@eduwork/dsh-oidc 0.1.0-alpha.11 → 0.2.0

package/lib/resources.js

@@ -0,0 +1,23 @@
+import { normalizeModels } from './profile.js'
+
+// The public resource contract extends the deployed worker wire protocol. OIDC
+// access tokens remain on the management plane; these calls use the model key.
+export function normalizeResourceModels(raw, profile) {
+  if (!Array.isArray(raw?.data) || raw.data.length > 128) throw new Error('invalid model catalog')
+  const reviewed = new Map(profile.provider.models.map(model => [model.id, model]))
+  const models = raw.data.map(row => {
+    const id = typeof row?.id === 'string' ? row.id.trim() : ''
+    // A plain /models response does not prove reasoning or vision support.
+    return reviewed.get(id) ?? { id, name: id, input: ['text'], reasoning: false }
+  })
+  return normalizeModels(models, profile.provider.id)
+}
+
+export function emptyResources(profile) {
+  return {
+    profileID: profile.id,
+    modelSource: profile.provider?.modelSource ?? 'none',
+    models: profile.provider?.models ?? [],
+    issues: [],
+  }
+}

package/lib/typert-schemas.js

@@ -2,9 +2,20 @@ import { z } from 'zod'
 
 const pkg = '@eduwork/dsh-oidc'
 export const profileIdSchema = z.string().min(1).max(64)
+export const loginIdSchema = z.string().regex(/^[A-Za-z0-9_-]{32}$/)
 export const reconcileOptionsSchema = z.object({ allowProvision: z.boolean().optional() }).strict()
 export const baseURLSchema = z.string().min(1).max(2048)
 export const modelCatalogModeSchema = z.enum(['discovery', 'manual'])
+export const configurationTargetSchema = z.enum(['config', 'examples'])
+export const openConfigurationResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#OpenConfigurationResult`,
+  schema: z.object({ opened: z.literal(true) }).strict(),
+})
+export const enterpriseSelectionResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#EnterpriseSelectionResult`,
+  schema: z.object({ changed: z.boolean(), selection: z.object({ provider: z.string(), model: z.string(), reasoningEffort: z.string().optional() }).strict().optional() }).strict(),
+})
+export const enterpriseSelectionOptionsSchema = z.object({ onlyIfMissing: z.boolean().optional() }).strict()
 
 const brandSchema = z.object({
   productName: z.string().optional(), organizationName: z.string().optional(), mark: z.string().optional(),
@@ -18,7 +29,7 @@ const publicProfileSchema = z.object({
   provider: z.object({
     id: z.string(), displayName: z.string(),
     models: z.array(z.object({ id: z.string(), name: z.string(), input: z.array(z.enum(['text', 'image'])) }).strict()),
-  }).strict(),
+  }).strict().optional(),
 }).strict()
 
 const accountSchema = z.object({
@@ -33,12 +44,20 @@ export const runtimeModelSchema = z.object({
   upstreamModelID: z.string().max(256).optional(), contextWindow: z.number().int().positive().optional(),
   maxTokens: z.number().int().positive().optional(),
   input: z.array(z.enum(['text', 'image', 'audio', 'video'])).optional(),
-  reasoning: z.boolean().optional(), reasoningEfforts: z.record(z.string(), z.string().nullable()).optional(),
+  reasoning: z.boolean().optional(), reasoningEfforts: z.union([z.literal(false), z.record(z.string(), z.string().nullable())]).optional(),
+  defaultReasoningEffort: z.enum(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']).optional(),
   compat: z.record(z.string(), z.unknown()).optional(),
 }).strict()
 
 export const runtimeModelsSchema = z.array(runtimeModelSchema).max(128)
 
+export const resourcesResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#Resources`,
+  schema: z.object({
+    profileID: z.string(), modelSource: z.string(), models: runtimeModelsSchema, issues: z.array(z.string()),
+  }).strict(),
+})
+
 const managementProfileSchema = z.object({
   id: z.string(), displayName: z.string(), organization: z.string(), baseURL: z.string(),
   builtIn: z.boolean(), configured: z.boolean(), enabled: z.boolean(), providerID: z.string(),
@@ -51,7 +70,9 @@ const managementProfileSchema = z.object({
 
 export const configurationResult = Object.freeze({
   mode: 'strict', typeSymbol: `${pkg}#Configuration`,
-  schema: z.object({ schemaVersion: z.literal('dsh-oidc/v1alpha1'), uiMode: z.enum(['standard', 'models-only', 'external']), profiles: z.array(publicProfileSchema) }).strict(),
+  schema: z.object({ schemaVersion: z.literal('dsh-oidc/v1alpha1'), uiMode: z.enum(['standard', 'models-only', 'external']), profiles: z.array(publicProfileSchema),
+    manageProductBrand: z.boolean().optional(), configFile: z.object({ path: z.string(), examplesPath: z.string(), canOpen: z.boolean() }).strict().optional(),
+  }).strict(),
 })
 
 export const managementResult = Object.freeze({
@@ -76,9 +97,19 @@ export const beginResult = Object.freeze({
   schema: z.union([
     z.object({ mode: z.literal('redirect'), authorizationURL: z.string().url() }).strict(),
     z.object({ mode: z.literal('completed'), status: accountSchema }).strict(),
+    z.object({ mode: z.literal('external'), loginID: loginIdSchema, expiresAt: z.string().datetime() }).strict(),
   ]),
 })
 
+export const loginResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#LoginResult`,
+  schema: z.object({
+    loginID: loginIdSchema, profileID: profileIdSchema, expiresAt: z.string().datetime(),
+    state: z.enum(['pending', 'completed', 'cancelled', 'expired', 'failed']),
+    status: accountSchema.optional(), errorCode: z.string().optional(),
+  }).strict(),
+})
+
 export function jsonParameter(name, schema, typeSymbol) {
   return Object.freeze({ name, wire: name, source: 'json', codec: Object.freeze({ mode: 'strict', typeSymbol, schema }) })
 }

package/lib/typert.host.js

@@ -1,38 +1,44 @@
-import {
-  accountResult, baseURLSchema, beginResult, configurationResult, jsonParameter, managementResult,
-  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT = {
-  package: pkg, face: 'host', schemas: [],
-  invocations: [
+import {
+  accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
+  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT = {
+  package: pkg, face: 'host', schemas: [],
+  invocations: [
     descriptor('configuration', [], configurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('begin', [profile()], beginResult),
+    descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-  model: { services: [], events: [], objects: [] },
-}
-
-export default TYPERT
+    descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+  model: { services: [], events: [], objects: [] },
+}
+
+export default TYPERT

package/lib/typert.remote-client.js

@@ -1,37 +1,43 @@
-import {
-  accountResult, baseURLSchema, beginResult, configurationResult, jsonParameter, managementResult,
-  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT_REMOTE = {
-  package: pkg,
-  descriptors: [
+import {
+  accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
+  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT_REMOTE = {
+  package: pkg,
+  descriptors: [
     descriptor('configuration', [], configurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('begin', [profile()], beginResult),
+    descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-}
-
-export default TYPERT_REMOTE
+    descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+}
+
+export default TYPERT_REMOTE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.1.0-alpha.11",
+  "version": "0.2.0",
   "description": "Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
@@ -31,8 +31,21 @@
     "examples/**/*.json",
     "schema/**/*.json",
     "protocol/openapi.yaml",
+    "protocol/resources.openapi.yaml",
     "README.md",
     "README.en.md",
+    "CODE_OF_CONDUCT.md",
+    "CODE_OF_CONDUCT.en.md",
+    "CONTRIBUTING.md",
+    "CONTRIBUTING.en.md",
+    "GOVERNANCE.md",
+    "GOVERNANCE.en.md",
+    "MAINTAINERS.md",
+    "MAINTAINERS.en.md",
+    "SECURITY.md",
+    "SECURITY.en.md",
+    "SUPPORT.md",
+    "SUPPORT.en.md",
     "LICENSE",
     "THIRD_PARTY_NOTICES.md",
     "THIRD_PARTY_NOTICES.en.md",
@@ -49,6 +62,7 @@
         "@deepseek-ai/dsh-api-remotes",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-settings-general",
         "@deepseek-ai/dsh-client-ui-settings-models",
         "@deepseek-ai/dsh-client-ui-sidebar",
         "@deepseek-ai/dsh-client-ui-theme"
@@ -62,22 +76,24 @@
     "build:client": "tsdown",
     "build": "npm run build:host && npm run build:client",
     "typecheck": "tsc --noEmit",
-    "test": "node --test",
-    "test:coverage": "node --test --experimental-test-coverage",
+    "test": "node --test \"test/*.test.js\"",
+    "test:coverage": "node --test --experimental-test-coverage \"test/*.test.js\"",
     "check:schemas": "node scripts/check-schemas.mjs",
     "check:secrets": "node scripts/check-secrets.mjs",
     "check:licenses": "node scripts/check-licenses.mjs",
     "check:docs": "node scripts/check-doc-links.mjs",
+    "check:dsh": "npm run check:lock && node scripts/check-dsh-rc1.mjs",
     "check:build": "node scripts/smoke-build.mjs",
-    "check": "npm run typecheck && npm run build && npm run check:build && npm test && npm run check:schemas && npm run check:docs && npm run check:secrets && npm run check:licenses && npm pack --dry-run",
-    "prepare": "npm run build"
+    "check": "npm run typecheck && npm run check:dsh && npm run build && npm run check:build && npm test && npm run check:schemas && npm run check:docs && npm run check:secrets && npm run check:licenses && npm pack --dry-run",
+    "prepare": "npm run build",
+    "check:browser": "node scripts/check-account-menu-browser.mjs",
+    "check:lock": "node scripts/check-dependency-lock.mjs"
   },
   "engines": {
     "node": ">=22.0.0"
   },
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   },
   "repository": {
     "type": "git",
@@ -93,26 +109,104 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-theme": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-credentials": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-launch-environment": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-settings": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.2-alpha.2",
-    "@earendil-works/pi-ai": "^0.84.2",
-    "react": "^18.2.0"
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-theme": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@earendil-works/pi-ai": "^0.84.2 || ^0.85.1",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-gateway": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-chunked-list": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-file-upload": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-theme": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-deque": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-file-reference": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-jobs": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-native-command": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-query": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-title": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage-domain": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-todo": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-crypto": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-time": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-workspace": "0.1.5-rc.1",
+    "@earendil-works/pi-ai": "0.85.1",
     "@types/react": "^18.3.28",
+    "@types/react-dom": "^18.3.7",
     "ajv": "^8.17.1",
+    "playwright-core": "1.63.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
     "tsdown": "0.22.14",
     "typescript": "^5.9.3",
     "yaml": "^2.8.1"

package/protocol/openapi.yaml

@@ -123,8 +123,8 @@ components:
       properties:
         protocol_version:
           type: string
-          const: worker-user-center/v1
-          description: Optional during v1 adoption; if present it MUST equal this value.
+          enum: [worker.user-center.v1, worker-user-center/v1, eduwork-resources/v1]
+          description: Optional during v1 adoption; all three version labels share the deployed credential lifecycle wire.
         subject:
           $ref: '#/components/schemas/InformationalSubject'
         provider:

package/protocol/resources.openapi.yaml

@@ -0,0 +1,51 @@
+openapi: 3.1.0
+info:
+  title: EduWork Identity and Resource Protocol
+  version: 1.0.0
+  description: >-
+    Optional resource integration for a local single-user OIDC client.
+    Management uses worker-user-center-v1 bootstrap and credential operations. Quota and activity heartbeat are institution extensions, absent from this contract.
+    Model discovery uses the resulting runtime API key, never the
+    identity token. Pure OIDC deployments may omit resource integration.
+  license: { name: MIT, identifier: MIT }
+servers:
+  - url: https://ai.example.edu/open/api/v1
+security:
+  - runtimeKey: []
+paths:
+  /models:
+    get:
+      operationId: listResourceModels
+      responses:
+        '200':
+          description: Available model identifiers; reviewed capabilities remain in the client Profile
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [data]
+                properties:
+                  data:
+                    type: array
+                    minItems: 1
+                    maxItems: 128
+                    items:
+                      type: object
+                      required: [id]
+                      properties:
+                        id: { type: string, minLength: 1, maxLength: 256 }
+        '401': { description: Runtime key is invalid or expired }
+        '403': { description: Model discovery is not permitted; keep the reviewed catalog }
+        '404': { description: Discovery not supported; client keeps reviewed model catalog }
+        '429': { $ref: '#/components/responses/RateLimited' }
+        '5XX': { $ref: '#/components/responses/Unavailable' }
+components:
+  responses:
+    RateLimited:
+      description: Temporarily limited; current client reports unavailable and allows a later manual refresh
+      headers:
+        Retry-After: { schema: { type: string }, description: Seconds or HTTP date for a future retry; never a refresh-token grant }
+    Unavailable:
+      description: Temporary resource failure; do not clear identity or the model key
+  securitySchemes:
+    runtimeKey: { type: http, scheme: bearer, description: Model runtime credential }