integration.lssm-os-operation-client

@lssm-tech/integration.lssm-os-operation-client

Browser-, Bun-, and Node-safe client for the authenticated Agent Host durable operation status route.

The integration owns HTTP transport only. Runtime Node remains the canonical owner of operation state, status, request and receipt digests, error mappings, and REST/CLI/MCP/SDK/UI projections. The client validates every untrusted body through that runtime contract before returning any surface. It implements and re-exports the provider-neutral operation client port from @lssm-tech/lib.lssm-os-runtime/runtime-node for source compatibility.

import { createLssmOsOperationClientV1 } from "@lssm-tech/integration.lssm-os-operation-client";

const client = createLssmOsOperationClientV1({
  origin: "https://agent-host.example.com",
  timeoutMs: 5_000,
  authorization: {
    async getAuthorization() {
      return { status: "available", authorization: "Bearer <opaque>" };
    },
  },
});

const result = await client.getOperationStatus({
  tenantId: "tenant",
  workspaceId: "workspace",
  environmentId: "production",
  operationId: "operation-123",
});

Credentials are injected for each request and are never retained, returned, or included in an error. The client accepts HTTPS origins only, bounds response bytes and time, requires private no-store JSON responses, rejects redirects, and verifies exact scope, operation identity, status code, operation URL, terminal posture, retry posture, and canonical digest.

Transport failure returns the canonical operation_unavailable error surface; it never invents operation completion. Consumers use the returned cli, mcp, sdk, or ui member unchanged instead of defining shell-local mappings.