@eduwork/dsh-oidc 0.1.0-alpha.11 → 0.2.0

package/lib/profile.js

@@ -1,17 +1,24 @@
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
+export const DEFAULT_CREDENTIAL_REF = 'EDUWORK_API_KEY'
 const MAX_PROFILE_BYTES = 512 * 1024
 const idPattern = /^[a-z][a-z0-9-]{0,63}$/
 const credentialPattern = /^[A-Za-z_][A-Za-z0-9_]*$/
 const colorPattern = /^#[0-9a-fA-F]{6}$/
 const allowedModalities = new Set(['text', 'image'])
+const allowedThinkingLevels = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
+const allowedMaxTokensFields = new Set(['max_completion_tokens', 'max_tokens'])
+const allowedThinkingFormats = new Set([
+  'openai', 'deepseek', 'openrouter', 'together', 'baseten', 'zai', 'qwen',
+  'chat-template', 'qwen-chat-template', 'string-thinking', 'ant-ling',
+])
 const allowedRootKeys = new Set([
   'schemaVersion', 'id', 'displayName', 'organization', 'nativeInstitutionID',
   'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'keyBinding', 'provider',
 ])
 const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
-const allowedKeyBindingKeys = new Set(['baseURL', 'credentialRef'])
+const allowedKeyBindingKeys = new Set(['type', 'baseURL', 'credentialRef'])
 const allowedBrandKeys = new Set([
   'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
   'loginTitle', 'loginDescription', 'supportURL',
@@ -19,11 +26,11 @@ const allowedBrandKeys = new Set([
 const allowedProviderKeys = new Set([
   'id', 'displayName', 'adapter', 'baseURL', 'reasoning', 'defaultContextWindow',
   'defaultMaxTokens', 'maxRequestImageBytes', 'requestImagePixelBudget',
-  'requestImageMaxBytes', 'streamIdleTimeoutMs', 'retryPolicy', 'compat', 'models',
+  'requestImageMaxBytes', 'streamIdleTimeoutMs', 'retryPolicy', 'compat', 'models', 'modelSource',
 ])
 const allowedModelKeys = new Set([
   'id', 'name', 'input', 'contextWindow', 'maxTokens', 'reasoning',
-  'reasoningEfforts', 'compat',
+  'reasoningEfforts', 'defaultReasoningEffort', 'compat',
 ])
 const allowedCompatKeys = new Set([
   'supportsDeveloperRole', 'supportsStore', 'supportsReasoningEffort',
@@ -141,9 +148,15 @@ function normalizeCompat(value, label) {
   const result = {}
   for (const key of allowedCompatKeys) {
     if (source[key] === undefined) continue
-    result[key] = key === 'maxTokensField' || key === 'thinkingFormat'
-      ? text(source[key], `${label}.${key}`, 64)
-      : boolean(source[key], `${label}.${key}`)
+    if (key === 'maxTokensField') {
+      result[key] = text(source[key], `${label}.${key}`, 64)
+      if (!allowedMaxTokensFields.has(result[key])) throw new Error(`${label}.${key} is not supported by DSH pi-ai`)
+    } else if (key === 'thinkingFormat') {
+      result[key] = text(source[key], `${label}.${key}`, 64)
+      if (!allowedThinkingFormats.has(result[key])) throw new Error(`${label}.${key} is not supported by DSH pi-ai`)
+    } else {
+      result[key] = boolean(source[key], `${label}.${key}`)
+    }
   }
   return Object.freeze(result)
 }
@@ -151,15 +164,18 @@ function normalizeCompat(value, label) {
 function normalizeReasoningEfforts(value, providerID, modelID) {
   if (value === false) return false
   const source = object(value, `${providerID}.${modelID}.reasoningEfforts`)
-  if (Object.keys(source).length === 0 || Object.keys(source).length > 16) throw new Error(`${providerID}.${modelID}.reasoningEfforts must contain 1-16 entries`)
+  if (Object.keys(source).length === 0 || Object.keys(source).length > allowedThinkingLevels.size) {
+    throw new Error(`${providerID}.${modelID}.reasoningEfforts must contain 1-${allowedThinkingLevels.size} entries`)
+  }
   return Object.freeze(Object.fromEntries(Object.entries(source).map(([level, wire]) => {
-    text(level, `${providerID}.${modelID}.reasoningEfforts level`, 32)
+    if (!allowedThinkingLevels.has(level)) throw new Error(`${providerID}.${modelID}.reasoningEfforts level ${level} is not supported by DSH pi-ai`)
+    if (wire === null && level !== 'off') throw new Error(`${providerID}.${modelID}.reasoningEfforts.${level} may be null only for off`)
     if (wire !== null) text(wire, `${providerID}.${modelID}.reasoningEfforts.${level}`, 32)
     return [level, wire]
   })))
 }
 
-function normalizeModels(models, providerID) {
+export function normalizeModels(models, providerID) {
   if (!Array.isArray(models) || models.length === 0 || models.length > 128) throw new Error(`${providerID}.models must contain 1-128 entries`)
   const seen = new Set()
   return Object.freeze(models.map((raw, index) => {
@@ -174,6 +190,19 @@ function normalizeModels(models, providerID) {
       throw new Error(`${providerID}.${id}.input must contain text and/or image`)
     }
     if (new Set(input).size !== input.length) throw new Error(`${providerID}.${id}.input contains duplicates`)
+    const normalizedReasoningEfforts = model.reasoningEfforts === undefined
+      ? undefined
+      : normalizeReasoningEfforts(model.reasoningEfforts, providerID, id)
+    let defaultReasoningEffort
+    if (model.defaultReasoningEffort !== undefined) {
+      defaultReasoningEffort = text(model.defaultReasoningEffort, `${providerID}.${id}.defaultReasoningEffort`, 32)
+      if (!allowedThinkingLevels.has(defaultReasoningEffort)) {
+        throw new Error(`${providerID}.${id}.defaultReasoningEffort is not supported by DSH pi-ai`)
+      }
+      if (!normalizedReasoningEfforts || normalizedReasoningEfforts === false || !(defaultReasoningEffort in normalizedReasoningEfforts)) {
+        throw new Error(`${providerID}.${id}.defaultReasoningEffort must be one of the model's declared reasoningEfforts`)
+      }
+    }
     return Object.freeze({
       id,
       name: model.name === undefined ? id : text(model.name, `${providerID}.${id}.name`, 256),
@@ -181,14 +210,15 @@ function normalizeModels(models, providerID) {
       ...(model.contextWindow === undefined ? {} : { contextWindow: positiveInteger(model.contextWindow, `${providerID}.${id}.contextWindow`) }),
       ...(model.maxTokens === undefined ? {} : { maxTokens: positiveInteger(model.maxTokens, `${providerID}.${id}.maxTokens`) }),
       ...(model.reasoning === undefined ? {} : { reasoning: boolean(model.reasoning, `${providerID}.${id}.reasoning`) }),
-      ...(model.reasoningEfforts === undefined ? {} : { reasoningEfforts: normalizeReasoningEfforts(model.reasoningEfforts, providerID, id) }),
+      ...(normalizedReasoningEfforts === undefined ? {} : { reasoningEfforts: normalizedReasoningEfforts }),
+      ...(defaultReasoningEffort === undefined ? {} : { defaultReasoningEffort }),
       ...(model.compat === undefined ? {} : { compat: normalizeCompat(model.compat, `${providerID}.${id}.compat`) }),
     })
   }))
 }
 
-function providerCredentialRef(providerID) {
-  return `${providerID.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`
+export function legacyCredentialRefs(profile) {
+  return [...new Set([profile.id, profile.provider?.id].filter(Boolean).map(id => `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`))]
 }
 
 function normalizeRetryPolicy(value) {
@@ -252,20 +282,29 @@ export function normalizeEnterpriseProfile(raw) {
     throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
   }
   const oidc = object(source.oidc, 'profile.oidc')
-  const keyBinding = object(source.keyBinding, 'profile.keyBinding')
-  const provider = object(source.provider, 'profile.provider')
+  const identityOnly = source.keyBinding === undefined && source.provider === undefined
+  if (!identityOnly && (source.keyBinding === undefined || source.provider === undefined)) {
+    throw new Error('profile.keyBinding and profile.provider must either both be present or both be omitted')
+  }
+  const keyBinding = identityOnly ? {} : object(source.keyBinding, 'profile.keyBinding')
+  const provider = identityOnly ? {} : object(source.provider, 'profile.provider')
   exactKeys(oidc, allowedOidcKeys, 'profile.oidc')
   exactKeys(keyBinding, allowedKeyBindingKeys, 'profile.keyBinding')
   exactKeys(provider, allowedProviderKeys, 'profile.provider')
-  const providerID = text(provider.id, 'profile.provider.id', 64)
+  const providerID = identityOnly ? id : text(provider.id, 'profile.provider.id', 64)
   if (!idPattern.test(providerID)) throw new Error('profile.provider.id is invalid')
-  const credentialRef = keyBinding.credentialRef === undefined
-    ? providerCredentialRef(providerID)
+  let credentialRef = keyBinding.credentialRef === undefined
+    ? DEFAULT_CREDENTIAL_REF
     : text(keyBinding.credentialRef, 'profile.keyBinding.credentialRef', 128)
   if (!credentialPattern.test(credentialRef)) {
     throw new Error('profile.keyBinding.credentialRef must be a valid DSH credential reference')
   }
-  if (provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
+  if (legacyCredentialRefs({ id, provider: { id: providerID } }).includes(credentialRef)) credentialRef = DEFAULT_CREDENTIAL_REF
+  if (!identityOnly && provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
+  const protocol = keyBinding.type ?? 'worker-user-center-v1'
+  if (!['worker-user-center-v1', 'eduwork-resources-v1'].includes(protocol)) throw new Error('profile.keyBinding.type is not supported')
+  const modelSource = provider.modelSource ?? 'profile'
+  if (!['profile', 'discovery'].includes(modelSource)) throw new Error('profile.provider.modelSource must be profile or discovery')
   const scopes = oidc.scopes
   if (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope))) {
     throw new Error('profile.oidc.scopes must contain openid and profile; every scope must be a non-empty token')
@@ -285,8 +324,8 @@ export function normalizeEnterpriseProfile(raw) {
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
     }),
-    keyBinding: Object.freeze({
-      type: 'worker-user-center-v1',
+    ...(identityOnly ? {} : { keyBinding: Object.freeze({
+      type: protocol,
       baseURL: exactURL(keyBinding.baseURL, 'profile.keyBinding.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
       providerId: providerID,
       credentialRef,
@@ -296,7 +335,13 @@ export function normalizeEnterpriseProfile(raw) {
       displayName: text(provider.displayName ?? source.displayName, 'profile.provider.displayName', 120),
       adapter: provider.adapter,
       baseURL: exactURL(provider.baseURL, 'profile.provider.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
-      reasoning: provider.reasoning === undefined ? 'high' : text(provider.reasoning, 'profile.provider.reasoning', 32),
+      reasoning: provider.reasoning === undefined
+        ? 'high'
+        : (() => {
+            const reasoning = text(provider.reasoning, 'profile.provider.reasoning', 32)
+            if (!allowedThinkingLevels.has(reasoning)) throw new Error('profile.provider.reasoning is not supported by DSH pi-ai')
+            return reasoning
+          })(),
       defaultContextWindow: optionalPositiveInteger(provider.defaultContextWindow, 'profile.provider.defaultContextWindow'),
       defaultMaxTokens: optionalPositiveInteger(provider.defaultMaxTokens, 'profile.provider.defaultMaxTokens'),
       maxRequestImageBytes: optionalPositiveInteger(provider.maxRequestImageBytes, 'profile.provider.maxRequestImageBytes'),
@@ -305,7 +350,10 @@ export function normalizeEnterpriseProfile(raw) {
       streamIdleTimeoutMs: optionalPositiveInteger(provider.streamIdleTimeoutMs, 'profile.provider.streamIdleTimeoutMs'),
       retryPolicy: provider.retryPolicy === undefined ? undefined : normalizeRetryPolicy(provider.retryPolicy),
       compat: provider.compat === undefined ? undefined : normalizeCompat(provider.compat, 'profile.provider.compat'),
-      models: normalizeModels(provider.models, providerID),
+      modelSource,
+      models: modelSource === 'discovery' && (provider.models === undefined || provider.models.length === 0)
+        ? Object.freeze([]) : normalizeModels(provider.models, providerID),
+    }),
     }),
   })
 }
@@ -317,8 +365,10 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
     if (!Array.isArray(raw.profiles)) throw new Error('dsh-oidc profiles must be an array')
     profiles.push(...raw.profiles.map(normalizeEnterpriseProfile))
   }
-  if (typeof raw.profilePathEnv === 'string' && environment[raw.profilePathEnv]) {
-    const parsed = JSON.parse(readFileSync(environment[raw.profilePathEnv], 'utf8'))
+  const pathEnv = raw.profilePathEnv ?? 'EDUWORK_OIDC_PROFILE'
+  const profilePath = environment[pathEnv] || (pathEnv === 'EDUWORK_OIDC_PROFILE' ? environment.DSH_OIDC_ENTERPRISE_PROFILE : undefined)
+  if (typeof profilePath === 'string' && profilePath) {
+    const parsed = JSON.parse(readFileSync(profilePath, 'utf8'))
     const rows = Array.isArray(parsed) ? parsed : parsed.profiles ?? [parsed]
     profiles.push(...rows.map(normalizeEnterpriseProfile))
   }
@@ -326,31 +376,38 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
   const providers = new Set()
   for (const profile of profiles) {
     if (unique.has(profile.id)) throw new Error(`dsh-oidc repeats profile ${profile.id}`)
-    if (providers.has(profile.provider.id)) throw new Error(`dsh-oidc repeats provider route ${profile.provider.id}`)
+    if (profile.provider && providers.has(profile.provider.id)) throw new Error(`dsh-oidc repeats provider route ${profile.provider.id}`)
     unique.set(profile.id, profile)
-    providers.add(profile.provider.id)
+    if (profile.provider) providers.add(profile.provider.id)
   }
   return unique
 }
 
 export function enterpriseProviderConfig(profiles) {
   return {
-    providers: Object.fromEntries([...profiles.values()].map(profile => [profile.provider.id, {
+    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.models.length).map(profile => [profile.provider.id, {
       displayName: profile.provider.displayName,
       apiKeyEnv: profile.keyBinding.credentialRef,
       baseURL: profile.provider.baseURL,
       allowInsecureDevelopment: profile.allowInsecureDevelopment,
       ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
       reasoning: profile.provider.reasoning,
-      defaultContextWindow: profile.provider.defaultContextWindow,
-      defaultMaxTokens: profile.provider.defaultMaxTokens,
-      maxRequestImageBytes: profile.provider.maxRequestImageBytes,
-      requestImagePixelBudget: profile.provider.requestImagePixelBudget,
-      requestImageMaxBytes: profile.provider.requestImageMaxBytes,
-      streamIdleTimeoutMs: profile.provider.streamIdleTimeoutMs,
-      retryPolicy: profile.provider.retryPolicy,
-      compat: profile.provider.compat,
-      models: profile.provider.models,
+      ...(profile.provider.defaultContextWindow === undefined ? {} : { defaultContextWindow: profile.provider.defaultContextWindow }),
+      ...(profile.provider.defaultMaxTokens === undefined ? {} : { defaultMaxTokens: profile.provider.defaultMaxTokens }),
+      ...(profile.provider.maxRequestImageBytes === undefined ? {} : { maxRequestImageBytes: profile.provider.maxRequestImageBytes }),
+      ...(profile.provider.requestImagePixelBudget === undefined ? {} : { requestImagePixelBudget: profile.provider.requestImagePixelBudget }),
+      ...(profile.provider.requestImageMaxBytes === undefined ? {} : { requestImageMaxBytes: profile.provider.requestImageMaxBytes }),
+      ...(profile.provider.streamIdleTimeoutMs === undefined ? {} : { streamIdleTimeoutMs: profile.provider.streamIdleTimeoutMs }),
+      ...(profile.provider.retryPolicy === undefined ? {} : { retryPolicy: structuredClone(profile.provider.retryPolicy) }),
+      ...(profile.provider.compat === undefined ? {} : { compat: { ...profile.provider.compat } }),
+      models: profile.provider.models.map(model => ({
+        ...model,
+        input: [...model.input],
+        ...(model.reasoningEfforts && typeof model.reasoningEfforts === 'object'
+          ? { reasoningEfforts: { ...model.reasoningEfforts } }
+          : {}),
+        ...(model.compat === undefined ? {} : { compat: { ...model.compat } }),
+      })),
     }])),
   }
 }
@@ -361,11 +418,11 @@ export function publicProfile(profile) {
     displayName: profile.displayName,
     organization: profile.organization,
     brand: profile.brand,
-    credentialRef: profile.keyBinding.credentialRef,
-    provider: {
+    credentialRef: profile.keyBinding?.credentialRef ?? '',
+    ...(profile.provider ? { provider: {
       id: profile.provider.id,
       displayName: profile.provider.displayName,
       models: profile.provider.models.map(model => ({ id: model.id, name: model.name, input: model.input })),
-    },
+    } } : {}),
   }
 }

package/lib/provider/core.js

@@ -1,4 +1,6 @@
 const modalities = new Set(['text', 'image'])
+export const REASONING_EFFORT_ORDER = Object.freeze(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
+const reasoningEfforts = new Set(REASONING_EFFORT_ORDER)
 export const ENTERPRISE_SETTINGS_NAMESPACE = 'provider-enterprise'
 export const ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024
 export const ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048
@@ -50,7 +52,43 @@ function normalizeThinkingMap(value, reasoning) {
   if (value === false || reasoning === false) return { off: null }
   const source = value ?? { off: null, high: 'high', max: 'max' }
   if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error('reasoningEfforts must be an object or false')
-  return Object.fromEntries(Object.entries(source).map(([key, level]) => [key, level ?? null]))
+  const entries = Object.entries(source)
+  if (entries.length === 0 || !entries.some(([effort]) => effort !== 'off')) {
+    throw new Error('reasoningEfforts must declare at least one thinking level')
+  }
+  for (const [effort, wire] of entries) {
+    if (!reasoningEfforts.has(effort)) throw new Error(`reasoningEfforts level ${effort} is not supported`)
+    if (wire === null && effort !== 'off') throw new Error(`reasoningEfforts.${effort} may be null only for off`)
+    if (wire !== null && (typeof wire !== 'string' || wire.length === 0)) throw new Error(`reasoningEfforts.${effort} must be a non-empty string`)
+  }
+  const map = {}
+  for (const effort of REASONING_EFFORT_ORDER) {
+    const wire = source[effort]
+    if (wire === undefined) map[effort] = null
+    else if (wire !== null) map[effort] = wire
+  }
+  return map
+}
+
+function declaredReasoningEfforts(value, reasoning) {
+  if (reasoning === false || value === false) return []
+  const source = value ?? { off: null, high: 'high', max: 'max' }
+  return REASONING_EFFORT_ORDER.filter(effort => Object.hasOwn(source, effort))
+}
+
+function reasoningPreference(value, label) {
+  const preference = value ?? 'high'
+  if (!reasoningEfforts.has(preference)) throw new Error(`${label} is not a supported reasoning effort`)
+  return preference
+}
+
+function nearestReasoningEffort(preference, supported) {
+  const preferredRank = REASONING_EFFORT_ORDER.indexOf(preference)
+  return [...supported].sort((left, right) => {
+    const leftRank = REASONING_EFFORT_ORDER.indexOf(left)
+    const rightRank = REASONING_EFFORT_ORDER.indexOf(right)
+    return Math.abs(leftRank - preferredRank) - Math.abs(rightRank - preferredRank) || leftRank - rightRank
+  })[0]
 }
 
 export function resolveEnterpriseProfiles(raw = {}) {
@@ -69,6 +107,7 @@ export function resolveEnterpriseProfiles(raw = {}) {
     const maxRequestImageBytes = positiveInteger(source.maxRequestImageBytes, ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES, `${route}.maxRequestImageBytes`)
     const requestImagePixelBudget = positiveInteger(source.requestImagePixelBudget, ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, `${route}.requestImagePixelBudget`)
     const requestImageMaxBytes = positiveInteger(source.requestImageMaxBytes, ENTERPRISE_DEFAULT_REQUEST_IMAGE_MAX_BYTES, `${route}.requestImageMaxBytes`)
+    const providerReasoning = reasoningPreference(source.reasoning, `${route}.reasoning`)
     if (!Array.isArray(source.models) || source.models.length === 0) throw new Error(`${route}.models must not be empty`)
 
     const ids = new Set()
@@ -78,6 +117,35 @@ export function resolveEnterpriseProfiles(raw = {}) {
       if (ids.has(id)) throw new Error(`${route} declares duplicate model ${id}`)
       ids.add(id)
       const reasoning = model.reasoning !== false && model.reasoningEfforts !== false
+      const compat = {
+        supportsDeveloperRole: false,
+        supportsStore: false,
+        supportsReasoningEffort: reasoning,
+        supportsUsageInStreaming: true,
+        maxTokensField: 'max_tokens',
+        supportsStrictMode: false,
+        supportsLongCacheRetention: false,
+        thinkingFormat: 'deepseek',
+        requiresReasoningContentOnAssistantMessages: true,
+        ...(source.compat ?? {}),
+        ...(model.compat ?? {}),
+      }
+      const supportsReasoningEffort = reasoning && compat.supportsReasoningEffort !== false
+      const efforts = supportsReasoningEffort ? declaredReasoningEfforts(model.reasoningEfforts, reasoning) : []
+      if (model.defaultReasoningEffort !== undefined && !reasoningEfforts.has(model.defaultReasoningEffort)) {
+        throw new Error(`${route}.${id}.defaultReasoningEffort is not a supported reasoning effort`)
+      }
+      if (model.defaultReasoningEffort !== undefined && !efforts.includes(model.defaultReasoningEffort)) {
+        throw new Error(`${route}.${id}.defaultReasoningEffort must be one of the model's declared reasoningEfforts`)
+      }
+      const defaultReasoningEffort = supportsReasoningEffort
+        ? (model.defaultReasoningEffort ?? nearestReasoningEffort(providerReasoning, efforts))
+        : undefined
+      // PiAi uses an internal effort to enable thinking even when the gateway
+      // accepts no reasoning_effort field. Keep that default separate from UI choices.
+      const internalThinkingEffort = reasoning && !supportsReasoningEffort
+        ? nearestReasoningEffort(providerReasoning, declaredReasoningEfforts(model.reasoningEfforts, reasoning))
+        : undefined
       return {
         id,
         name: nonEmpty(model.name ?? id, `${route}.${id}.name`),
@@ -90,18 +158,10 @@ export function resolveEnterpriseProfiles(raw = {}) {
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
         contextWindow: positiveInteger(model.contextWindow, contextWindow, `${route}.${id}.contextWindow`),
         maxTokens: positiveInteger(model.maxTokens, maxTokens, `${route}.${id}.maxTokens`),
-        compat: {
-          supportsDeveloperRole: false,
-          supportsStore: false,
-          supportsReasoningEffort: reasoning,
-          supportsUsageInStreaming: true,
-          maxTokensField: 'max_tokens',
-          supportsStrictMode: false,
-          supportsLongCacheRetention: false,
-          thinkingFormat: 'deepseek',
-          requiresReasoningContentOnAssistantMessages: true,
-          ...(source.compat ?? {}),
-          ...(model.compat ?? {}),
+        compat,
+        modelPolicy: {
+          reasoning, supportsReasoningEffort, reasoningEfforts: efforts, defaultReasoningEffort,
+          ...(internalThinkingEffort === undefined ? {} : { internalThinkingEffort }),
         },
       }
     })
@@ -111,14 +171,15 @@ export function resolveEnterpriseProfiles(raw = {}) {
       displayName,
       baseURL,
       credentialRef,
-      reasoning: source.reasoning ?? 'high',
+      reasoning: providerReasoning,
       maxRequestImageBytes,
       requestImagePixelBudget,
       requestImageMaxBytes,
       streamIdleTimeoutMs: positiveInteger(source.streamIdleTimeoutMs, 300000, `${route}.streamIdleTimeoutMs`),
       retryPolicy: source.retryPolicy ?? ENTERPRISE_DEFAULT_RETRY_POLICY,
       configuredMaxTokens: new Map(models.map(model => [model.id, model.maxTokens])),
-      models,
+      modelPolicies: new Map(models.map(model => [model.id, model.modelPolicy])),
+      models: models.map(({ modelPolicy: _modelPolicy, ...model }) => model),
     }
   })
 }

package/lib/provider/index.js

@@ -1,5 +1,5 @@
 import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
-import { LlmError, assertUsableApiKey, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
+import { LlmError, assertUsableApiKey, resolveImageAttachmentAccess, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
 import { Config as PiAiConfig, PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
 import { createProvider } from '@earendil-works/pi-ai'
 import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy'
@@ -22,7 +22,13 @@ function installEnterpriseSettings(ctx, rawConfig, hooks) {
       SETTINGS_NAMESPACE,
       PiAiConfig,
       settingsBase(rawConfig),
-      hooks,
+      {
+        ...hooks,
+        validate(value) {
+          assertServiceableEnterpriseProviders(value)
+          hooks.validate?.(value)
+        },
+      },
     )
   })
 }
@@ -37,24 +43,24 @@ function apiKeyAuth(displayName) {
   }
 }
 
-function profilesFrom(rawConfig) {
+export function profilesFrom(rawConfig) {
   const profiles = new Map()
   for (const route of resolveEnterpriseProfiles(rawConfig)) {
     profiles.set(route.provider, {
       provider: route.provider,
       displayName: route.displayName,
       apiKeyEnv: route.credentialRef,
-      reasoning: route.reasoning,
       maxRequestImageBytes: route.maxRequestImageBytes,
       requestImagePixelBudget: route.requestImagePixelBudget,
       requestImageMaxBytes: route.requestImageMaxBytes,
       streamIdleTimeoutMs: route.streamIdleTimeoutMs,
       retryPolicy: resolveRetryPolicy(route.retryPolicy, `${name}: ${route.provider}.retryPolicy`),
       configuredMaxTokens: route.configuredMaxTokens,
-      modelPolicies: new Map(route.models.map(model => [model.id, {
-        reasoning: model.reasoning,
-        supportsReasoningEffort: model.compat.supportsReasoningEffort,
-      }])),
+      modelPolicies: route.modelPolicies,
+      // DSH 0.1.5-rc.1 reads per-model configuration errors before resolution.
+      // Our declarative profiles validate eagerly, so a successfully constructed
+      // provider has no deferred errors. Earlier adapters ignore this field.
+      modelErrors: new Map(),
       piProvider: createProvider({
         id: route.provider,
         name: route.displayName,
@@ -68,6 +74,10 @@ function profilesFrom(rawConfig) {
   return profiles
 }
 
+export function assertServiceableEnterpriseProviders(rawConfig) {
+  profilesFrom(rawConfig)
+}
+
 function isolatedPiAiAuth() {
   const stored = new Map()
   return {
@@ -89,50 +99,71 @@ function isolatedPiAiAuth() {
   }
 }
 
+export function resolveEnterpriseImageAccess(ctx, attachments, ref) {
+  return resolveImageAttachmentAccess(
+    attachments,
+    hostPath => ctx.get('fs')?.processPathFromHostPath(hostPath),
+    ref,
+  )
+}
+
 export function apply(ctx, rawConfig = {}) {
   const transforms = new EnterpriseModelTransforms(ctx)
   let current = () => settingsBase(rawConfig)
   let profiles = profilesFrom(current())
-  if (profiles.size === 0) return
 
   const baseAdapter = new PiAiAdapter({
     profiles: () => profiles,
     auth: isolatedPiAiAuth(),
     resolveApiKey: async (provider, profile) => {
+      if (await rawConfig.beforeResolveCredential?.(provider) === false) {
+        throw new LlmError(`${name}: organization sign-in is required for provider route "${provider}"`, 'MISSING_CREDENTIAL')
+      }
       const ref = profile.apiKeyEnv
       const credentials = ctx.get('credentials')
-      const hit = credentials === undefined
+      const hit = typeof rawConfig.resolveCredential === 'function'
+        ? (await rawConfig.resolveCredential(provider))?.value
+        : credentials === undefined
         ? launchEnvironmentOf(ctx).get(ref)?.value
         : (await credentials.resolve(ref))?.value
       if (typeof hit === 'string' && hit.length > 0) return assertUsableApiKey(hit, name, ref)
       throw new LlmError(`${name}: no credential for provider route "${provider}" (${ref})`, 'MISSING_CREDENTIAL')
     },
     resolveAttachments: () => ctx.get('attachments'),
+    resolveImageAccess: (attachments, ref) => resolveEnterpriseImageAccess(ctx, attachments, ref),
   })
 
   const adapter = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
     profiles.get(provider)?.modelPolicies.get(model) ?? { reasoning: true, supportsReasoningEffort: true }
   ))
-  const registration = ctx.llm.registerAdapter([...profiles.keys()], adapter)
-  let directory = ctx.llm.registerConfigurableProviders(configurableEntries(profiles))
-
-  if (rawConfig.settingsEnabled !== true) {
-    installEnterpriseSettings(ctx, rawConfig, { setSource() {}, onChange() {} })
-    return
-  }
-
-  const refresh = () => {
-    const next = profilesFrom(current())
+  let registration
+  let directory
+  const replaceProfiles = next => {
     const previous = profiles
     profiles = next
     try {
-      registration.replace([...next.keys()])
-      directory.replace(configurableEntries(next))
+      if (registration) registration.replace([...next.keys()])
+      else if (next.size) registration = ctx.llm.registerAdapter([...next.keys()], adapter)
+      if (directory) directory.replace(configurableEntries(next))
+      else if (next.size) directory = ctx.llm.registerConfigurableProviders(configurableEntries(next))
     } catch (error) {
       profiles = previous
+      registration?.replace([...previous.keys()])
       throw error
     }
   }
+  if (profiles.size) replaceProfiles(profiles)
+  const controller = { replaceConfig(config) { replaceProfiles(profilesFrom(config)) } }
+
+  if (rawConfig.settingsEnabled !== true) {
+    installEnterpriseSettings(ctx, rawConfig, { setSource() {}, onChange() {} })
+    return controller
+  }
+
+  const refresh = () => {
+    const next = profilesFrom(current())
+    replaceProfiles(next)
+  }
 
   installEnterpriseSettings(ctx, rawConfig, {
     setSource(source) { current = source },
@@ -144,6 +175,7 @@ export function apply(ctx, rawConfig = {}) {
       }
     },
   })
+  return controller
 }
 
 export { resolveEnterpriseProfiles } from './core.js'

package/lib/provider/transform-adapter.js

@@ -1,3 +1,5 @@
+import { LlmError } from '@deepseek-ai/dsh-llm'
+
 /** Delegate one enterprise route while applying capabilities contributed by replaceable feature plugins. */
 export class TransformingEnterpriseAdapter {
   constructor(inner, transforms, modelPolicy = () => ({})) {
@@ -8,6 +10,7 @@ export class TransformingEnterpriseAdapter {
 
   providerInfo(provider) { return this.inner.providerInfo(provider) }
   providerRetryPolicy(provider) { return this.inner.providerRetryPolicy(provider) }
+  imageRequestPricing(provider, model) { return this.inner.imageRequestPricing(provider, model) }
 
   async listModels(provider) {
     const models = await this.inner.listModels(provider)
@@ -18,48 +21,66 @@ export class TransformingEnterpriseAdapter {
   }
 
   async resolveModel(provider, model, signal) {
-    return this.decorateModel(provider, model, await this.inner.resolveModel(provider, model, signal))
+    const policy = this.modelPolicy(provider, model)
+    return this.decorateModel(provider, model, await this.inner.resolveModel(provider, model, signal), policy)
   }
 
-  decorateModel(provider, model, resolved) {
+  decorateModel(provider, model, resolved, policy = this.modelPolicy(provider, model)) {
     const decorated = {
       ...resolved,
       inputModalities: this.transforms.capabilities(provider, model, resolved.inputModalities),
     }
-    const policy = this.modelPolicy(provider, model)
-    if (policy.reasoning === false || policy.supportsReasoningEffort !== false) return decorated
+    if (policy.reasoning !== false && policy.supportsReasoningEffort !== false && Array.isArray(policy.reasoningEfforts)) {
+      return {
+        ...decorated,
+        reasoning: {
+          efforts: policy.reasoningEfforts.map(id => ({ id, name: `${id.charAt(0).toUpperCase()}${id.slice(1)}` })),
+          defaultEffort: policy.defaultReasoningEffort,
+        },
+      }
+    }
     const { reasoning: _unsupportedReasoningEfforts, ...thinkingOnly } = decorated
     return thinkingOnly
   }
 
   async prepareCall(provider, model, signal) {
+    const policy = this.modelPolicy(provider, model)
     const prepared = typeof this.inner.prepareCall === 'function'
       ? await this.inner.prepareCall(provider, model, signal)
       : { model: await this.inner.resolveModel(provider, model, signal), stream: options => this.inner.stream(options) }
     return {
-      model: this.decorateModel(provider, model, prepared.model),
-      stream: options => this.streamPrepared(options, prepared),
+      model: this.decorateModel(provider, model, prepared.model, policy),
+      stream: options => this.streamPrepared(options, prepared, policy),
     }
   }
 
-  async * streamPrepared(options, prepared) {
+  async * streamPrepared(options, prepared, policy = this.modelPolicy(options.provider, options.model)) {
     const nativeModelInfo = prepared.model
     let request = options
-    const policy = this.modelPolicy(options.provider, options.model)
     if (policy.reasoning === false) {
       request = { ...options, reasoningEffort: 'off' }
     } else if (policy.supportsReasoningEffort === false) {
       const { reasoningEffort: _unsupportedReasoningEffort, ...withoutEffort } = options
-      request = withoutEffort
+      // This enables the model's configured thinking mode inside PiAi;
+      // compat.supportsReasoningEffort=false suppresses the HTTP effort field.
+      request = policy.internalThinkingEffort === undefined
+        ? withoutEffort
+        : { ...withoutEffort, reasoningEffort: policy.internalThinkingEffort }
+    } else if (Array.isArray(policy.reasoningEfforts)) {
+      const effort = options.reasoningEffort ?? policy.defaultReasoningEffort
+      if (!policy.reasoningEfforts.includes(effort)) {
+        throw new LlmError(`enterprise model "${options.provider}/${options.model}" does not support reasoning effort "${String(effort)}"`, 'UNSUPPORTED_REASONING_EFFORT')
+      }
+      request = { ...options, reasoningEffort: effort }
     }
     yield* prepared.stream(await this.transforms.apply(request, nativeModelInfo))
   }
 
   async * stream(options) {
+    const policy = this.modelPolicy(options.provider, options.model)
     const prepared = typeof this.inner.prepareCall === 'function'
       ? await this.inner.prepareCall(options.provider, options.model, options.signal)
       : { model: await this.inner.resolveModel(options.provider, options.model, options.signal), stream: request => this.inner.stream(request) }
-    yield* this.streamPrepared(options, prepared)
+    yield* this.streamPrepared(options, prepared, policy)
   }
 }
-