@lssm-tech/lib.authos-runtime
The ./ssr request-edge APIs bind the shared server-only UI subject scope.
runWithSubject, cached reads, nested/concurrent request isolation and
SubjectContextMissingError remain compatible. AuthOS still owns subject construction; the lower propagation port makes no policy decisions.
Pure deterministic AuthOS runtime projections and security gates over @lssm-tech/lib.authos-spec.
This package does not authenticate users, call Better Auth, access databases, or execute providers. It converts AuthOS contracts into safe runtime-facing projections for RBAC, RoleMorph, personalization, data-transmission, database/form metadata, Connect with LSSM, redaction, and production IdP readiness.
The runtime also includes a deterministic domain-command persistence helper. It turns approved or approval-required AuthOS command contracts into immutable local runtime events with governance metadata, while returning canExecute: false plans so provider, database, and Better Auth execution remains outside this package.
The ecosystem provisioning reducer applies redacted, idempotent receipts for identity, entitlement, product-local membership, activation, and revocation. It never activates partial provisioning, rejects scope and idempotency conflicts, resumes after retry evidence, and can rebuild state from durable receipts without calling an identity provider or product API.
Subject providers and subject modes
The ./subject subpath ships the production-grade SubjectProvider port implementation consumed by @lssm-tech/lib.contracts-spec/rich-reference (S-3) and the per-call subject-mode factories used by the AI-agent surface (S-9):
createSubjectProvider({ resolve, cache }) — request-scoped resolver with optional dual-key tenant-scoped LRU cache. Returns undefined (deny-closed) when the strategy throws or yields a malformed shape.createDelegatedSubject({ userSession, agentId, signature }, verifier) — builds an agent-on-behalf-of-user Subject with kind='user' and delegationChain=[userId, agentId] so the audit record carries both identities. Throws on bad signature; resolveSubjectMode turns that into a deny-closed undefined.createAgentSubject(identity) — first-class agent identity (kind='agent', no delegation chain).resolveSubjectMode(ctx) — per-call dispatcher selected by the caller via ctx.mode.
The createHmacDelegationVerifier(secret) helper produces a server-side HMAC-SHA-256 verifier; secrets must come from the orchestration boundary that issues delegation contracts.
Auth read models and lifecycles over injected ports
These subpaths hold the reusable rules; hosts keep storage, transport and environment wiring and implement the ports.
./auth-audit — the public auth-audit taxonomy (AUTH_AUDIT_EVENT_TYPES), redacted action -> event projection, page-limit clamp, actor scoping (non tenant readers are forced to their own actor) and the tenant-bound HMAC-SHA-256 pagination cursor (constant-time verified, INVALID_CURSOR on any failure). The host maps each event type to its own query filter../auth-email-address — the secondary email lifecycle behind the
auth-email-address-* operations over an AuthEmailAddressStore port: syntax/length validation, a uniform 6-digit code stored only as
sha256:<HMAC>, 10-minute expiry, store-enforced attempt limit, constant-time verification, non-enumerating collisions and typed
AuthEmailLifecycleError codes. Ids, codes and the clock are injectable../waitlist-admin — the approve/reject workflow over a
WaitlistAdminStore port, generic over the host actor, record and invitation types: verified-email gate, eligibility, idempotent re-approve and reject, lowest-privilege default role, post-condition check, best-effort invite delivery and PII-free WAITLIST_APPROVED/WAITLIST_REJECTED events../operator-auth — the operator-auth lifecycle generic over the host operator role: invitation pending -> processing -> accepted/revoked with exact code-ref checks, observed-claim completion/release, 5-minute stale-claim takeover (every store, guarded by compare-and-set), 24h resend rotation; single-use, operator-bound 5-minute passkey challenges; refs-only credentials (raw key/token/password material is refused); 5-failure / 15-minute lockout; admin/reader role gating via OperatorAuthPolicy. The clock and id source are injectable (OperatorAuthRuntime).
InMemoryOperatorAuthRepository is a process-local store for tests and explicitly enabled local mode; durable hosts implement
OperatorAuthRepository and apply the same rules in their guarded writes../oauth-request — the Passport OAuth gates: resolvePassportOAuthRequest
admits a serialized Better Auth OAuth query only for a catalog relying party carrying the signed envelope (sig, exp, ba_iat, ba_param, 8 KiB cap), and assertSafeOAuthRedirect(url, { identityOrigin }) is the open-redirect allowlist (identity-origin continuation paths or an exact registered relying-party callback origin + path; userinfo, other schemes/ports/origins and unparsable input fail closed with OAUTH_REDIRECT_NOT_REGISTERED). The host supplies the identity origin.
