# @lssm-tech/lib.authos-spec

Contract-first AuthOS specifications for identity, authentication, federation, and security-gated account surfaces.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.4`
- Package path: `packages/domains/identity/spec`
- Manifest path: `packages/domains/identity/spec/package.json`
- Manifest Git blob: `e0342d3ec89a7d7e33a157b7623afca3a7d4885a`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/lib.authos-spec](https://lssm.co/docs/packages/lib.authos-spec/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/lib.authos-spec.txt)

## Package metadata

```json
{
  "layer": "domains",
  "physicalArea": "identity",
  "primaryArea": "identity-and-access",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "contracts",
    "catalogKind": "library",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Identity, access and subject context](https://lssm.co/docs/areas/identity-and-access/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/domains/identity/spec/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/README.md",
  "blobSha": "97d24436b54c9b032294000296f4a9b01719cf9e",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# `@lssm-tech/lib.authos-spec`

Contract-first AuthOS specifications for identity, authentication, account federation, and security-gated account surfaces.

AuthOS V0 deliberately covers a broad identity/auth surface while staying provider-neutral. Runtime execution is delegated to integrations such as Better Auth; this package defines the contracts, fixtures, maturity tags, and semantic validation that other packages must preserve.

## Scope

- identities, accounts, profiles, sessions, credentials, devices, and factors;
- organization, team, admin, invitation, and membership references;
- OAuth/OIDC, SSO/SAML, SCIM, email/phone verification, OTP, magic-link, passkey, one-tap, and MFA descriptors;
- Connect with LSSM account-link federation and LSSM-as-IdP descriptors;
- auth events, audit evidence, maturity tags, semantic validation, and agent domain-command authority contracts.
- provider-neutral acquisition handoff through the optional opaque `attributionToken` on `auth.signUp` v1.2.0.
- provider-neutral login-method descriptors for email/password, email OTP, email magic link, Google, Microsoft, LinkedIn, TikTok, Facebook, and GitHub, including maturity and account-resolution policy.
- explicit `auth.invitation.adminList`, `auth.invitation.send`, `auth.invitation.resend`, and `auth.invitation.revoke` operations for tenant-scoped organization administration; resend rotates the acceptance token and all token material remains server-only.
- explicit `auth.mfa.enroll`, `auth.mfa.confirm`, `auth.mfa.verify`, and
  `auth.mfa.disable` operations for the complete TOTP and recovery lifecycle.
  Identity and challenge authority remain server-derived. The shared executor
  redacts declared transient fields before telemetry; host persistence and
  evidence adapters must enforce the contract's explicit forbidden-sink
  obligations.
- ecosystem application and OIDC relying-party registrations, pairwise subject
  links, coarse product entitlements, product invitation scope, and redacted
  provisioning receipts. These contracts never contain client secrets,
  acceptance tokens, or product-local roles.
- provider-client reconciliation requests and receipts carry only an
  application identifier plus redacted configuration evidence. Client secrets
  remain host-owned and are forbidden in both input and output contracts.
- pairwise product-membership provisioning handoffs. The central authority sends
  the RP-specific subject, email, access tier, and idempotent provisioning ID;
  canonical identity IDs and local membership identifiers never cross that
  boundary.
- a product-owned `sessionAuthorityOrigin` for every application. Identity may
  be shared, but the product creates a host-scoped session and keeps local
  membership and role authority.
- product-branded connect labels over one declared `identityAuthorityOrigin`.
  “Continue with hCircle,” CompanyOS, Pactena, or LSSM changes the disclosure
  and return context, never the issuer or canonical account.

## Referral and affiliate handoff

AuthOS only carries acquisition context through identity creation. It never
decodes, logs, or chooses a referral or affiliate winner. A host captures the
signed token from a link or cookie, passes it to `auth.signUp`, and hands it to
GrowthOS after the identity is created. GrowthOS remains authoritative for
attribution, rewards, reversals, ledger balances, and payouts.

## Non-goals

- No bespoke auth engine.
- No Better Auth dependency or provider SDK imports.
- No production LSSM-as-IdP enablement without security-review evidence.
- No credential-secret persistence in fixtures, errors, or events.
  Security-ceremony operations may carry explicitly declared transient inputs
  or one-time outputs only when shared telemetry redaction is active and host
  persistence/evidence adapters enforce the declared forbidden-sink policy.
- No assumption that one AuthOS entitlement replaces product-local membership,
  role, or permission authority.


## Domain-command authority

Agent-facing AuthOS commands are contracts only: they classify read, draft, approval-required, and reserved-human actions without executing identity, session, credential, organization, or IdP mutations. High-impact commands such as session start, factor verification, LSSM account linking, credential rotation, SSO configuration, organization role changes, and LSSM-as-IdP enablement require explicit approval evidence before any host-owned integration may execute them.

## Public entrypoints

- `@lssm-tech/lib.authos-spec`
- `@lssm-tech/lib.authos-spec/types`
- `@lssm-tech/lib.authos-spec/fixtures`
- `@lssm-tech/lib.authos-spec/validation`
- `@lssm-tech/lib.authos-spec/operations/api-keys`
- `@lssm-tech/lib.authos-spec/operations/security`
- `@lssm-tech/lib.authos-spec/operations/roles`
- `@lssm-tech/lib.authos-spec/operations/sso`

## Personal API keys

`operations/api-keys` owns `auth.apiKey.list`, `auth.apiKey.options`, `auth.apiKey.create`, and `auth.apiKey.revoke`, the `auth.apiKey.created` / `auth.apiKey.revoked` events, and the policy hosts must enforce (`AuthApiKeyPolicyDocBlock`): `cos_pk_` secrets stored only as SHA-256 hashes and returned once, 90-day default and 365-day maximum expiry, 60 requests per minute per key, at most 10 active keys per person, one organization (optionally one workspace) per key, and the read-only scope catalog `AUTH_API_KEY_SCOPES` (`companyos.workspace.read`, `companyos.evidence.read`, `opa.daily.read`). Each scope lists the exact GET routes it grants and the organization-grant permission it needs; hosts derive their route allowlist from that list and re-check the owner's grant on every request. Use-time failures are `API_KEY_INVALID`, `API_KEY_SCOPE_DENIED`, `API_KEY_GRANT_REVOKED`, and `API_KEY_RATE_LIMITED`.


## Account security

`operations/security` owns `auth.trustedDevice.{list,revoke}`, `auth.connectLssm.{status,initiate,unlink}`, `auth.provider.readiness`, `auth.phone.{status,sendCode,verify,enableMfa,remove}`, `auth.mfa.sendSms`, and the recent-authentication policy (`AUTH_RECENT_AUTHENTICATION_SECONDS`, `AUTH_RECENT_AUTHENTICATION_ERRORS`, `isRecentAuthentication`, `AuthRecentAuthenticationDocBlock`). Hosts gating any sensitive action (API keys, LSSM unlink, SSO identity providers, SSO settings, SCIM token issue/rotate) apply the same 10-minute window or current-password rule and declare `REAUTHENTICATION_REQUIRED` / `RECENT_SIGN_IN_REQUIRED`. `AUTH_PHONE_E164_PATTERN` validates phone numbers; phone numbers are verification and second-factor data only, never a sign-in identifier.

## Enterprise SSO and SCIM

`operations/sso` owns `auth.sso.*` (overview, discovery, settings, connections, domains) and `auth.scim.*` (tokens, group mappings, SCIM 2.0 users/groups), their events and named errors, and pure rules: domain normalization and verification records, the sign-in decision with owner break-glass (`evaluateSsoSignIn`), SCIM group precedence (`resolveScimMemberRole`) and identity-provider MFA evidence (`ssoClaimsAssertMfa`). `AuthSsoPolicyDocBlock` states the posture. MFA after SSO: by default (`requireIdpMfa: false`) the identity provider is trusted for MFA and hosts never prompt for their own second factor; with `requireIdpMfa: true` an SSO sign-in without MFA evidence (`amr`/`acr` claims or an authentication-methods SAML attribute) is refused with `SSO_MFA_REQUIRED`. Identity provider create/update/delete, `auth.sso.settings.update` and SCIM token issue/rotate require recent authentication (transient `password`). `auth.role.delete` 1.1.0 adds `ROLE_IN_USE_BY_SSO` for roles that are the SSO default or a SCIM group's role.

## Proposed reviewed development resource authority

PROPOSED_NOT_ADMITTED private development resource authority: optional canonical AuthOS resource JWT/workload profiles; exact <=300-second TTL and registered resource/claim validation; durable scoped OSINT receipts preserve SAME active decisionRef and terminal expiry/revocation. Existing defaults and production RP catalog remain unchanged. Real adoption, security review, TLS/registration, canonical lifecycle/obligation/evidence adapters, migration admission and runtime qualification are required before enablement. Product entitlement is not an OSINT effect grant. No issuer, key, token, grant or database has been created or verified by this source preparation.


Proposed development security review records bind the actual database, profile content, security evidence, asymmetric algorithm, native token type, allowed signing key IDs and native resource policy versions. `AuthOsDevProfileReviewV1Schema` is an additive root export. Records are installed only by the independently admitted security owner; runtime cannot approve itself. Native user access-JWT `sub` remains the canonical user ID. OSINT's specialized principal verifier maps that verified identity through the actual registered RP pairwise link. This preparation is `PROPOSED_NOT_ADMITTED`; generic provider behavior and production RP catalog stay unchanged.

## Proposed local disposable custody

Local disposable custody successor: an additive V2 whole-review arm admits only
the genuine Windows DPAPI CurrentUser provider, exact owner SID/owner-only ACL,
local namespace/root and immutable pairwise/issuer ciphertext digests. V1 review
syntax and generic SecretProvider interface remain unchanged. Only explicit
local-disposable host composition admits the factory-branded provider; native
signing, reserved claims, canonical SQL locks/policies and revocation remain.
This source proposal is unapproved and unqualified. Source/runtime/security
admission, actual DB/TLS/native key installation and mandatory real issuance,
revocation/custody/cleanup acceptance remain required. No cloud backend is
impersonated, production admission introduced, keys generated or review installed.


## Declared capabilities

### Lib Authos Spec

Capability ID: `package.lssm.tech.lib.authos.spec`

Contract-first AuthOS specifications for identity, authentication, federation, and security-gated account surfaces.

Use cases:

- Adopt contract-first authos specifications for identity, authentication, federation, and security-gated account surfaces

Constraints:

```json
{
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "avoidWhen": [
    "The @lssm-tech/lib.authos-spec package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "lib",
    "authos",
    "spec"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/lib.authos-spec",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/ecosystem",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/ecosystem-catalog",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/fixtures",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/i18n",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs/en",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs/es",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs/fr",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/i18n/keys",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/operations",
    "symbols": []
  },
  {
    "from": "@lssm-tech/lib.authos-spec/operations/auth-audit-list.query",
    "symbols": []
  }
]
```

## Catalogue metadata

```json
{
  "family": "contracts",
  "kind": "library",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./dev-profile-review",
    "./dev-profile-review-v2",
    "./dev-resource-profile",
    "./dev-source-scope",
    "./ecosystem",
    "./ecosystem-catalog",
    "./fixtures",
    "./i18n",
    "./i18n/catalogs",
    "./i18n/catalogs/en",
    "./i18n/catalogs/es",
    "./i18n/catalogs/fr",
    "./i18n/keys",
    "./operations",
    "./operations/auth-audit-list.query",
    "./operations/auth-email-address-add.command",
    "./operations/auth-email-address-list.query",
    "./operations/auth-email-address-primary.command",
    "./operations/auth-email-address-remove.command",
    "./operations/auth-email-address-verify.command",
    "./operations/auth-invitation-accept.command",
    "./operations/auth-invitation-admin-list.query",
    "./operations/auth-invitation-list.query",
    "./operations/auth-invitation-resend.command",
    "./operations/auth-invitation-revoke.command",
    "./operations/auth-invitation-send.command",
    "./operations/auth-passkey-register.command",
    "./operations/auth-session-list.query",
    "./operations/auth-session-revoke.command",
    "./operations/auth-signout.command",
    "./operations/auth-signup.command",
    "./operations/registry",
    "./operations/waitlist",
    "./operations/waitlist/registry",
    "./operations/waitlist/waitlist-approve.command",
    "./operations/waitlist/waitlist-entry",
    "./operations/waitlist/waitlist-join.command",
    "./operations/waitlist/waitlist-list.query",
    "./operations/waitlist/waitlist-reject.command",
    "./operations/waitlist/waitlist-status.query",
    "./types",
    "./validation"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/ecosystem",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/ecosystem-catalog",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/fixtures",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/i18n",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs/en",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs/es",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/i18n/catalogs/fr",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/i18n/keys",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/operations",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.lib.authos.spec",
    "from": "@lssm-tech/lib.authos-spec/operations/auth-audit-list.query",
    "symbols": []
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/lib.authos-spec` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/dev-profile-review` — subpath `./dev-profile-review`
  - `unconditional`: `./src/dev-profile-review.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/dev-profile-review.ts); verified source file.

- `@lssm-tech/lib.authos-spec/dev-profile-review-v2` — subpath `./dev-profile-review-v2`
  - `unconditional`: `./src/dev-profile-review-v2.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/dev-profile-review-v2.ts); verified source file.

- `@lssm-tech/lib.authos-spec/dev-resource-profile` — subpath `./dev-resource-profile`
  - `unconditional`: `./src/dev-resource-profile.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/dev-resource-profile.ts); verified source file.

- `@lssm-tech/lib.authos-spec/dev-source-scope` — subpath `./dev-source-scope`
  - `unconditional`: `./src/dev-source-scope.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/dev-source-scope.ts); verified source file.

- `@lssm-tech/lib.authos-spec/ecosystem` — subpath `./ecosystem`
  - `unconditional`: `./src/ecosystem.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/ecosystem.ts); verified source file.

- `@lssm-tech/lib.authos-spec/ecosystem-catalog` — subpath `./ecosystem-catalog`
  - `unconditional`: `./src/ecosystem-catalog.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/ecosystem-catalog.ts); verified source file.

- `@lssm-tech/lib.authos-spec/fixtures` — subpath `./fixtures`
  - `unconditional`: `./src/fixtures.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/fixtures.ts); verified source file.

- `@lssm-tech/lib.authos-spec/i18n` — subpath `./i18n`
  - `unconditional`: `./src/i18n/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/i18n/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/i18n/catalogs` — subpath `./i18n/catalogs`
  - `unconditional`: `./src/i18n/catalogs/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/i18n/catalogs/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/i18n/catalogs/en` — subpath `./i18n/catalogs/en`
  - `unconditional`: `./src/i18n/catalogs/en.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/i18n/catalogs/en.ts); verified source file.

- `@lssm-tech/lib.authos-spec/i18n/catalogs/es` — subpath `./i18n/catalogs/es`
  - `unconditional`: `./src/i18n/catalogs/es.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/i18n/catalogs/es.ts); verified source file.

- `@lssm-tech/lib.authos-spec/i18n/catalogs/fr` — subpath `./i18n/catalogs/fr`
  - `unconditional`: `./src/i18n/catalogs/fr.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/i18n/catalogs/fr.ts); verified source file.

- `@lssm-tech/lib.authos-spec/i18n/keys` — subpath `./i18n/keys`
  - `unconditional`: `./src/i18n/keys.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/i18n/keys.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations` — subpath `./operations`
  - `unconditional`: `./src/operations/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/account` — subpath `./operations/account`
  - `unconditional`: `./src/operations/account/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/account/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/account/auth-account-delete.command` — subpath `./operations/account/auth-account-delete.command`
  - `unconditional`: `./src/operations/account/auth-account-delete.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/account/auth-account-delete.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/account/auth-account-get.query` — subpath `./operations/account/auth-account-get.query`
  - `unconditional`: `./src/operations/account/auth-account-get.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/account/auth-account-get.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/account/auth-account-password-change.command` — subpath `./operations/account/auth-account-password-change.command`
  - `unconditional`: `./src/operations/account/auth-account-password-change.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/account/auth-account-password-change.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/account/auth-account-profile-update.command` — subpath `./operations/account/auth-account-profile-update.command`
  - `unconditional`: `./src/operations/account/auth-account-profile-update.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/account/auth-account-profile-update.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/api-keys` — subpath `./operations/api-keys`
  - `unconditional`: `./src/operations/api-keys/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/api-keys/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-audit-list.query` — subpath `./operations/auth-audit-list.query`
  - `unconditional`: `./src/operations/auth-audit-list.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-audit-list.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-email-address-add.command` — subpath `./operations/auth-email-address-add.command`
  - `unconditional`: `./src/operations/auth-email-address-add.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-email-address-add.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-email-address-list.query` — subpath `./operations/auth-email-address-list.query`
  - `unconditional`: `./src/operations/auth-email-address-list.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-email-address-list.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-email-address-primary.command` — subpath `./operations/auth-email-address-primary.command`
  - `unconditional`: `./src/operations/auth-email-address-primary.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-email-address-primary.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-email-address-remove.command` — subpath `./operations/auth-email-address-remove.command`
  - `unconditional`: `./src/operations/auth-email-address-remove.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-email-address-remove.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-email-address-verify.command` — subpath `./operations/auth-email-address-verify.command`
  - `unconditional`: `./src/operations/auth-email-address-verify.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-email-address-verify.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-invitation-accept.command` — subpath `./operations/auth-invitation-accept.command`
  - `unconditional`: `./src/operations/auth-invitation-accept.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-invitation-accept.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-invitation-admin-list.query` — subpath `./operations/auth-invitation-admin-list.query`
  - `unconditional`: `./src/operations/auth-invitation-admin-list.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-invitation-admin-list.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-invitation-list.query` — subpath `./operations/auth-invitation-list.query`
  - `unconditional`: `./src/operations/auth-invitation-list.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-invitation-list.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-invitation-resend.command` — subpath `./operations/auth-invitation-resend.command`
  - `unconditional`: `./src/operations/auth-invitation-resend.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-invitation-resend.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-invitation-revoke.command` — subpath `./operations/auth-invitation-revoke.command`
  - `unconditional`: `./src/operations/auth-invitation-revoke.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-invitation-revoke.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-invitation-send.command` — subpath `./operations/auth-invitation-send.command`
  - `unconditional`: `./src/operations/auth-invitation-send.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-invitation-send.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-mfa-confirm.command` — subpath `./operations/auth-mfa-confirm.command`
  - `unconditional`: `./src/operations/auth-mfa-confirm.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-mfa-confirm.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-mfa-disable.command` — subpath `./operations/auth-mfa-disable.command`
  - `unconditional`: `./src/operations/auth-mfa-disable.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-mfa-disable.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-mfa-enroll.command` — subpath `./operations/auth-mfa-enroll.command`
  - `unconditional`: `./src/operations/auth-mfa-enroll.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-mfa-enroll.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-mfa-verify.command` — subpath `./operations/auth-mfa-verify.command`
  - `unconditional`: `./src/operations/auth-mfa-verify.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-mfa-verify.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-passkey-register.command` — subpath `./operations/auth-passkey-register.command`
  - `unconditional`: `./src/operations/auth-passkey-register.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-passkey-register.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-session-list.query` — subpath `./operations/auth-session-list.query`
  - `unconditional`: `./src/operations/auth-session-list.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-session-list.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-session-revoke.command` — subpath `./operations/auth-session-revoke.command`
  - `unconditional`: `./src/operations/auth-session-revoke.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-session-revoke.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-signout.command` — subpath `./operations/auth-signout.command`
  - `unconditional`: `./src/operations/auth-signout.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-signout.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/auth-signup.command` — subpath `./operations/auth-signup.command`
  - `unconditional`: `./src/operations/auth-signup.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/auth-signup.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/registry` — subpath `./operations/registry`
  - `unconditional`: `./src/operations/registry.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/registry.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/roles` — subpath `./operations/roles`
  - `unconditional`: `./src/operations/roles/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/roles/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/sso` — subpath `./operations/sso`
  - `unconditional`: `./src/operations/sso/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/sso/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/security` — subpath `./operations/security`
  - `unconditional`: `./src/operations/security/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/security/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist` — subpath `./operations/waitlist`
  - `unconditional`: `./src/operations/waitlist/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/index.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/registry` — subpath `./operations/waitlist/registry`
  - `unconditional`: `./src/operations/waitlist/registry.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/registry.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/waitlist-approve.command` — subpath `./operations/waitlist/waitlist-approve.command`
  - `unconditional`: `./src/operations/waitlist/waitlist-approve.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/waitlist-approve.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/waitlist-entry` — subpath `./operations/waitlist/waitlist-entry`
  - `unconditional`: `./src/operations/waitlist/waitlist-entry.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/waitlist-entry.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/waitlist-join.command` — subpath `./operations/waitlist/waitlist-join.command`
  - `unconditional`: `./src/operations/waitlist/waitlist-join.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/waitlist-join.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/waitlist-list.query` — subpath `./operations/waitlist/waitlist-list.query`
  - `unconditional`: `./src/operations/waitlist/waitlist-list.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/waitlist-list.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/waitlist-reject.command` — subpath `./operations/waitlist/waitlist-reject.command`
  - `unconditional`: `./src/operations/waitlist/waitlist-reject.command.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/waitlist-reject.command.ts); verified source file.

- `@lssm-tech/lib.authos-spec/operations/waitlist/waitlist-status.query` — subpath `./operations/waitlist/waitlist-status.query`
  - `unconditional`: `./src/operations/waitlist/waitlist-status.query.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/operations/waitlist/waitlist-status.query.ts); verified source file.

- `@lssm-tech/lib.authos-spec/product-access` — subpath `./product-access`
  - `unconditional`: `./src/product-access.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/product-access.ts); verified source file.

- `@lssm-tech/lib.authos-spec/types` — subpath `./types`
  - `unconditional`: `./src/types.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/types.ts); verified source file.

- `@lssm-tech/lib.authos-spec/validation` — subpath `./validation`
  - `unconditional`: `./src/validation.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/domains/identity/spec/src/validation.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "browser": "./dist/browser/index.js",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./dev-profile-review": {
      "types": "./dist/dev-profile-review.d.ts",
      "browser": "./dist/browser/dev-profile-review.js",
      "bun": "./dist/dev-profile-review.js",
      "node": "./dist/node/dev-profile-review.js",
      "default": "./dist/dev-profile-review.js"
    },
    "./dev-profile-review-v2": {
      "types": "./dist/dev-profile-review-v2.d.ts",
      "browser": "./dist/browser/dev-profile-review-v2.js",
      "bun": "./dist/dev-profile-review-v2.js",
      "node": "./dist/node/dev-profile-review-v2.js",
      "default": "./dist/dev-profile-review-v2.js"
    },
    "./dev-resource-profile": {
      "types": "./dist/dev-resource-profile.d.ts",
      "browser": "./dist/browser/dev-resource-profile.js",
      "bun": "./dist/dev-resource-profile.js",
      "node": "./dist/node/dev-resource-profile.js",
      "default": "./dist/dev-resource-profile.js"
    },
    "./dev-source-scope": {
      "types": "./dist/dev-source-scope.d.ts",
      "browser": "./dist/browser/dev-source-scope.js",
      "bun": "./dist/dev-source-scope.js",
      "node": "./dist/node/dev-source-scope.js",
      "default": "./dist/dev-source-scope.js"
    },
    "./ecosystem": {
      "types": "./dist/ecosystem.d.ts",
      "browser": "./dist/browser/ecosystem.js",
      "bun": "./dist/ecosystem.js",
      "node": "./dist/node/ecosystem.js",
      "default": "./dist/ecosystem.js"
    },
    "./ecosystem-catalog": {
      "types": "./dist/ecosystem-catalog.d.ts",
      "browser": "./dist/browser/ecosystem-catalog.js",
      "bun": "./dist/ecosystem-catalog.js",
      "node": "./dist/node/ecosystem-catalog.js",
      "default": "./dist/ecosystem-catalog.js"
    },
    "./fixtures": {
      "types": "./dist/fixtures.d.ts",
      "browser": "./dist/browser/fixtures.js",
      "bun": "./dist/fixtures.js",
      "node": "./dist/node/fixtures.js",
      "default": "./dist/fixtures.js"
    },
    "./i18n": {
      "types": "./dist/i18n/index.d.ts",
      "browser": "./dist/browser/i18n/index.js",
      "bun": "./dist/i18n/index.js",
      "node": "./dist/node/i18n/index.js",
      "default": "./dist/i18n/index.js"
    },
    "./i18n/catalogs": {
      "types": "./dist/i18n/catalogs/index.d.ts",
      "browser": "./dist/browser/i18n/catalogs/index.js",
      "bun": "./dist/i18n/catalogs/index.js",
      "node": "./dist/node/i18n/catalogs/index.js",
      "default": "./dist/i18n/catalogs/index.js"
    },
    "./i18n/catalogs/en": {
      "types": "./dist/i18n/catalogs/en.d.ts",
      "browser": "./dist/browser/i18n/catalogs/en.js",
      "bun": "./dist/i18n/catalogs/en.js",
      "node": "./dist/node/i18n/catalogs/en.js",
      "default": "./dist/i18n/catalogs/en.js"
    },
    "./i18n/catalogs/es": {
      "types": "./dist/i18n/catalogs/es.d.ts",
      "browser": "./dist/browser/i18n/catalogs/es.js",
      "bun": "./dist/i18n/catalogs/es.js",
      "node": "./dist/node/i18n/catalogs/es.js",
      "default": "./dist/i18n/catalogs/es.js"
    },
    "./i18n/catalogs/fr": {
      "types": "./dist/i18n/catalogs/fr.d.ts",
      "browser": "./dist/browser/i18n/catalogs/fr.js",
      "bun": "./dist/i18n/catalogs/fr.js",
      "node": "./dist/node/i18n/catalogs/fr.js",
      "default": "./dist/i18n/catalogs/fr.js"
    },
    "./i18n/keys": {
      "types": "./dist/i18n/keys.d.ts",
      "browser": "./dist/browser/i18n/keys.js",
      "bun": "./dist/i18n/keys.js",
      "node": "./dist/node/i18n/keys.js",
      "default": "./dist/i18n/keys.js"
    },
    "./operations": {
      "types": "./dist/operations/index.d.ts",
      "browser": "./dist/browser/operations/index.js",
      "bun": "./dist/operations/index.js",
      "node": "./dist/node/operations/index.js",
      "default": "./dist/operations/index.js"
    },
    "./operations/account": {
      "types": "./dist/operations/account/index.d.ts",
      "browser": "./dist/browser/operations/account/index.js",
      "bun": "./dist/operations/account/index.js",
      "node": "./dist/node/operations/account/index.js",
      "default": "./dist/operations/account/index.js"
    },
    "./operations/account/auth-account-delete.command": {
      "types": "./dist/operations/account/auth-account-delete.command.d.ts",
      "browser": "./dist/browser/operations/account/auth-account-delete.command.js",
      "bun": "./dist/operations/account/auth-account-delete.command.js",
      "node": "./dist/node/operations/account/auth-account-delete.command.js",
      "default": "./dist/operations/account/auth-account-delete.command.js"
    },
    "./operations/account/auth-account-get.query": {
      "types": "./dist/operations/account/auth-account-get.query.d.ts",
      "browser": "./dist/browser/operations/account/auth-account-get.query.js",
      "bun": "./dist/operations/account/auth-account-get.query.js",
      "node": "./dist/node/operations/account/auth-account-get.query.js",
      "default": "./dist/operations/account/auth-account-get.query.js"
    },
    "./operations/account/auth-account-password-change.command": {
      "types": "./dist/operations/account/auth-account-password-change.command.d.ts",
      "browser": "./dist/browser/operations/account/auth-account-password-change.command.js",
      "bun": "./dist/operations/account/auth-account-password-change.command.js",
      "node": "./dist/node/operations/account/auth-account-password-change.command.js",
      "default": "./dist/operations/account/auth-account-password-change.command.js"
    },
    "./operations/account/auth-account-profile-update.command": {
      "types": "./dist/operations/account/auth-account-profile-update.command.d.ts",
      "browser": "./dist/browser/operations/account/auth-account-profile-update.command.js",
      "bun": "./dist/operations/account/auth-account-profile-update.command.js",
      "node": "./dist/node/operations/account/auth-account-profile-update.command.js",
      "default": "./dist/operations/account/auth-account-profile-update.command.js"
    },
    "./operations/api-keys": {
      "types": "./dist/operations/api-keys/index.d.ts",
      "browser": "./dist/browser/operations/api-keys/index.js",
      "bun": "./dist/operations/api-keys/index.js",
      "node": "./dist/node/operations/api-keys/index.js",
      "default": "./dist/operations/api-keys/index.js"
    },
    "./operations/auth-audit-list.query": {
      "types": "./dist/operations/auth-audit-list.query.d.ts",
      "browser": "./dist/browser/operations/auth-audit-list.query.js",
      "bun": "./dist/operations/auth-audit-list.query.js",
      "node": "./dist/node/operations/auth-audit-list.query.js",
      "default": "./dist/operations/auth-audit-list.query.js"
    },
    "./operations/auth-email-address-add.command": {
      "types": "./dist/operations/auth-email-address-add.command.d.ts",
      "browser": "./dist/browser/operations/auth-email-address-add.command.js",
      "bun": "./dist/operations/auth-email-address-add.command.js",
      "node": "./dist/node/operations/auth-email-address-add.command.js",
      "default": "./dist/operations/auth-email-address-add.command.js"
    },
    "./operations/auth-email-address-list.query": {
      "types": "./dist/operations/auth-email-address-list.query.d.ts",
      "browser": "./dist/browser/operations/auth-email-address-list.query.js",
      "bun": "./dist/operations/auth-email-address-list.query.js",
      "node": "./dist/node/operations/auth-email-address-list.query.js",
      "default": "./dist/operations/auth-email-address-list.query.js"
    },
    "./operations/auth-email-address-primary.command": {
      "types": "./dist/operations/auth-email-address-primary.command.d.ts",
      "browser": "./dist/browser/operations/auth-email-address-primary.command.js",
      "bun": "./dist/operations/auth-email-address-primary.command.js",
      "node": "./dist/node/operations/auth-email-address-primary.command.js",
      "default": "./dist/operations/auth-email-address-primary.command.js"
    },
    "./operations/auth-email-address-remove.command": {
      "types": "./dist/operations/auth-email-address-remove.command.d.ts",
      "browser": "./dist/browser/operations/auth-email-address-remove.command.js",
      "bun": "./dist/operations/auth-email-address-remove.command.js",
      "node": "./dist/node/operations/auth-email-address-remove.command.js",
      "default": "./dist/operations/auth-email-address-remove.command.js"
    },
    "./operations/auth-email-address-verify.command": {
      "types": "./dist/operations/auth-email-address-verify.command.d.ts",
      "browser": "./dist/browser/operations/auth-email-address-verify.command.js",
      "bun": "./dist/operations/auth-email-address-verify.command.js",
      "node": "./dist/node/operations/auth-email-address-verify.command.js",
      "default": "./dist/operations/auth-email-address-verify.command.js"
    },
    "./operations/auth-invitation-accept.command": {
      "types": "./dist/operations/auth-invitation-accept.command.d.ts",
      "browser": "./dist/browser/operations/auth-invitation-accept.command.js",
      "bun": "./dist/operations/auth-invitation-accept.command.js",
      "node": "./dist/node/operations/auth-invitation-accept.command.js",
      "default": "./dist/operations/auth-invitation-accept.command.js"
    },
    "./operations/auth-invitation-admin-list.query": {
      "types": "./dist/operations/auth-invitation-admin-list.query.d.ts",
      "browser": "./dist/browser/operations/auth-invitation-admin-list.query.js",
      "bun": "./dist/operations/auth-invitation-admin-list.query.js",
      "node": "./dist/node/operations/auth-invitation-admin-list.query.js",
      "default": "./dist/operations/auth-invitation-admin-list.query.js"
    },
    "./operations/auth-invitation-list.query": {
      "types": "./dist/operations/auth-invitation-list.query.d.ts",
      "browser": "./dist/browser/operations/auth-invitation-list.query.js",
      "bun": "./dist/operations/auth-invitation-list.query.js",
      "node": "./dist/node/operations/auth-invitation-list.query.js",
      "default": "./dist/operations/auth-invitation-list.query.js"
    },
    "./operations/auth-invitation-resend.command": {
      "types": "./dist/operations/auth-invitation-resend.command.d.ts",
      "browser": "./dist/browser/operations/auth-invitation-resend.command.js",
      "bun": "./dist/operations/auth-invitation-resend.command.js",
      "node": "./dist/node/operations/auth-invitation-resend.command.js",
      "default": "./dist/operations/auth-invitation-resend.command.js"
    },
    "./operations/auth-invitation-revoke.command": {
      "types": "./dist/operations/auth-invitation-revoke.command.d.ts",
      "browser": "./dist/browser/operations/auth-invitation-revoke.command.js",
      "bun": "./dist/operations/auth-invitation-revoke.command.js",
      "node": "./dist/node/operations/auth-invitation-revoke.command.js",
      "default": "./dist/operations/auth-invitation-revoke.command.js"
    },
    "./operations/auth-invitation-send.command": {
      "types": "./dist/operations/auth-invitation-send.command.d.ts",
      "browser": "./dist/browser/operations/auth-invitation-send.command.js",
      "bun": "./dist/operations/auth-invitation-send.command.js",
      "node": "./dist/node/operations/auth-invitation-send.command.js",
      "default": "./dist/operations/auth-invitation-send.command.js"
    },
    "./operations/auth-mfa-confirm.command": {
      "types": "./dist/operations/auth-mfa-confirm.command.d.ts",
      "browser": "./dist/browser/operations/auth-mfa-confirm.command.js",
      "bun": "./dist/operations/auth-mfa-confirm.command.js",
      "node": "./dist/node/operations/auth-mfa-confirm.command.js",
      "default": "./dist/operations/auth-mfa-confirm.command.js"
    },
    "./operations/auth-mfa-disable.command": {
      "types": "./dist/operations/auth-mfa-disable.command.d.ts",
      "browser": "./dist/browser/operations/auth-mfa-disable.command.js",
      "bun": "./dist/operations/auth-mfa-disable.command.js",
      "node": "./dist/node/operations/auth-mfa-disable.command.js",
      "default": "./dist/operations/auth-mfa-disable.command.js"
    },
    "./operations/auth-mfa-enroll.command": {
      "types": "./dist/operations/auth-mfa-enroll.command.d.ts",
      "browser": "./dist/browser/operations/auth-mfa-enroll.command.js",
      "bun": "./dist/operations/auth-mfa-enroll.command.js",
      "node": "./dist/node/operations/auth-mfa-enroll.command.js",
      "default": "./dist/operations/auth-mfa-enroll.command.js"
    },
    "./operations/auth-mfa-verify.command": {
      "types": "./dist/operations/auth-mfa-verify.command.d.ts",
      "browser": "./dist/browser/operations/auth-mfa-verify.command.js",
      "bun": "./dist/operations/auth-mfa-verify.command.js",
      "node": "./dist/node/operations/auth-mfa-verify.command.js",
      "default": "./dist/operations/auth-mfa-verify.command.js"
    },
    "./operations/auth-passkey-register.command": {
      "types": "./dist/operations/auth-passkey-register.command.d.ts",
      "browser": "./dist/browser/operations/auth-passkey-register.command.js",
      "bun": "./dist/operations/auth-passkey-register.command.js",
      "node": "./dist/node/operations/auth-passkey-register.command.js",
      "default": "./dist/operations/auth-passkey-register.command.js"
    },
    "./operations/auth-session-list.query": {
      "types": "./dist/operations/auth-session-list.query.d.ts",
      "browser": "./dist/browser/operations/auth-session-list.query.js",
      "bun": "./dist/operations/auth-session-list.query.js",
      "node": "./dist/node/operations/auth-session-list.query.js",
      "default": "./dist/operations/auth-session-list.query.js"
    },
    "./operations/auth-session-revoke.command": {
      "types": "./dist/operations/auth-session-revoke.command.d.ts",
      "browser": "./dist/browser/operations/auth-session-revoke.command.js",
      "bun": "./dist/operations/auth-session-revoke.command.js",
      "node": "./dist/node/operations/auth-session-revoke.command.js",
      "default": "./dist/operations/auth-session-revoke.command.js"
    },
    "./operations/auth-signout.command": {
      "types": "./dist/operations/auth-signout.command.d.ts",
      "browser": "./dist/browser/operations/auth-signout.command.js",
      "bun": "./dist/operations/auth-signout.command.js",
      "node": "./dist/node/operations/auth-signout.command.js",
      "default": "./dist/operations/auth-signout.command.js"
    },
    "./operations/auth-signup.command": {
      "types": "./dist/operations/auth-signup.command.d.ts",
      "browser": "./dist/browser/operations/auth-signup.command.js",
      "bun": "./dist/operations/auth-signup.command.js",
      "node": "./dist/node/operations/auth-signup.command.js",
      "default": "./dist/operations/auth-signup.command.js"
    },
    "./operations/registry": {
      "types": "./dist/operations/registry.d.ts",
      "browser": "./dist/browser/operations/registry.js",
      "bun": "./dist/operations/registry.js",
      "node": "./dist/node/operations/registry.js",
      "default": "./dist/operations/registry.js"
    },
    "./operations/roles": {
      "types": "./dist/operations/roles/index.d.ts",
      "browser": "./dist/browser/operations/roles/index.js",
      "bun": "./dist/operations/roles/index.js",
      "node": "./dist/node/operations/roles/index.js",
      "default": "./dist/operations/roles/index.js"
    },
    "./operations/sso": {
      "types": "./dist/operations/sso/index.d.ts",
      "browser": "./dist/browser/operations/sso/index.js",
      "bun": "./dist/operations/sso/index.js",
      "node": "./dist/node/operations/sso/index.js",
      "default": "./dist/operations/sso/index.js"
    },
    "./operations/security": {
      "types": "./dist/operations/security/index.d.ts",
      "browser": "./dist/browser/operations/security/index.js",
      "bun": "./dist/operations/security/index.js",
      "node": "./dist/node/operations/security/index.js",
      "default": "./dist/operations/security/index.js"
    },
    "./operations/waitlist": {
      "types": "./dist/operations/waitlist/index.d.ts",
      "browser": "./dist/browser/operations/waitlist/index.js",
      "bun": "./dist/operations/waitlist/index.js",
      "node": "./dist/node/operations/waitlist/index.js",
      "default": "./dist/operations/waitlist/index.js"
    },
    "./operations/waitlist/registry": {
      "types": "./dist/operations/waitlist/registry.d.ts",
      "browser": "./dist/browser/operations/waitlist/registry.js",
      "bun": "./dist/operations/waitlist/registry.js",
      "node": "./dist/node/operations/waitlist/registry.js",
      "default": "./dist/operations/waitlist/registry.js"
    },
    "./operations/waitlist/waitlist-approve.command": {
      "types": "./dist/operations/waitlist/waitlist-approve.command.d.ts",
      "browser": "./dist/browser/operations/waitlist/waitlist-approve.command.js",
      "bun": "./dist/operations/waitlist/waitlist-approve.command.js",
      "node": "./dist/node/operations/waitlist/waitlist-approve.command.js",
      "default": "./dist/operations/waitlist/waitlist-approve.command.js"
    },
    "./operations/waitlist/waitlist-entry": {
      "types": "./dist/operations/waitlist/waitlist-entry.d.ts",
      "browser": "./dist/browser/operations/waitlist/waitlist-entry.js",
      "bun": "./dist/operations/waitlist/waitlist-entry.js",
      "node": "./dist/node/operations/waitlist/waitlist-entry.js",
      "default": "./dist/operations/waitlist/waitlist-entry.js"
    },
    "./operations/waitlist/waitlist-join.command": {
      "types": "./dist/operations/waitlist/waitlist-join.command.d.ts",
      "browser": "./dist/browser/operations/waitlist/waitlist-join.command.js",
      "bun": "./dist/operations/waitlist/waitlist-join.command.js",
      "node": "./dist/node/operations/waitlist/waitlist-join.command.js",
      "default": "./dist/operations/waitlist/waitlist-join.command.js"
    },
    "./operations/waitlist/waitlist-list.query": {
      "types": "./dist/operations/waitlist/waitlist-list.query.d.ts",
      "browser": "./dist/browser/operations/waitlist/waitlist-list.query.js",
      "bun": "./dist/operations/waitlist/waitlist-list.query.js",
      "node": "./dist/node/operations/waitlist/waitlist-list.query.js",
      "default": "./dist/operations/waitlist/waitlist-list.query.js"
    },
    "./operations/waitlist/waitlist-reject.command": {
      "types": "./dist/operations/waitlist/waitlist-reject.command.d.ts",
      "browser": "./dist/browser/operations/waitlist/waitlist-reject.command.js",
      "bun": "./dist/operations/waitlist/waitlist-reject.command.js",
      "node": "./dist/node/operations/waitlist/waitlist-reject.command.js",
      "default": "./dist/operations/waitlist/waitlist-reject.command.js"
    },
    "./operations/waitlist/waitlist-status.query": {
      "types": "./dist/operations/waitlist/waitlist-status.query.d.ts",
      "browser": "./dist/browser/operations/waitlist/waitlist-status.query.js",
      "bun": "./dist/operations/waitlist/waitlist-status.query.js",
      "node": "./dist/node/operations/waitlist/waitlist-status.query.js",
      "default": "./dist/operations/waitlist/waitlist-status.query.js"
    },
    "./product-access": {
      "types": "./dist/product-access.d.ts",
      "browser": "./dist/browser/product-access.js",
      "bun": "./dist/product-access.js",
      "node": "./dist/node/product-access.js",
      "default": "./dist/product-access.js"
    },
    "./types": {
      "types": "./dist/types.d.ts",
      "browser": "./dist/browser/types.js",
      "bun": "./dist/types.js",
      "node": "./dist/node/types.js",
      "default": "./dist/types.js"
    },
    "./validation": {
      "types": "./dist/validation.d.ts",
      "browser": "./dist/browser/validation.js",
      "bun": "./dist/validation.js",
      "node": "./dist/node/validation.js",
      "default": "./dist/validation.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/lib.contracts-spec-core](https://lssm.co/docs/packages/lib.contracts-spec-core/): `workspace:^`
- [@lssm-tech/lib.schema](https://lssm.co/docs/packages/lib.schema/): `workspace:^`
- `zod`: `catalog:`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "publish:pkg": "bun publish --tolerate-republish --ignore-scripts --verbose",
  "publish:pkg:canary": "bun publish:pkg --tag canary",
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "dev": "contractspec-bun-build dev",
  "clean": "rimraf dist .turbo",
  "lint": "bun lint:fix",
  "lint:fix": "node ../../../../scripts/biome.cjs check --write .",
  "lint:check": "node ../../../../scripts/biome.cjs check .",
  "test": "bun test",
  "prebuild": "contractspec-bun-build prebuild",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Lib Authos Spec documentation](https://www.npmjs.com/package/%40lssm-tech%2Flib.authos-spec) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Flib.authos-spec",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/lib.authos-spec.txt",
  "route": "/llms/lib.authos-spec",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/lib.authos-spec.txt",
  "blobSha": "97d24436b54c9b032294000296f4a9b01719cf9e",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```