@eduwork/dsh-oidc 0.1.0 → 0.2.1

package/lib/typert.host.js

@@ -1,38 +1,44 @@
-import {
-  accountResult, baseURLSchema, beginResult, configurationResult, jsonParameter, managementResult,
-  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT = {
-  package: pkg, face: 'host', schemas: [],
-  invocations: [
+import {
+  accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
+  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT = {
+  package: pkg, face: 'host', schemas: [],
+  invocations: [
     descriptor('configuration', [], configurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('begin', [profile()], beginResult),
+    descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-  model: { services: [], events: [], objects: [] },
-}
-
-export default TYPERT
+    descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+  model: { services: [], events: [], objects: [] },
+}
+
+export default TYPERT

package/lib/typert.remote-client.js

@@ -1,37 +1,43 @@
-import {
-  accountResult, baseURLSchema, beginResult, configurationResult, jsonParameter, managementResult,
-  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT_REMOTE = {
-  package: pkg,
-  descriptors: [
+import {
+  accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
+  modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT_REMOTE = {
+  package: pkg,
+  descriptors: [
     descriptor('configuration', [], configurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('begin', [profile()], beginResult),
+    descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-}
-
-export default TYPERT_REMOTE
+    descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+}
+
+export default TYPERT_REMOTE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
@@ -31,6 +31,7 @@
     "examples/**/*.json",
     "schema/**/*.json",
     "protocol/openapi.yaml",
+    "protocol/resources.openapi.yaml",
     "README.md",
     "README.en.md",
     "CODE_OF_CONDUCT.md",
@@ -81,10 +82,12 @@
     "check:secrets": "node scripts/check-secrets.mjs",
     "check:licenses": "node scripts/check-licenses.mjs",
     "check:docs": "node scripts/check-doc-links.mjs",
-    "check:dsh": "node scripts/check-dsh-rc1.mjs",
+    "check:dsh": "npm run check:lock && node scripts/check-dsh-rc1.mjs",
     "check:build": "node scripts/smoke-build.mjs",
     "check": "npm run typecheck && npm run check:dsh && npm run build && npm run check:build && npm test && npm run check:schemas && npm run check:docs && npm run check:secrets && npm run check:licenses && npm pack --dry-run",
-    "prepare": "npm run build"
+    "prepare": "npm run build",
+    "check:browser": "node scripts/check-account-menu-browser.mjs",
+    "check:lock": "node scripts/check-dependency-lock.mjs"
   },
   "engines": {
     "node": ">=22.0.0"
@@ -106,36 +109,104 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-brand": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-theme": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-fs": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-timeout": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.2-rc.1",
-    "@earendil-works/pi-ai": "^0.84.2",
-    "react": "^18.2.0"
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-theme": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
+    "@earendil-works/pi-ai": "^0.84.2 || ^0.85.1",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-gateway": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-chunked-list": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-file-upload": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-theme": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-deque": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-file-reference": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-jobs": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-native-command": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection-cache": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-query": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-title": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage-domain": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-todo": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-crypto": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-time": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-workspace": "0.1.5-rc.1",
+    "@earendil-works/pi-ai": "0.85.1",
     "@types/react": "^18.3.28",
+    "@types/react-dom": "^18.3.7",
     "ajv": "^8.17.1",
+    "playwright-core": "1.63.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
     "tsdown": "0.22.14",
     "typescript": "^5.9.3",
     "yaml": "^2.8.1"

package/protocol/openapi.yaml

@@ -123,8 +123,8 @@ components:
       properties:
         protocol_version:
           type: string
-          const: worker-user-center/v1
-          description: Optional during v1 adoption; if present it MUST equal this value.
+          enum: [worker.user-center.v1, worker-user-center/v1, eduwork-resources/v1]
+          description: Optional during v1 adoption; all three version labels share the deployed credential lifecycle wire.
         subject:
           $ref: '#/components/schemas/InformationalSubject'
         provider:

package/protocol/resources.openapi.yaml

@@ -0,0 +1,51 @@
+openapi: 3.1.0
+info:
+  title: EduWork Identity and Resource Protocol
+  version: 1.0.0
+  description: >-
+    Optional resource integration for a local single-user OIDC client.
+    Management uses worker-user-center-v1 bootstrap and credential operations. Quota and activity heartbeat are institution extensions, absent from this contract.
+    Model discovery uses the resulting runtime API key, never the
+    identity token. Pure OIDC deployments may omit resource integration.
+  license: { name: MIT, identifier: MIT }
+servers:
+  - url: https://ai.example.edu/open/api/v1
+security:
+  - runtimeKey: []
+paths:
+  /models:
+    get:
+      operationId: listResourceModels
+      responses:
+        '200':
+          description: Available model identifiers; reviewed capabilities remain in the client Profile
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [data]
+                properties:
+                  data:
+                    type: array
+                    minItems: 1
+                    maxItems: 128
+                    items:
+                      type: object
+                      required: [id]
+                      properties:
+                        id: { type: string, minLength: 1, maxLength: 256 }
+        '401': { description: Runtime key is invalid or expired }
+        '403': { description: Model discovery is not permitted; keep the reviewed catalog }
+        '404': { description: Discovery not supported; client keeps reviewed model catalog }
+        '429': { $ref: '#/components/responses/RateLimited' }
+        '5XX': { $ref: '#/components/responses/Unavailable' }
+components:
+  responses:
+    RateLimited:
+      description: Temporarily limited; current client reports unavailable and allows a later manual refresh
+      headers:
+        Retry-After: { schema: { type: string }, description: Seconds or HTTP date for a future retry; never a refresh-token grant }
+    Unavailable:
+      description: Temporary resource failure; do not clear identity or the model key
+  securitySchemes:
+    runtimeKey: { type: http, scheme: bearer, description: Model runtime credential }