@eduwork/dsh-oidc 0.2.2 → 0.2.4

package/docs/release-checklist.en.md

@@ -1,65 +1,11 @@
-# Public release checklist
+# Package release checklist
 
 [简体中文](release-checklist.md) | **English**
 
-Record the maintainer, date, command-output links, and exceptions in the release pull request or release record. An applicable but incomplete security, compatibility, or supply-chain item blocks public release; the current maintainer records why an item is not applicable. During the initial single-maintainer phase, do not invent a second human approval: independent technical review, CI/focused regression evidence, and an explicit maintainer decision form the release basis.
+Source and publication are maintained in EduWork. Follow [the shared package workflow](https://github.com/ecnu/EduWork/blob/main/docs/PACKAGES_EN.md); this package retains its independent npm name and SemVer.
 
-This independent stable version is `0.2.0`; the manifest is updated while dev.7 runtime sources and historical frozen artifacts remain unchanged. The repository locks registry-published DSH RC.1 dependencies. npm authorization does not authorize a GitHub push or Release; record actual publication outcomes separately. Local Windows checks must not be reported as completed Linux/Node matrix or institution deployment acceptance.
-
-## Authority and project metadata
-
-- [ ] Repository owner confirmed public release and the MIT license.
-- [ ] The `freedomkk-qfeng/dsh-oidc` remote and ownership of the `@eduwork/dsh-oidc` npm package are confirmed.
-- [ ] Maintainer, security, and release-manager rosters recorded, accurately stating whether backups and a recovery path currently exist.
-- [ ] GitHub Private Vulnerability Reporting is enabled and its entry point has been checked without sensitive data.
-- [ ] ECNU/ChatECNU name, example text, colors, and trademark notice approved.
-
-## Source and protocol review
-
-- [ ] Independent technical review completed for OIDC, Key Binding, model-gateway invariants, Profile validation, Provider credentials, and the native boundary; the maintainer accepted findings and exceptions in the release record.
-- [ ] Enterprise Profile JSON Schema matches runtime behavior.
-- [ ] OpenAPI matches normative Key Binding prose and implementation.
-- [ ] OIDC standard references and limitations are current.
-- [ ] No unnecessary local reimplementation of a supported DSH capability.
-- [ ] Compatibility matrix and changelog updated.
-
-## Security and privacy
-
-- [ ] Threat model reviewed for actual topology.
-- [ ] Single-user Credential Provider, Profile ownership and shared-key-slot boundaries verified.
-- [ ] OIDC success and negative conformance suite passed against staging.
-- [ ] Cross-user/tenant Key Binding authorization tests passed.
-- [ ] API-key expiry, rotation, suspension, and remote revocation behavior tested.
-- [ ] Confirmed the WebServer listens only on `127.0.0.1` and no reverse proxy, port forward, or tunnel exposes the local session to other users.
-- [ ] Remote TLS, CSP, cookies, CSRF, egress, clock, logging, APM, and backups reviewed.
-- [ ] Privacy/legal review completed for identity and audit data.
-- [ ] Secret scans of both the current tree and publishable Git history found no production hosts, IDs, keys, logs, personal paths, or personal data.
-
-## Supply chain
-
-- [ ] Clean `npm ci` and `npm run check` completed on Windows and Linux with Node 22 and 24.
-- [ ] `npm audit` and static analysis reviewed (not merely run).
-- [ ] Every direct/transitive license and exception reviewed.
-- [ ] npm install scripts reviewed; unexpected scripts denied.
-- [ ] Lockfile diff reviewed and dependency versions pinned as intended.
-- [ ] GitHub Actions pinned to immutable commits before public release.
-
-## Product acceptance
-
-- [ ] Plain Web DSH: login, callback, display name/sub fallback, provision, model call, refresh, check, logout.
-- [ ] Desktop backend: shared Wails/Electron flow, cancellation and model defaults verified; validate any maintained legacy native bridge separately.
-- [ ] Native multimodal and text-only + image-transform routes tested.
-- [ ] Unsupported reasoning-effort model still runs with thinking enabled.
-- [ ] Failure UX tested: Discovery, token, UserInfo, bootstrap, policy denial, model key, expiry, network timeout.
-
-## Build and publish
-
-- [ ] `npm run check` passes from a clean checkout.
-- [ ] `npm pack --dry-run` and extracted tarball reviewed; only intended files included.
-- [ ] Source maps contain no private absolute paths or secrets.
-- [ ] Tag/release notes/checksums prepared.
-- [ ] The actual publication path is recorded: until a Trusted Publisher is configured, run the manual workflow only with `publish=false`; the first stable release may use the maintainer's npm CLI plus browser 2FA to publish the frozen tarball, explicitly without claiming provenance.
-- [ ] When using Trusted Publishing, the Publisher is bound to repository `freedomkk-qfeng/dsh-oidc`, workflow `release.yml`, and environment `npm`; the job uses pinned npm CLI `11.6.2`, and this commit's Windows/Linux × Node 22/24 CI is successful.
-- [ ] Inputs and artifacts are verified for the selected path: the CLI path checks frozen tarball identity, SHA-256, 2FA, and registry results; the Trusted path additionally checks the existing `v<package version>` tag, commit, workflow artifact, and an actual npm provenance attestation.
-- [ ] Publishing credentials were not written to the repository, logs, or deliverables, and the release does not claim Trusted Publishing before it is configured.
-- [ ] Rollback/deprecation and vulnerability-notification plan confirmed.
+- Review the changed behavior, version, changelog, compatibility and package lock.
+- Run npm ci and npm run check in this package directory, plus relevant real Host or browser acceptance when behavior changes. Use synthetic test data.
+- Inspect the actual tarball, public documentation, licenses and exported entries. Never ship credentials or user data.
+- Select this package in packages-release.yml; publish=false only produces artifacts. Explicit publication runs from the matching package version tag, using the npm environment and this repository's trusted publisher.
+- Verify registry bytes before updating a product lock. Publishing npm does not publish a desktop Release or deploy a client.

package/docs/release-checklist.md

@@ -1,65 +1,11 @@
-# 公开发布检查表
+# 包发布检查表
 
 **简体中文** | [English](release-checklist.en.md)
 
-在发布 Pull Request 或发行记录中记录维护者、日期、命令输出链接和例外说明。适用但未完成的安全、兼容或供应链项目会阻止公开发布；不适用项由当前维护者记录原因。项目处于初期单一维护者阶段时，不虚构第二位人工审批，以独立技术复核、CI/专项回归证据和维护者明确决定作为发布依据。
+源码与发布入口统一在 EduWork；遵循[公共包发布流程](https://github.com/ecnu/EduWork/blob/main/docs/PACKAGES.md)，本包保留独立的 npm 名称和 SemVer。
 
-本次独立稳定版本为 `0.2.0`；manifest 已更新，dev.7 的运行源码与历史冻结产物不变。仓库锁使用 npm 可安装的 DSH RC.1 基线。npm 发布授权不等于 GitHub 推送或 Release 授权，按实际执行结果记录。本机 Windows 检查不能冒充 Linux/Node 矩阵或机构真实部署验收。
-
-## 授权与项目元数据
-
-- [ ] 仓库所有者确认公开发布和 MIT 许可证。
-- [ ] `freedomkk-qfeng/dsh-oidc` 远程仓库位置和 `@eduwork/dsh-oidc` npm 包所有权均已确认。
-- [ ] 维护者、安全维护者和发布经理名单已记录，并如实说明当前是否存在替补及恢复路径。
-- [ ] GitHub Private Vulnerability Reporting 已启用并完成一次无敏感数据的入口检查。
-- [ ] ECNU/ChatECNU 名称、示例文字、颜色和商标声明获批。
-
-## 源码与协议审查
-
-- [ ] OIDC、Key Binding、模型网关一致性、Profile 校验、Provider 凭据和 native 边界已完成独立技术复核，维护者已在发布记录中接受结论和例外。
-- [ ] Enterprise Profile JSON Schema 与运行行为一致。
-- [ ] OpenAPI 与 Key Binding 规范正文和实现一致。
-- [ ] OIDC 标准引用和限制仍然有效。
-- [ ] 没有重复实现 DSH 已支持且适用的能力。
-- [ ] 兼容性矩阵和变更日志已更新。
-
-## 安全与隐私
-
-- [ ] 已按实际部署拓扑审查威胁模型。
-- [ ] 单机 Credential Provider、Profile 归属与共享 Key 槽隔离边界已验证。
-- [ ] 已在预发布环境通过 OIDC 成功和反向符合性测试。
-- [ ] 已通过跨用户/跨 tenant Key Binding 授权测试。
-- [ ] 已测试 API Key 过期、轮换、停用和远程撤销行为。
-- [ ] 已确认 WebServer 仅监听 `127.0.0.1`，没有反向代理、端口转发或隧道把本地会话暴露给其他用户。
-- [ ] 已审查远端 TLS、CSP、Cookie、CSRF、出口、时钟、日志、APM 和备份。
-- [ ] 已完成身份和审计数据的隐私/法律审查。
-- [ ] 当前树与待公开 Git 历史的密钥扫描均未发现生产 host、ID、Key、日志、个人路径或个人数据。
-
-## 供应链
-
-- [ ] Windows 和 Linux 上分别使用 Node 22、24 完成干净 `npm ci` 与 `npm run check`。
-- [ ] `npm audit` 和静态分析结果经过审查，而不只是执行。
-- [ ] 所有直接/间接许可证和例外已经审查。
-- [ ] npm 安装脚本已经审查，未预期脚本被拒绝。
-- [ ] Lockfile diff 已审查，依赖版本按预期锁定。
-- [ ] 公开发布前，GitHub Actions 已固定到不可变 commit。
-
-## 产品验收
-
-- [ ] 纯 Web DSH：登录、callback、显示 name/sub 降级、provision、模型调用、刷新、检查连接和退出。
-- [ ] 桌面 backend：Wails/Electron 共用流程、取消和默认模型正确；仍需维护的旧 native 桥单独验证。
-- [ ] 原生多模态和纯文本 + image-transform 路由均已测试。
-- [ ] 不支持 reasoning effort 的模型仍能启用 thinking 并正常运行。
-- [ ] 已测试失败 UX：Discovery、token、UserInfo、bootstrap、策略拒绝、模型 Key、过期和网络超时。
-
-## 构建与发布
-
-- [ ] 在干净 checkout 中通过 `npm run check`。
-- [ ] 已审查 `npm pack --dry-run` 和解压后的 tarball，且只包含预期文件。
-- [ ] Source map 不包含私有绝对路径或秘密。
-- [ ] Tag、发布说明和 checksum 已准备。
-- [ ] 实际发布路径已记录：Trusted Publisher 尚未配置时，手动 workflow 只以 `publish=false` 运行；首次稳定版可以使用维护者 npm CLI + 浏览器 2FA 发布冻结 tarball，且明确不声称 provenance。
-- [ ] 若使用 Trusted Publishing，Publisher 已绑定仓库 `freedomkk-qfeng/dsh-oidc`、workflow `release.yml` 和 environment `npm`；发布 job 使用固定 npm CLI `11.6.2`，且该提交的 Windows/Linux × Node 22/24 CI 已成功。
-- [ ] 发布输入与产物已按所选路径核验：CLI 路径核对冻结 tarball 身份、SHA-256、2FA 和 registry 结果；Trusted 路径还核对现有 `v<package version>` tag、提交、workflow artifact 和实际 npm provenance attestation。
-- [ ] 发布凭据没有写入仓库、日志或交付物；未配置 Trusted Publisher 时也不宣称使用了 Trusted Publishing。
-- [ ] 已确认回滚、弃用和漏洞通知计划。
+- 核对变更行为、版本、变更记录、兼容范围和依赖锁。
+- 在当前包目录执行 npm ci、npm run check；有行为变化时补对应 Host 或浏览器实测，使用合成测试数据。
+- 检查实际 tarball、公开文档、许可证和导出入口，不携带凭据或用户数据。
+- 在 packages-release.yml 中选择本包；publish=false 仅产出候选。明确发布时从匹配包版本的 tag 运行，使用 npm environment 与本仓库的 Trusted Publisher。
+- 核验 registry 中的实际字节后再更新产品锁。发布 npm 不会发布桌面 Release 或替换客户端。

package/docs/server-integration-contract.en.md

@@ -1,13 +1,15 @@
 # EduWork identity and resource integration (RFC EW-IDENTITY-1)
 
-> Scope update in .20260910.6: quota and activity heartbeat are institution-only extensions. The public package never requests /quota and its resources RPC contains only model metadata. No capability string or configuration flag enables quota in the public package. ECNU retains its existing server wire in a separate package.
+> Capability scope: quota and activity heartbeat are institution-only extensions. The public package never requests /quota and its resources RPC contains only model metadata. No capability string or configuration flag enables quota in the public package. ECNU retains its existing server wire in a separate package.
 
-> Current candidate supports two modes: identity-only OIDC can omit all resource interfaces and use personal API keys. The complete organization-resource mode below adds managed credentials and models; see [Public resource protocol](public-resource-protocol.en.md). The mandatory requirements below apply to complete integration, not identity-only login.
+> Two integration modes are supported: identity-only OIDC can omit all resource interfaces and use personal API keys. The complete organization-resource mode below adds managed credentials and models; see [Public resource protocol](public-resource-protocol.en.md). The mandatory requirements below apply to complete integration, not identity-only login.
 
 [简体中文](server-integration-contract.md) | **English**
 
 This document is written for identity-platform, model-platform, and integration-test teams. It defines, in API-reference form, the server capabilities required by `dsh-oidc`.
 
+For the goals behind these interfaces and ways to contribute to their evolution, see the [Open Identity and Model Integration Initiative](open-integration.en.md). This specification remains the implementation and integration reference; the initiative does not change existing fields, paths, or compatibility rules.
+
 Status: implemented client wire specification, not an IETF standard. Source code and HTTP contract tests determine current behavior. Section 10 provides curl examples; section 11 contains **unimplemented optional proposals**. Every client is a local, single-user Runtime; this is not a shared Web-login architecture.
 
 | Capability | Required interfaces | Optionality and implemented behavior |

package/docs/server-integration-contract.md

@@ -1,13 +1,15 @@
 # EduWork 身份与资源接入规范（RFC EW-IDENTITY-1）
 
-> .20260910.6 范围调整：配额与活跃心跳属于机构专属扩展。公版不请求 /quota，resources RPC 只返回模型元数据；任何 capabilities 字符串或公版配置开关都不会启用配额。ECNU 在独立机构包中沿用原配额服务协议。
+> 能力范围：配额与活跃心跳属于机构专属扩展。公版不请求 /quota，resources RPC 只返回模型元数据；任何 capabilities 字符串或公版配置开关都不会启用配额。ECNU 在独立机构包中沿用原配额服务协议。
 
-> 当前候选支持两种模式：纯身份 OIDC 可省略全部资源接口，用户自配个人 Key；下文完整机构资源模式提供托管凭据与模型，见 [公共资源协议](public-resource-protocol.md)。下文的完整交付要求不适用于只做身份接入的场景。
+> 支持两种接入模式：纯身份 OIDC 可省略全部资源接口，用户自配个人 Key；下文完整机构资源模式提供托管凭据与模型，见 [公共资源协议](public-resource-protocol.md)。下文的完整交付要求不适用于只做身份接入的场景。
 
 **简体中文** | [English](server-integration-contract.en.md)
 
 本文面向身份平台、模型平台和联调测试人员，以接口说明的形式定义接入 `dsh-oidc` 时服务端必须提供的能力。
 
+希望了解这套接口的目标或参与后续演进，请先看[开放身份与模型接入倡议](open-integration.md)。本规范是实现与联调依据，倡议不改变现有字段、路径或兼容性约定。
+
 状态：现有客户端 wire 规范；不是 IETF 标准。本文以 `@eduwork/dsh-oidc` 源码及 HTTP 契约测试为准。第 10 节列出需填入本次授权结果的 curl 请求示例；第 11 节是**尚未实现的可选扩展提案**。所有客户端都是用户本机的单用户 Runtime，不设计共享 Web 服务端登录会话。
 
 | 能力档 | 最小交付 | 可选性与当前行为 |
@@ -816,7 +818,7 @@ curl --fail-with-body --max-time 10 "$REVOCATION_ENDPOINT" \
 
 ### 11.1 机构资源发现
 
-当前公版只读取本机可信 JSONC/Profile；**不会请求** `/.well-known/eduwork-configuration`。后续可约定此 HTTPS 入口返回纯数据 `protocol_version: eduwork-discovery/v1alpha1`，包含机构展示、OIDC Public Client、资源基址和能力名称。必须由用户/发行方明确导入，核对 issuer/provider/origin 后转换成本机配置；不得自动更换凭据目标，不得下发插件、脚本、CSS、可执行命令或任意模型 adapter。具体字段、签名/信任根、版本协商另行评审，不能把该提案当作本轮服务器必做接口。
+当前公版只读取本机可信 JSONC/Profile；**不会请求** `/.well-known/eduwork-configuration`。后续可约定此 HTTPS 入口返回纯数据 `protocol_version: eduwork-discovery/v1alpha1`，包含机构展示、OIDC Public Client、资源基址和能力名称。必须由用户/发行方明确导入，核对 issuer/provider/origin 后转换成本机配置；不得自动更换凭据目标，不得下发插件、脚本、CSS、可执行命令或任意模型 adapter。具体字段、签名/信任根、版本协商另行评审，不能把该提案当作当前协议的必需接口。
 
 ### 11.2 机构活跃心跳
 

package/examples/enterprise-profile.example.json

@@ -1,78 +1,78 @@
-{
-  "schemaVersion": "dsh-oidc/v1alpha1",
-  "id": "example-university",
-  "displayName": "Example University AI",
-  "organization": "Example University",
-  "brand": {
-    "productName": "Example AI Work",
-    "organizationName": "Example University",
-    "mark": "E",
-    "primaryColor": "#5157af",
-    "loginTitle": "Sign in with Example University",
-    "loginDescription": "Authenticate with the university identity provider and bind a model runtime credential. Your password never enters DSH.",
-    "supportURL": "https://support.example.edu/ai"
-  },
-  "oidc": {
-    "issuer": "https://id.example.edu/oidc",
-    "clientId": "dsh-web-public-client",
-    "scopes": [
-      "openid",
-      "profile",
-      "offline_access",
-      "worker.bootstrap.read",
-      "worker.credential.provision",
-      "worker.credential.read",
-      "worker.credential.renew"
-    ]
-  },
-  "keyBinding": {
-    "baseURL": "https://ai.example.edu/api/worker/v1",
-    "credentialRef": "EDUWORK_API_KEY"
-  },
-  "provider": {
-    "id": "example-ai",
-    "displayName": "Example AI",
-    "adapter": "openai-compatible",
-    "baseURL": "https://ai.example.edu/open/api/v1",
-    "reasoning": "high",
-    "defaultContextWindow": 262144,
-    "defaultMaxTokens": 32768,
-    "streamIdleTimeoutMs": 300000,
-    "retryPolicy": {
-      "mode": "normal",
-      "maxRetries": 2
-    },
-    "compat": {
-      "supportsDeveloperRole": false,
-      "supportsStore": false,
-      "supportsReasoningEffort": true,
-      "supportsUsageInStreaming": true,
-      "maxTokensField": "max_tokens",
-      "supportsStrictMode": false,
-      "supportsLongCacheRetention": false,
-      "thinkingFormat": "deepseek",
-      "requiresReasoningContentOnAssistantMessages": true
-    },
-    "models": [
-      {
-        "id": "example-max",
-        "name": "Example Max",
-        "input": ["text"],
-        "reasoningEfforts": {
-          "max": "max",
-          "high": "high",
-          "low": "low"
-        },
-        "defaultReasoningEffort": "high"
-      },
-      {
-        "id": "example-plus",
-        "name": "Example Plus",
-        "input": ["text", "image"],
-        "compat": {
-          "supportsReasoningEffort": false
-        }
-      }
-    ]
-  }
-}
+{
+  "schemaVersion": "dsh-oidc/v1alpha1",
+  "id": "example-university",
+  "displayName": "Example University AI",
+  "organization": "Example University",
+  "brand": {
+    "productName": "Example AI Work",
+    "organizationName": "Example University",
+    "mark": "E",
+    "primaryColor": "#5157af",
+    "loginTitle": "Sign in with Example University",
+    "loginDescription": "Authenticate with the university identity provider and bind a model runtime credential. Your password never enters DSH.",
+    "supportURL": "https://support.example.edu/ai"
+  },
+  "oidc": {
+    "issuer": "https://id.example.edu/oidc",
+    "clientId": "replace-with-public-client-id",
+    "scopes": [
+      "openid",
+      "profile",
+      "offline_access",
+      "worker.bootstrap.read",
+      "worker.credential.provision",
+      "worker.credential.read",
+      "worker.credential.renew"
+    ]
+  },
+  "keyBinding": {
+    "baseURL": "https://ai.example.edu/api/worker/v1",
+    "credentialRef": "EDUWORK_API_KEY"
+  },
+  "provider": {
+    "id": "example-ai",
+    "displayName": "Example AI",
+    "adapter": "openai-compatible",
+    "baseURL": "https://ai.example.edu/open/api/v1",
+    "reasoning": "high",
+    "defaultContextWindow": 262144,
+    "defaultMaxTokens": 32768,
+    "streamIdleTimeoutMs": 300000,
+    "retryPolicy": {
+      "mode": "normal",
+      "maxRetries": 2
+    },
+    "compat": {
+      "supportsDeveloperRole": false,
+      "supportsStore": false,
+      "supportsReasoningEffort": true,
+      "supportsUsageInStreaming": true,
+      "maxTokensField": "max_tokens",
+      "supportsStrictMode": false,
+      "supportsLongCacheRetention": false,
+      "thinkingFormat": "deepseek",
+      "requiresReasoningContentOnAssistantMessages": true
+    },
+    "models": [
+      {
+        "id": "example-max",
+        "name": "Example Max",
+        "input": ["text"],
+        "reasoningEfforts": {
+          "max": "max",
+          "high": "high",
+          "low": "low"
+        },
+        "defaultReasoningEffort": "high"
+      },
+      {
+        "id": "example-plus",
+        "name": "Example Plus",
+        "input": ["text", "image"],
+        "compat": {
+          "supportsReasoningEffort": false
+        }
+      }
+    ]
+  }
+}

package/examples/identity-only.example.json

@@ -4,7 +4,7 @@
   "displayName": "Example Organization",
   "oidc": {
     "issuer": "https://identity.example.edu",
-    "clientId": "example-public-client",
+    "clientId": "replace-with-public-client-id",
     "scopes": ["openid", "profile", "offline_access"]
   }
 }

package/examples/resources-discovery.example.json

@@ -4,7 +4,7 @@
   "displayName": "Example Organization",
   "oidc": {
     "issuer": "https://identity.example.edu",
-    "clientId": "example-public-client",
+    "clientId": "replace-with-public-client-id",
     "scopes": ["openid", "profile", "offline_access"]
   },
   "keyBinding": {

package/lib/provider/core.js

@@ -161,6 +161,7 @@ export function resolveEnterpriseProfiles(raw = {}) {
         compat,
         modelPolicy: {
           reasoning, supportsReasoningEffort, reasoningEfforts: efforts, defaultReasoningEffort,
+          requiresReasoningContent: reasoning && compat.requiresReasoningContentOnAssistantMessages === true,
           ...(internalThinkingEffort === undefined ? {} : { internalThinkingEffort }),
         },
       }

package/lib/provider/transform-adapter.js

@@ -1,5 +1,31 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 
+/** pi-ai preserves the response's raw reasoning alias in replay metadata.
+ * Routes requiring reasoning_content must replay that same text under the
+ * canonical field, otherwise pi-ai adds an empty alias and strict gateways
+ * reject the pair. Change only the outgoing copy; durable history is untouched.
+ */
+export function canonicalReasoningReplay(request, policy) {
+  if (!policy.requiresReasoningContent) return request
+  let changed = false
+  const messages = request.messages.map(message => {
+    const source = message.source, replay = source?.replayState
+    if (message.role !== 'assistant' || source?.kind !== 'model' || source.provider !== request.provider || source.model !== request.model
+      || replay?.response?.kind !== 'pi-ai' || replay.response.version !== 2 || replay.response.api !== 'openai-completions'
+      || !Array.isArray(replay.blocks)) return message
+    let replaced = false
+    const blocks = replay.blocks.map(block => {
+      if (block.type !== 'reasoning' || !['reasoning', 'reasoning_text'].includes(block.thinkingSignature)) return block
+      replaced = true
+      return { ...block, thinkingSignature: 'reasoning_content' }
+    })
+    if (!replaced) return message
+    changed = true
+    return { ...message, source: { ...source, replayState: { ...replay, blocks } } }
+  })
+  return changed ? { ...request, messages } : request
+}
+
 /** Delegate one enterprise route while applying capabilities contributed by replaceable feature plugins. */
 export class TransformingEnterpriseAdapter {
   constructor(inner, transforms, modelPolicy = () => ({})) {
@@ -73,7 +99,7 @@ export class TransformingEnterpriseAdapter {
       }
       request = { ...options, reasoningEffort: effort }
     }
-    yield* prepared.stream(await this.transforms.apply(request, nativeModelInfo))
+    yield* prepared.stream(canonicalReasoningReplay(await this.transforms.apply(request, nativeModelInfo), policy))
   }
 
   async * stream(options) {

package/lib/provider/transforms.js

@@ -56,4 +56,3 @@ export class EnterpriseModelTransforms extends Service {
     return transformed
   }
 }
-

package/lib/typert.host.js

@@ -1,44 +1,44 @@
-import {
+import {
   accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
   modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT = {
-  package: pkg, face: 'host', schemas: [],
-  invocations: [
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT = {
+  package: pkg, face: 'host', schemas: [],
+  invocations: [
     descriptor('configuration', [], configurationResult),
     descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('resources', [profile()], resourcesResult),
-    descriptor('begin', [profile()], beginResult),
-    descriptor('loginStatus', [login()], loginResult),
-    descriptor('cancelLogin', [login()], loginResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
     descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-  model: { services: [], events: [], objects: [] },
-}
-
-export default TYPERT
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+  model: { services: [], events: [], objects: [] },
+}
+
+export default TYPERT

package/lib/typert.remote-client.js

@@ -1,43 +1,43 @@
-import {
+import {
   accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
   modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT_REMOTE = {
-  package: pkg,
-  descriptors: [
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT_REMOTE = {
+  package: pkg,
+  descriptors: [
     descriptor('configuration', [], configurationResult),
     descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('resources', [profile()], resourcesResult),
-    descriptor('begin', [profile()], beginResult),
-    descriptor('loginStatus', [login()], loginResult),
-    descriptor('cancelLogin', [login()], loginResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
     descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-}
-
-export default TYPERT_REMOTE
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+}
+
+export default TYPERT_REMOTE