{"id":"@lssm-tech/lib.authos-runtime","slug":"lib.authos-runtime","name":"@lssm-tech/lib.authos-runtime","version":"2.0.4","path":"packages/domains/identity/runtime","manifestPath":"packages/domains/identity/runtime/package.json","manifestBlobSha":"c053d8a5730227b8bbce4644281a9ee5425093b3","layer":"domains","physicalArea":"identity","primaryArea":"identity-and-access","classification":{"privateDeclared":null,"catalogFamily":"runtime","catalogKind":"library","catalogStatus":"active","adoptionMode":"adoptable","stability":"experimental"},"description":"Pure deterministic AuthOS runtime projections and security gates over AuthOS contracts.","descriptionOrigin":"package.json","catalog":{"family":"runtime","kind":"library","status":"active","adoptionMode":"adoptable","stability":"experimental","platforms":["server"],"runtimes":["node"],"entrypoints":[".","./auth-audit","./auth-email-address","./oauth-request","./operator-auth","./projections","./provisioning","./security-gates","./ssr","./ssr/subject-context","./subject","./subject/agent","./subject/delegated","./subject/subject-provider","./waitlist","./waitlist-admin"],"documentation":[{"title":"Lib Authos Runtime documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Flib.authos-runtime","kind":"readme"}],"examples":[],"replacements":[],"capabilities":[{"id":"package.lssm.tech.lib.authos.runtime","title":"Lib Authos Runtime","description":"Pure deterministic AuthOS runtime projections and security gates over AuthOS contracts.","status":"active","useCases":["Adopt pure deterministic authos runtime projections and security gates over authos contracts"],"aliases":["lib","authos","runtime"],"pythonEquivalents":[],"canonicalImports":[{"from":"@lssm-tech/lib.authos-runtime","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/auth-audit","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/auth-email-address","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/oauth-request","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/operator-auth","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/projections","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/provisioning","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/security-gates","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/ssr","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/ssr/subject-context","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/subject","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/subject/agent","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/subject/delegated","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/subject/subject-provider","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/waitlist","symbols":[]},{"from":"@lssm-tech/lib.authos-runtime/waitlist-admin","symbols":[]}],"constraints":{"platforms":["server"],"runtimes":["node"],"avoidWhen":["The @lssm-tech/lib.authos-runtime package constraints do not match the target runtime or platform."],"requires":["TypeScript"]},"alternatives":[],"relationships":[],"resolutionPriority":50}],"visualTesting":{"status":"deferred","owner":"@contractspec-core","targetWave":"wave-3-react-packages","rationale":"Foundational Storybook adoption establishes shared catalogs and guardrails before this package migrates."}},"canonicalImports":[{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/auth-audit","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/auth-email-address","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/oauth-request","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/operator-auth","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/projections","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/provisioning","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/security-gates","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/ssr","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/ssr/subject-context","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/subject","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/subject/agent","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/subject/delegated","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/subject/subject-provider","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/waitlist","symbols":[]},{"capabilityId":"package.lssm.tech.lib.authos.runtime","from":"@lssm-tech/lib.authos-runtime/waitlist-admin","symbols":[]}],"scripts":{"publish:pkg":"bun publish --tolerate-republish --ignore-scripts --verbose","publish:pkg:canary":"bun publish:pkg --tag canary","build":"contractspec-bun-build build","build:bundle":"contractspec-bun-build transpile","build:types":"contractspec-bun-build types","dev":"contractspec-bun-build dev","clean":"rimraf dist .turbo","lint":"bun lint:fix","lint:fix":"node ../../../../scripts/biome.cjs check --write .","lint:check":"node ../../../../scripts/biome.cjs check .","test":"bun test","prebuild":"contractspec-bun-build prebuild","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/lib.authos-spec":"workspace:^","@lssm-tech/lib.contracts-runtime-kernel":"workspace:^","@lssm-tech/lib.crypto-utils":"workspace:^","@lssm-tech/lib.ui-kit-core":"workspace:^"},"devDependencies":{"@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","@types/react":"catalog:types","@types/react-dom":"catalog:types","react":"catalog:","react-dom":"catalog:","typescript":"catalog:","@lssm-tech/lib.ui-kit-web":"workspace:^"},"peerDependencies":{"react":"catalog:"},"optionalDependencies":{},"peerDependenciesMeta":{"react":{"optional":true}},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./auth-audit":"./src/auth-audit.ts","./auth-email-address":"./src/auth-email-address.ts","./oauth-request":"./src/oauth-request.ts","./operator-auth":"./src/operator-auth/index.ts","./product-access":"./src/product-access.ts","./projections":"./src/projections.ts","./provisioning":"./src/provisioning.ts","./security-gates":"./src/security-gates.ts","./ssr":"./src/ssr/index.ts","./ssr/subject-context":"./src/ssr/subject-context.ts","./subject":"./src/subject/index.ts","./subject/agent":"./src/subject/agent.ts","./subject/delegated":"./src/subject/delegated.ts","./subject/subject-provider":"./src/subject/subject-provider.ts","./waitlist":"./src/waitlist.ts","./waitlist-admin":"./src/waitlist-admin.ts"},"publishExports":{".":{"types":"./dist/index.d.ts","bun":"./dist/index.js","node":"./dist/node/index.js","default":"./dist/index.js"},"./auth-audit":{"types":"./dist/auth-audit.d.ts","bun":"./dist/auth-audit.js","node":"./dist/node/auth-audit.js","default":"./dist/auth-audit.js"},"./auth-email-address":{"types":"./dist/auth-email-address.d.ts","bun":"./dist/auth-email-address.js","node":"./dist/node/auth-email-address.js","default":"./dist/auth-email-address.js"},"./oauth-request":{"types":"./dist/oauth-request.d.ts","bun":"./dist/oauth-request.js","node":"./dist/node/oauth-request.js","default":"./dist/oauth-request.js"},"./operator-auth":{"types":"./dist/operator-auth/index.d.ts","bun":"./dist/operator-auth/index.js","node":"./dist/node/operator-auth/index.js","default":"./dist/operator-auth/index.js"},"./product-access":{"types":"./dist/product-access.d.ts","bun":"./dist/product-access.js","node":"./dist/node/product-access.js","default":"./dist/product-access.js"},"./projections":{"types":"./dist/projections.d.ts","bun":"./dist/projections.js","node":"./dist/node/projections.js","default":"./dist/projections.js"},"./provisioning":{"types":"./dist/provisioning.d.ts","bun":"./dist/provisioning.js","node":"./dist/node/provisioning.js","default":"./dist/provisioning.js"},"./security-gates":{"types":"./dist/security-gates.d.ts","bun":"./dist/security-gates.js","node":"./dist/node/security-gates.js","default":"./dist/security-gates.js"},"./ssr":{"types":"./dist/ssr/index.d.ts","bun":"./dist/ssr/index.js","node":"./dist/node/ssr/index.js","default":"./dist/ssr/index.js"},"./ssr/subject-context":{"types":"./dist/ssr/subject-context.d.ts","bun":"./dist/ssr/subject-context.js","node":"./dist/node/ssr/subject-context.js","default":"./dist/ssr/subject-context.js"},"./subject":{"types":"./dist/subject/index.d.ts","bun":"./dist/subject/index.js","node":"./dist/node/subject/index.js","default":"./dist/subject/index.js"},"./subject/agent":{"types":"./dist/subject/agent.d.ts","bun":"./dist/subject/agent.js","node":"./dist/node/subject/agent.js","default":"./dist/subject/agent.js"},"./subject/delegated":{"types":"./dist/subject/delegated.d.ts","bun":"./dist/subject/delegated.js","node":"./dist/node/subject/delegated.js","default":"./dist/subject/delegated.js"},"./subject/subject-provider":{"types":"./dist/subject/subject-provider.d.ts","bun":"./dist/subject/subject-provider.js","node":"./dist/node/subject/subject-provider.js","default":"./dist/subject/subject-provider.js"},"./waitlist":{"types":"./dist/waitlist.d.ts","bun":"./dist/waitlist.js","node":"./dist/node/waitlist.js","default":"./dist/waitlist.js"},"./waitlist-admin":{"types":"./dist/waitlist-admin.d.ts","bun":"./dist/waitlist-admin.js","node":"./dist/node/waitlist-admin.js","default":"./dist/waitlist-admin.js"}},"types":"./dist/index.d.ts","files":["dist","README.md"],"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/lib.authos-runtime","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/domains/identity/runtime/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./auth-audit","importPath":"@lssm-tech/lib.authos-runtime/auth-audit","target":"./src/auth-audit.ts","targets":[{"conditions":[],"target":"./src/auth-audit.ts","sourcePath":"packages/domains/identity/runtime/src/auth-audit.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/auth-audit.ts","sourceStatus":"verified source file"}]},{"subpath":"./auth-email-address","importPath":"@lssm-tech/lib.authos-runtime/auth-email-address","target":"./src/auth-email-address.ts","targets":[{"conditions":[],"target":"./src/auth-email-address.ts","sourcePath":"packages/domains/identity/runtime/src/auth-email-address.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/auth-email-address.ts","sourceStatus":"verified source file"}]},{"subpath":"./oauth-request","importPath":"@lssm-tech/lib.authos-runtime/oauth-request","target":"./src/oauth-request.ts","targets":[{"conditions":[],"target":"./src/oauth-request.ts","sourcePath":"packages/domains/identity/runtime/src/oauth-request.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/oauth-request.ts","sourceStatus":"verified source file"}]},{"subpath":"./operator-auth","importPath":"@lssm-tech/lib.authos-runtime/operator-auth","target":"./src/operator-auth/index.ts","targets":[{"conditions":[],"target":"./src/operator-auth/index.ts","sourcePath":"packages/domains/identity/runtime/src/operator-auth/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/operator-auth/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./product-access","importPath":"@lssm-tech/lib.authos-runtime/product-access","target":"./src/product-access.ts","targets":[{"conditions":[],"target":"./src/product-access.ts","sourcePath":"packages/domains/identity/runtime/src/product-access.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/product-access.ts","sourceStatus":"verified source file"}]},{"subpath":"./projections","importPath":"@lssm-tech/lib.authos-runtime/projections","target":"./src/projections.ts","targets":[{"conditions":[],"target":"./src/projections.ts","sourcePath":"packages/domains/identity/runtime/src/projections.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/projections.ts","sourceStatus":"verified source file"}]},{"subpath":"./provisioning","importPath":"@lssm-tech/lib.authos-runtime/provisioning","target":"./src/provisioning.ts","targets":[{"conditions":[],"target":"./src/provisioning.ts","sourcePath":"packages/domains/identity/runtime/src/provisioning.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/provisioning.ts","sourceStatus":"verified source file"}]},{"subpath":"./security-gates","importPath":"@lssm-tech/lib.authos-runtime/security-gates","target":"./src/security-gates.ts","targets":[{"conditions":[],"target":"./src/security-gates.ts","sourcePath":"packages/domains/identity/runtime/src/security-gates.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/security-gates.ts","sourceStatus":"verified source file"}]},{"subpath":"./ssr","importPath":"@lssm-tech/lib.authos-runtime/ssr","target":"./src/ssr/index.ts","targets":[{"conditions":[],"target":"./src/ssr/index.ts","sourcePath":"packages/domains/identity/runtime/src/ssr/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/ssr/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./ssr/subject-context","importPath":"@lssm-tech/lib.authos-runtime/ssr/subject-context","target":"./src/ssr/subject-context.ts","targets":[{"conditions":[],"target":"./src/ssr/subject-context.ts","sourcePath":"packages/domains/identity/runtime/src/ssr/subject-context.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/ssr/subject-context.ts","sourceStatus":"verified source file"}]},{"subpath":"./subject","importPath":"@lssm-tech/lib.authos-runtime/subject","target":"./src/subject/index.ts","targets":[{"conditions":[],"target":"./src/subject/index.ts","sourcePath":"packages/domains/identity/runtime/src/subject/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./subject/agent","importPath":"@lssm-tech/lib.authos-runtime/subject/agent","target":"./src/subject/agent.ts","targets":[{"conditions":[],"target":"./src/subject/agent.ts","sourcePath":"packages/domains/identity/runtime/src/subject/agent.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/agent.ts","sourceStatus":"verified source file"}]},{"subpath":"./subject/delegated","importPath":"@lssm-tech/lib.authos-runtime/subject/delegated","target":"./src/subject/delegated.ts","targets":[{"conditions":[],"target":"./src/subject/delegated.ts","sourcePath":"packages/domains/identity/runtime/src/subject/delegated.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/delegated.ts","sourceStatus":"verified source file"}]},{"subpath":"./subject/subject-provider","importPath":"@lssm-tech/lib.authos-runtime/subject/subject-provider","target":"./src/subject/subject-provider.ts","targets":[{"conditions":[],"target":"./src/subject/subject-provider.ts","sourcePath":"packages/domains/identity/runtime/src/subject/subject-provider.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/subject-provider.ts","sourceStatus":"verified source file"}]},{"subpath":"./waitlist","importPath":"@lssm-tech/lib.authos-runtime/waitlist","target":"./src/waitlist.ts","targets":[{"conditions":[],"target":"./src/waitlist.ts","sourcePath":"packages/domains/identity/runtime/src/waitlist.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/waitlist.ts","sourceStatus":"verified source file"}]},{"subpath":"./waitlist-admin","importPath":"@lssm-tech/lib.authos-runtime/waitlist-admin","target":"./src/waitlist-admin.ts","targets":[{"conditions":[],"target":"./src/waitlist-admin.ts","sourcePath":"packages/domains/identity/runtime/src/waitlist-admin.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/waitlist-admin.ts","sourceStatus":"verified source file"}]}],"entryCount":17,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[{"title":"Lib Authos Runtime documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Flib.authos-runtime","kind":"readme","pinnedUrl":null,"sourceStatus":"declared link; destination not verified"}],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/lib.authos-runtime.txt"},"readme":{"status":"available","body":"# `@lssm-tech/lib.authos-runtime`\n\nThe `./ssr` request-edge APIs bind the shared server-only UI subject scope.\n`runWithSubject`, cached reads, nested/concurrent request isolation and\n`SubjectContextMissingError` remain compatible. AuthOS still owns subject\nconstruction; the lower propagation port makes no policy decisions.\n\nPure deterministic AuthOS runtime projections and security gates over `@lssm-tech/lib.authos-spec`.\n\nThis package does not authenticate users, call Better Auth, access databases, or execute providers. It converts AuthOS contracts into safe runtime-facing projections for RBAC, RoleMorph, personalization, data-transmission, database/form metadata, Connect with LSSM, redaction, and production IdP readiness.\n\n\nThe runtime also includes a deterministic domain-command persistence helper. It turns approved or approval-required AuthOS command contracts into immutable local runtime events with governance metadata, while returning `canExecute: false` plans so provider, database, and Better Auth execution remains outside this package.\n\nThe ecosystem provisioning reducer applies redacted, idempotent receipts for\nidentity, entitlement, product-local membership, activation, and revocation.\nIt never activates partial provisioning, rejects scope and idempotency\nconflicts, resumes after retry evidence, and can rebuild state from durable\nreceipts without calling an identity provider or product API.\n\n## Subject providers and subject modes\n\nThe `./subject` subpath ships the production-grade `SubjectProvider` port implementation consumed by `@lssm-tech/lib.contracts-spec/rich-reference` (S-3) and the per-call subject-mode factories used by the AI-agent surface (S-9):\n\n- `createSubjectProvider({ resolve, cache })` — request-scoped resolver with optional dual-key tenant-scoped LRU cache. Returns `undefined` (deny-closed) when the strategy throws or yields a malformed shape.\n- `createDelegatedSubject({ userSession, agentId, signature }, verifier)` — builds an agent-on-behalf-of-user `Subject` with `kind='user'` and `delegationChain=[userId, agentId]` so the audit record carries both identities. Throws on bad signature; `resolveSubjectMode` turns that into a deny-closed `undefined`.\n- `createAgentSubject(identity)` — first-class agent identity (`kind='agent'`, no delegation chain).\n- `resolveSubjectMode(ctx)` — per-call dispatcher selected by the caller via `ctx.mode`.\n\nThe `createHmacDelegationVerifier(secret)` helper produces a server-side HMAC-SHA-256 verifier; secrets must come from the orchestration boundary that issues delegation contracts.\n\n## Auth read models and lifecycles over injected ports\n\nThese subpaths hold the reusable rules; hosts keep storage, transport and\nenvironment wiring and implement the ports.\n\n- `./auth-audit` — the public auth-audit taxonomy (`AUTH_AUDIT_EVENT_TYPES`),\n  redacted action -> event projection, page-limit clamp, actor scoping (non\n  tenant readers are forced to their own actor) and the tenant-bound\n  HMAC-SHA-256 pagination cursor (constant-time verified, `INVALID_CURSOR` on\n  any failure). The host maps each event type to its own query filter.\n- `./auth-email-address` — the secondary email lifecycle behind the\n  `auth-email-address-*` operations over an `AuthEmailAddressStore` port:\n  syntax/length validation, a uniform 6-digit code stored only as\n  `sha256:<HMAC>`, 10-minute expiry, store-enforced attempt limit,\n  constant-time verification, non-enumerating collisions and typed\n  `AuthEmailLifecycleError` codes. Ids, codes and the clock are injectable.\n- `./waitlist-admin` — the approve/reject workflow over a\n  `WaitlistAdminStore` port, generic over the host actor, record and\n  invitation types: verified-email gate, eligibility, idempotent re-approve and\n  reject, lowest-privilege default role, post-condition check, best-effort\n  invite delivery and PII-free `WAITLIST_APPROVED`/`WAITLIST_REJECTED` events.\n- `./operator-auth` — the operator-auth lifecycle generic over the host\n  operator role: invitation pending -> processing -> accepted/revoked with\n  exact code-ref checks, observed-claim completion/release, 5-minute\n  stale-claim takeover (every store, guarded by compare-and-set), 24h resend\n  rotation; single-use, operator-bound 5-minute passkey challenges; refs-only\n  credentials (raw key/token/password material is refused); 5-failure /\n  15-minute lockout; admin/reader role gating via `OperatorAuthPolicy`. The\n  clock and id source are injectable (`OperatorAuthRuntime`).\n  `InMemoryOperatorAuthRepository` is a process-local store for tests and\n  explicitly enabled local mode; durable hosts implement\n  `OperatorAuthRepository` and apply the same rules in their guarded writes.\n- `./oauth-request` — the Passport OAuth gates: `resolvePassportOAuthRequest`\n  admits a serialized Better Auth OAuth query only for a catalog relying party\n  carrying the signed envelope (`sig`, `exp`, `ba_iat`, `ba_param`, 8 KiB cap),\n  and `assertSafeOAuthRedirect(url, { identityOrigin })` is the open-redirect\n  allowlist (identity-origin continuation paths or an exact registered\n  relying-party callback origin + path; userinfo, other schemes/ports/origins\n  and unparsable input fail closed with `OAUTH_REDIRECT_NOT_REGISTERED`). The\n  host supplies the identity origin.\n","sourcePath":"packages/domains/identity/runtime/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/README.md","blobSha":"2d024110369adeadd5a850e1aa3ede4e8dc2f1fa","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"identity-and-access","areaTitle":"Identity, access and subject context","displayName":"lib.authos-runtime","runtimes":["node"],"platforms":["server"],"kind":"library","scope":"Package manifest","canonicalRoute":"/docs/packages/lib.authos-runtime/","contextUrl":"/docs/packages/lib.authos-runtime.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}