# @lssm-tech/integration.personal-os-authos

Fail-closed AuthOS and Better Auth session bridge for PersonalOS.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.4`
- Package path: `packages/integrations/personal-os-authos`
- Manifest path: `packages/integrations/personal-os-authos/package.json`
- Manifest Git blob: `78c2ebce1c24c060ee21bf6cfdfb9302ff394218`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.personal-os-authos](https://lssm.co/docs/packages/integration.personal-os-authos/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.personal-os-authos.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "personal-and-learning",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "integrations",
    "catalogKind": "integration",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Personal workflows, learning and progress](https://lssm.co/docs/areas/personal-and-learning/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/personal-os-authos/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/README.md",
  "blobSha": "68bdc5ca8b1cbe42067d23d0bb1ea60c56ba0dfd",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# `@lssm-tech/integration.personal-os-authos`

AuthOS/Better Auth bridge for PersonalOS. It fixes the supported authentication
methods, requires verified email sessions, maps a server-verified session to a
one-way pseudonymous personal subject, and reloads full active delegation scopes from a host
authority store. Each scope binds its identifier, target subject, exact actor,
and allowed command names; bare delegation identifiers are never authoritative.

The host supplies the database adapter, secrets, email delivery callbacks, and
delegation repository. Missing, expired, unverified, or malformed sessions fail
closed. Browser, mobile, and desktop clients receive no authority from this
package; they only present the Better Auth cookie or bearer token.

The bridge binds the Better Auth session `userId` to the verified user before
issuing the canonical `PersonalAuthenticatedSessionV1`. It rejects invalid or
future authentication times, expired sessions, malformed opaque identifiers,
provider failures, conflicting delegation duplicates, actor substitutions, and
undeclared delegation fields. Every request re-reads provider session state, so
revocation takes effect without trusting a client cache.

Session and subject identities use domain-separated one-way SHA-256 references;
raw provider user IDs, session identifiers, email addresses, and bearer tokens
never enter PersonalOS projections, receipts, or telemetry.


## Declared capabilities

### Integration Personal Os Authos

Capability ID: `package.lssm.tech.integration.personal.os.authos`

Fail-closed AuthOS and Better Auth session bridge for PersonalOS.

Use cases:

- Adopt fail-closed authos and better auth session bridge for personalos

Constraints:

```json
{
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "avoidWhen": [
    "The @lssm-tech/integration.personal-os-authos package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "integration",
    "personal",
    "authos"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/integration.personal-os-authos",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-authos/bridge",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-authos/session-verifier",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-authos/spec",
    "symbols": []
  }
]
```

## Catalogue metadata

```json
{
  "family": "integrations",
  "kind": "integration",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./bridge",
    "./session-verifier",
    "./spec"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.authos",
    "from": "@lssm-tech/integration.personal-os-authos",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.authos",
    "from": "@lssm-tech/integration.personal-os-authos/bridge",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.authos",
    "from": "@lssm-tech/integration.personal-os-authos/session-verifier",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.authos",
    "from": "@lssm-tech/integration.personal-os-authos/spec",
    "symbols": []
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.personal-os-authos` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/src/index.ts); verified source file.

- `@lssm-tech/integration.personal-os-authos/bridge` — subpath `./bridge`
  - `unconditional`: `./src/bridge.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/src/bridge.ts); verified source file.

- `@lssm-tech/integration.personal-os-authos/session-verifier` — subpath `./session-verifier`
  - `unconditional`: `./src/session-verifier.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/src/session-verifier.ts); verified source file.

- `@lssm-tech/integration.personal-os-authos/spec` — subpath `./spec`
  - `unconditional`: `./src/spec.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-authos/src/spec.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./bridge": {
      "types": "./dist/bridge.d.ts",
      "bun": "./dist/bridge.js",
      "node": "./dist/node/bridge.js",
      "default": "./dist/bridge.js"
    },
    "./session-verifier": {
      "types": "./dist/session-verifier.d.ts",
      "bun": "./dist/session-verifier.js",
      "node": "./dist/node/session-verifier.js",
      "default": "./dist/session-verifier.js"
    },
    "./spec": {
      "types": "./dist/spec.d.ts",
      "bun": "./dist/spec.js",
      "node": "./dist/node/spec.js",
      "default": "./dist/spec.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/integration.authos-better-auth](https://lssm.co/docs/packages/integration.authos-better-auth/): `workspace:^`
- [@lssm-tech/lib.authos-spec](https://lssm.co/docs/packages/lib.authos-spec/): `workspace:^`
- [@lssm-tech/lib.personal-os-spec](https://lssm.co/docs/packages/lib.personal-os-spec/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "clean": "rimraf dist .turbo",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "lint:fix": "node ../../../scripts/biome.cjs check --write .",
  "prebuild": "contractspec-bun-build prebuild",
  "test": "bun test",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Integration Personal Os Authos documentation](https://www.npmjs.com/package/%40lssm-tech%2Fintegration.personal-os-authos) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Fintegration.personal-os-authos",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.personal-os-authos.txt",
  "route": "/llms/integration.personal-os-authos",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.personal-os-authos.txt",
  "blobSha": "68bdc5ca8b1cbe42067d23d0bb1ea60c56ba0dfd",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```