@eduwork/dsh-oidc 0.2.3 → 0.3.0-dev.1

package/examples/ecnu.enterprise-profile.example.json

@@ -12,28 +12,17 @@
     "loginDescription": "登录后由学校企业服务为当前用户绑定 ChatECNU 运行凭据；学校密码不会进入 DSH。",
     "supportURL": "https://support.example.edu/replace-me"
   },
-  "oidc": {
-    "issuer": "https://oidc.example.edu/replace-me",
+  "auth": {
+    "discoveryUrl": "https://models.example.org/.well-known/openid-configuration",
+    "expectedIssuer": "https://models.example.org",
+    "experimentalOidcLlm": true,
     "clientId": "replace-with-public-client-id",
-    "scopes": [
-      "openid",
-      "profile",
-      "offline_access",
-      "worker.bootstrap.read",
-      "worker.credential.provision",
-      "worker.credential.read",
-      "worker.credential.renew"
-    ]
-  },
-  "keyBinding": {
-    "baseURL": "https://worker.example.edu/api/worker/v1",
-    "credentialRef": "EDUWORK_API_KEY"
+    "identityMode": "oidc"
   },
   "provider": {
     "id": "chatecnu",
     "displayName": "ChatECNU",
     "adapter": "openai-compatible",
-    "baseURL": "https://models.example.edu/open/api/v1",
     "reasoning": "high",
     "defaultContextWindow": 1000000,
     "defaultMaxTokens": 393216,
@@ -59,7 +48,9 @@
         "name": "ecnu-max",
         "contextWindow": 1000000,
         "maxTokens": 393216,
-        "input": ["text"],
+        "input": [
+          "text"
+        ],
         "reasoningEfforts": {
           "max": "max",
           "high": "high",
@@ -71,11 +62,15 @@
         "name": "ecnu-plus",
         "contextWindow": 262144,
         "maxTokens": 65536,
-        "input": ["text", "image"],
+        "input": [
+          "text",
+          "image"
+        ],
         "compat": {
           "supportsReasoningEffort": false
         }
       }
-    ]
+    ],
+    "modelSource": "discovery"
   }
 }

package/examples/enterprise-profile.example.json

@@ -1,78 +1,73 @@
-{
-  "schemaVersion": "dsh-oidc/v1alpha1",
-  "id": "example-university",
-  "displayName": "Example University AI",
-  "organization": "Example University",
-  "brand": {
-    "productName": "Example AI Work",
-    "organizationName": "Example University",
-    "mark": "E",
-    "primaryColor": "#5157af",
-    "loginTitle": "Sign in with Example University",
-    "loginDescription": "Authenticate with the university identity provider and bind a model runtime credential. Your password never enters DSH.",
-    "supportURL": "https://support.example.edu/ai"
-  },
-  "oidc": {
-    "issuer": "https://id.example.edu/oidc",
-    "clientId": "dsh-web-public-client",
-    "scopes": [
-      "openid",
-      "profile",
-      "offline_access",
-      "worker.bootstrap.read",
-      "worker.credential.provision",
-      "worker.credential.read",
-      "worker.credential.renew"
-    ]
-  },
-  "keyBinding": {
-    "baseURL": "https://ai.example.edu/api/worker/v1",
-    "credentialRef": "EDUWORK_API_KEY"
-  },
-  "provider": {
-    "id": "example-ai",
-    "displayName": "Example AI",
-    "adapter": "openai-compatible",
-    "baseURL": "https://ai.example.edu/open/api/v1",
-    "reasoning": "high",
-    "defaultContextWindow": 262144,
-    "defaultMaxTokens": 32768,
-    "streamIdleTimeoutMs": 300000,
-    "retryPolicy": {
-      "mode": "normal",
-      "maxRetries": 2
-    },
-    "compat": {
-      "supportsDeveloperRole": false,
-      "supportsStore": false,
-      "supportsReasoningEffort": true,
-      "supportsUsageInStreaming": true,
-      "maxTokensField": "max_tokens",
-      "supportsStrictMode": false,
-      "supportsLongCacheRetention": false,
-      "thinkingFormat": "deepseek",
-      "requiresReasoningContentOnAssistantMessages": true
-    },
-    "models": [
-      {
-        "id": "example-max",
-        "name": "Example Max",
-        "input": ["text"],
-        "reasoningEfforts": {
-          "max": "max",
-          "high": "high",
-          "low": "low"
-        },
-        "defaultReasoningEffort": "high"
-      },
-      {
-        "id": "example-plus",
-        "name": "Example Plus",
-        "input": ["text", "image"],
-        "compat": {
-          "supportsReasoningEffort": false
-        }
-      }
-    ]
-  }
-}
+{
+  "schemaVersion": "dsh-oidc/v1alpha1",
+  "id": "example-university",
+  "displayName": "Example University AI",
+  "organization": "Example University",
+  "brand": {
+    "productName": "Example AI Work",
+    "organizationName": "Example University",
+    "mark": "E",
+    "primaryColor": "#5157af",
+    "loginTitle": "Sign in with Example University",
+    "loginDescription": "Authenticate with the university identity provider and bind a model runtime credential. Your password never enters DSH.",
+    "supportURL": "https://support.example.edu/ai"
+  },
+  "auth": {
+    "discoveryUrl": "https://models.example.org/.well-known/openid-configuration",
+    "expectedIssuer": "https://models.example.org",
+    "experimentalOidcLlm": true,
+    "clientId": "replace-with-public-client-id",
+    "identityMode": "oidc"
+  },
+  "provider": {
+    "id": "example-ai",
+    "displayName": "Example AI",
+    "adapter": "openai-compatible",
+    "reasoning": "high",
+    "defaultContextWindow": 262144,
+    "defaultMaxTokens": 32768,
+    "streamIdleTimeoutMs": 300000,
+    "retryPolicy": {
+      "mode": "normal",
+      "maxRetries": 2
+    },
+    "compat": {
+      "supportsDeveloperRole": false,
+      "supportsStore": false,
+      "supportsReasoningEffort": true,
+      "supportsUsageInStreaming": true,
+      "maxTokensField": "max_tokens",
+      "supportsStrictMode": false,
+      "supportsLongCacheRetention": false,
+      "thinkingFormat": "deepseek",
+      "requiresReasoningContentOnAssistantMessages": true
+    },
+    "models": [
+      {
+        "id": "example-max",
+        "name": "Example Max",
+        "input": [
+          "text"
+        ],
+        "reasoningEfforts": {
+          "max": "max",
+          "high": "high",
+          "low": "low"
+        },
+        "defaultReasoningEffort": "high"
+      },
+      {
+        "id": "example-plus",
+        "name": "Example Plus",
+        "input": [
+          "text",
+          "image"
+        ],
+        "compat": {
+          "supportsReasoningEffort": false
+        }
+      }
+    ],
+    "modelSource": "discovery"
+  }
+}

package/examples/identity-only.example.json

@@ -4,7 +4,7 @@
   "displayName": "Example Organization",
   "oidc": {
     "issuer": "https://identity.example.edu",
-    "clientId": "example-public-client",
+    "clientId": "replace-with-public-client-id",
     "scopes": ["openid", "profile", "offline_access"]
   }
 }

package/examples/litellm.enterprise-profile.example.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": "dsh-oidc/v1alpha1",
+  "id": "example-gateway",
+  "displayName": "示例模型网关",
+  "auth": {
+    "discoveryUrl": "https://gateway.example.org/.well-known/litellm-cli-auth",
+    "expectedIssuer": "https://gateway.example.org"
+  }
+}

package/examples/oidc-llm.enterprise-profile.example.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "dsh-oidc/v1alpha1",
+  "id": "example-models",
+  "displayName": "示例模型服务（实验）",
+  "auth": {
+    "discoveryUrl": "https://models.example.org/.well-known/openid-configuration",
+    "expectedIssuer": "https://models.example.org",
+    "experimentalOidcLlm": true,
+    "clientId": "replace-with-public-client-id",
+    "identityMode": "oidc"
+  }
+}

package/examples/resources-discovery.example.json

@@ -2,19 +2,16 @@
   "schemaVersion": "dsh-oidc/v1alpha1",
   "id": "example-resources",
   "displayName": "Example Organization",
-  "oidc": {
-    "issuer": "https://identity.example.edu",
-    "clientId": "example-public-client",
-    "scopes": ["openid", "profile", "offline_access"]
-  },
-  "keyBinding": {
-    "type": "eduwork-resources-v1",
-    "baseURL": "https://ai.example.edu/api/worker/v1"
+  "auth": {
+    "discoveryUrl": "https://models.example.org/.well-known/openid-configuration",
+    "expectedIssuer": "https://models.example.org",
+    "experimentalOidcLlm": true,
+    "clientId": "replace-with-public-client-id",
+    "identityMode": "oidc"
   },
   "provider": {
     "id": "example-ai",
     "adapter": "openai-compatible",
-    "baseURL": "https://ai.example.edu/open/api/v1",
     "modelSource": "discovery"
   }
 }

package/lib/callback-page.js

@@ -15,13 +15,13 @@ export function callbackPage(profile = {}, outcome = 'failed', language = 'en')
   const zh = language === 'zh-CN'
   const brand = profile.brand ?? {}, product = brand.productName || profile.displayName || 'EduWork'
   const organization = brand.organizationName || profile.organization || ''
-  const success = outcome === 'completed' || outcome === 'credential-required'
+  const success = outcome === 'completed'
   const title = success ? (zh ? '身份认证已完成' : 'You’re signed in')
     : outcome === 'expired' ? (zh ? '此次登录已过期' : 'This sign-in has expired') : (zh ? '此次登录未完成' : 'Sign-in did not complete')
-  const description = outcome === 'credential-required'
-    ? (zh ? '请返回应用，继续完成模型服务连接。' : 'Return to the app to finish connecting your model service.')
-    : success ? (zh ? '请返回应用继续工作。' : 'Return to the app to continue your work.')
-      : (zh ? '请返回应用重新发起登录。' : 'Return to the app and start sign-in again.')
+  const description = success ? (zh ? '请返回应用继续工作。' : 'Return to the app to continue your work.')
+      : outcome === 'issuer-invalid'
+        ? (zh ? '认证服务返回的信息与登录配置不一致。请联系管理员检查后重试。' : 'The authentication response does not match the sign-in configuration. Contact your administrator before trying again.')
+        : (zh ? '请返回应用重新发起登录。' : 'Return to the app and start sign-in again.')
   const accent = /^#[a-f0-9]{6}$/i.test(brand.primaryColor ?? '') ? brand.primaryColor : '#4f5fd7'
   let logo = '', imageSource = "'none'"
   if (/^data:image\/(png|webp);base64,[A-Za-z0-9+/]+=*$/.test(brand.logoURL ?? '')) { logo = brand.logoURL; imageSource = 'data:' }

package/lib/client.js

@@ -4247,7 +4247,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		const pkg$1 = "@eduwork/dsh-oidc";
 		const profileIdSchema = string().min(1).max(64);
 		const loginIdSchema = string().regex(/^[A-Za-z0-9_-]{32}$/);
-		const reconcileOptionsSchema = object({ allowProvision: boolean().optional() }).strict();
+		const reconcileOptionsSchema = object({}).strict();
 		const baseURLSchema = string().min(1).max(2048);
 		const modelCatalogModeSchema = _enum(["discovery", "manual"]);
 		const configurationTargetSchema = _enum(["config", "examples"]);
@@ -4648,7 +4648,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						return next.status;
 					}
 					if (next.state === "cancelled") return service.status(profileID);
-					if (next.state === "failed") throw Object.assign(/* @__PURE__ */ new Error("Organization sign-in did not complete. Please try again."), { code: next.errorCode });
+					if (next.state === "failed") {
+						const message = ["gateway_callback_issuer_missing", "gateway_callback_issuer_invalid"].includes(next.errorCode) ? "The authentication response does not match the sign-in configuration. Contact your administrator before trying again." : "Organization sign-in did not complete. Please try again.";
+						throw Object.assign(new Error(message), { code: next.errorCode });
+					}
 					if (next.state === "expired") break;
 					await wait(interval, signal);
 				}
@@ -4709,7 +4712,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			configure: "配置",
 			enable: "启用并重载",
 			login: "登录",
-			provision: "确认创建并连接",
 			refresh: "刷新状态",
 			processing: "处理中…",
 			profileManaged: "Enterprise Profile 管理",
@@ -4789,7 +4791,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			configure: "Configure",
 			enable: "Enable and reload",
 			login: "Sign in",
-			provision: "Confirm and connect",
 			refresh: "Refresh",
 			processing: "Working…",
 			profileManaged: "Enterprise Profile managed",
@@ -5005,7 +5006,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			};
 			const login = useSignIn(service);
 			const signIn = (profileID) => run(() => login.begin(profileID));
-			const connect = (profileID, status) => status?.state === "authenticated" || status?.state === "provision_required" ? run(() => service.reconcile(profileID, { allowProvision: true })) : signIn(profileID);
+			const connect = (profileID) => signIn(profileID);
 			if (!management) return h$2("p", { style: {
 				margin: "18px 0",
 				color: textSecondary,
@@ -5163,12 +5164,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					type: "button",
 					disabled: busy,
 					style: primaryStyle,
-					onClick: () => connect(profile.id, status)
-				}, busy ? copy.processing : status?.state === "authenticated" || status?.state === "provision_required" ? copy.provision : copy.login), profile.enabled && !restartRequired && connected && h$2("button", {
+					onClick: () => connect(profile.id)
+				}, busy ? copy.processing : copy.login), profile.enabled && !restartRequired && connected && h$2("button", {
 					type: "button",
 					disabled: busy,
 					style: buttonStyle,
-					onClick: () => run(() => service.reconcile(profile.id, { allowProvision: false }))
+					onClick: () => run(() => service.reconcile(profile.id, {}))
 				}, copy.refresh))));
 			})) : h$2("div", { style: {
 				padding: 18,
@@ -5703,6 +5704,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			const activate = async (value) => {
 				if (value?.state === "connected" && value.credentialReady) await connected(value.profileID);
 			};
+			const reconcile = async (id, select) => {
+				const generation = mutate(id), result = await base.reconcile(id, {});
+				if (epoch(id) === generation && !disposed) {
+					publish(result);
+					if (select) await activate(result);
+				}
+				return result;
+			};
 			return {
 				service: {
 					...base,
@@ -5737,14 +5746,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						}
 						return next;
 					},
-					async reconcile(id, options) {
-						const generation = mutate(id), result = await base.reconcile(id, options);
-						if (epoch(id) === generation && !disposed) {
-							publish(result);
-							if (options?.allowProvision === true) await activate(result);
-						}
-						return result;
-					},
+					reconcile: (id) => reconcile(id, false),
+					useModels: (id) => reconcile(id, true),
 					async logout(id) {
 						const generation = mutate(id), result = await base.logout(id);
 						if (epoch(id) === generation) publish(result);
@@ -5787,7 +5790,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			check: "刷新账户",
 			logout: "退出登录",
 			login: "登录账户",
-			provision: "确认创建模型凭据",
 			waiting: "请在浏览器中完成登录…",
 			cancel: "取消登录",
 			processing: "正在处理…"
@@ -5796,7 +5798,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			check: "Refresh account",
 			logout: "Sign out",
 			login: "Sign in",
-			provision: "Provision model credential",
 			waiting: "Complete sign-in in your browser…",
 			cancel: "Cancel sign-in",
 			processing: "Working…"
@@ -5897,7 +5898,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				style: action,
 				onClick
 			}, label);
-			const refreshAccount = () => service.reconcile(profile.id, { allowProvision: false });
+			const refreshAccount = () => service.reconcile(profile.id, {});
 			const defaultContent = signedIn && button(busy ? words.processing : words.check, () => void run(refreshAccount));
 			const content = open && h$1("div", {
 				ref: panel,
@@ -5938,7 +5939,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			}, { fallback: defaultContent }) : defaultContent, h$1("div", { style: {
 				display: "grid",
 				gap: 6
-			} }, status?.state === "authenticated" && profile.provider && button(words.provision, () => void run(() => service.reconcile(profile.id, { allowProvision: true }))), !signedIn && button(busy ? words.processing : words.login, () => void run(() => login.begin(profile.id))), signedIn && button(words.logout, () => void run(() => service.logout(profile.id), true))), login.pending && h$1("p", { role: "status" }, words.waiting, " ", h$1("button", {
+			} }, !signedIn && button(busy ? words.processing : words.login, () => void run(() => login.begin(profile.id))), signedIn && button(words.logout, () => void run(() => service.logout(profile.id), true))), login.pending && h$1("p", { role: "status" }, words.waiting, " ", h$1("button", {
 				type: "button",
 				role: "menuitem",
 				style: action,
@@ -6005,13 +6006,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			identityConnected: "组织身份已登录",
 			unavailable: "企业模型服务暂时不可用",
 			connected: "已连接",
-			authenticated: "身份认证完成，等待创建模型凭据",
 			disconnected: "尚未连接",
-			description: "使用组织统一身份认证连接企业模型。密码不会进入 DSH；模型请求只使用绑定后的运行凭据。",
+			description: "使用组织统一身份认证连接企业模型。密码不会进入 DSH；模型请求使用登录授权。",
 			connecting: "正在连接…",
 			login: "使用企业账号登录",
-			provisioning: "正在创建…",
-			provision: "确认创建模型凭据",
 			checking: "正在检查…",
 			check: "检查连接",
 			logout: "退出登录",
@@ -6021,7 +6019,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			other: "使用其他模型",
 			enabled: "完成后将启用",
 			footerConnected: "企业模型已连接",
-			footerAuthenticated: "身份认证完成，等待创建模型凭据",
 			footerSetup: "点击设置完成登录"
 		} : {
 			waiting: "Complete sign-in in your browser…",
@@ -6030,13 +6027,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			identityConnected: "Organization identity connected",
 			unavailable: "Enterprise model service is temporarily unavailable",
 			connected: "Connected",
-			authenticated: "Identity verified; model credential is not provisioned",
 			disconnected: "Not connected",
-			description: "Connect with your organization account. Your password never enters DSH; model requests use only the bound runtime credential.",
+			description: "Connect with your organization account. Your password never enters DSH; model requests use your sign-in authorization.",
 			connecting: "Connecting…",
 			login: "Sign in with organization",
-			provisioning: "Provisioning…",
-			provision: "Provision model credential",
 			checking: "Checking…",
 			check: "Check connection",
 			logout: "Sign out",
@@ -6046,7 +6040,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			other: "Use another model",
 			enabled: "This enables",
 			footerConnected: "Enterprise models connected",
-			footerAuthenticated: "Identity verified; provision a model credential",
 			footerSetup: "Open settings to connect"
 		};
 		async function unwrap(operation) {
@@ -6176,7 +6169,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			};
 			const login = useSignIn(service);
 			const begin = () => account.run("login", () => login.begin(profile.id));
-			const stateLabel = account.status?.state === "connected" ? messages.connected : account.status?.state === "authenticated" ? messages.authenticated : messages.disconnected;
+			const stateLabel = account.status?.state === "connected" ? messages.connected : messages.disconnected;
 			const userName = accountUserName(account.status);
 			return h("section", { style: {
 				padding: "16px 0",
@@ -6216,21 +6209,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				display: "flex",
 				gap: 8,
 				flexWrap: "wrap"
-			} }, account.status?.state !== "connected" && account.status?.state !== "authenticated" && h("button", {
+			} }, account.status?.state !== "connected" && h("button", {
 				type: "button",
 				disabled: Boolean(account.busy),
 				style: primary,
 				onClick: begin
-			}, account.busy ? messages.connecting : messages.login), profile.provider && !account.status?.credentialReady && account.status?.state === "authenticated" && h("button", {
-				type: "button",
-				disabled: Boolean(account.busy),
-				style: primary,
-				onClick: () => account.run("provision", () => service.reconcile(profile.id, { allowProvision: true }))
-			}, account.busy ? messages.provisioning : messages.provision), account.status?.state === "connected" && h("button", {
+			}, account.busy ? messages.connecting : messages.login), account.status?.state === "connected" && h("button", {
 				type: "button",
 				disabled: Boolean(account.busy),
 				style: button,
-				onClick: () => account.run("reconcile", () => service.reconcile(profile.id, { allowProvision: false }))
+				onClick: () => account.run("reconcile", () => service.reconcile(profile.id, {}))
 			}, account.busy ? messages.checking : messages.check), account.status?.state !== "signed_out" && h("button", {
 				type: "button",
 				disabled: Boolean(account.busy),
@@ -6332,17 +6320,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				display: "flex",
 				gap: 9,
 				flexWrap: "wrap"
-			} }, account.status?.state !== "authenticated" && h("button", {
-				type: "button",
-				disabled: Boolean(account.busy),
-				style: primary,
-				onClick: account.status?.state === "connected" ? () => account.run("provision", () => service.reconcile(profile.id, { allowProvision: true })) : begin
-			}, account.busy ? messages.connecting : account.status?.state === "connected" ? isChinese ? "使用企业模型" : "Use organization model" : messages.login), account.status?.state === "authenticated" && h("button", {
+			} }, h("button", {
 				type: "button",
 				disabled: Boolean(account.busy),
 				style: primary,
-				onClick: () => account.run("provision", () => service.reconcile(profile.id, { allowProvision: true }))
-			}, account.busy ? messages.provisioning : messages.provision), h("button", {
+				onClick: account.status?.state === "connected" ? () => account.run("select", () => service.useModels(profile.id)) : begin
+			}, account.busy ? messages.connecting : account.status?.state === "connected" ? isChinese ? "使用企业模型" : "Use organization model" : messages.login), h("button", {
 				type: "button",
 				disabled: Boolean(account.busy),
 				style: button,
@@ -6369,7 +6352,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			const profile = configuration.profiles[0];
 			const status = useAccountStatus(service, profile.id);
 			const userName = accountUserName(status);
-			const statusLabel = status?.state === "connected" ? profile.provider ? messages.footerConnected : messages.identityConnected : status?.state === "authenticated" ? messages.footerAuthenticated : messages.footerSetup;
+			const statusLabel = status?.state === "connected" ? profile.provider ? messages.footerConnected : messages.identityConnected : messages.footerSetup;
 			return h(AccountMenu, {
 				service,
 				profile,

package/lib/desktop-oidc.js

@@ -6,7 +6,7 @@ import { callbackLanguage, callbackPage } from './callback-page.js'
 const MAX_FLOWS = 32
 const MAX_HISTORY = 128
 const error = (code, message) => Object.assign(new Error(message), { code })
-const safeCodes = new Set(['oidc_callback_invalid', 'oidc_authorization_rejected', 'oidc_token_invalid', 'oidc_id_token_invalid', 'oidc_userinfo_invalid'])
+const safeCodes = new Set(['oidc_callback_invalid', 'oidc_authorization_rejected', 'oidc_token_invalid', 'oidc_id_token_invalid', 'oidc_userinfo_invalid', 'gateway_token_invalid', 'gateway_scope_changed', 'gateway_identity_changed', 'gateway_callback_issuer_missing', 'gateway_callback_issuer_invalid'])
 
 function reply(response, status, profile, outcome, language) {
   const page = callbackPage(profile, outcome, language)
@@ -60,7 +60,8 @@ export class DesktopOidcBackend extends WebOidcBackend {
         throw error('oidc_host_unavailable', 'OIDC host has stopped')
       }
       attempt.origin = `http://127.0.0.1:${server.address().port}`
-      const authorization = this.createAuthorization(profile, discovery, `${attempt.origin}${OIDC_CALLBACK_PATH}`)
+      const authorization = await this.createAuthorization(profile, discovery, `${attempt.origin}${OIDC_CALLBACK_PATH}`)
+      if (this.disposed || attempt.state !== 'pending') throw error('oidc_login_cancelled', 'Sign-in was cancelled')
       Object.assign(attempt, { oauthState: authorization.state, flow: authorization.flow })
       attempt.timer = setTimeout(() => { void this.cancelLogin(loginID, 'expired').catch(() => {}) }, this.ttl)
       attempt.timer.unref()
@@ -137,8 +138,9 @@ export class DesktopOidcBackend extends WebOidcBackend {
       this.ctx.logger.warn('Desktop OIDC host credentials are unavailable')
     })
     await attempt.processing
+    const failedOutcome = ['gateway_callback_issuer_missing', 'gateway_callback_issuer_invalid'].includes(attempt.errorCode) ? 'issuer-invalid' : 'failed'
     if (!response.destroyed) reply(response, attempt.state === 'completed' ? 200 : 400, profile,
-      attempt.state === 'completed' ? (attempt.status?.state === 'authenticated' ? 'credential-required' : 'completed') : 'failed', language)
+      attempt.state === 'completed' ? 'completed' : failedOutcome, language)
     await this.closeCallback(attempt)
   }
 
@@ -149,7 +151,7 @@ export class DesktopOidcBackend extends WebOidcBackend {
     try {
       const session = await this.exchangeAuthorization(requested, attempt.flow)
       if (attempt.state !== 'pending') return
-      const refs = [sessionRef(profile), ...(profile.keyBinding ? [profile.keyBinding.credentialRef] : [])]
+      const refs = [sessionRef(profile)]
       for (const ref of refs) previous.set(ref, await this.ctx.credentials.resolve(ref))
       if (attempt.state !== 'pending') return
       wrote = true
@@ -157,7 +159,7 @@ export class DesktopOidcBackend extends WebOidcBackend {
       if (attempt.state !== 'pending') return
       // A resource outage must not turn a successful identity login into a failed login.
       let status
-      try { status = await this.reconcile(profile.id, { allowProvision: false }) }
+      try { status = await this.reconcile(profile.id) }
       catch { status = await this.status(profile.id) }
       if (attempt.state !== 'pending') return
       attempt.status = status
@@ -173,13 +175,7 @@ export class DesktopOidcBackend extends WebOidcBackend {
       // Cancellation/disposal while the host vault writes must not resurrect a login.
       if (wrote && attempt.state !== 'completed') {
         await this.writeCredentials(profile, attempt.flow.epoch, async () => {
-          const currentRecord = await this.ctx.credentials.resolve(sessionRef(profile))
-          let currentSession
-          try { currentSession = JSON.parse(currentRecord?.value) } catch { /* No proven runtime-key ownership. */ }
-          const ownsCurrentKey = await this.boundCredential(profile, currentSession)
           for (const [ref, record] of previous) {
-            // A different profile may have rebound the shared key during login.
-            if (ref !== sessionRef(profile) && !ownsCurrentKey) continue
             if (record?.value !== undefined) await this.ctx.credentials.set(ref, record.value)
             else await this.ctx.credentials.unset(ref)
           }