@eduwork/dsh-oidc 0.2.3 → 0.3.0-dev.1

package/lib/profile.js

@@ -1,10 +1,8 @@
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
-export const DEFAULT_CREDENTIAL_REF = 'EDUWORK_API_KEY'
 const MAX_PROFILE_BYTES = 512 * 1024
 const idPattern = /^[a-z][a-z0-9-]{0,63}$/
-const credentialPattern = /^[A-Za-z_][A-Za-z0-9_]*$/
 const colorPattern = /^#[0-9a-fA-F]{6}$/
 const allowedModalities = new Set(['text', 'image'])
 const allowedThinkingLevels = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
@@ -15,10 +13,9 @@ const allowedThinkingFormats = new Set([
 ])
 const allowedRootKeys = new Set([
   'schemaVersion', 'id', 'displayName', 'organization', 'nativeInstitutionID',
-  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'keyBinding', 'provider',
+  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'auth', 'provider',
 ])
 const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
-const allowedKeyBindingKeys = new Set(['type', 'baseURL', 'credentialRef'])
 const allowedBrandKeys = new Set([
   'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
   'loginTitle', 'loginDescription', 'supportURL',
@@ -217,9 +214,6 @@ export function normalizeModels(models, providerID) {
   }))
 }
 
-export function legacyCredentialRefs(profile) {
-  return [...new Set([profile.id, profile.provider?.id].filter(Boolean).map(id => `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`))]
-}
 
 function normalizeRetryPolicy(value) {
   const source = object(value, 'profile.provider.retryPolicy')
@@ -281,35 +275,41 @@ export function normalizeEnterpriseProfile(raw) {
   if (allowedInsecureOrigin !== undefined && !allowInsecureDevelopment) {
     throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
   }
-  const oidc = object(source.oidc, 'profile.oidc')
-  const identityOnly = source.keyBinding === undefined && source.provider === undefined
-  if (!identityOnly && (source.keyBinding === undefined || source.provider === undefined)) {
-    throw new Error('profile.keyBinding and profile.provider must either both be present or both be omitted')
+  const gateway = source.auth !== undefined
+  if (gateway && source.oidc !== undefined) throw new Error('profile.auth cannot be combined with oidc')
+  let auth
+  if (gateway) {
+    const rawAuth = object(source.auth, 'profile.auth')
+    exactKeys(rawAuth, new Set(['discoveryUrl', 'expectedIssuer', 'experimentalOidcLlm', 'clientId', 'identityMode']), 'profile.auth')
+    const experimental = rawAuth.experimentalOidcLlm === true
+    if (rawAuth.experimentalOidcLlm !== undefined && typeof rawAuth.experimentalOidcLlm !== 'boolean') throw new Error('profile.auth.experimentalOidcLlm must be boolean')
+    if (!experimental && (rawAuth.clientId !== undefined || rawAuth.identityMode !== undefined)) throw new Error('profile.auth clientId and identityMode require experimentalOidcLlm=true')
+    if (experimental && !['oauth', 'oidc'].includes(rawAuth.identityMode)) throw new Error('profile.auth.identityMode must explicitly select oauth or oidc')
+    if (experimental && allowedInsecureOrigin && !rawAuth.expectedIssuer) throw new Error('development oidc-llm requires expectedIssuer')
+    const developmentOrigin = experimental ? allowedInsecureOrigin : undefined
+    auth = Object.freeze({
+      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment, developmentOrigin),
+      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment, developmentOrigin) }),
+      ...(experimental ? { experimentalOidcLlm: true, clientId: text(rawAuth.clientId, 'profile.auth.clientId', 256), identityMode: rawAuth.identityMode } : {}),
+    })
+    if (source.provider?.baseURL !== undefined) throw new Error('profile.auth derives provider.baseURL from validated discovery')
+    if (source.provider?.modelSource !== undefined && source.provider.modelSource !== 'discovery') throw new Error('profile.auth requires discovery modelSource')
   }
-  const keyBinding = identityOnly ? {} : object(source.keyBinding, 'profile.keyBinding')
-  const provider = identityOnly ? {} : object(source.provider, 'profile.provider')
+  const oidc = gateway ? {} : object(source.oidc, 'profile.oidc')
+  const identityOnly = !gateway
+  if (identityOnly && source.provider !== undefined) throw new Error('OIDC identity profiles cannot configure model resources; use auth.discoveryUrl for Access Token model access')
+  const provider = gateway ? { id, adapter: 'openai-compatible', ...object(source.provider ?? {}, 'profile.provider'), modelSource: 'discovery' } : {}
   exactKeys(oidc, allowedOidcKeys, 'profile.oidc')
-  exactKeys(keyBinding, allowedKeyBindingKeys, 'profile.keyBinding')
   exactKeys(provider, allowedProviderKeys, 'profile.provider')
   const providerID = identityOnly ? id : text(provider.id, 'profile.provider.id', 64)
   if (!idPattern.test(providerID)) throw new Error('profile.provider.id is invalid')
-  let credentialRef = keyBinding.credentialRef === undefined
-    ? DEFAULT_CREDENTIAL_REF
-    : text(keyBinding.credentialRef, 'profile.keyBinding.credentialRef', 128)
-  if (!credentialPattern.test(credentialRef)) {
-    throw new Error('profile.keyBinding.credentialRef must be a valid DSH credential reference')
-  }
-  if (legacyCredentialRefs({ id, provider: { id: providerID } }).includes(credentialRef)) credentialRef = DEFAULT_CREDENTIAL_REF
   if (!identityOnly && provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
-  const protocol = keyBinding.type ?? 'worker-user-center-v1'
-  if (!['worker-user-center-v1', 'eduwork-resources-v1'].includes(protocol)) throw new Error('profile.keyBinding.type is not supported')
-  const modelSource = provider.modelSource ?? 'profile'
-  if (!['profile', 'discovery'].includes(modelSource)) throw new Error('profile.provider.modelSource must be profile or discovery')
+  const modelSource = 'discovery'
   const scopes = oidc.scopes
-  if (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope))) {
+  if (!gateway && (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope)))) {
     throw new Error('profile.oidc.scopes must contain openid and profile; every scope must be a non-empty token')
   }
-  if (new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
+  if (!gateway && new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
   return Object.freeze({
     schemaVersion: PROFILE_SCHEMA_VERSION,
     id,
@@ -319,22 +319,16 @@ export function normalizeEnterpriseProfile(raw) {
     ...(allowedInsecureOrigin === undefined ? {} : { insecureDevelopmentOrigin: allowedInsecureOrigin }),
     nativeInstitutionID: source.nativeInstitutionID === undefined ? id : text(source.nativeInstitutionID, 'profile.nativeInstitutionID', 64),
     brand: normalizeBrand(source.brand),
-    oidc: Object.freeze({
+    ...(gateway ? { auth } : { oidc: Object.freeze({
       issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment, allowedInsecureOrigin),
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
-    }),
-    ...(identityOnly ? {} : { keyBinding: Object.freeze({
-      type: protocol,
-      baseURL: exactURL(keyBinding.baseURL, 'profile.keyBinding.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
-      providerId: providerID,
-      credentialRef,
-    }),
-    provider: Object.freeze({
+    }) }),
+    ...(identityOnly ? {} : { provider: Object.freeze({
       id: providerID,
       displayName: text(provider.displayName ?? source.displayName, 'profile.provider.displayName', 120),
       adapter: provider.adapter,
-      baseURL: exactURL(provider.baseURL, 'profile.provider.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
+      baseURL: '',
       reasoning: provider.reasoning === undefined
         ? 'high'
         : (() => {
@@ -385,9 +379,9 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
 
 export function enterpriseProviderConfig(profiles) {
   return {
-    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.models.length).map(profile => [profile.provider.id, {
+    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.baseURL && profile.provider.models.length).map(profile => [profile.provider.id, {
       displayName: profile.provider.displayName,
-      apiKeyEnv: profile.keyBinding.credentialRef,
+      apiKeyEnv: `DSH_GATEWAY_${profile.id.toUpperCase().replace(/-/g, '_')}_ACCESS`,
       baseURL: profile.provider.baseURL,
       allowInsecureDevelopment: profile.allowInsecureDevelopment,
       ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
@@ -418,7 +412,7 @@ export function publicProfile(profile) {
     displayName: profile.displayName,
     organization: profile.organization,
     brand: profile.brand,
-    credentialRef: profile.keyBinding?.credentialRef ?? '',
+    credentialRef: '',
     ...(profile.provider ? { provider: {
       id: profile.provider.id,
       displayName: profile.provider.displayName,

package/lib/provider/authorization-scope.js

@@ -0,0 +1,46 @@
+/** Keep prepared calls, credential resolution and streamed results in one authorization. */
+export class AuthorizationScopedAdapter {
+  constructor(inner, storage, createScope) {
+    this.inner = inner
+    this.storage = storage
+    this.createScope = createScope
+  }
+
+  providerInfo(provider) { return this.inner.providerInfo(provider) }
+  providerRetryPolicy(provider) { return this.inner.providerRetryPolicy(provider) }
+  imageRequestPricing(provider, model) { return this.inner.imageRequestPricing(provider, model) }
+  listModels(provider) { return this.inner.listModels(provider) }
+  resolveModel(provider, model, signal) { return this.inner.resolveModel(provider, model, signal) }
+
+  async prepareCall(provider, model, signal) {
+    const scope = await this.createScope(provider)
+    const prepared = await this.inner.prepareCall(provider, model, signal)
+    return { model: prepared.model, stream: options => this.streamPrepared(prepared, options, scope) }
+  }
+
+  async * streamPrepared(prepared, options, scope) {
+    if (!scope) { yield* prepared.stream(options); return }
+    const lease = scope.open(options.signal)
+    let iterator
+    try {
+      lease.assertCurrent()
+      iterator = prepared.stream({ ...options, signal: lease.signal })[Symbol.asyncIterator]()
+      for (;;) {
+        lease.assertCurrent()
+        const next = await this.storage.run(lease, () => iterator.next())
+        // Even a transport that buffers or ignores abort must not emit stale data.
+        lease.assertCurrent()
+        if (next.done) return
+        yield next.value
+      }
+    } finally {
+      try { await this.storage.run(lease, () => iterator?.return?.()) }
+      finally { lease.close() }
+    }
+  }
+
+  async * stream(options) {
+    const prepared = await this.prepareCall(options.provider, options.model, options.signal)
+    yield* prepared.stream(options)
+  }
+}

package/lib/provider/index.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
 import { LlmError, assertUsableApiKey, resolveImageAttachmentAccess, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
 import { Config as PiAiConfig, PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
@@ -10,6 +11,7 @@ import {
 } from './core.js'
 import { TransformingEnterpriseAdapter } from './transform-adapter.js'
 import { EnterpriseModelTransforms } from './transforms.js'
+import { AuthorizationScopedAdapter } from './authorization-scope.js'
 
 export const name = 'dsh-oidc-provider'
 export const inject = ['llm']
@@ -108,6 +110,7 @@ export function resolveEnterpriseImageAccess(ctx, attachments, ref) {
 }
 
 export function apply(ctx, rawConfig = {}) {
+  const callAuthorization = new AsyncLocalStorage()
   const transforms = new EnterpriseModelTransforms(ctx)
   let current = () => settingsBase(rawConfig)
   let profiles = profilesFrom(current())
@@ -121,7 +124,10 @@ export function apply(ctx, rawConfig = {}) {
       }
       const ref = profile.apiKeyEnv
       const credentials = ctx.get('credentials')
-      const hit = typeof rawConfig.resolveCredential === 'function'
+      const lease = callAuthorization.getStore()
+      const hit = lease
+        ? (await lease.resolveCredential(provider))?.value
+        : typeof rawConfig.resolveCredential === 'function'
         ? (await rawConfig.resolveCredential(provider))?.value
         : credentials === undefined
         ? launchEnvironmentOf(ctx).get(ref)?.value
@@ -133,9 +139,12 @@ export function apply(ctx, rawConfig = {}) {
     resolveImageAccess: (attachments, ref) => resolveEnterpriseImageAccess(ctx, attachments, ref),
   })
 
-  const adapter = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
+  const transforming = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
     profiles.get(provider)?.modelPolicies.get(model) ?? { reasoning: true, supportsReasoningEffort: true }
   ))
+  const adapter = typeof rawConfig.createAuthorizationScope === 'function'
+    ? new AuthorizationScopedAdapter(transforming, callAuthorization, rawConfig.createAuthorizationScope)
+    : transforming
   let registration
   let directory
   const replaceProfiles = next => {

package/lib/provider/transforms.js

@@ -56,4 +56,3 @@ export class EnterpriseModelTransforms extends Service {
     return transformed
   }
 }
-

package/lib/typert-schemas.js

@@ -3,7 +3,7 @@ import { z } from 'zod'
 const pkg = '@eduwork/dsh-oidc'
 export const profileIdSchema = z.string().min(1).max(64)
 export const loginIdSchema = z.string().regex(/^[A-Za-z0-9_-]{32}$/)
-export const reconcileOptionsSchema = z.object({ allowProvision: z.boolean().optional() }).strict()
+export const reconcileOptionsSchema = z.object({}).strict()
 export const baseURLSchema = z.string().min(1).max(2048)
 export const modelCatalogModeSchema = z.enum(['discovery', 'manual'])
 export const configurationTargetSchema = z.enum(['config', 'examples'])

package/lib/typert.host.js

@@ -1,44 +1,44 @@
-import {
+import {
   accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
   modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT = {
-  package: pkg, face: 'host', schemas: [],
-  invocations: [
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT = {
+  package: pkg, face: 'host', schemas: [],
+  invocations: [
     descriptor('configuration', [], configurationResult),
     descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('resources', [profile()], resourcesResult),
-    descriptor('begin', [profile()], beginResult),
-    descriptor('loginStatus', [login()], loginResult),
-    descriptor('cancelLogin', [login()], loginResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
     descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-  model: { services: [], events: [], objects: [] },
-}
-
-export default TYPERT
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+  model: { services: [], events: [], objects: [] },
+}
+
+export default TYPERT

package/lib/typert.remote-client.js

@@ -1,43 +1,43 @@
-import {
+import {
   accountResult, baseURLSchema, beginResult, configurationResult, configurationTargetSchema, openConfigurationResult, jsonParameter, managementResult, loginIdSchema, loginResult,
   modelCatalogModeSchema, profileIdSchema, reconcileOptionsSchema, restartResult, runtimeModelsSchema, resourcesResult, enterpriseSelectionResult, enterpriseSelectionOptionsSchema,
-} from './typert-schemas.js'
-
-const pkg = '@eduwork/dsh-oidc'
-const source = { file: 'lib/index.js', line: 1, column: 1 }
-const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
-const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
-const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
-const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
-const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
-const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
-const descriptor = (method, parameters, result) => ({
-  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
-  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
-})
-
-export const TYPERT_REMOTE = {
-  package: pkg,
-  descriptors: [
+} from './typert-schemas.js'
+
+const pkg = '@eduwork/dsh-oidc'
+const source = { file: 'lib/index.js', line: 1, column: 1 }
+const profile = () => jsonParameter('profileID', profileIdSchema, `${pkg}#ProfileID`)
+const login = () => jsonParameter('loginID', loginIdSchema, `${pkg}#LoginID`)
+const options = () => jsonParameter('options', reconcileOptionsSchema, `${pkg}#ReconcileOptions`)
+const baseURL = () => jsonParameter('baseURL', baseURLSchema, `${pkg}#BaseURL`)
+const modelMode = () => jsonParameter('modelMode', modelCatalogModeSchema, `${pkg}#ModelCatalogMode`)
+const models = () => jsonParameter('models', runtimeModelsSchema, `${pkg}#RuntimeModels`)
+const descriptor = (method, parameters, result) => ({
+  id: `${pkg}#oidcAccounts/${method}`, service: 'oidcAccounts', namespace: 'oidcAccounts', method,
+  invocation: { kind: 'direct' }, parameters, result, sourceLocation: source,
+})
+
+export const TYPERT_REMOTE = {
+  package: pkg,
+  descriptors: [
     descriptor('configuration', [], configurationResult),
     descriptor('openConfiguration', [jsonParameter('target', configurationTargetSchema, `${pkg}#ConfigurationTarget`)], openConfigurationResult),
-    descriptor('status', [profile()], accountResult),
-    descriptor('resources', [profile()], resourcesResult),
-    descriptor('begin', [profile()], beginResult),
-    descriptor('loginStatus', [login()], loginResult),
-    descriptor('cancelLogin', [login()], loginResult),
+    descriptor('status', [profile()], accountResult),
+    descriptor('resources', [profile()], resourcesResult),
+    descriptor('begin', [profile()], beginResult),
+    descriptor('loginStatus', [login()], loginResult),
+    descriptor('cancelLogin', [login()], loginResult),
     descriptor('reconcile', [profile(), options()], accountResult),
     descriptor('selectEnterpriseModel', [profile(), jsonParameter('options', enterpriseSelectionOptionsSchema, `${pkg}#EnterpriseSelectionOptions`)], enterpriseSelectionResult),
-    descriptor('logout', [profile()], accountResult),
-    descriptor('management', [], managementResult),
-    descriptor('activate', [profile()], managementResult),
-    descriptor('configure', [profile()], managementResult),
-    descriptor('addCustom', [baseURL()], managementResult),
-    descriptor('updateCustom', [profile(), baseURL()], managementResult),
-    descriptor('removeProfile', [profile()], managementResult),
-    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
-    descriptor('restart', [], restartResult),
-  ],
-}
-
-export default TYPERT_REMOTE
+    descriptor('logout', [profile()], accountResult),
+    descriptor('management', [], managementResult),
+    descriptor('activate', [profile()], managementResult),
+    descriptor('configure', [profile()], managementResult),
+    descriptor('addCustom', [baseURL()], managementResult),
+    descriptor('updateCustom', [profile(), baseURL()], managementResult),
+    descriptor('removeProfile', [profile()], managementResult),
+    descriptor('configureModels', [profile(), modelMode(), models()], managementResult),
+    descriptor('restart', [], restartResult),
+  ],
+}
+
+export default TYPERT_REMOTE

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.2.3",
-  "description": "Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
+  "version": "0.3.0-dev.1",
+  "description": "Standards-based OIDC identity, token-authorized model access, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -33,7 +33,7 @@
     "protocol/openapi.yaml",
     "protocol/resources.openapi.yaml",
     "README.md",
-    "README.en.md",
+    "README_EN.md",
     "CODE_OF_CONDUCT.md",
     "CODE_OF_CONDUCT.en.md",
     "CONTRIBUTING.md",
@@ -97,12 +97,13 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/freedomkk-qfeng/dsh-oidc.git"
+    "url": "git+https://github.com/ecnu/EduWork.git",
+    "directory": "packages/dsh-oidc"
   },
   "bugs": {
-    "url": "https://github.com/freedomkk-qfeng/dsh-oidc/issues"
+    "url": "https://github.com/ecnu/EduWork/issues"
   },
-  "homepage": "https://github.com/freedomkk-qfeng/dsh-oidc#readme",
+  "homepage": "https://github.com/ecnu/EduWork/tree/main/packages/dsh-oidc#readme",
   "license": "MIT",
   "dependencies": {
     "zod": "4.4.3"