# @lssm-tech/lib.authos-runtime

Pure deterministic AuthOS runtime projections and security gates over AuthOS contracts.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.4`
- Package path: `packages/domains/identity/runtime`
- Manifest path: `packages/domains/identity/runtime/package.json`
- Manifest Git blob: `c053d8a5730227b8bbce4644281a9ee5425093b3`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/lib.authos-runtime](https://lssm.co/docs/packages/lib.authos-runtime/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/lib.authos-runtime.txt)

## Package metadata

```json
{
  "layer": "domains",
  "physicalArea": "identity",
  "primaryArea": "identity-and-access",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "runtime",
    "catalogKind": "library",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Identity, access and subject context](https://lssm.co/docs/areas/identity-and-access/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/domains/identity/runtime/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/README.md",
  "blobSha": "2d024110369adeadd5a850e1aa3ede4e8dc2f1fa",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# `@lssm-tech/lib.authos-runtime`

The `./ssr` request-edge APIs bind the shared server-only UI subject scope.
`runWithSubject`, cached reads, nested/concurrent request isolation and
`SubjectContextMissingError` remain compatible. AuthOS still owns subject
construction; the lower propagation port makes no policy decisions.

Pure deterministic AuthOS runtime projections and security gates over `@lssm-tech/lib.authos-spec`.

This package does not authenticate users, call Better Auth, access databases, or execute providers. It converts AuthOS contracts into safe runtime-facing projections for RBAC, RoleMorph, personalization, data-transmission, database/form metadata, Connect with LSSM, redaction, and production IdP readiness.


The runtime also includes a deterministic domain-command persistence helper. It turns approved or approval-required AuthOS command contracts into immutable local runtime events with governance metadata, while returning `canExecute: false` plans so provider, database, and Better Auth execution remains outside this package.

The ecosystem provisioning reducer applies redacted, idempotent receipts for
identity, entitlement, product-local membership, activation, and revocation.
It never activates partial provisioning, rejects scope and idempotency
conflicts, resumes after retry evidence, and can rebuild state from durable
receipts without calling an identity provider or product API.

## Subject providers and subject modes

The `./subject` subpath ships the production-grade `SubjectProvider` port implementation consumed by `@lssm-tech/lib.contracts-spec/rich-reference` (S-3) and the per-call subject-mode factories used by the AI-agent surface (S-9):

- `createSubjectProvider({ resolve, cache })` — request-scoped resolver with optional dual-key tenant-scoped LRU cache. Returns `undefined` (deny-closed) when the strategy throws or yields a malformed shape.
- `createDelegatedSubject({ userSession, agentId, signature }, verifier)` — builds an agent-on-behalf-of-user `Subject` with `kind='user'` and `delegationChain=[userId, agentId]` so the audit record carries both identities. Throws on bad signature; `resolveSubjectMode` turns that into a deny-closed `undefined`.
- `createAgentSubject(identity)` — first-class agent identity (`kind='agent'`, no delegation chain).
- `resolveSubjectMode(ctx)` — per-call dispatcher selected by the caller via `ctx.mode`.

The `createHmacDelegationVerifier(secret)` helper produces a server-side HMAC-SHA-256 verifier; secrets must come from the orchestration boundary that issues delegation contracts.

## Auth read models and lifecycles over injected ports

These subpaths hold the reusable rules; hosts keep storage, transport and
environment wiring and implement the ports.

- `./auth-audit` — the public auth-audit taxonomy (`AUTH_AUDIT_EVENT_TYPES`),
  redacted action -> event projection, page-limit clamp, actor scoping (non
  tenant readers are forced to their own actor) and the tenant-bound
  HMAC-SHA-256 pagination cursor (constant-time verified, `INVALID_CURSOR` on
  any failure). The host maps each event type to its own query filter.
- `./auth-email-address` — the secondary email lifecycle behind the
  `auth-email-address-*` operations over an `AuthEmailAddressStore` port:
  syntax/length validation, a uniform 6-digit code stored only as
  `sha256:<HMAC>`, 10-minute expiry, store-enforced attempt limit,
  constant-time verification, non-enumerating collisions and typed
  `AuthEmailLifecycleError` codes. Ids, codes and the clock are injectable.
- `./waitlist-admin` — the approve/reject workflow over a
  `WaitlistAdminStore` port, generic over the host actor, record and
  invitation types: verified-email gate, eligibility, idempotent re-approve and
  reject, lowest-privilege default role, post-condition check, best-effort
  invite delivery and PII-free `WAITLIST_APPROVED`/`WAITLIST_REJECTED` events.
- `./operator-auth` — the operator-auth lifecycle generic over the host
  operator role: invitation pending -> processing -> accepted/revoked with
  exact code-ref checks, observed-claim completion/release, 5-minute
  stale-claim takeover (every store, guarded by compare-and-set), 24h resend
  rotation; single-use, operator-bound 5-minute passkey challenges; refs-only
  credentials (raw key/token/password material is refused); 5-failure /
  15-minute lockout; admin/reader role gating via `OperatorAuthPolicy`. The
  clock and id source are injectable (`OperatorAuthRuntime`).
  `InMemoryOperatorAuthRepository` is a process-local store for tests and
  explicitly enabled local mode; durable hosts implement
  `OperatorAuthRepository` and apply the same rules in their guarded writes.
- `./oauth-request` — the Passport OAuth gates: `resolvePassportOAuthRequest`
  admits a serialized Better Auth OAuth query only for a catalog relying party
  carrying the signed envelope (`sig`, `exp`, `ba_iat`, `ba_param`, 8 KiB cap),
  and `assertSafeOAuthRedirect(url, { identityOrigin })` is the open-redirect
  allowlist (identity-origin continuation paths or an exact registered
  relying-party callback origin + path; userinfo, other schemes/ports/origins
  and unparsable input fail closed with `OAUTH_REDIRECT_NOT_REGISTERED`). The
  host supplies the identity origin.


## Declared capabilities

### Lib Authos Runtime

Capability ID: `package.lssm.tech.lib.authos.runtime`

Pure deterministic AuthOS runtime projections and security gates over AuthOS contracts.

Use cases:

- Adopt pure deterministic authos runtime projections and security gates over authos contracts

Constraints:

```json
{
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "avoidWhen": [
    "The @lssm-tech/lib.authos-runtime package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "lib",
    "authos",
    "runtime"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/lib.authos-runtime",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/auth-audit",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/auth-email-address",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/oauth-request",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/operator-auth",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/projections",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/provisioning",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/security-gates",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/ssr",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/ssr/subject-context",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/subject",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/subject/agent",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/subject/delegated",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/subject/subject-provider",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/waitlist",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-runtime/waitlist-admin",
    "symbols": []
  }
]
```

## Catalogue metadata

```json
{
  "family": "runtime",
  "kind": "library",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./auth-audit",
    "./auth-email-address",
    "./oauth-request",
    "./operator-auth",
    "./projections",
    "./provisioning",
    "./security-gates",
    "./ssr",
    "./ssr/subject-context",
    "./subject",
    "./subject/agent",
    "./subject/delegated",
    "./subject/subject-provider",
    "./waitlist",
    "./waitlist-admin"
  ],
  "examples": [],
  "replacements": [],
  "visualTesting": {
    "status": "deferred",
    "owner": "@contractspec-core",
    "targetWave": "wave-3-react-packages",
    "rationale": "Foundational Storybook adoption establishes shared catalogs and guardrails before this package migrates."
  }
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/auth-audit",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/auth-email-address",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/oauth-request",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/operator-auth",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/projections",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/provisioning",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/security-gates",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/ssr",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/ssr/subject-context",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/subject",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/subject/agent",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/subject/delegated",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/subject/subject-provider",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/waitlist",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.runtime",
    "from": "@lssm-tech/lib.authos-runtime/waitlist-admin",
    "symbols": []
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/lib.authos-runtime` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/index.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/auth-audit` — subpath `./auth-audit`
  - `unconditional`: `./src/auth-audit.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/auth-audit.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/auth-email-address` — subpath `./auth-email-address`
  - `unconditional`: `./src/auth-email-address.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/auth-email-address.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/oauth-request` — subpath `./oauth-request`
  - `unconditional`: `./src/oauth-request.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/oauth-request.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/operator-auth` — subpath `./operator-auth`
  - `unconditional`: `./src/operator-auth/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/operator-auth/index.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/product-access` — subpath `./product-access`
  - `unconditional`: `./src/product-access.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/product-access.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/projections` — subpath `./projections`
  - `unconditional`: `./src/projections.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/projections.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/provisioning` — subpath `./provisioning`
  - `unconditional`: `./src/provisioning.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/provisioning.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/security-gates` — subpath `./security-gates`
  - `unconditional`: `./src/security-gates.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/security-gates.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/ssr` — subpath `./ssr`
  - `unconditional`: `./src/ssr/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/ssr/index.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/ssr/subject-context` — subpath `./ssr/subject-context`
  - `unconditional`: `./src/ssr/subject-context.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/ssr/subject-context.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/subject` — subpath `./subject`
  - `unconditional`: `./src/subject/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/index.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/subject/agent` — subpath `./subject/agent`
  - `unconditional`: `./src/subject/agent.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/agent.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/subject/delegated` — subpath `./subject/delegated`
  - `unconditional`: `./src/subject/delegated.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/delegated.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/subject/subject-provider` — subpath `./subject/subject-provider`
  - `unconditional`: `./src/subject/subject-provider.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/subject/subject-provider.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/waitlist` — subpath `./waitlist`
  - `unconditional`: `./src/waitlist.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/waitlist.ts); verified source file.

- `@lssm-tech/lib.authos-runtime/waitlist-admin` — subpath `./waitlist-admin`
  - `unconditional`: `./src/waitlist-admin.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/runtime/src/waitlist-admin.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./auth-audit": {
      "types": "./dist/auth-audit.d.ts",
      "bun": "./dist/auth-audit.js",
      "node": "./dist/node/auth-audit.js",
      "default": "./dist/auth-audit.js"
    },
    "./auth-email-address": {
      "types": "./dist/auth-email-address.d.ts",
      "bun": "./dist/auth-email-address.js",
      "node": "./dist/node/auth-email-address.js",
      "default": "./dist/auth-email-address.js"
    },
    "./oauth-request": {
      "types": "./dist/oauth-request.d.ts",
      "bun": "./dist/oauth-request.js",
      "node": "./dist/node/oauth-request.js",
      "default": "./dist/oauth-request.js"
    },
    "./operator-auth": {
      "types": "./dist/operator-auth/index.d.ts",
      "bun": "./dist/operator-auth/index.js",
      "node": "./dist/node/operator-auth/index.js",
      "default": "./dist/operator-auth/index.js"
    },
    "./product-access": {
      "types": "./dist/product-access.d.ts",
      "bun": "./dist/product-access.js",
      "node": "./dist/node/product-access.js",
      "default": "./dist/product-access.js"
    },
    "./projections": {
      "types": "./dist/projections.d.ts",
      "bun": "./dist/projections.js",
      "node": "./dist/node/projections.js",
      "default": "./dist/projections.js"
    },
    "./provisioning": {
      "types": "./dist/provisioning.d.ts",
      "bun": "./dist/provisioning.js",
      "node": "./dist/node/provisioning.js",
      "default": "./dist/provisioning.js"
    },
    "./security-gates": {
      "types": "./dist/security-gates.d.ts",
      "bun": "./dist/security-gates.js",
      "node": "./dist/node/security-gates.js",
      "default": "./dist/security-gates.js"
    },
    "./ssr": {
      "types": "./dist/ssr/index.d.ts",
      "bun": "./dist/ssr/index.js",
      "node": "./dist/node/ssr/index.js",
      "default": "./dist/ssr/index.js"
    },
    "./ssr/subject-context": {
      "types": "./dist/ssr/subject-context.d.ts",
      "bun": "./dist/ssr/subject-context.js",
      "node": "./dist/node/ssr/subject-context.js",
      "default": "./dist/ssr/subject-context.js"
    },
    "./subject": {
      "types": "./dist/subject/index.d.ts",
      "bun": "./dist/subject/index.js",
      "node": "./dist/node/subject/index.js",
      "default": "./dist/subject/index.js"
    },
    "./subject/agent": {
      "types": "./dist/subject/agent.d.ts",
      "bun": "./dist/subject/agent.js",
      "node": "./dist/node/subject/agent.js",
      "default": "./dist/subject/agent.js"
    },
    "./subject/delegated": {
      "types": "./dist/subject/delegated.d.ts",
      "bun": "./dist/subject/delegated.js",
      "node": "./dist/node/subject/delegated.js",
      "default": "./dist/subject/delegated.js"
    },
    "./subject/subject-provider": {
      "types": "./dist/subject/subject-provider.d.ts",
      "bun": "./dist/subject/subject-provider.js",
      "node": "./dist/node/subject/subject-provider.js",
      "default": "./dist/subject/subject-provider.js"
    },
    "./waitlist": {
      "types": "./dist/waitlist.d.ts",
      "bun": "./dist/waitlist.js",
      "node": "./dist/node/waitlist.js",
      "default": "./dist/waitlist.js"
    },
    "./waitlist-admin": {
      "types": "./dist/waitlist-admin.d.ts",
      "bun": "./dist/waitlist-admin.js",
      "node": "./dist/node/waitlist-admin.js",
      "default": "./dist/waitlist-admin.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/lib.authos-spec](https://lssm.co/docs/packages/lib.authos-spec/): `workspace:^`
- [@lssm-tech/lib.contracts-runtime-kernel](https://lssm.co/docs/packages/lib.contracts-runtime-kernel/): `workspace:^`
- [@lssm-tech/lib.crypto-utils](https://lssm.co/docs/packages/lib.crypto-utils/): `workspace:^`
- [@lssm-tech/lib.ui-kit-core](https://lssm.co/docs/packages/lib.ui-kit-core/): `workspace:^`

### Peer dependencies

- `react`: `catalog:`

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/lib.ui-kit-web](https://lssm.co/docs/packages/lib.ui-kit-web/): `workspace:^`
- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/react`: `catalog:types`
- `@types/react-dom`: `catalog:types`
- `react`: `catalog:`
- `react-dom`: `catalog:`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{
  "react": {
    "optional": true
  }
}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "publish:pkg": "bun publish --tolerate-republish --ignore-scripts --verbose",
  "publish:pkg:canary": "bun publish:pkg --tag canary",
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "dev": "contractspec-bun-build dev",
  "clean": "rimraf dist .turbo",
  "lint": "bun lint:fix",
  "lint:fix": "node ../../../../scripts/biome.cjs check --write .",
  "lint:check": "node ../../../../scripts/biome.cjs check .",
  "test": "bun test",
  "prebuild": "contractspec-bun-build prebuild",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Lib Authos Runtime documentation](https://www.npmjs.com/package/%40lssm-tech%2Flib.authos-runtime) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Flib.authos-runtime",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/lib.authos-runtime.txt",
  "route": "/llms/lib.authos-runtime",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/lib.authos-runtime.txt",
  "blobSha": "2d024110369adeadd5a850e1aa3ede4e8dc2f1fa",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```