,OAAO,WACZ,OAAO,WACL,IAAI,MAAM,UAAU,EAClB,OAAO;KAAC;KAAsB;KAAuB;IAAqB,EAC5E,CAAC,SACK,OAAO,cAAc,kBAAkB,IAAI,CAAC,CACpD,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,uCAAuC,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC,CACnF,CACF,GACA,OAAO,MACT,CACF;IACA,KAAK,kBAAkB,IAAI;;;IAI3B,KAAK,QAAQ,gBAAgB,CAAC,CAAC,OAAO,UAAmB;KACvD,IAAI,+BAA+B,KAAK,GAAG;MACzC,qBAAqB,SAAS;KAChC,OAAO;MACL,OAAO,MAAM,0CAA0C,EAAE,OAAO,aAAa,KAAK,EAAE,CAAC;KACvF;IACF,CAAC;GACH,OAAO,IAAI,OAAO,KAAK,aAAa,sBAAsB;IACxD,OAAO,KAAK,wCAAwC;KAClD,UAAU,OAAO,KAAK;KACtB,SAAS,2DAA2D,WAAW,UAAU,EAAE;IAC7F,CAAC;GACH;;;;GAKA,IAAI,OAAO,WAAW,eAAe;IACnC,MAAM,YAAY,IAAI,IAAI,OAAO,QAAQ,SAAS;IAClD,MAAM,UAAU;;;;;;;;IAQhB,OAAO,IAAI,QAAQ,KAAK,kBAAkB,UAAU;KAClD,MAAM,aAAa,MAAM,MAAM;KAC/B,IAAI,CAAC,UAAU,IAAI,UAAU,GAAG;MAC9B,OAAO,MAAM,6CAA6C,EAAE,WAAW,CAAC;MACxE,OAAO,OAAO;KAChB;KACA,OAAO,OAAO,WAAW;MACvB,KAAK,YAAY;OACf,MAAM,wBAAwB;OAC9B,MAAM,QAAQ,MAAM,QAAQ,gBAAgB;;;OAG5C,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,OAAO,GAAG;QAC5C,IAAI,IAAI,YAAY,MAAM,iBAAiB;SACzC,OAAO,MAAM,QAAQ;QACvB;OACF;OACA,MAAM,QAAQ,gBAAgB,GAAG,MAAM,aAAa,SAAS,GAAG,MAAM;OACtE,OAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC;MACpE;MACA,QAAQ,UAAU;KACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW;MAChB,MAAM,cAAc,+BAA+B,KAAK;;;MAGxD,OAAO,eAAe,gBAAgB,UAAU,OAAO,CACrD,iCACA;OAAE;OAAY,OAAO,aAAa,KAAK;MAAE,CAC3C;MACA,IAAI,aAAa;OACf,qBAAqB,SAAS;MAChC;KACF,CAAC,CACH,GACA,OAAO,KACT;IACF,CAAC;GACH;;GAGA,IAAI;GACJ,IAAI,OAAO,MAAM;IACf,MAAM,MAAM,eAAe,OAAO,QAAQ;IAC1C,MAAM,aAAa,kBAAkB,OAAO,MAAM,GAAG;IACrD,IAAI,WAAW,QAAQ;KACrB,gCAAgC,OAAO,MAAM,KAAK,MAAM;KACxD,MAAM,QAAQ,OAAO,OAAO,cAC1B,gBACE;MAAE,WAAW,IAAI,SAAS;MAAW,WAAW,IAAI,SAAS,SAAS;KAAG,GACzE,YACA,QACA,gBACA,eACA,oBACF,CACF;KACA,OAAO;KACP,MAAM,EAAE,aAAa;KACrB,MAAM,UAAU,IAAI,iBAAiB,UAAU,eAAe,GAAG;KAEjE,OAAO,OAAO,WACZ,OAAO,WAAW,IAAI,MAAM,UAAU,EAAE,OAAO,iBAAiB,CAAC,IAAI,UACnE,OAAO,WAAW,QAAQ,OAAO,KAA6B,CAAC,CACjE,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,WACL,OAAO,KAAK,wCAAwC,EAClD,OAAO,aAAa,KAAK,EAC3B,CAAC,CACH,CACF,GACA,OAAO,MACT,CACF;KAEA,OAAO,IAAI,QAAQ,KAAK,WAAW,UACjC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,YAAY,KAAK;MACzC,SAAS,cAAc,OAAO,MAAM;KACtC,CAAC,CACH;KACA,OAAO,IAAI,QAAQ,KAAK,YAAY,UAClC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,aAAa,KAAK;MAC1C,SAAS,aAAa,OAAO,MAAM;KACrC,CAAC,CACH;KACA,OAAO,IAAI,KAAK,KAAK,mBAAmB,UACtC,OAAO,WAAW,SAAS,aAAa,gBAAgB,KAAK,CAAC,CAAC,CACjE;KACA,OAAO,IAAI,KAAK,KAAK,kBAAkB,UACrC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,eAAe;OACrC,MAAM,MAAM;OACZ,WAAW,MAAM;OACjB,IAAI,MAAM;OACV,QAAQ,MAAM;OACd,QAAQ,MAAM,WAAW,cAAc,MAAM,SAAS;MACxD,CAAC;MACD,SAAS,YAAY,OAAO,MAAM;KACpC,CAAC,CACH;KACA,OAAO,IAAI,WAAW,KAAK,aAAa,UACtC,OAAO,WAAW;MAChB,MAAM,CAAC,OAAO,UAAU,gBAAgB,KAAK;MAC7C,SAAS,gBAAgB,OAAO,MAAM;KACxC,CAAC,CACH;KAEA,IAAI,WAAW,uBAAuB;;;MAGpC,OAAO,IAAI,QAAQ,KAAK,iBAAiB,UACvC,OAAO,WAAW;OAChB,MAAM,UAAU,SAAS,mBAAmB;OAC5C,IAAI,CAAC,SAAS;QACZ;OACF;OACA,MAAM,UAAkC,CAAC;OACzC,WAAW,OAAO,SAAS,SAAS,oBAAoB;OACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;;QAElD,IAAI,CAAC,MAAM,QAAQ,QAAQ,IAAI,GAAG,GAAG;SACnC,MAAM,QAAQ,QAAQ,IAAI,KAAK,KAAK;QACtC;OACF;MACF,CAAC,CACH;MACA,OAAO,MAAM,4CAA4C,CAAC,CAAC;KAC7D;IACF,OAAO;KACL,OAAO,KAAK,6BAA6B;MACvC,SAAS,WAAW;MACpB,QAAQ,WAAW,UAAU,2BAA2B;KAC1D,CAAC;IACH;GACF;GAEA,OAAO,OAAO,mBACZ,OAAO,WAAW;IAChB,WAAW;;IAEX,MAAM,SAAS,QAAQ,EAAE,MAAM,2BAA2B,CAAC;GAC7D,CAAC,CACH;GAEA,OAAO,KAAK,4BAA4B;IACtC,SAAS,QAAQ,OAAO,WAAW,aAAa;IAChD,UAAU,OAAO,SAAS,YAAY;IACtC,MAAM,QAAQ,IAAI;IAClB,UAAU,QAAQ,OAAO,QAAQ;IACjC,WAAW,OAAO,cAAc,oBAAoB,cAAc;GACpE,CAAC;EACH,CAAC;CACH,CAAC;AACH;AAEA,OAAO,MAAM,oBAAmC,wBAAwB;AAExE,eAAe","names":[],"sources":["../src/opencode.ts"],"version":3,"file":"opencode.js","sourceRoot":""}

package/dist/plugin.d.ts

@@ -1,4 +1,4 @@
-import { type AuthServerConfig, type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
+import { type AuthServerConfig, type DeviceSignIn, type Logger, type TokenSet } from "@vymalo/opencode-auth-core/lib";
 /**
 * Identity for the exchanged project-token store. Kept as a constant, not
 * `auth.id`, because the exchanged-token key has always been derived from this
@@ -54,10 +54,28 @@ export interface LightbridgeRuntimeOptions {
 * `TokenRuntime` (no network, no disk).
 */
 export interface LightbridgeRuntimeLike {
-	getProjectToken(options?: {
-		interactive?: boolean;
+	/**
+	* A usable gateway/OTEL bearer. NEVER interactive (ADR-0023): when no usable
+	* token exists it rejects with `InteractiveAuthRequiredError` and the caller
+	* fails closed. The only way a human signs in is `beginDeviceSignIn`, driven
+	* from the host's Connect dialog.
+	*/
+	getProjectToken(): Promise<TokenSet>;
+	/**
+	* The shared human/IdP root token, refresh-only (never interactive).
+	* `minValidityMs` forces a real refresh when the cached token has less than
+	* that left (the host's 5-minute refresh window is wider than our skew).
+	*/
+	ensureRootToken(options?: {
+		minValidityMs?: number;
 	}): Promise<TokenSet>;
-	reset?(): Promise<void>;
+	/**
+	* Request a device code for the Connect dialog; `complete` polls and stores.
+	* `signal` cancels the device-authorization request.
+	*/
+	beginDeviceSignIn(signal?: AbortSignal): Promise<DeviceSignIn>;
+	/** Drop every stored token for this identity (the host disconnected it). */
+	reset(): Promise<void>;
 }
 /**
 * Builds a `LightbridgeRuntimeLike` for a given `(auth, projectId)` pair.
@@ -117,10 +135,18 @@ export declare class LightbridgeRuntime implements LightbridgeRuntimeLike {
 	* invents a token: a failure propagates to the caller, which is expected to
 	* fail closed (no header / empty `headers()`).
 	*/
-	getProjectToken(options?: {
-		interactive?: boolean;
-	}): Promise<TokenSet>;
+	getProjectToken(): Promise<TokenSet>;
 	private performExchange;
+	/** See {@link LightbridgeRuntimeLike.ensureRootToken}. */
+	ensureRootToken(options?: {
+		minValidityMs?: number;
+	}): Promise<TokenSet>;
+	/**
+	* The ONLY interactive entry point (ADR-0023): the root runtime requests a
+	* device code and, on `complete`, stores the result through the shared
+	* credential file's single writer (`setCached` under the refresh lock).
+	*/
+	beginDeviceSignIn(signal?: AbortSignal): Promise<DeviceSignIn>;
 	/**
 	* Drop the cached tokens for this identity: the exchanged project token
 	* entirely (its own exclusive store), and the shared root credential. The

package/dist/plugin.js

@@ -168,9 +168,9 @@ export class LightbridgeRuntime {
 	* invents a token: a failure propagates to the caller, which is expected to
 	* fail closed (no header / empty `headers()`).
 	*/
-	async getProjectToken(options = {}) {
+	async getProjectToken() {
 		if (!this.exchange) {
-			return this.rootRuntime.ensure({ interactive: options.interactive });
+			return this.rootRuntime.ensure({ interactive: false });
 		}
 		const cached = await this.getCachedProjectToken();
 		if (isProjectTokenUsable(cached, this.tokenExpirySkewMs)) {
@@ -181,7 +181,7 @@ export class LightbridgeRuntime {
 		if (this.inFlightExchange) {
 			return this.inFlightExchange;
 		}
-		const exchange = this.performExchange(options);
+		const exchange = this.performExchange();
 		this.inFlightExchange = exchange;
 		try {
 			return await exchange;
@@ -191,8 +191,8 @@ export class LightbridgeRuntime {
 			}
 		}
 	}
-	async performExchange(options) {
-		const human = await this.rootRuntime.ensure({ interactive: options.interactive });
+	async performExchange() {
+		const human = await this.rootRuntime.ensure({ interactive: false });
 		this.logger.info("lightbridge_exchange_started", { projectId: this.projectId ?? "(default)" });
 		try {
 			// No `projectId` → send no `project_id` param; the backend mints a token
@@ -208,6 +208,21 @@ export class LightbridgeRuntime {
 			throw error;
 		}
 	}
+	/** See {@link LightbridgeRuntimeLike.ensureRootToken}. */
+	async ensureRootToken(options = {}) {
+		return this.rootRuntime.ensure({
+			interactive: false,
+			minValidityMs: options.minValidityMs
+		});
+	}
+	/**
+	* The ONLY interactive entry point (ADR-0023): the root runtime requests a
+	* device code and, on `complete`, stores the result through the shared
+	* credential file's single writer (`setCached` under the refresh lock).
+	*/
+	async beginDeviceSignIn(signal) {
+		return this.rootRuntime.beginDeviceSignIn(signal);
+	}
 	/**
 	* Drop the cached tokens for this identity: the exchanged project token
 	* entirely (its own exclusive store), and the shared root credential. The

package/dist/plugin.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAIK;AACP,SAAS,6BAA6B;;;;;;AAOtC,OAAO,MAAM,uBAAuB;;;;;;AAOpC,OAAO,MAAM,2BAA2B;;;;;;;;;;;;;;AAexC,OAAO,MAAM,qBAAqB;AAClC,OAAO,MAAM,uBAAuB;;;;;;;AAQpC,OAAO,MAAM,sBAAsB;;;;;;AA2CnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAS,4BACP,UACA,MACA,aACA,SACc;CACd,OAAO,IAAI,aAAa,UAAU,MAAM;EACtC,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,cAAc;EACd,UAAU,YAAY;EACtB,WAAW,aAAa,MAAM,YAAY,KAAK,QAAQ,EAAC,AAAC,EAAE;EAC3D,WAAW,OAAO,UAAU;GAC1B,MAAM,YAAY,KAAK,UAAU,OAAO,KAAK,IAAI,CAAC;EACpD;;;EAGA,aAAa,YAAY;GACvB,MAAM,YAAY,OAAO,QAAQ;EACnC;CACF,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,OAAO,MAAM,mBAAqD;CAe7C;CAdnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,WAAW,KAAK;EACrB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,WAAW,QAAQ,YAAY;EACpC,KAAK,YAAY,QAAQ,YAAY,iBAAiB;EACtD,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,cAAc,IAAI,sBAAsB,aAAa,KAAK,SAAS,GAAG,KAAK,MAAM;EACtF,KAAK,cAAc,4BAA4B,KAAK,UAAU,MAAM,KAAK,aAAa,OAAO;;;;EAK7F,KAAK,kBAAkB,IAAI,aAAa,sBAAsB,MAAM;GAClE,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,oBAAoB,KAAK,SAAS;GAC5C,mBAAmB,KAAK;GACxB,cAAc;EAChB,CAAC;CACH;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,gBAAgB,kBAAkB,KAAK,UAAU;CAC/D;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,MAAM,gBAAgB,UAAqC,CAAC,GAAsB;EAChF,IAAI,CAAC,KAAK,UAAU;GAClB,OAAO,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EACrE;EAEA,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB,OAAO;EAC7C,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,gBAAgB,SAAuD;EACnF,MAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAChF,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,gBAAgB,WAC3C,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,QAAuB;EAC3B,MAAM,KAAK,gBAAgB,MAAM;EACjC,MAAM,KAAK,YAAY,OAAO,KAAK,QAAQ;CAC7C;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,wBAAwB;AACjD;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}
+{"mappings":"AAAA,SAAS,YAAY;AAErB,SACE,yBACA,8BACA,kBACA,oBAKK;AACP,SAAS,6BAA6B;;;;;;AAOtC,OAAO,MAAM,uBAAuB;;;;;;AAOpC,OAAO,MAAM,2BAA2B;;;;;;;;;;;;;;AAexC,OAAO,MAAM,qBAAqB;AAClC,OAAO,MAAM,uBAAuB;;;;;;;AAQpC,OAAO,MAAM,sBAAsB;;;;;;AA6DnC,SAAS,qBAAqB,OAA6B,QAAmC;CAC5F,IAAI,CAAC,OAAO,aAAa;EACvB,OAAO;CACT;CACA,IAAI,MAAM,cAAc,WAAW;EACjC,OAAO;CACT;CACA,OAAO,KAAK,IAAI,IAAI,SAAS,MAAM;AACrC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAS,4BACP,UACA,MACA,aACA,SACc;CACd,OAAO,IAAI,aAAa,UAAU,MAAM;EACtC,QAAQ,QAAQ;EAChB,WAAW,QAAQ;EACnB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,cAAc;EACd,UAAU,YAAY;EACtB,WAAW,aAAa,MAAM,YAAY,KAAK,QAAQ,EAAC,AAAC,EAAE;EAC3D,WAAW,OAAO,UAAU;GAC1B,MAAM,YAAY,KAAK,UAAU,OAAO,KAAK,IAAI,CAAC;EACpD;;;EAGA,aAAa,YAAY;GACvB,MAAM,YAAY,OAAO,QAAQ;EACnC;CACF,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,OAAO,MAAM,mBAAqD;CAe7C;CAdnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;CAEjB,AAAiB;CACjB,AAAQ;CAER,YACE,MACA,AAAiB,WACjB,UAAqC,CAAC,GACtC;EAFiB;EAGjB,KAAK,WAAW,KAAK;EACrB,KAAK,aAAa,aAAa;EAC/B,KAAK,SAAS,QAAQ,UAAU,wBAAwB,MAAM;EAC9D,KAAK,WAAW,QAAQ,YAAY;EACpC,KAAK,YAAY,QAAQ,YAAY,iBAAiB;EACtD,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;EAEN,KAAK,cAAc,IAAI,sBAAsB,aAAa,KAAK,SAAS,GAAG,KAAK,MAAM;EACtF,KAAK,cAAc,4BAA4B,KAAK,UAAU,MAAM,KAAK,aAAa,OAAO;;;;EAK7F,KAAK,kBAAkB,IAAI,aAAa,sBAAsB,MAAM;GAClE,QAAQ,KAAK;GACb,WAAW,QAAQ;GACnB,oBAAoB,QAAQ;GAC5B,UAAU,oBAAoB,KAAK,SAAS;GAC5C,mBAAmB,KAAK;GACxB,cAAc;EAChB,CAAC;CACH;;CAGA,MAAM,wBAAuD;EAC3D,OAAO,KAAK,gBAAgB,kBAAkB,KAAK,UAAU;CAC/D;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,MAAM,kBAAqC;EACzC,IAAI,CAAC,KAAK,UAAU;GAClB,OAAO,KAAK,YAAY,OAAO,EAAE,aAAa,MAAM,CAAC;EACvD;EAEA,MAAM,SAAS,MAAM,KAAK,sBAAsB;EAChD,IAAI,qBAAqB,QAAQ,KAAK,iBAAiB,GAAG;GACxD,KAAK,OAAO,MAAM,kCAAkC,EAAE,WAAW,KAAK,UAAU,CAAC;GACjF,OAAO;EACT;EACA,KAAK,OAAO,MAAM,mCAAmC,EAAE,WAAW,KAAK,UAAU,CAAC;EAElF,IAAI,KAAK,kBAAkB;GACzB,OAAO,KAAK;EACd;EAEA,MAAM,WAAW,KAAK,gBAAgB;EACtC,KAAK,mBAAmB;EACxB,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,qBAAqB,UAAU;IACtC,KAAK,mBAAmB;GAC1B;EACF;CACF;CAEA,MAAc,kBAAqC;EACjD,MAAM,QAAQ,MAAM,KAAK,YAAY,OAAO,EAAE,aAAa,MAAM,CAAC;EAClE,KAAK,OAAO,KAAK,gCAAgC,EAAE,WAAW,KAAK,aAAa,YAAY,CAAC;EAC7F,IAAI;;;GAGF,MAAM,YAAY,MAAM,KAAK,gBAAgB,WAC3C,KAAK,YACL,MAAM,aACN,KAAK,YAAY,EAAE,YAAY,KAAK,UAAU,IAAI,CAAC,CACrD;GACA,KAAK,OAAO,KAAK,gCAAgC,EAC/C,WAAW,KAAK,aAAa,YAC/B,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,+BAA+B;IAC/C,WAAW,KAAK;IAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR;CACF;;CAGA,MAAM,gBAAgB,UAAsC,CAAC,GAAsB;EACjF,OAAO,KAAK,YAAY,OAAO;GAAE,aAAa;GAAO,eAAe,QAAQ;EAAc,CAAC;CAC7F;;;;;;CAOA,MAAM,kBAAkB,QAA6C;EACnE,OAAO,KAAK,YAAY,kBAAkB,MAAM;CAClD;;;;;;;CAQA,MAAM,QAAuB;EAC3B,MAAM,KAAK,gBAAgB,MAAM;EACjC,MAAM,KAAK,YAAY,OAAO,KAAK,QAAQ;CAC7C;AACF;;AAGA,OAAO,SAAS,oBAAoB,WAA2B;CAC7D,OAAO,KAAK,WAAW,wBAAwB;AACjD;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE;;AAGA,OAAO,SAAS,aAAa,WAA2B;CACtD,OAAO,KAAK,WAAW,oBAAoB,oBAAoB;AACjE","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/dist/sign-in.d.ts

@@ -0,0 +1,70 @@
+import type { Credential, Plugin } from "@opencode/plugin/effect";
+import { type TokenSet } from "@vymalo/opencode-auth-core/lib";
+import type { Logger } from "./logging.js";
+import type { LightbridgeRuntimeLike } from "./plugin.js";
+type IntegrationEditor = Parameters<Parameters<Plugin.Context["integration"]["transform"]>[0]>[0];
+/** The host's oauth-method registration shape (the package does not export it by name). */
+export type IntegrationOAuthMethodRegistration = Extract<Parameters<IntegrationEditor["method"]["update"]>[0], {
+	method: {
+		type: "oauth";
+	};
+}>;
+/** Id of the one sign-in method lightbridge registers on its integration (ADR-0023). */
+export declare const SIGN_IN_METHOD_ID = "device";
+/** Label of the button the host renders for that method. */
+export declare const SIGN_IN_METHOD_LABEL = "Sign in";
+/** The host calls a method's `refresh` once the credential is within this of `expires`. */
+export declare const HOST_REFRESH_WINDOW_MS: number;
+/** The exact path a user follows to sign in, for the `lightbridge_sign_in_required` hint. */
+export declare function signInPath(name: string): string;
+/**
+* Display-only account label (email / username) read from the access token's
+* claims. Deliberately UNVERIFIED: nothing security-relevant ever reads it, it
+* only decorates the host's connection row. Opaque (non-JWT) tokens and any
+* decoding problem yield `undefined`.
+*/
+export declare function accountLabel(accessToken: string): string | undefined;
+/**
+* The host-side projection of our token: a "connected" marker plus the current
+* access token. CUSTODY RULE (ADR-0023): `refresh` is ALWAYS `""` — the refresh
+* token never leaves lightbridge's own state file, so a host credential-store
+* leak or a host-driven refresh cannot replay (and thereby rotate away) it.
+*/
+export declare function projectCredential(token: TokenSet, now?: number): Credential.OAuth;
+export interface SignInDependencies {
+	integrationID: string;
+	runtime: LightbridgeRuntimeLike;
+	logger: Logger;
+	/**
+	* Runs after the projection was handed back (kick the model sync, reload the
+	* host's providers). Detached: the dialog closes without waiting for it, and
+	* a failure or a late interrupt cannot undo the sign-in.
+	*/
+	afterSignIn: () => Promise<void>;
+	/** Called synchronously on a successful sign-in (re-arms the sign-in notice). */
+	onSignedIn?: () => void;
+	/** Called when a sign-in-related call finds no usable token (refresh-only failure). */
+	onSignInRequired?: (source: string) => void;
+}
+/**
+* The oauth method registration behind the host's "Connect" dialog (ADR-0023).
+* `authorize` requests a device code and hands the host the URL + code to show;
+* `callback` awaits the user's approval (interruptible: the host closing the
+* dialog interrupts it, which aborts the polling) and returns the projection.
+*/
+export declare function createSignInRegistration(deps: SignInDependencies): IntegrationOAuthMethodRegistration;
+export interface SignInNotice {
+	/** Warn (once until re-armed) that sign-in is needed; always records the source at debug. */
+	notify(source: string): void;
+	/** Re-arm: the next `notify` warns again (after a sign-in, or a host disconnect). */
+	reset(): void;
+}
+/**
+* Emit `lightbridge_sign_in_required` at most once per arming, naming the exact
+* path to sign in. Every non-interactive caller that finds no usable token
+* (startup check, gateway header, OTEL token source, the register sync) reports
+* through this one latch; each call is also recorded at `debug` as
+* `lightbridge_sign_in_required_seen` so the sources stay observable.
+*/
+export declare function createSignInRequiredNotifier(logger: Logger, name: string): SignInNotice;
+export {};

package/dist/sign-in.js

@@ -0,0 +1,152 @@
+import { isInteractiveAuthRequiredError } from "@vymalo/opencode-auth-core/lib";
+import { Effect } from "effect";
+/** Id of the one sign-in method lightbridge registers on its integration (ADR-0023). */
+export const SIGN_IN_METHOD_ID = "device";
+/** Label of the button the host renders for that method. */
+export const SIGN_IN_METHOD_LABEL = "Sign in";
+/** Fallback lifetime for a token the IdP gave no `expires_in` for. */
+const FALLBACK_LIFETIME_MS = 60 * 60 * 1e3;
+const MAX_LABEL_CHARS = 80;
+/** The host calls a method's `refresh` once the credential is within this of `expires`. */
+export const HOST_REFRESH_WINDOW_MS = 5 * 60 * 1e3;
+/** The exact path a user follows to sign in, for the `lightbridge_sign_in_required` hint. */
+export function signInPath(name) {
+	return `Settings → Providers → Show more providers → (Integrations dialog) search "${name}" → Sign in`;
+}
+/**
+* Display-only account label (email / username) read from the access token's
+* claims. Deliberately UNVERIFIED: nothing security-relevant ever reads it, it
+* only decorates the host's connection row. Opaque (non-JWT) tokens and any
+* decoding problem yield `undefined`.
+*/
+export function accountLabel(accessToken) {
+	const parts = accessToken.split(".");
+	if (parts.length !== 3 || !parts[1]) {
+		return undefined;
+	}
+	try {
+		const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		for (const key of ["email", "preferred_username"]) {
+			const value = claims[key];
+			if (typeof value === "string" && value.trim().length > 0) {
+				return value.trim().slice(0, MAX_LABEL_CHARS);
+			}
+		}
+	} catch {}
+	return undefined;
+}
+/**
+* The host-side projection of our token: a "connected" marker plus the current
+* access token. CUSTODY RULE (ADR-0023): `refresh` is ALWAYS `""` — the refresh
+* token never leaves lightbridge's own state file, so a host credential-store
+* leak or a host-driven refresh cannot replay (and thereby rotate away) it.
+*/
+export function projectCredential(token, now = Date.now()) {
+	const label = accountLabel(token.accessToken);
+	return {
+		type: "oauth",
+		methodID: SIGN_IN_METHOD_ID,
+		access: token.accessToken,
+		refresh: "",
+		expires: Math.floor(token.expiresAt ?? now + FALLBACK_LIFETIME_MS),
+		...label ? { metadata: { label } } : {}
+	};
+}
+/**
+* The oauth method registration behind the host's "Connect" dialog (ADR-0023).
+* `authorize` requests a device code and hands the host the URL + code to show;
+* `callback` awaits the user's approval (interruptible: the host closing the
+* dialog interrupts it, which aborts the polling) and returns the projection.
+*/
+export function createSignInRegistration(deps) {
+	const { integrationID, runtime, logger } = deps;
+	return {
+		integrationID,
+		method: {
+			id: SIGN_IN_METHOD_ID,
+			type: "oauth",
+			label: SIGN_IN_METHOD_LABEL
+		},
+		authorize: () => Effect.tryPromise({
+			// The effect's signal aborts when the host abandons the attempt, which
+			// also cancels the device-authorization request.
+			try: (signal) => runtime.beginDeviceSignIn(signal),
+			catch: (error) => error
+		}).pipe(Effect.tapError((error) => Effect.sync(() => logger.error("lightbridge_sign_in_begin_failed", errorFields(error)))), Effect.map((session) => ({
+			url: session.verificationUriComplete ?? session.verificationUri,
+			instructions: `Confirm the code ${session.userCode} on the page that opens, then approve the request.`,
+			expiresAt: session.expiresAt,
+			mode: "auto",
+			callback: Effect.tryPromise({
+				try: (signal) => session.complete(signal),
+				catch: (error) => error
+			}).pipe(Effect.tapError((error) => Effect.sync(() => logger.warn("lightbridge_sign_in_failed", errorFields(error)))), Effect.onInterrupt(() => Effect.sync(() => logger.info("lightbridge_sign_in_cancelled", { integrationID }))), Effect.map((token) => {
+				logger.info("lightbridge_sign_in_completed", { integrationID });
+				deps.onSignedIn?.();
+				// Detached on purpose (see `afterSignIn`).
+				void (async () => {
+					try {
+						await deps.afterSignIn();
+					} catch (error) {
+						logger.warn("lightbridge_sign_in_followup_failed", errorFields(error));
+					}
+				})();
+				return projectCredential(token);
+			}))
+		}))),
+		// The host calls this within HOST_REFRESH_WINDOW_MS of `expires`. Whatever it
+		// holds is ignored (it has no refresh token): the truth is our own runtime,
+		// forced to a real, non-interactive refresh through the single writer. A
+		// revoked/cleared root fails here - it never starts a flow.
+		refresh: () => Effect.tryPromise({
+			try: () => runtime.ensureRootToken({ minValidityMs: HOST_REFRESH_WINDOW_MS }),
+			catch: (error) => error
+		}).pipe(Effect.tapError((error) => Effect.sync(() => {
+			logger.warn("lightbridge_sign_in_refresh_failed", errorFields(error));
+			if (isInteractiveAuthRequiredError(error)) {
+				deps.onSignInRequired?.("refresh");
+			}
+		})), Effect.tap((token) => Effect.sync(() => {
+			// A refresh that "succeeds" with a token still inside the window means
+			// the refresh itself failed and we served what was left.
+			if (token.expiresAt !== undefined && token.expiresAt - Date.now() <= HOST_REFRESH_WINDOW_MS) {
+				logger.warn("lightbridge_sign_in_refresh_failed", { error: "refresh returned a token still inside the host refresh window" });
+			}
+		})), Effect.map((token) => projectCredential(token))),
+		label: (credential) => {
+			const label = credential.metadata?.label;
+			return typeof label === "string" ? label : undefined;
+		}
+	};
+}
+function errorFields(error) {
+	return { error: error instanceof Error ? error.message : String(error) };
+}
+/**
+* Emit `lightbridge_sign_in_required` at most once per arming, naming the exact
+* path to sign in. Every non-interactive caller that finds no usable token
+* (startup check, gateway header, OTEL token source, the register sync) reports
+* through this one latch; each call is also recorded at `debug` as
+* `lightbridge_sign_in_required_seen` so the sources stay observable.
+*/
+export function createSignInRequiredNotifier(logger, name) {
+	let notified = false;
+	return {
+		notify(source) {
+			logger.debug("lightbridge_sign_in_required_seen", { source });
+			if (notified) {
+				return;
+			}
+			notified = true;
+			logger.warn("lightbridge_sign_in_required", {
+				source,
+				message: `lightbridge is not signed in: open ${signInPath(name)}`
+			});
+		},
+		reset() {
+			notified = false;
+		}
+	};
+}
+
+//# sourceMappingURL=sign-in.js.map

package/dist/sign-in.js.map

@@ -0,0 +1 @@
+{"mappings":"AACA,SAAS,sCAAqD;AAC9D,SAAS,cAAc;;AAcvB,OAAO,MAAM,oBAAoB;;AAGjC,OAAO,MAAM,uBAAuB;;AAGpC,MAAM,uBAAuB,KAAK,KAAK;AAEvC,MAAM,kBAAkB;;AAGxB,OAAO,MAAM,yBAAiC,IAAI,KAAK;;AAGvD,OAAO,SAAS,WAAW,MAAsB;CAC/C,OAAO,8EAA8E,KAAK;AAC5F;;;;;;;AAQA,OAAO,SAAS,aAAa,aAAyC;CACpE,MAAM,QAAQ,YAAY,MAAM,GAAG;CACnC,IAAI,MAAM,WAAW,KAAK,CAAC,MAAM,IAAI;EACnC,OAAO;CACT;CACA,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAI7E,KAAK,MAAM,OAAO,CAAC,SAAS,oBAAoB,GAAG;GACjD,MAAM,QAAQ,OAAO;GACrB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,GAAG;IACxD,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,eAAe;GAC9C;EACF;CACF,QAAQ,CAER;CACA,OAAO;AACT;;;;;;;AAQA,OAAO,SAAS,kBAAkB,OAAiB,MAAc,KAAK,IAAI,GAAqB;CAC7F,MAAM,QAAQ,aAAa,MAAM,WAAW;CAC5C,OAAO;EACL,MAAM;EACN,UAAU;EACV,QAAQ,MAAM;EACd,SAAS;EACT,SAAS,KAAK,MAAM,MAAM,aAAa,MAAM,oBAAoB;EACjE,GAAI,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC;CACzC;AACF;;;;;;;AAwBA,OAAO,SAAS,yBACd,MACoC;CACpC,MAAM,EAAE,eAAe,SAAS,WAAW;CAC3C,OAAO;EACL;EACA,QAAQ;GAAE,IAAI;GAAmB,MAAM;GAAS,OAAO;EAAqB;EAC5E,iBACE,OAAO,WAAW;;;GAGhB,MAAM,WAAwB,QAAQ,kBAAkB,MAAM;GAC9D,QAAQ,UAAU;EACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW,OAAO,MAAM,oCAAoC,YAAY,KAAK,CAAC,CAAC,CACxF,GACA,OAAO,KAAK,aAAa;GACvB,KAAK,QAAQ,2BAA2B,QAAQ;GAChD,cAAc,oBAAoB,QAAQ,SAAS;GACnD,WAAW,QAAQ;GACnB,MAAM;GACN,UAAU,OAAO,WAAW;IAC1B,MAAM,WAAwB,QAAQ,SAAS,MAAM;IACrD,QAAQ,UAAU;GACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW,OAAO,KAAK,8BAA8B,YAAY,KAAK,CAAC,CAAC,CACjF,GACA,OAAO,kBACL,OAAO,WAAW,OAAO,KAAK,iCAAiC,EAAE,cAAc,CAAC,CAAC,CACnF,GACA,OAAO,KAAK,UAAU;IACpB,OAAO,KAAK,iCAAiC,EAAE,cAAc,CAAC;IAC9D,KAAK,aAAa;;IAElB,MAAM,YAAY;KAChB,IAAI;MACF,MAAM,KAAK,YAAY;KACzB,SAAS,OAAO;MACd,OAAO,KAAK,uCAAuC,YAAY,KAAK,CAAC;KACvE;IACF,EAAC,AAAC,CAAC;IACH,OAAO,kBAAkB,KAAK;GAChC,CAAC,CACH;EACF,EAAE,CACJ;;;;;EAKF,eACE,OAAO,WAAW;GAChB,WAAW,QAAQ,gBAAgB,EAAE,eAAe,uBAAuB,CAAC;GAC5E,QAAQ,UAAU;EACpB,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,WAAW;GAChB,OAAO,KAAK,sCAAsC,YAAY,KAAK,CAAC;GACpE,IAAI,+BAA+B,KAAK,GAAG;IACzC,KAAK,mBAAmB,SAAS;GACnC;EACF,CAAC,CACH,GACA,OAAO,KAAK,UACV,OAAO,WAAW;;;GAGhB,IACE,MAAM,cAAc,aACpB,MAAM,YAAY,KAAK,IAAI,KAAK,wBAChC;IACA,OAAO,KAAK,sCAAsC,EAChD,OAAO,gEACT,CAAC;GACH;EACF,CAAC,CACH,GACA,OAAO,KAAK,UAAU,kBAAkB,KAAK,CAAC,CAChD;EACF,QAAQ,eAAe;GACrB,MAAM,QAAQ,WAAW,UAAU;GACnC,OAAO,OAAO,UAAU,WAAW,QAAQ;EAC7C;CACF;AACF;AAEA,SAAS,YAAY,OAAmC;CACtD,OAAO,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AACzE;;;;;;;;AAgBA,OAAO,SAAS,6BAA6B,QAAgB,MAA4B;CACvF,IAAI,WAAW;CACf,OAAO;EACL,OAAO,QAAQ;GACb,OAAO,MAAM,qCAAqC,EAAE,OAAO,CAAC;GAC5D,IAAI,UAAU;IACZ;GACF;GACA,WAAW;GACX,OAAO,KAAK,gCAAgC;IAC1C;IACA,SAAS,sCAAsC,WAAW,IAAI;GAChE,CAAC;EACH;EACA,QAAQ;GACN,WAAW;EACb;CACF;AACF","names":[],"sources":["../src/sign-in.ts"],"version":3,"file":"sign-in.js","sourceRoot":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vymalo/opencode-lightbridge",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Umbrella OpenCode plugin for ADR-0012: one shared credential (TokenRuntime) drives both the LLM gateway bearer and OTEL export, so a developer authenticates once and every egress rides the same project-scoped token.",
   "license": "MIT",
   "author": "vymalo contributors",
@@ -54,9 +54,9 @@
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.222.0",
     "@opentelemetry/core": "^2.11.0",
-    "@vymalo/opencode-auth-core": "0.19.0",
-    "@vymalo/opencode-core-otel": "0.19.0",
-    "@vymalo/opencode-provider-sync": "0.19.0"
+    "@vymalo/opencode-auth-core": "0.20.0",
+    "@vymalo/opencode-provider-sync": "0.20.0",
+    "@vymalo/opencode-core-otel": "0.20.0"
   },
   "devDependencies": {
     "@opentelemetry/sdk-logs": "^0.222.0",