@eduwork/dsh-oidc 0.1.0 → 0.2.0

package/lib/profile.js

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
+export const DEFAULT_CREDENTIAL_REF = 'EDUWORK_API_KEY'
 const MAX_PROFILE_BYTES = 512 * 1024
 const idPattern = /^[a-z][a-z0-9-]{0,63}$/
 const credentialPattern = /^[A-Za-z_][A-Za-z0-9_]*$/
@@ -17,7 +18,7 @@ const allowedRootKeys = new Set([
   'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'keyBinding', 'provider',
 ])
 const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
-const allowedKeyBindingKeys = new Set(['baseURL', 'credentialRef'])
+const allowedKeyBindingKeys = new Set(['type', 'baseURL', 'credentialRef'])
 const allowedBrandKeys = new Set([
   'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
   'loginTitle', 'loginDescription', 'supportURL',
@@ -25,11 +26,11 @@ const allowedBrandKeys = new Set([
 const allowedProviderKeys = new Set([
   'id', 'displayName', 'adapter', 'baseURL', 'reasoning', 'defaultContextWindow',
   'defaultMaxTokens', 'maxRequestImageBytes', 'requestImagePixelBudget',
-  'requestImageMaxBytes', 'streamIdleTimeoutMs', 'retryPolicy', 'compat', 'models',
+  'requestImageMaxBytes', 'streamIdleTimeoutMs', 'retryPolicy', 'compat', 'models', 'modelSource',
 ])
 const allowedModelKeys = new Set([
   'id', 'name', 'input', 'contextWindow', 'maxTokens', 'reasoning',
-  'reasoningEfforts', 'compat',
+  'reasoningEfforts', 'defaultReasoningEffort', 'compat',
 ])
 const allowedCompatKeys = new Set([
   'supportsDeveloperRole', 'supportsStore', 'supportsReasoningEffort',
@@ -174,7 +175,7 @@ function normalizeReasoningEfforts(value, providerID, modelID) {
   })))
 }
 
-function normalizeModels(models, providerID) {
+export function normalizeModels(models, providerID) {
   if (!Array.isArray(models) || models.length === 0 || models.length > 128) throw new Error(`${providerID}.models must contain 1-128 entries`)
   const seen = new Set()
   return Object.freeze(models.map((raw, index) => {
@@ -189,6 +190,19 @@ function normalizeModels(models, providerID) {
       throw new Error(`${providerID}.${id}.input must contain text and/or image`)
     }
     if (new Set(input).size !== input.length) throw new Error(`${providerID}.${id}.input contains duplicates`)
+    const normalizedReasoningEfforts = model.reasoningEfforts === undefined
+      ? undefined
+      : normalizeReasoningEfforts(model.reasoningEfforts, providerID, id)
+    let defaultReasoningEffort
+    if (model.defaultReasoningEffort !== undefined) {
+      defaultReasoningEffort = text(model.defaultReasoningEffort, `${providerID}.${id}.defaultReasoningEffort`, 32)
+      if (!allowedThinkingLevels.has(defaultReasoningEffort)) {
+        throw new Error(`${providerID}.${id}.defaultReasoningEffort is not supported by DSH pi-ai`)
+      }
+      if (!normalizedReasoningEfforts || normalizedReasoningEfforts === false || !(defaultReasoningEffort in normalizedReasoningEfforts)) {
+        throw new Error(`${providerID}.${id}.defaultReasoningEffort must be one of the model's declared reasoningEfforts`)
+      }
+    }
     return Object.freeze({
       id,
       name: model.name === undefined ? id : text(model.name, `${providerID}.${id}.name`, 256),
@@ -196,14 +210,15 @@ function normalizeModels(models, providerID) {
       ...(model.contextWindow === undefined ? {} : { contextWindow: positiveInteger(model.contextWindow, `${providerID}.${id}.contextWindow`) }),
       ...(model.maxTokens === undefined ? {} : { maxTokens: positiveInteger(model.maxTokens, `${providerID}.${id}.maxTokens`) }),
       ...(model.reasoning === undefined ? {} : { reasoning: boolean(model.reasoning, `${providerID}.${id}.reasoning`) }),
-      ...(model.reasoningEfforts === undefined ? {} : { reasoningEfforts: normalizeReasoningEfforts(model.reasoningEfforts, providerID, id) }),
+      ...(normalizedReasoningEfforts === undefined ? {} : { reasoningEfforts: normalizedReasoningEfforts }),
+      ...(defaultReasoningEffort === undefined ? {} : { defaultReasoningEffort }),
       ...(model.compat === undefined ? {} : { compat: normalizeCompat(model.compat, `${providerID}.${id}.compat`) }),
     })
   }))
 }
 
-function providerCredentialRef(providerID) {
-  return `${providerID.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`
+export function legacyCredentialRefs(profile) {
+  return [...new Set([profile.id, profile.provider?.id].filter(Boolean).map(id => `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`))]
 }
 
 function normalizeRetryPolicy(value) {
@@ -267,20 +282,29 @@ export function normalizeEnterpriseProfile(raw) {
     throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
   }
   const oidc = object(source.oidc, 'profile.oidc')
-  const keyBinding = object(source.keyBinding, 'profile.keyBinding')
-  const provider = object(source.provider, 'profile.provider')
+  const identityOnly = source.keyBinding === undefined && source.provider === undefined
+  if (!identityOnly && (source.keyBinding === undefined || source.provider === undefined)) {
+    throw new Error('profile.keyBinding and profile.provider must either both be present or both be omitted')
+  }
+  const keyBinding = identityOnly ? {} : object(source.keyBinding, 'profile.keyBinding')
+  const provider = identityOnly ? {} : object(source.provider, 'profile.provider')
   exactKeys(oidc, allowedOidcKeys, 'profile.oidc')
   exactKeys(keyBinding, allowedKeyBindingKeys, 'profile.keyBinding')
   exactKeys(provider, allowedProviderKeys, 'profile.provider')
-  const providerID = text(provider.id, 'profile.provider.id', 64)
+  const providerID = identityOnly ? id : text(provider.id, 'profile.provider.id', 64)
   if (!idPattern.test(providerID)) throw new Error('profile.provider.id is invalid')
-  const credentialRef = keyBinding.credentialRef === undefined
-    ? providerCredentialRef(providerID)
+  let credentialRef = keyBinding.credentialRef === undefined
+    ? DEFAULT_CREDENTIAL_REF
     : text(keyBinding.credentialRef, 'profile.keyBinding.credentialRef', 128)
   if (!credentialPattern.test(credentialRef)) {
     throw new Error('profile.keyBinding.credentialRef must be a valid DSH credential reference')
   }
-  if (provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
+  if (legacyCredentialRefs({ id, provider: { id: providerID } }).includes(credentialRef)) credentialRef = DEFAULT_CREDENTIAL_REF
+  if (!identityOnly && provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
+  const protocol = keyBinding.type ?? 'worker-user-center-v1'
+  if (!['worker-user-center-v1', 'eduwork-resources-v1'].includes(protocol)) throw new Error('profile.keyBinding.type is not supported')
+  const modelSource = provider.modelSource ?? 'profile'
+  if (!['profile', 'discovery'].includes(modelSource)) throw new Error('profile.provider.modelSource must be profile or discovery')
   const scopes = oidc.scopes
   if (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope))) {
     throw new Error('profile.oidc.scopes must contain openid and profile; every scope must be a non-empty token')
@@ -300,8 +324,8 @@ export function normalizeEnterpriseProfile(raw) {
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
     }),
-    keyBinding: Object.freeze({
-      type: 'worker-user-center-v1',
+    ...(identityOnly ? {} : { keyBinding: Object.freeze({
+      type: protocol,
       baseURL: exactURL(keyBinding.baseURL, 'profile.keyBinding.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
       providerId: providerID,
       credentialRef,
@@ -326,7 +350,10 @@ export function normalizeEnterpriseProfile(raw) {
       streamIdleTimeoutMs: optionalPositiveInteger(provider.streamIdleTimeoutMs, 'profile.provider.streamIdleTimeoutMs'),
       retryPolicy: provider.retryPolicy === undefined ? undefined : normalizeRetryPolicy(provider.retryPolicy),
       compat: provider.compat === undefined ? undefined : normalizeCompat(provider.compat, 'profile.provider.compat'),
-      models: normalizeModels(provider.models, providerID),
+      modelSource,
+      models: modelSource === 'discovery' && (provider.models === undefined || provider.models.length === 0)
+        ? Object.freeze([]) : normalizeModels(provider.models, providerID),
+    }),
     }),
   })
 }
@@ -338,8 +365,10 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
     if (!Array.isArray(raw.profiles)) throw new Error('dsh-oidc profiles must be an array')
     profiles.push(...raw.profiles.map(normalizeEnterpriseProfile))
   }
-  if (typeof raw.profilePathEnv === 'string' && environment[raw.profilePathEnv]) {
-    const parsed = JSON.parse(readFileSync(environment[raw.profilePathEnv], 'utf8'))
+  const pathEnv = raw.profilePathEnv ?? 'EDUWORK_OIDC_PROFILE'
+  const profilePath = environment[pathEnv] || (pathEnv === 'EDUWORK_OIDC_PROFILE' ? environment.DSH_OIDC_ENTERPRISE_PROFILE : undefined)
+  if (typeof profilePath === 'string' && profilePath) {
+    const parsed = JSON.parse(readFileSync(profilePath, 'utf8'))
     const rows = Array.isArray(parsed) ? parsed : parsed.profiles ?? [parsed]
     profiles.push(...rows.map(normalizeEnterpriseProfile))
   }
@@ -347,16 +376,16 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
   const providers = new Set()
   for (const profile of profiles) {
     if (unique.has(profile.id)) throw new Error(`dsh-oidc repeats profile ${profile.id}`)
-    if (providers.has(profile.provider.id)) throw new Error(`dsh-oidc repeats provider route ${profile.provider.id}`)
+    if (profile.provider && providers.has(profile.provider.id)) throw new Error(`dsh-oidc repeats provider route ${profile.provider.id}`)
     unique.set(profile.id, profile)
-    providers.add(profile.provider.id)
+    if (profile.provider) providers.add(profile.provider.id)
   }
   return unique
 }
 
 export function enterpriseProviderConfig(profiles) {
   return {
-    providers: Object.fromEntries([...profiles.values()].map(profile => [profile.provider.id, {
+    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.models.length).map(profile => [profile.provider.id, {
       displayName: profile.provider.displayName,
       apiKeyEnv: profile.keyBinding.credentialRef,
       baseURL: profile.provider.baseURL,
@@ -389,11 +418,11 @@ export function publicProfile(profile) {
     displayName: profile.displayName,
     organization: profile.organization,
     brand: profile.brand,
-    credentialRef: profile.keyBinding.credentialRef,
-    provider: {
+    credentialRef: profile.keyBinding?.credentialRef ?? '',
+    ...(profile.provider ? { provider: {
       id: profile.provider.id,
       displayName: profile.provider.displayName,
       models: profile.provider.models.map(model => ({ id: model.id, name: model.name, input: model.input })),
-    },
+    } } : {}),
   }
 }

package/lib/provider/core.js

@@ -1,4 +1,6 @@
 const modalities = new Set(['text', 'image'])
+export const REASONING_EFFORT_ORDER = Object.freeze(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
+const reasoningEfforts = new Set(REASONING_EFFORT_ORDER)
 export const ENTERPRISE_SETTINGS_NAMESPACE = 'provider-enterprise'
 export const ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024
 export const ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048
@@ -50,7 +52,43 @@ function normalizeThinkingMap(value, reasoning) {
   if (value === false || reasoning === false) return { off: null }
   const source = value ?? { off: null, high: 'high', max: 'max' }
   if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error('reasoningEfforts must be an object or false')
-  return Object.fromEntries(Object.entries(source).map(([key, level]) => [key, level ?? null]))
+  const entries = Object.entries(source)
+  if (entries.length === 0 || !entries.some(([effort]) => effort !== 'off')) {
+    throw new Error('reasoningEfforts must declare at least one thinking level')
+  }
+  for (const [effort, wire] of entries) {
+    if (!reasoningEfforts.has(effort)) throw new Error(`reasoningEfforts level ${effort} is not supported`)
+    if (wire === null && effort !== 'off') throw new Error(`reasoningEfforts.${effort} may be null only for off`)
+    if (wire !== null && (typeof wire !== 'string' || wire.length === 0)) throw new Error(`reasoningEfforts.${effort} must be a non-empty string`)
+  }
+  const map = {}
+  for (const effort of REASONING_EFFORT_ORDER) {
+    const wire = source[effort]
+    if (wire === undefined) map[effort] = null
+    else if (wire !== null) map[effort] = wire
+  }
+  return map
+}
+
+function declaredReasoningEfforts(value, reasoning) {
+  if (reasoning === false || value === false) return []
+  const source = value ?? { off: null, high: 'high', max: 'max' }
+  return REASONING_EFFORT_ORDER.filter(effort => Object.hasOwn(source, effort))
+}
+
+function reasoningPreference(value, label) {
+  const preference = value ?? 'high'
+  if (!reasoningEfforts.has(preference)) throw new Error(`${label} is not a supported reasoning effort`)
+  return preference
+}
+
+function nearestReasoningEffort(preference, supported) {
+  const preferredRank = REASONING_EFFORT_ORDER.indexOf(preference)
+  return [...supported].sort((left, right) => {
+    const leftRank = REASONING_EFFORT_ORDER.indexOf(left)
+    const rightRank = REASONING_EFFORT_ORDER.indexOf(right)
+    return Math.abs(leftRank - preferredRank) - Math.abs(rightRank - preferredRank) || leftRank - rightRank
+  })[0]
 }
 
 export function resolveEnterpriseProfiles(raw = {}) {
@@ -69,6 +107,7 @@ export function resolveEnterpriseProfiles(raw = {}) {
     const maxRequestImageBytes = positiveInteger(source.maxRequestImageBytes, ENTERPRISE_DEFAULT_MAX_REQUEST_IMAGE_BYTES, `${route}.maxRequestImageBytes`)
     const requestImagePixelBudget = positiveInteger(source.requestImagePixelBudget, ENTERPRISE_DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, `${route}.requestImagePixelBudget`)
     const requestImageMaxBytes = positiveInteger(source.requestImageMaxBytes, ENTERPRISE_DEFAULT_REQUEST_IMAGE_MAX_BYTES, `${route}.requestImageMaxBytes`)
+    const providerReasoning = reasoningPreference(source.reasoning, `${route}.reasoning`)
     if (!Array.isArray(source.models) || source.models.length === 0) throw new Error(`${route}.models must not be empty`)
 
     const ids = new Set()
@@ -78,6 +117,35 @@ export function resolveEnterpriseProfiles(raw = {}) {
       if (ids.has(id)) throw new Error(`${route} declares duplicate model ${id}`)
       ids.add(id)
       const reasoning = model.reasoning !== false && model.reasoningEfforts !== false
+      const compat = {
+        supportsDeveloperRole: false,
+        supportsStore: false,
+        supportsReasoningEffort: reasoning,
+        supportsUsageInStreaming: true,
+        maxTokensField: 'max_tokens',
+        supportsStrictMode: false,
+        supportsLongCacheRetention: false,
+        thinkingFormat: 'deepseek',
+        requiresReasoningContentOnAssistantMessages: true,
+        ...(source.compat ?? {}),
+        ...(model.compat ?? {}),
+      }
+      const supportsReasoningEffort = reasoning && compat.supportsReasoningEffort !== false
+      const efforts = supportsReasoningEffort ? declaredReasoningEfforts(model.reasoningEfforts, reasoning) : []
+      if (model.defaultReasoningEffort !== undefined && !reasoningEfforts.has(model.defaultReasoningEffort)) {
+        throw new Error(`${route}.${id}.defaultReasoningEffort is not a supported reasoning effort`)
+      }
+      if (model.defaultReasoningEffort !== undefined && !efforts.includes(model.defaultReasoningEffort)) {
+        throw new Error(`${route}.${id}.defaultReasoningEffort must be one of the model's declared reasoningEfforts`)
+      }
+      const defaultReasoningEffort = supportsReasoningEffort
+        ? (model.defaultReasoningEffort ?? nearestReasoningEffort(providerReasoning, efforts))
+        : undefined
+      // PiAi uses an internal effort to enable thinking even when the gateway
+      // accepts no reasoning_effort field. Keep that default separate from UI choices.
+      const internalThinkingEffort = reasoning && !supportsReasoningEffort
+        ? nearestReasoningEffort(providerReasoning, declaredReasoningEfforts(model.reasoningEfforts, reasoning))
+        : undefined
       return {
         id,
         name: nonEmpty(model.name ?? id, `${route}.${id}.name`),
@@ -90,18 +158,10 @@ export function resolveEnterpriseProfiles(raw = {}) {
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
         contextWindow: positiveInteger(model.contextWindow, contextWindow, `${route}.${id}.contextWindow`),
         maxTokens: positiveInteger(model.maxTokens, maxTokens, `${route}.${id}.maxTokens`),
-        compat: {
-          supportsDeveloperRole: false,
-          supportsStore: false,
-          supportsReasoningEffort: reasoning,
-          supportsUsageInStreaming: true,
-          maxTokensField: 'max_tokens',
-          supportsStrictMode: false,
-          supportsLongCacheRetention: false,
-          thinkingFormat: 'deepseek',
-          requiresReasoningContentOnAssistantMessages: true,
-          ...(source.compat ?? {}),
-          ...(model.compat ?? {}),
+        compat,
+        modelPolicy: {
+          reasoning, supportsReasoningEffort, reasoningEfforts: efforts, defaultReasoningEffort,
+          ...(internalThinkingEffort === undefined ? {} : { internalThinkingEffort }),
         },
       }
     })
@@ -111,14 +171,15 @@ export function resolveEnterpriseProfiles(raw = {}) {
       displayName,
       baseURL,
       credentialRef,
-      reasoning: source.reasoning ?? 'high',
+      reasoning: providerReasoning,
       maxRequestImageBytes,
       requestImagePixelBudget,
       requestImageMaxBytes,
       streamIdleTimeoutMs: positiveInteger(source.streamIdleTimeoutMs, 300000, `${route}.streamIdleTimeoutMs`),
       retryPolicy: source.retryPolicy ?? ENTERPRISE_DEFAULT_RETRY_POLICY,
       configuredMaxTokens: new Map(models.map(model => [model.id, model.maxTokens])),
-      models,
+      modelPolicies: new Map(models.map(model => [model.id, model.modelPolicy])),
+      models: models.map(({ modelPolicy: _modelPolicy, ...model }) => model),
     }
   })
 }

package/lib/provider/index.js

@@ -43,24 +43,24 @@ function apiKeyAuth(displayName) {
   }
 }
 
-function profilesFrom(rawConfig) {
+export function profilesFrom(rawConfig) {
   const profiles = new Map()
   for (const route of resolveEnterpriseProfiles(rawConfig)) {
     profiles.set(route.provider, {
       provider: route.provider,
       displayName: route.displayName,
       apiKeyEnv: route.credentialRef,
-      reasoning: route.reasoning,
       maxRequestImageBytes: route.maxRequestImageBytes,
       requestImagePixelBudget: route.requestImagePixelBudget,
       requestImageMaxBytes: route.requestImageMaxBytes,
       streamIdleTimeoutMs: route.streamIdleTimeoutMs,
       retryPolicy: resolveRetryPolicy(route.retryPolicy, `${name}: ${route.provider}.retryPolicy`),
       configuredMaxTokens: route.configuredMaxTokens,
-      modelPolicies: new Map(route.models.map(model => [model.id, {
-        reasoning: model.reasoning,
-        supportsReasoningEffort: model.compat.supportsReasoningEffort,
-      }])),
+      modelPolicies: route.modelPolicies,
+      // DSH 0.1.5-rc.1 reads per-model configuration errors before resolution.
+      // Our declarative profiles validate eagerly, so a successfully constructed
+      // provider has no deferred errors. Earlier adapters ignore this field.
+      modelErrors: new Map(),
       piProvider: createProvider({
         id: route.provider,
         name: route.displayName,
@@ -111,15 +111,19 @@ export function apply(ctx, rawConfig = {}) {
   const transforms = new EnterpriseModelTransforms(ctx)
   let current = () => settingsBase(rawConfig)
   let profiles = profilesFrom(current())
-  if (profiles.size === 0) return
 
   const baseAdapter = new PiAiAdapter({
     profiles: () => profiles,
     auth: isolatedPiAiAuth(),
     resolveApiKey: async (provider, profile) => {
+      if (await rawConfig.beforeResolveCredential?.(provider) === false) {
+        throw new LlmError(`${name}: organization sign-in is required for provider route "${provider}"`, 'MISSING_CREDENTIAL')
+      }
       const ref = profile.apiKeyEnv
       const credentials = ctx.get('credentials')
-      const hit = credentials === undefined
+      const hit = typeof rawConfig.resolveCredential === 'function'
+        ? (await rawConfig.resolveCredential(provider))?.value
+        : credentials === undefined
         ? launchEnvironmentOf(ctx).get(ref)?.value
         : (await credentials.resolve(ref))?.value
       if (typeof hit === 'string' && hit.length > 0) return assertUsableApiKey(hit, name, ref)
@@ -132,26 +136,34 @@ export function apply(ctx, rawConfig = {}) {
   const adapter = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
     profiles.get(provider)?.modelPolicies.get(model) ?? { reasoning: true, supportsReasoningEffort: true }
   ))
-  const registration = ctx.llm.registerAdapter([...profiles.keys()], adapter)
-  let directory = ctx.llm.registerConfigurableProviders(configurableEntries(profiles))
-
-  if (rawConfig.settingsEnabled !== true) {
-    installEnterpriseSettings(ctx, rawConfig, { setSource() {}, onChange() {} })
-    return
-  }
-
-  const refresh = () => {
-    const next = profilesFrom(current())
+  let registration
+  let directory
+  const replaceProfiles = next => {
     const previous = profiles
     profiles = next
     try {
-      registration.replace([...next.keys()])
-      directory.replace(configurableEntries(next))
+      if (registration) registration.replace([...next.keys()])
+      else if (next.size) registration = ctx.llm.registerAdapter([...next.keys()], adapter)
+      if (directory) directory.replace(configurableEntries(next))
+      else if (next.size) directory = ctx.llm.registerConfigurableProviders(configurableEntries(next))
     } catch (error) {
       profiles = previous
+      registration?.replace([...previous.keys()])
       throw error
     }
   }
+  if (profiles.size) replaceProfiles(profiles)
+  const controller = { replaceConfig(config) { replaceProfiles(profilesFrom(config)) } }
+
+  if (rawConfig.settingsEnabled !== true) {
+    installEnterpriseSettings(ctx, rawConfig, { setSource() {}, onChange() {} })
+    return controller
+  }
+
+  const refresh = () => {
+    const next = profilesFrom(current())
+    replaceProfiles(next)
+  }
 
   installEnterpriseSettings(ctx, rawConfig, {
     setSource(source) { current = source },
@@ -163,6 +175,7 @@ export function apply(ctx, rawConfig = {}) {
       }
     },
   })
+  return controller
 }
 
 export { resolveEnterpriseProfiles } from './core.js'

package/lib/provider/transform-adapter.js

@@ -1,3 +1,5 @@
+import { LlmError } from '@deepseek-ai/dsh-llm'
+
 /** Delegate one enterprise route while applying capabilities contributed by replaceable feature plugins. */
 export class TransformingEnterpriseAdapter {
   constructor(inner, transforms, modelPolicy = () => ({})) {
@@ -19,47 +21,66 @@ export class TransformingEnterpriseAdapter {
   }
 
   async resolveModel(provider, model, signal) {
-    return this.decorateModel(provider, model, await this.inner.resolveModel(provider, model, signal))
+    const policy = this.modelPolicy(provider, model)
+    return this.decorateModel(provider, model, await this.inner.resolveModel(provider, model, signal), policy)
   }
 
-  decorateModel(provider, model, resolved) {
+  decorateModel(provider, model, resolved, policy = this.modelPolicy(provider, model)) {
     const decorated = {
       ...resolved,
       inputModalities: this.transforms.capabilities(provider, model, resolved.inputModalities),
     }
-    const policy = this.modelPolicy(provider, model)
-    if (policy.reasoning === false || policy.supportsReasoningEffort !== false) return decorated
+    if (policy.reasoning !== false && policy.supportsReasoningEffort !== false && Array.isArray(policy.reasoningEfforts)) {
+      return {
+        ...decorated,
+        reasoning: {
+          efforts: policy.reasoningEfforts.map(id => ({ id, name: `${id.charAt(0).toUpperCase()}${id.slice(1)}` })),
+          defaultEffort: policy.defaultReasoningEffort,
+        },
+      }
+    }
     const { reasoning: _unsupportedReasoningEfforts, ...thinkingOnly } = decorated
     return thinkingOnly
   }
 
   async prepareCall(provider, model, signal) {
+    const policy = this.modelPolicy(provider, model)
     const prepared = typeof this.inner.prepareCall === 'function'
       ? await this.inner.prepareCall(provider, model, signal)
       : { model: await this.inner.resolveModel(provider, model, signal), stream: options => this.inner.stream(options) }
     return {
-      model: this.decorateModel(provider, model, prepared.model),
-      stream: options => this.streamPrepared(options, prepared),
+      model: this.decorateModel(provider, model, prepared.model, policy),
+      stream: options => this.streamPrepared(options, prepared, policy),
     }
   }
 
-  async * streamPrepared(options, prepared) {
+  async * streamPrepared(options, prepared, policy = this.modelPolicy(options.provider, options.model)) {
     const nativeModelInfo = prepared.model
     let request = options
-    const policy = this.modelPolicy(options.provider, options.model)
     if (policy.reasoning === false) {
       request = { ...options, reasoningEffort: 'off' }
     } else if (policy.supportsReasoningEffort === false) {
       const { reasoningEffort: _unsupportedReasoningEffort, ...withoutEffort } = options
-      request = withoutEffort
+      // This enables the model's configured thinking mode inside PiAi;
+      // compat.supportsReasoningEffort=false suppresses the HTTP effort field.
+      request = policy.internalThinkingEffort === undefined
+        ? withoutEffort
+        : { ...withoutEffort, reasoningEffort: policy.internalThinkingEffort }
+    } else if (Array.isArray(policy.reasoningEfforts)) {
+      const effort = options.reasoningEffort ?? policy.defaultReasoningEffort
+      if (!policy.reasoningEfforts.includes(effort)) {
+        throw new LlmError(`enterprise model "${options.provider}/${options.model}" does not support reasoning effort "${String(effort)}"`, 'UNSUPPORTED_REASONING_EFFORT')
+      }
+      request = { ...options, reasoningEffort: effort }
     }
     yield* prepared.stream(await this.transforms.apply(request, nativeModelInfo))
   }
 
   async * stream(options) {
+    const policy = this.modelPolicy(options.provider, options.model)
     const prepared = typeof this.inner.prepareCall === 'function'
       ? await this.inner.prepareCall(options.provider, options.model, options.signal)
       : { model: await this.inner.resolveModel(options.provider, options.model, options.signal), stream: request => this.inner.stream(request) }
-    yield* this.streamPrepared(options, prepared)
+    yield* this.streamPrepared(options, prepared, policy)
   }
 }

package/lib/resources.js

@@ -0,0 +1,23 @@
+import { normalizeModels } from './profile.js'
+
+// The public resource contract extends the deployed worker wire protocol. OIDC
+// access tokens remain on the management plane; these calls use the model key.
+export function normalizeResourceModels(raw, profile) {
+  if (!Array.isArray(raw?.data) || raw.data.length > 128) throw new Error('invalid model catalog')
+  const reviewed = new Map(profile.provider.models.map(model => [model.id, model]))
+  const models = raw.data.map(row => {
+    const id = typeof row?.id === 'string' ? row.id.trim() : ''
+    // A plain /models response does not prove reasoning or vision support.
+    return reviewed.get(id) ?? { id, name: id, input: ['text'], reasoning: false }
+  })
+  return normalizeModels(models, profile.provider.id)
+}
+
+export function emptyResources(profile) {
+  return {
+    profileID: profile.id,
+    modelSource: profile.provider?.modelSource ?? 'none',
+    models: profile.provider?.models ?? [],
+    issues: [],
+  }
+}

package/lib/typert-schemas.js

@@ -2,9 +2,20 @@ import { z } from 'zod'
 
 const pkg = '@eduwork/dsh-oidc'
 export const profileIdSchema = z.string().min(1).max(64)
+export const loginIdSchema = z.string().regex(/^[A-Za-z0-9_-]{32}$/)
 export const reconcileOptionsSchema = z.object({ allowProvision: z.boolean().optional() }).strict()
 export const baseURLSchema = z.string().min(1).max(2048)
 export const modelCatalogModeSchema = z.enum(['discovery', 'manual'])
+export const configurationTargetSchema = z.enum(['config', 'examples'])
+export const openConfigurationResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#OpenConfigurationResult`,
+  schema: z.object({ opened: z.literal(true) }).strict(),
+})
+export const enterpriseSelectionResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#EnterpriseSelectionResult`,
+  schema: z.object({ changed: z.boolean(), selection: z.object({ provider: z.string(), model: z.string(), reasoningEffort: z.string().optional() }).strict().optional() }).strict(),
+})
+export const enterpriseSelectionOptionsSchema = z.object({ onlyIfMissing: z.boolean().optional() }).strict()
 
 const brandSchema = z.object({
   productName: z.string().optional(), organizationName: z.string().optional(), mark: z.string().optional(),
@@ -18,7 +29,7 @@ const publicProfileSchema = z.object({
   provider: z.object({
     id: z.string(), displayName: z.string(),
     models: z.array(z.object({ id: z.string(), name: z.string(), input: z.array(z.enum(['text', 'image'])) }).strict()),
-  }).strict(),
+  }).strict().optional(),
 }).strict()
 
 const accountSchema = z.object({
@@ -33,12 +44,20 @@ export const runtimeModelSchema = z.object({
   upstreamModelID: z.string().max(256).optional(), contextWindow: z.number().int().positive().optional(),
   maxTokens: z.number().int().positive().optional(),
   input: z.array(z.enum(['text', 'image', 'audio', 'video'])).optional(),
-  reasoning: z.boolean().optional(), reasoningEfforts: z.record(z.string(), z.string().nullable()).optional(),
+  reasoning: z.boolean().optional(), reasoningEfforts: z.union([z.literal(false), z.record(z.string(), z.string().nullable())]).optional(),
+  defaultReasoningEffort: z.enum(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']).optional(),
   compat: z.record(z.string(), z.unknown()).optional(),
 }).strict()
 
 export const runtimeModelsSchema = z.array(runtimeModelSchema).max(128)
 
+export const resourcesResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#Resources`,
+  schema: z.object({
+    profileID: z.string(), modelSource: z.string(), models: runtimeModelsSchema, issues: z.array(z.string()),
+  }).strict(),
+})
+
 const managementProfileSchema = z.object({
   id: z.string(), displayName: z.string(), organization: z.string(), baseURL: z.string(),
   builtIn: z.boolean(), configured: z.boolean(), enabled: z.boolean(), providerID: z.string(),
@@ -51,7 +70,9 @@ const managementProfileSchema = z.object({
 
 export const configurationResult = Object.freeze({
   mode: 'strict', typeSymbol: `${pkg}#Configuration`,
-  schema: z.object({ schemaVersion: z.literal('dsh-oidc/v1alpha1'), uiMode: z.enum(['standard', 'models-only', 'external']), profiles: z.array(publicProfileSchema) }).strict(),
+  schema: z.object({ schemaVersion: z.literal('dsh-oidc/v1alpha1'), uiMode: z.enum(['standard', 'models-only', 'external']), profiles: z.array(publicProfileSchema),
+    manageProductBrand: z.boolean().optional(), configFile: z.object({ path: z.string(), examplesPath: z.string(), canOpen: z.boolean() }).strict().optional(),
+  }).strict(),
 })
 
 export const managementResult = Object.freeze({
@@ -76,9 +97,19 @@ export const beginResult = Object.freeze({
   schema: z.union([
     z.object({ mode: z.literal('redirect'), authorizationURL: z.string().url() }).strict(),
     z.object({ mode: z.literal('completed'), status: accountSchema }).strict(),
+    z.object({ mode: z.literal('external'), loginID: loginIdSchema, expiresAt: z.string().datetime() }).strict(),
   ]),
 })
 
+export const loginResult = Object.freeze({
+  mode: 'strict', typeSymbol: `${pkg}#LoginResult`,
+  schema: z.object({
+    loginID: loginIdSchema, profileID: profileIdSchema, expiresAt: z.string().datetime(),
+    state: z.enum(['pending', 'completed', 'cancelled', 'expired', 'failed']),
+    status: accountSchema.optional(), errorCode: z.string().optional(),
+  }).strict(),
+})
+
 export function jsonParameter(name, schema, typeSymbol) {
   return Object.freeze({ name, wire: name, source: 'json', codec: Object.freeze({ mode: 'strict', typeSymbol, schema }) })
 }