@lssm/lib.authos-runtime

Pure deterministic AuthOS runtime projections and security gates over @lssm/lib.authos-spec.

This package does not authenticate users, call Better Auth, access databases, or execute providers. It converts AuthOS contracts into safe runtime-facing projections for RBAC, RoleMorph, personalization, data-transmission, database/form metadata, Connect with LSSM, redaction, and production IdP readiness.

The runtime also includes a deterministic domain-command persistence helper. It turns approved or approval-required AuthOS command contracts into immutable local runtime events with governance metadata, while returning canExecute: false plans so provider, database, and Better Auth execution remains outside this package.

The ecosystem provisioning reducer applies redacted, idempotent receipts for identity, entitlement, product-local membership, activation, and revocation. It never activates partial provisioning, rejects scope and idempotency conflicts, resumes after retry evidence, and can rebuild state from durable receipts without calling an identity provider or product API.

Subject providers and subject modes

The ./subject subpath ships the production-grade SubjectProvider port implementation consumed by @lssm/lib.contracts-spec/rich-reference (S-3) and the per-call subject-mode factories used by the AI-agent surface (S-9):

• createSubjectProvider({ resolve, cache }) — request-scoped resolver with optional dual-key tenant-scoped LRU cache. Returns undefined (deny-closed) when the strategy throws or yields a malformed shape.
• createDelegatedSubject({ userSession, agentId, signature }, verifier) — builds an agent-on-behalf-of-user Subject with kind='user' and delegationChain=[userId, agentId] so the audit record carries both identities. Throws on bad signature; resolveSubjectMode turns that into a deny-closed undefined.
• createAgentSubject(identity) — first-class agent identity (kind='agent', no delegation chain).
• resolveSubjectMode(ctx) — per-call dispatcher selected by the caller via ctx.mode.

The createHmacDelegationVerifier(secret) helper produces a server-side HMAC-SHA-256 verifier; secrets must come from the orchestration boundary that issues delegation contracts.