@eduwork/dsh-oidc 0.1.0-alpha.11

package/lib/profile.js

@@ -0,0 +1,371 @@
+import { readFileSync } from 'node:fs'
+
+export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
+const MAX_PROFILE_BYTES = 512 * 1024
+const idPattern = /^[a-z][a-z0-9-]{0,63}$/
+const credentialPattern = /^[A-Za-z_][A-Za-z0-9_]*$/
+const colorPattern = /^#[0-9a-fA-F]{6}$/
+const allowedModalities = new Set(['text', 'image'])
+const allowedRootKeys = new Set([
+  'schemaVersion', 'id', 'displayName', 'organization', 'nativeInstitutionID',
+  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'keyBinding', 'provider',
+])
+const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
+const allowedKeyBindingKeys = new Set(['baseURL', 'credentialRef'])
+const allowedBrandKeys = new Set([
+  'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
+  'loginTitle', 'loginDescription', 'supportURL',
+])
+const allowedProviderKeys = new Set([
+  'id', 'displayName', 'adapter', 'baseURL', 'reasoning', 'defaultContextWindow',
+  'defaultMaxTokens', 'maxRequestImageBytes', 'requestImagePixelBudget',
+  'requestImageMaxBytes', 'streamIdleTimeoutMs', 'retryPolicy', 'compat', 'models',
+])
+const allowedModelKeys = new Set([
+  'id', 'name', 'input', 'contextWindow', 'maxTokens', 'reasoning',
+  'reasoningEfforts', 'compat',
+])
+const allowedCompatKeys = new Set([
+  'supportsDeveloperRole', 'supportsStore', 'supportsReasoningEffort',
+  'supportsUsageInStreaming', 'maxTokensField', 'supportsStrictMode',
+  'supportsLongCacheRetention', 'thinkingFormat',
+  'requiresReasoningContentOnAssistantMessages',
+])
+
+function object(value, label) {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`)
+  return value
+}
+
+function exactKeys(value, allowed, label) {
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not allowed`)
+}
+
+function text(value, label, max = 2048) {
+  if (typeof value !== 'string' || value.trim() === '' || value !== value.trim() || value.length > max) {
+    throw new Error(`${label} must be a non-empty trimmed string no longer than ${max} characters`)
+  }
+  return value
+}
+
+function isLoopback(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
+}
+
+function insecureDevelopmentOrigin(value, label) {
+  const raw = text(value, label)
+  const parsed = new URL(raw)
+  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.search || parsed.hash || (parsed.pathname !== '/' && parsed.pathname !== '')) {
+    throw new Error(`${label} must be an exact HTTP origin without credentials, path, query, or fragment`)
+  }
+  return raw.replace(/\/+$/, '')
+}
+
+function endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin) {
+  return parsed.protocol === 'https:' || (allowInsecure && parsed.protocol === 'http:' && (
+    isLoopback(parsed.hostname) || parsed.origin === allowedInsecureOrigin
+  ))
+}
+
+function issuerURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
+  const raw = text(value, label)
+  const parsed = new URL(raw)
+  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  if (!permitted || parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+  }
+  return raw
+}
+
+function exactURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
+  const raw = text(value, label)
+  const parsed = new URL(raw)
+  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  if (!permitted || parsed.username || parsed.password || parsed.hash || parsed.search) {
+    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+  }
+  return raw.replace(/\/+$/, '')
+}
+
+function safeHTTPSResource(value, label, max) {
+  const raw = text(value, label, max)
+  const parsed = new URL(raw)
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash) {
+    throw new Error(`${label} must be an HTTPS URL without credentials or fragment`)
+  }
+  return raw
+}
+
+function positiveInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`)
+  return value
+}
+
+function optionalPositiveInteger(value, label) {
+  return value === undefined ? undefined : positiveInteger(value, label)
+}
+
+function boolean(value, label) {
+  if (typeof value !== 'boolean') throw new Error(`${label} must be a boolean`)
+  return value
+}
+
+function normalizeBrand(value = {}) {
+  const source = object(value, 'brand')
+  exactKeys(source, allowedBrandKeys, 'brand')
+  const result = {}
+  if (source.productName !== undefined) result.productName = text(source.productName, 'brand.productName', 80)
+  if (source.organizationName !== undefined) result.organizationName = text(source.organizationName, 'brand.organizationName', 120)
+  if (source.mark !== undefined) result.mark = text(source.mark, 'brand.mark', 4)
+  if (source.primaryColor !== undefined) {
+    if (typeof source.primaryColor !== 'string' || !colorPattern.test(source.primaryColor)) throw new Error('brand.primaryColor must be a six-digit hex color')
+    result.primaryColor = source.primaryColor.toLowerCase()
+  }
+  if (source.logoURL !== undefined) {
+    const logo = text(source.logoURL, 'brand.logoURL', 128 * 1024)
+    if (!/^https:\/\//.test(logo) && !/^data:image\/(?:png|webp);base64,[A-Za-z0-9+/]+=*$/.test(logo)) {
+      throw new Error('brand.logoURL must be HTTPS or a base64 PNG/WebP data URL')
+    }
+    result.logoURL = logo.startsWith('https://') ? safeHTTPSResource(logo, 'brand.logoURL', 128 * 1024) : logo
+  }
+  for (const key of ['loginTitle', 'loginDescription']) {
+    if (source[key] !== undefined) result[key] = text(source[key], `brand.${key}`, key === 'loginTitle' ? 120 : 500)
+  }
+  if (source.supportURL !== undefined) result.supportURL = exactURL(source.supportURL, 'brand.supportURL')
+  return Object.freeze(result)
+}
+
+function normalizeCompat(value, label) {
+  const source = object(value, label)
+  exactKeys(source, allowedCompatKeys, label)
+  const result = {}
+  for (const key of allowedCompatKeys) {
+    if (source[key] === undefined) continue
+    result[key] = key === 'maxTokensField' || key === 'thinkingFormat'
+      ? text(source[key], `${label}.${key}`, 64)
+      : boolean(source[key], `${label}.${key}`)
+  }
+  return Object.freeze(result)
+}
+
+function normalizeReasoningEfforts(value, providerID, modelID) {
+  if (value === false) return false
+  const source = object(value, `${providerID}.${modelID}.reasoningEfforts`)
+  if (Object.keys(source).length === 0 || Object.keys(source).length > 16) throw new Error(`${providerID}.${modelID}.reasoningEfforts must contain 1-16 entries`)
+  return Object.freeze(Object.fromEntries(Object.entries(source).map(([level, wire]) => {
+    text(level, `${providerID}.${modelID}.reasoningEfforts level`, 32)
+    if (wire !== null) text(wire, `${providerID}.${modelID}.reasoningEfforts.${level}`, 32)
+    return [level, wire]
+  })))
+}
+
+function normalizeModels(models, providerID) {
+  if (!Array.isArray(models) || models.length === 0 || models.length > 128) throw new Error(`${providerID}.models must contain 1-128 entries`)
+  const seen = new Set()
+  return Object.freeze(models.map((raw, index) => {
+    const label = `${providerID}.models[${index}]`
+    const model = object(raw, label)
+    exactKeys(model, allowedModelKeys, label)
+    const id = text(model.id, `${label}.id`, 256)
+    if (seen.has(id)) throw new Error(`${providerID} repeats model ${id}`)
+    seen.add(id)
+    const input = model.input ?? ['text']
+    if (!Array.isArray(input) || input.length === 0 || input.some(value => !allowedModalities.has(value))) {
+      throw new Error(`${providerID}.${id}.input must contain text and/or image`)
+    }
+    if (new Set(input).size !== input.length) throw new Error(`${providerID}.${id}.input contains duplicates`)
+    return Object.freeze({
+      id,
+      name: model.name === undefined ? id : text(model.name, `${providerID}.${id}.name`, 256),
+      input: Object.freeze([...new Set(input)]),
+      ...(model.contextWindow === undefined ? {} : { contextWindow: positiveInteger(model.contextWindow, `${providerID}.${id}.contextWindow`) }),
+      ...(model.maxTokens === undefined ? {} : { maxTokens: positiveInteger(model.maxTokens, `${providerID}.${id}.maxTokens`) }),
+      ...(model.reasoning === undefined ? {} : { reasoning: boolean(model.reasoning, `${providerID}.${id}.reasoning`) }),
+      ...(model.reasoningEfforts === undefined ? {} : { reasoningEfforts: normalizeReasoningEfforts(model.reasoningEfforts, providerID, id) }),
+      ...(model.compat === undefined ? {} : { compat: normalizeCompat(model.compat, `${providerID}.${id}.compat`) }),
+    })
+  }))
+}
+
+function providerCredentialRef(providerID) {
+  return `${providerID.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`
+}
+
+function normalizeRetryPolicy(value) {
+  const source = object(value, 'profile.provider.retryPolicy')
+  exactKeys(source, new Set(['mode', 'maxRetries', 'retryableCodes', 'backoff']), 'profile.provider.retryPolicy')
+  if (!['normal', 'always'].includes(source.mode)) throw new Error('profile.provider.retryPolicy.mode must be normal or always')
+  if (source.maxRetries !== undefined && (!Number.isSafeInteger(source.maxRetries) || source.maxRetries < 0)) {
+    throw new Error('profile.provider.retryPolicy.maxRetries must be a non-negative safe integer')
+  }
+  if (source.retryableCodes !== undefined) {
+    if (!Array.isArray(source.retryableCodes) || source.retryableCodes.length === 0 || source.retryableCodes.length > 64
+      || source.retryableCodes.some(code => typeof code !== 'string' || code === '' || code.length > 128)
+      || new Set(source.retryableCodes).size !== source.retryableCodes.length) {
+      throw new Error('profile.provider.retryPolicy.retryableCodes must contain 1-64 unique non-empty strings')
+    }
+  }
+  let backoff
+  if (source.backoff !== undefined) {
+    const raw = object(source.backoff, 'profile.provider.retryPolicy.backoff')
+    exactKeys(raw, new Set(['initialDelayMs', 'maxDelayMs', 'jitterRatio']), 'profile.provider.retryPolicy.backoff')
+    for (const key of ['initialDelayMs', 'maxDelayMs']) {
+      if (raw[key] !== undefined && (!Number.isFinite(raw[key]) || raw[key] <= 0 || raw[key] > 2147483647)) {
+        throw new Error(`profile.provider.retryPolicy.backoff.${key} is invalid`)
+      }
+    }
+    if (raw.jitterRatio !== undefined && (!Number.isFinite(raw.jitterRatio) || raw.jitterRatio < 0 || raw.jitterRatio > 1)) {
+      throw new Error('profile.provider.retryPolicy.backoff.jitterRatio must be between 0 and 1')
+    }
+    if (raw.initialDelayMs !== undefined && raw.maxDelayMs !== undefined && raw.initialDelayMs > raw.maxDelayMs) {
+      throw new Error('profile.provider.retryPolicy.backoff.initialDelayMs must not exceed maxDelayMs')
+    }
+    backoff = Object.freeze({ ...raw })
+  }
+  return Object.freeze({
+    mode: source.mode,
+    ...(source.maxRetries === undefined ? {} : { maxRetries: source.maxRetries }),
+    ...(source.retryableCodes === undefined ? {} : { retryableCodes: Object.freeze([...source.retryableCodes]) }),
+    ...(backoff === undefined ? {} : { backoff }),
+  })
+}
+
+function boundedProfile(raw) {
+  let encoded
+  try { encoded = JSON.stringify(raw) }
+  catch (cause) { throw new Error('enterprise profile must be JSON-serializable', { cause }) }
+  if (Buffer.byteLength(encoded, 'utf8') > MAX_PROFILE_BYTES) throw new Error(`enterprise profile exceeds ${MAX_PROFILE_BYTES} bytes`)
+}
+
+export function normalizeEnterpriseProfile(raw) {
+  boundedProfile(raw)
+  const source = object(raw, 'enterprise profile')
+  exactKeys(source, allowedRootKeys, 'profile')
+  if (source.schemaVersion !== PROFILE_SCHEMA_VERSION) throw new Error(`unsupported enterprise profile schemaVersion ${String(source.schemaVersion)}`)
+  const id = text(source.id, 'profile.id', 64)
+  if (!idPattern.test(id)) throw new Error('profile.id is invalid')
+  const allowInsecureDevelopment = source.allowInsecureDevelopment === true
+  const allowedInsecureOrigin = source.insecureDevelopmentOrigin === undefined
+    ? undefined
+    : insecureDevelopmentOrigin(source.insecureDevelopmentOrigin, 'profile.insecureDevelopmentOrigin')
+  if (allowedInsecureOrigin !== undefined && !allowInsecureDevelopment) {
+    throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
+  }
+  const oidc = object(source.oidc, 'profile.oidc')
+  const keyBinding = object(source.keyBinding, 'profile.keyBinding')
+  const provider = object(source.provider, 'profile.provider')
+  exactKeys(oidc, allowedOidcKeys, 'profile.oidc')
+  exactKeys(keyBinding, allowedKeyBindingKeys, 'profile.keyBinding')
+  exactKeys(provider, allowedProviderKeys, 'profile.provider')
+  const providerID = text(provider.id, 'profile.provider.id', 64)
+  if (!idPattern.test(providerID)) throw new Error('profile.provider.id is invalid')
+  const credentialRef = keyBinding.credentialRef === undefined
+    ? providerCredentialRef(providerID)
+    : text(keyBinding.credentialRef, 'profile.keyBinding.credentialRef', 128)
+  if (!credentialPattern.test(credentialRef)) {
+    throw new Error('profile.keyBinding.credentialRef must be a valid DSH credential reference')
+  }
+  if (provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
+  const scopes = oidc.scopes
+  if (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope))) {
+    throw new Error('profile.oidc.scopes must contain openid and profile; every scope must be a non-empty token')
+  }
+  if (new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
+  return Object.freeze({
+    schemaVersion: PROFILE_SCHEMA_VERSION,
+    id,
+    displayName: text(source.displayName, 'profile.displayName', 120),
+    organization: text(source.organization ?? source.displayName, 'profile.organization', 120),
+    allowInsecureDevelopment,
+    ...(allowedInsecureOrigin === undefined ? {} : { insecureDevelopmentOrigin: allowedInsecureOrigin }),
+    nativeInstitutionID: source.nativeInstitutionID === undefined ? id : text(source.nativeInstitutionID, 'profile.nativeInstitutionID', 64),
+    brand: normalizeBrand(source.brand),
+    oidc: Object.freeze({
+      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment, allowedInsecureOrigin),
+      clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
+      scopes: Object.freeze([...scopes]),
+    }),
+    keyBinding: Object.freeze({
+      type: 'worker-user-center-v1',
+      baseURL: exactURL(keyBinding.baseURL, 'profile.keyBinding.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
+      providerId: providerID,
+      credentialRef,
+    }),
+    provider: Object.freeze({
+      id: providerID,
+      displayName: text(provider.displayName ?? source.displayName, 'profile.provider.displayName', 120),
+      adapter: provider.adapter,
+      baseURL: exactURL(provider.baseURL, 'profile.provider.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
+      reasoning: provider.reasoning === undefined ? 'high' : text(provider.reasoning, 'profile.provider.reasoning', 32),
+      defaultContextWindow: optionalPositiveInteger(provider.defaultContextWindow, 'profile.provider.defaultContextWindow'),
+      defaultMaxTokens: optionalPositiveInteger(provider.defaultMaxTokens, 'profile.provider.defaultMaxTokens'),
+      maxRequestImageBytes: optionalPositiveInteger(provider.maxRequestImageBytes, 'profile.provider.maxRequestImageBytes'),
+      requestImagePixelBudget: optionalPositiveInteger(provider.requestImagePixelBudget, 'profile.provider.requestImagePixelBudget'),
+      requestImageMaxBytes: optionalPositiveInteger(provider.requestImageMaxBytes, 'profile.provider.requestImageMaxBytes'),
+      streamIdleTimeoutMs: optionalPositiveInteger(provider.streamIdleTimeoutMs, 'profile.provider.streamIdleTimeoutMs'),
+      retryPolicy: provider.retryPolicy === undefined ? undefined : normalizeRetryPolicy(provider.retryPolicy),
+      compat: provider.compat === undefined ? undefined : normalizeCompat(provider.compat, 'profile.provider.compat'),
+      models: normalizeModels(provider.models, providerID),
+    }),
+  })
+}
+
+export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
+  const profiles = []
+  if (raw.profile !== undefined) profiles.push(normalizeEnterpriseProfile(raw.profile))
+  if (raw.profiles !== undefined) {
+    if (!Array.isArray(raw.profiles)) throw new Error('dsh-oidc profiles must be an array')
+    profiles.push(...raw.profiles.map(normalizeEnterpriseProfile))
+  }
+  if (typeof raw.profilePathEnv === 'string' && environment[raw.profilePathEnv]) {
+    const parsed = JSON.parse(readFileSync(environment[raw.profilePathEnv], 'utf8'))
+    const rows = Array.isArray(parsed) ? parsed : parsed.profiles ?? [parsed]
+    profiles.push(...rows.map(normalizeEnterpriseProfile))
+  }
+  const unique = new Map()
+  const providers = new Set()
+  for (const profile of profiles) {
+    if (unique.has(profile.id)) throw new Error(`dsh-oidc repeats profile ${profile.id}`)
+    if (providers.has(profile.provider.id)) throw new Error(`dsh-oidc repeats provider route ${profile.provider.id}`)
+    unique.set(profile.id, profile)
+    providers.add(profile.provider.id)
+  }
+  return unique
+}
+
+export function enterpriseProviderConfig(profiles) {
+  return {
+    providers: Object.fromEntries([...profiles.values()].map(profile => [profile.provider.id, {
+      displayName: profile.provider.displayName,
+      apiKeyEnv: profile.keyBinding.credentialRef,
+      baseURL: profile.provider.baseURL,
+      allowInsecureDevelopment: profile.allowInsecureDevelopment,
+      ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
+      reasoning: profile.provider.reasoning,
+      defaultContextWindow: profile.provider.defaultContextWindow,
+      defaultMaxTokens: profile.provider.defaultMaxTokens,
+      maxRequestImageBytes: profile.provider.maxRequestImageBytes,
+      requestImagePixelBudget: profile.provider.requestImagePixelBudget,
+      requestImageMaxBytes: profile.provider.requestImageMaxBytes,
+      streamIdleTimeoutMs: profile.provider.streamIdleTimeoutMs,
+      retryPolicy: profile.provider.retryPolicy,
+      compat: profile.provider.compat,
+      models: profile.provider.models,
+    }])),
+  }
+}
+
+export function publicProfile(profile) {
+  return {
+    id: profile.id,
+    displayName: profile.displayName,
+    organization: profile.organization,
+    brand: profile.brand,
+    credentialRef: profile.keyBinding.credentialRef,
+    provider: {
+      id: profile.provider.id,
+      displayName: profile.provider.displayName,
+      models: profile.provider.models.map(model => ({ id: model.id, name: model.name, input: model.input })),
+    },
+  }
+}

package/lib/provider/core.js

@@ -0,0 +1,138 @@
+const modalities = new Set(['text', 'image'])
+export const ENTERPRISE_SETTINGS_NAMESPACE = 'provider-enterprise'
+export const ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024
+export const ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048
+export const ENTERPRISE_DEFAULT_REQUEST_IMAGE_MAX_BYTES = 1024 * 1024
+export const ENTERPRISE_DEFAULT_RETRY_POLICY = Object.freeze({ mode: 'normal', maxRetries: 2 })
+
+function nonEmpty(value, label) {
+  if (typeof value !== 'string' || value.trim().length === 0) throw new Error(`${label} must be a non-empty string`)
+  return value.trim()
+}
+
+function exactDevelopmentOrigin(value, label) {
+  if (value === undefined) return undefined
+  const raw = nonEmpty(value, label).replace(/\/+$/, '')
+  const parsed = new URL(raw)
+  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.hash || parsed.search || (parsed.pathname !== '/' && parsed.pathname !== '')) {
+    throw new Error(`${label} must be an exact HTTP origin`)
+  }
+  return raw
+}
+
+function endpointURL(value, label, allowInsecureDevelopment = false, insecureDevelopmentOrigin) {
+  const raw = nonEmpty(value, label).replace(/\/+$/, '')
+  const parsed = new URL(raw)
+  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
+  const allowedOrigin = exactDevelopmentOrigin(insecureDevelopmentOrigin, `${label}.insecureDevelopmentOrigin`)
+  const permittedHTTP = parsed.protocol === 'http:' && (loopback || (allowInsecureDevelopment === true && parsed.origin === allowedOrigin))
+  if ((parsed.protocol !== 'https:' && !permittedHTTP) || parsed.username || parsed.password || parsed.hash || parsed.search) {
+    throw new Error(`${label} must be HTTPS or explicitly allowed development HTTP without credentials, query, or fragment`)
+  }
+  return raw
+}
+
+function positiveInteger(value, fallback, label) {
+  const resolved = value ?? fallback
+  if (!Number.isSafeInteger(resolved) || resolved <= 0) throw new Error(`${label} must be a positive integer`)
+  return resolved
+}
+
+function normalizeInput(value, label) {
+  const input = value ?? ['text']
+  if (!Array.isArray(input) || input.length === 0 || input.some(item => !modalities.has(item))) {
+    throw new Error(`${label} must contain text and/or image`)
+  }
+  return [...new Set(input)]
+}
+
+function normalizeThinkingMap(value, reasoning) {
+  if (value === false || reasoning === false) return { off: null }
+  const source = value ?? { off: null, high: 'high', max: 'max' }
+  if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error('reasoningEfforts must be an object or false')
+  return Object.fromEntries(Object.entries(source).map(([key, level]) => [key, level ?? null]))
+}
+
+export function resolveEnterpriseProfiles(raw = {}) {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) throw new Error('enterprise provider config must be an object')
+  const providers = raw.providers ?? {}
+  if (typeof providers !== 'object' || providers === null || Array.isArray(providers)) throw new Error('enterprise provider config.providers must be an object')
+
+  return Object.entries(providers).map(([provider, source]) => {
+    const route = nonEmpty(provider, 'provider route')
+    if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error(`${route} config must be an object`)
+    const displayName = nonEmpty(source.displayName ?? route, `${route}.displayName`)
+    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment, source.insecureDevelopmentOrigin)
+    const credentialRef = nonEmpty(source.apiKeyEnv, `${route}.apiKeyEnv`)
+    const contextWindow = positiveInteger(source.defaultContextWindow, 262144, `${route}.defaultContextWindow`)
+    const maxTokens = positiveInteger(source.defaultMaxTokens, 32768, `${route}.defaultMaxTokens`)
+    const maxRequestImageBytes = positiveInteger(source.maxRequestImageBytes, ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES, `${route}.maxRequestImageBytes`)
+    const requestImagePixelBudget = positiveInteger(source.requestImagePixelBudget, ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, `${route}.requestImagePixelBudget`)
+    const requestImageMaxBytes = positiveInteger(source.requestImageMaxBytes, ENTERPRISE_DEFAULT_REQUEST_IMAGE_MAX_BYTES, `${route}.requestImageMaxBytes`)
+    if (!Array.isArray(source.models) || source.models.length === 0) throw new Error(`${route}.models must not be empty`)
+
+    const ids = new Set()
+    const models = source.models.map((model, index) => {
+      if (typeof model !== 'object' || model === null || Array.isArray(model)) throw new Error(`${route}.models[${index}] must be an object`)
+      const id = nonEmpty(model.id, `${route}.models[${index}].id`)
+      if (ids.has(id)) throw new Error(`${route} declares duplicate model ${id}`)
+      ids.add(id)
+      const reasoning = model.reasoning !== false && model.reasoningEfforts !== false
+      return {
+        id,
+        name: nonEmpty(model.name ?? id, `${route}.${id}.name`),
+        api: 'openai-completions',
+        provider: route,
+        baseUrl: baseURL,
+        reasoning,
+        thinkingLevelMap: normalizeThinkingMap(model.reasoningEfforts, reasoning),
+        input: normalizeInput(model.input, `${route}.${id}.input`),
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: positiveInteger(model.contextWindow, contextWindow, `${route}.${id}.contextWindow`),
+        maxTokens: positiveInteger(model.maxTokens, maxTokens, `${route}.${id}.maxTokens`),
+        compat: {
+          supportsDeveloperRole: false,
+          supportsStore: false,
+          supportsReasoningEffort: reasoning,
+          supportsUsageInStreaming: true,
+          maxTokensField: 'max_tokens',
+          supportsStrictMode: false,
+          supportsLongCacheRetention: false,
+          thinkingFormat: 'deepseek',
+          requiresReasoningContentOnAssistantMessages: true,
+          ...(source.compat ?? {}),
+          ...(model.compat ?? {}),
+        },
+      }
+    })
+
+    return {
+      provider: route,
+      displayName,
+      baseURL,
+      credentialRef,
+      reasoning: source.reasoning ?? 'high',
+      maxRequestImageBytes,
+      requestImagePixelBudget,
+      requestImageMaxBytes,
+      streamIdleTimeoutMs: positiveInteger(source.streamIdleTimeoutMs, 300000, `${route}.streamIdleTimeoutMs`),
+      retryPolicy: source.retryPolicy ?? ENTERPRISE_DEFAULT_RETRY_POLICY,
+      configuredMaxTokens: new Map(models.map(model => [model.id, model.maxTokens])),
+      models,
+    }
+  })
+}
+
+export function configurableEntries(profiles) {
+  return [...profiles.values()].map(profile => ({
+    provider: profile.provider,
+    displayName: profile.displayName,
+    settingsNs: ENTERPRISE_SETTINGS_NAMESPACE,
+    settingsPath: ['providers', profile.provider],
+    declared: true,
+  }))
+}
+
+export function settingsBase(rawConfig) {
+  return { providers: rawConfig.providers ?? {} }
+}

package/lib/provider/index.js

@@ -0,0 +1,156 @@
+import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
+import { LlmError, assertUsableApiKey, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
+import { Config as PiAiConfig, PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
+import { createProvider } from '@earendil-works/pi-ai'
+import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy'
+import {
+  configurableEntries, ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES, ENTERPRISE_DEFAULT_REQUEST_IMAGE_MAX_BYTES,
+  ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, ENTERPRISE_DEFAULT_RETRY_POLICY, ENTERPRISE_SETTINGS_NAMESPACE,
+  resolveEnterpriseProfiles, settingsBase,
+} from './core.js'
+import { TransformingEnterpriseAdapter } from './transform-adapter.js'
+import { EnterpriseModelTransforms } from './transforms.js'
+
+export const name = 'dsh-oidc-provider'
+export const inject = ['llm']
+export const SETTINGS_NAMESPACE = ENTERPRISE_SETTINGS_NAMESPACE
+
+function installEnterpriseSettings(ctx, rawConfig, hooks) {
+  ctx.inject(['settings'], (settingsCtx) => {
+    settingsCtx.settings.installSection(
+      ctx,
+      SETTINGS_NAMESPACE,
+      PiAiConfig,
+      settingsBase(rawConfig),
+      hooks,
+    )
+  })
+}
+
+function apiKeyAuth(displayName) {
+  return {
+    name: displayName,
+    resolve: ({ credential }) => Promise.resolve({
+      auth: credential?.key === undefined ? {} : { apiKey: credential.key },
+      source: displayName,
+    }),
+  }
+}
+
+function profilesFrom(rawConfig) {
+  const profiles = new Map()
+  for (const route of resolveEnterpriseProfiles(rawConfig)) {
+    profiles.set(route.provider, {
+      provider: route.provider,
+      displayName: route.displayName,
+      apiKeyEnv: route.credentialRef,
+      reasoning: route.reasoning,
+      maxRequestImageBytes: route.maxRequestImageBytes,
+      requestImagePixelBudget: route.requestImagePixelBudget,
+      requestImageMaxBytes: route.requestImageMaxBytes,
+      streamIdleTimeoutMs: route.streamIdleTimeoutMs,
+      retryPolicy: resolveRetryPolicy(route.retryPolicy, `${name}: ${route.provider}.retryPolicy`),
+      configuredMaxTokens: route.configuredMaxTokens,
+      modelPolicies: new Map(route.models.map(model => [model.id, {
+        reasoning: model.reasoning,
+        supportsReasoningEffort: model.compat.supportsReasoningEffort,
+      }])),
+      piProvider: createProvider({
+        id: route.provider,
+        name: route.displayName,
+        baseUrl: route.baseURL,
+        auth: { apiKey: apiKeyAuth(route.displayName) },
+        models: route.models,
+        api: openAICompletionsApi(),
+      }),
+    })
+  }
+  return profiles
+}
+
+function isolatedPiAiAuth() {
+  const stored = new Map()
+  return {
+    credentials: {
+      read: id => Promise.resolve(stored.get(id)),
+      list: () => Promise.resolve([]),
+      async modify(id, mutate) {
+        const next = await mutate(stored.get(id))
+        if (next === undefined) stored.delete(id)
+        else stored.set(id, next)
+        return next
+      },
+      delete: id => { stored.delete(id); return Promise.resolve() },
+    },
+    authContext: {
+      env: () => Promise.resolve(undefined),
+      fileExists: () => Promise.resolve(false),
+    },
+  }
+}
+
+export function apply(ctx, rawConfig = {}) {
+  const transforms = new EnterpriseModelTransforms(ctx)
+  let current = () => settingsBase(rawConfig)
+  let profiles = profilesFrom(current())
+  if (profiles.size === 0) return
+
+  const baseAdapter = new PiAiAdapter({
+    profiles: () => profiles,
+    auth: isolatedPiAiAuth(),
+    resolveApiKey: async (provider, profile) => {
+      const ref = profile.apiKeyEnv
+      const credentials = ctx.get('credentials')
+      const hit = credentials === undefined
+        ? launchEnvironmentOf(ctx).get(ref)?.value
+        : (await credentials.resolve(ref))?.value
+      if (typeof hit === 'string' && hit.length > 0) return assertUsableApiKey(hit, name, ref)
+      throw new LlmError(`${name}: no credential for provider route "${provider}" (${ref})`, 'MISSING_CREDENTIAL')
+    },
+    resolveAttachments: () => ctx.get('attachments'),
+  })
+
+  const adapter = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
+    profiles.get(provider)?.modelPolicies.get(model) ?? { reasoning: true, supportsReasoningEffort: true }
+  ))
+  const registration = ctx.llm.registerAdapter([...profiles.keys()], adapter)
+  let directory = ctx.llm.registerConfigurableProviders(configurableEntries(profiles))
+
+  if (rawConfig.settingsEnabled !== true) {
+    installEnterpriseSettings(ctx, rawConfig, { setSource() {}, onChange() {} })
+    return
+  }
+
+  const refresh = () => {
+    const next = profilesFrom(current())
+    const previous = profiles
+    profiles = next
+    try {
+      registration.replace([...next.keys()])
+      directory.replace(configurableEntries(next))
+    } catch (error) {
+      profiles = previous
+      throw error
+    }
+  }
+
+  installEnterpriseSettings(ctx, rawConfig, {
+    setSource(source) { current = source },
+    onChange() {
+      try { refresh() }
+      catch (error) {
+        ctx.logger.error('dsh-oidc-provider: keeping previous routes after a refused settings update')
+        ctx.logger.error(error)
+      }
+    },
+  })
+}
+
+export { resolveEnterpriseProfiles } from './core.js'
+export { TransformingEnterpriseAdapter } from './transform-adapter.js'
+export { EnterpriseModelTransforms } from './transforms.js'
+export {
+  configurableEntries, ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES, ENTERPRISE_DEFAULT_REQUEST_IMAGE_MAX_BYTES,
+  ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, ENTERPRISE_DEFAULT_RETRY_POLICY,
+  ENTERPRISE_SETTINGS_NAMESPACE, settingsBase,
+}