3.13.7

May 25, 2026 · 31 packages · 24 unique changes · 9 release entries

appsbundlesintegrationslibs

This release affects the contracts, integrations, sharedLibs, solutions familyies.

Run contractspec connect adoption resolve --family contracts to see how it impacts your project.

Release summaries

github-integration-v2
Production-grade GitHub integration v2.0.0 with full CRUD operations for repositories, issues, and pull requests, OAuth2 and GitHub App authentication, and comprehensive webhook handling.
integrator
GitHub integration now supports full CRUD operations for repositories, issues, and pull requests. OAuth2 and GitHub App authentication are available alongside personal access tokens. Webhook handling supports push, PR, issue, and workflow events.
integration-hub-all-integrations
Complete the shipped integration registry so Integration Hub lists Fal and OpenAI image provider specs.
integrator
The default integration registry now includes all shipped provider specs, including `ai-image.fal` and `ai-image.openai`, so registry consumers and the Integration Hub runtime preview sees the complete shipped catalog instead of a stale non-registry seed row.
integration-surfaces-slng-gradium-fal-tavily
Add SLNG, Gradium, fal, and Tavily integration surfaces with API/WebSocket/SDK/MCP/OAuth metadata and SLNG voice implementation coverage.
maintainer
Integration contracts now include SLNG and Tavily provider specs, richer Gradium/fal surfaces, and a WebSocket transport discriminator.
integrator
Voice and web-research integrations can discover API/WebSocket/SDK/MCP/OAuth support from the registry and use the new SLNG voice provider implementation.
knowledge-provider-delta-orchestration
Add provider delta contracts, Google Drive knowledge ingestion, and governed mutation execution for workspace knowledge.
maintainer
Maintainers get shared delta sync contracts and package-local tests for Gmail/Drive ingestion and governed mutations.
integrator
Integrators can model provider leases, cursors, webhook expiry, dedupe/idempotency, replay checkpoints, tombstones, Drive files, and governed outbound mutations before wiring runtime sync.
managed-byok-integration-coverage
Expand provider specs and integration wrappers with managed and BYOK ownership coverage.
maintainer
Provider specifications and integration wrappers now advertise managed and BYOK credential ownership modes consistently across shipped provider packages.
integrator
Integrators can derive transport and credential ownership setup from specs, with Integration Hub preview flows seeded from the shipped provider registry.
customer
Integration setup previews can explain managed versus BYOK credential ownership without exposing raw secret values.
matrix-communication-channels
Add first-class Matrix communication support with bridge-aware metadata and a minimal provider adapter.
maintainer
Matrix is now represented across integration specs, communication channel contracts, runtime channel defaults, and provider-messaging implementation boundaries.
integrator
Applications can configure Matrix as an existing managed/BYOK homeserver connection and describe externally managed bridges without replacing direct messaging providers.
customer
Matrix can participate as an interoperability channel while direct provider integrations remain available and homeserver/bridge setup stays operator-managed.
notion-integration-v2
Production-grade Notion integration v2.0.0 with full CRUD operations, OAuth2 authentication, and real-time synchronization capabilities.
integrator
Notion integration now supports full CRUD operations for pages, databases, and blocks. OAuth2 with PKCE is available alongside API key authentication. Real-time sync via webhooks and delta sync are supported.
slack-integration-v2
Production-grade Slack integration v2.0.0 with full CRUD operations for conversations, users, reactions, and files, plus OAuth2 and Event API webhook support.
integrator
Slack integration now supports full CRUD operations for conversations, users, reactions, and files. OAuth2 authentication is available alongside bot tokens. Event API webhook handling supports message, channel, and user events.
teams-integration-v1
New Microsoft Teams integration v1.0.0 with messaging, channels, teams, and users via Microsoft Graph API, plus Azure AD OAuth2 and webhook/subscription support.
integrator
New Microsoft Teams integration with full messaging, channel, team, and user operations. Azure AD OAuth2 authentication with both delegated and app-only flows. Change notification subscriptions for real-time updates.

Migration guide

Configure Matrix as an existing managed or BYOK connection
Required
Provide an existing homeserver URL, access token, and Matrix room target; keep homeserver and bridge provisioning outside ContractSpec.

Upgrade steps

Review default registry enumeration assumptions
assisted
Consumers that render every default registry entry will now show two additional image provider specs.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/example.integration-hub, @lssm-tech/lib.runtime-sandbox
1. If your UI enumerates `createDefaultIntegrationSpecRegistry().list()`, verify image-provider grouping and mode filters.
2. Use `supportedModes` and credential-manifest exemptions to distinguish BYOK-only specs from dual-mode specs.
Route new provider connections by declared transports and auth methods
assisted
Prefer official SDK transports where present, use WebSocket metadata for realtime voice protocols, and use Tavily OAuth metadata only for remote MCP flows.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.provider-voice
1. Use `createDefaultIntegrationSpecRegistry()` to discover SLNG, Gradium, fal, and Tavily specs.
2. For SLNG STT, send documented multipart uploads unless using a provider-supported URL flow.
3. For fal MCP, use Bearer API-key auth; for fal SDK/API, keep existing FAL key handling.
4. For Tavily MCP OAuth, use the advertised authorize/token endpoints and OpenID/offline scopes from remote MCP metadata.
Accept Matrix as a communication channel
assisted
Treat `matrix` like other canonical CommunicationOS channels in validation and runtime capability flows.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/lib.communication-spec, @lssm-tech/lib.communication-runtime, @lssm-tech/integration.provider-messaging
1. Allow `matrix` channel values anywhere `ChannelTypeEnum` or `RuntimeChannelType` is consumed.
2. Preserve existing direct channel handling and avoid automatic Matrix bridge substitution.
Use provider ownership metadata when rendering integration setup
assisted
Read managed/BYOK ownership support from provider specs instead of hard-coding credential-mode copy.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/example.integration-hub, @lssm-tech/integration.runtime, @lssm-tech/integration.runtime-managed, @lssm-tech/integration.runtime-hybrid, @lssm-tech/integration.runtime-local, @lssm-tech/integration.provider-opencode-go, @lssm-tech/integration.provider-codex, @lssm-tech/integration.provider-claude-code, @lssm-tech/integration.provider-gemini, @lssm-tech/integration.provider-copilot, @lssm-tech/integration.provider-local-model, @lssm-tech/integration.provider-stt, @lssm-tech/integration.providers-impls, @lssm-tech/integration.harness-runtime, @lssm-tech/integration.example-generator, @lssm-tech/integration.workflow-devkit, @lssm-tech/integration.builder-telegram, @lssm-tech/integration.builder-voice, @lssm-tech/integration.builder-whatsapp
1. Resolve provider specs from the shared registry.
2. Render managed and BYOK options only when the provider advertises support.
3. Keep credential preview values redacted and route real credentials through runtime secret providers.
Configure OAuth2 authentication for Slack
manual
Existing bot token authentication continues to work. To migrate to OAuth2, configure a Slack app with the required scopes and use the new OAuth2 handler.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.runtime, @lssm-tech/integration.provider-messaging
1. Create a Slack app at https://api.slack.com/apps
2. Configure OAuth2 redirect URLs and required scopes
3. Use SlackOAuth2Handler to generate authorization URLs and exchange codes
4. Store tokens via SecretProvider for managed mode
Configure Event API for real-time events
manual
Enable webhook support to receive real-time updates from Slack events.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.runtime, @lssm-tech/integration.provider-messaging
1. Configure webhook URL in Slack app's Event Subscriptions settings
2. Set signing secret and configure via SlackWebhookReceiver
3. Implement SlackEventHandler to handle message, channel, and user events
4. Verify signature validation and idempotency are working
Configure Azure AD OAuth2 for Microsoft Teams
manual
Register an application in Azure AD with Microsoft Graph API permissions for Teams.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.runtime, @lssm-tech/integration.provider-messaging
1. Register an app in Azure AD (https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps)
2. Grant Microsoft Graph API permissions for Teams (ChannelMessage.Send, Channel.ReadBasic.All, Team.ReadBasic.All)
3. Configure redirect URIs for OAuth2 callbacks
4. Store client_id, client_secret, and tenant_id securely
5. Use TeamsOAuth2Handler for delegated or app-only authentication
Configure change notifications for real-time events
manual
Enable Microsoft Graph webhook subscriptions to receive real-time updates from Teams.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.runtime, @lssm-tech/integration.provider-messaging
1. Set up a publicly accessible HTTPS notification endpoint
2. Use TeamsSubscriptionManager to create subscriptions for messages/channels/teams
3. Implement TeamsEventHandler to handle incoming change notifications
4. Set up subscription renewal before expiry (max 3 days for messages)
Configure OAuth2 authentication for GitHub
manual
Existing personal access token authentication continues to work. To migrate to OAuth2, configure a GitHub OAuth App and use the new OAuth2 handler.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.runtime, @lssm-tech/integration.provider-github
1. Create a GitHub OAuth App at https://github.com/settings/developers
2. Store client_id and client_secret securely
3. Use GitHubOAuth2Handler to generate authorization URLs and exchange codes
4. Store tokens via SecretProvider for managed mode
Configure webhooks for real-time events
manual
Enable webhook support to receive real-time updates from GitHub events.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.runtime, @lssm-tech/integration.provider-github
1. Configure webhook URL in GitHub repository or organization settings
2. Set webhook secret and configure via GitHubWebhookReceiver
3. Implement GitHubEventHandler to handle push, PR, issue, and workflow events
4. Verify signature validation and idempotency are working
Attach delta state before runtime sync
manual
Use `ProviderDeltaSyncState` for provider cursors, leases, webhook expiry, dedupe, idempotency, replay, and tombstone state.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/lib.contracts-spec, @lssm-tech/lib.knowledge, @lssm-tech/bundle.library, @lssm-tech/bundle.marketing, @lssm-tech/app.web-landing, @lssm-tech/example.knowledge-canon
1. Pass provider cursor or watermark state into Gmail and Drive sync calls.
2. Persist returned delta state before acknowledging runtime sync work.
3. Skip or delete records marked with tombstones before re-indexing.
Gate knowledge mutations before provider writes
manual
Wrap external writes with `executeGovernedKnowledgeMutation(...)` so dry-runs, approvals, idempotency, audit evidence, and outbound-send gates are explicit.
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/lib.contracts-spec, @lssm-tech/lib.knowledge, @lssm-tech/bundle.library, @lssm-tech/bundle.marketing, @lssm-tech/app.web-landing, @lssm-tech/example.knowledge-canon
1. Use `dryRun` for preview-only flows.
2. Provide `idempotencyKey` and `auditEvidence.evidenceRef` for non-dry-run mutations.
3. Require approval refs and an approved outbound-send gate before sending external messages.
Configure OAuth2 authentication for Notion
manual
Set up OAuth2 with PKCE for Notion integration
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.provider-project-management, @lssm-tech/integration.runtime
1. Create a Notion OAuth application at https://www.notion.so/my-integrations
2. Store client_id and client_secret securely
3. Use NotionOAuth2Handler to generate authorization URLs and exchange codes
4. Store tokens via SecretProvider for managed mode
Configure webhooks for real-time sync
manual
Set up webhook endpoint and delta sync for real-time Notion updates
Packages: @lssm-tech/lib.contracts-integrations, @lssm-tech/integration.provider-project-management, @lssm-tech/integration.runtime
1. Configure webhook endpoint URL in Notion integration settings
2. Store webhook secret securely via SecretProvider
3. Implement NotionWebhookReceiver to handle incoming events
4. Set up NotionDeltaSync for efficient change tracking

Unique release changes

- Expand provider specs and integration wrappers with managed and BYOK ownership coverage.
19 packages · 19 occurrences
- Read managed/BYOK ownership support from provider specs instead of hard-coding credential-mode copy.
19 packages · 19 occurrences
- Add provider delta contracts, Google Drive knowledge ingestion, and governed mutation execution for workspace knowledge.
6 packages · 6 occurrences
- Use `ProviderDeltaSyncState` for provider cursors, leases, webhook expiry, dedupe, idempotency, replay, and tombstone state.
6 packages · 6 occurrences
- Wrap external writes with `executeGovernedKnowledgeMutation(...)` so dry-runs, approvals, idempotency, audit evidence, and outbound-send gates are explicit.
6 packages · 6 occurrences
- Add first-class Matrix communication support with bridge-aware metadata and a minimal provider adapter.
4 packages · 4 occurrences
- Provide an existing homeserver URL, access token, and Matrix room target; keep homeserver and bridge provisioning outside ContractSpec.
4 packages · 4 occurrences
- Treat `matrix` like other canonical CommunicationOS channels in validation and runtime capability flows.
4 packages · 4 occurrences
- Enable Microsoft Graph webhook subscriptions to receive real-time updates from Teams.
3 packages · 3 occurrences
- Enable webhook support to receive real-time updates from GitHub events.
3 packages · 3 occurrences
- Enable webhook support to receive real-time updates from Slack events.
3 packages · 3 occurrences
- Existing bot token authentication continues to work. To migrate to OAuth2, configure a Slack app with the required scopes and use the new OAuth2 handler.
3 packages · 3 occurrences
- Existing personal access token authentication continues to work. To migrate to OAuth2, configure a GitHub OAuth App and use the new OAuth2 handler.
3 packages · 3 occurrences
- New Microsoft Teams integration v1.0.0 with messaging, channels, teams, and users via Microsoft Graph API, plus Azure AD OAuth2 and webhook/subscription support.
3 packages · 3 occurrences
- Production-grade GitHub integration v2.0.0 with full CRUD operations for repositories, issues, and pull requests, OAuth2 and GitHub App authentication, and comprehensive webhook handling.
3 packages · 3 occurrences
- Production-grade Notion integration v2.0.0 with full CRUD operations, OAuth2 authentication, and real-time synchronization capabilities.
3 packages · 3 occurrences
- Production-grade Slack integration v2.0.0 with full CRUD operations for conversations, users, reactions, and files, plus OAuth2 and Event API webhook support.
3 packages · 3 occurrences
- Register an application in Azure AD with Microsoft Graph API permissions for Teams.
3 packages · 3 occurrences
- Set up OAuth2 with PKCE for Notion integration
3 packages · 3 occurrences
- Set up webhook endpoint and delta sync for real-time Notion updates
3 packages · 3 occurrences
- Add SLNG, Gradium, fal, and Tavily integration surfaces with API/WebSocket/SDK/MCP/OAuth metadata and SLNG voice implementation coverage.
2 packages · 2 occurrences
- Complete the shipped integration registry so Integration Hub lists Fal and OpenAI image provider specs.
2 packages · 2 occurrences
- Consumers that render every default registry entry will now show two additional image provider specs.
2 packages · 2 occurrences
- Prefer official SDK transports where present, use WebSocket metadata for realtime voice protocols, and use Tavily OAuth metadata only for remote MCP flows.
2 packages · 2 occurrences

Impacted packages

@lssm-tech/app.web-landing
Layer: apps · 3 changes
@lssm-tech/bundle.library
Layer: bundles · 3 changes
@lssm-tech/bundle.marketing
Layer: bundles · 3 changes
@lssm-tech/integration.builder-telegram
Layer: integrations · 2 changes
@lssm-tech/integration.builder-voice
Layer: integrations · 2 changes
@lssm-tech/integration.builder-whatsapp
Layer: integrations · 2 changes
@lssm-tech/integration.example-generator
Layer: integrations · 2 changes
@lssm-tech/integration.harness-runtime
Layer: integrations · 2 changes
@lssm-tech/integration.provider-claude-code
Layer: integrations · 2 changes
@lssm-tech/integration.provider-codex
Layer: integrations · 2 changes
@lssm-tech/integration.provider-copilot
Layer: integrations · 2 changes
@lssm-tech/integration.provider-gemini
Layer: integrations · 2 changes
@lssm-tech/integration.provider-github
Layer: integrations · 3 changes
@lssm-tech/integration.provider-local-model
Layer: integrations · 2 changes
@lssm-tech/integration.provider-messaging
Layer: integrations · 3 changes
@lssm-tech/integration.provider-opencode-go
Layer: integrations · 2 changes
@lssm-tech/integration.provider-project-management
Layer: integrations · 3 changes
@lssm-tech/integration.provider-stt
Layer: integrations · 2 changes
@lssm-tech/integration.provider-voice
Layer: integrations · 2 changes
@lssm-tech/integration.providers-impls
Layer: integrations · 2 changes
@lssm-tech/integration.runtime
Layer: integrations · 3 changes
@lssm-tech/integration.runtime-hybrid
Layer: integrations · 2 changes
@lssm-tech/integration.runtime-local
Layer: integrations · 2 changes
@lssm-tech/integration.runtime-managed
Layer: integrations · 2 changes
@lssm-tech/integration.workflow-devkit
Layer: integrations · 2 changes
@lssm-tech/lib.communication-runtime
Layer: libs · 3 changes
@lssm-tech/lib.communication-spec
Layer: libs · 3 changes
@lssm-tech/lib.contracts-integrations
Layer: libs · 3 changes
@lssm-tech/lib.contracts-spec
Layer: libs · 3 changes
@lssm-tech/lib.knowledge
Layer: libs · 3 changes
@lssm-tech/lib.runtime-sandbox
Layer: libs · 2 changes