{"id":"@lssm-tech/app.api-founder-suite-monolith","slug":"app.api-founder-suite-monolith","name":"@lssm-tech/app.api-founder-suite-monolith","version":"0.4.2","path":"packages/apps/api-founder-suite-monolith","manifestPath":"packages/apps/api-founder-suite-monolith/package.json","manifestBlobSha":"6f2f912ecfb3bca6ee58923a80aeaf2864684920","layer":"apps","physicalArea":null,"primaryArea":"app-composition","classification":{"privateDeclared":true,"catalogFamily":null,"catalogKind":null,"catalogStatus":null,"adoptionMode":null,"stability":null},"description":null,"descriptionOrigin":"package.json","catalog":{},"canonicalImports":[],"scripts":{"build":"bun run build:elysia","build:elysia":"bun build --target node --packages bundle --loader .sql:text --outfile dist/index.js src/app.ts && mkdir -p api/dist api/db/migrations && cp dist/index.js api/dist/index.js && cp db/migrations/*.sql api/db/migrations/","database:plan":"bun src/database-cli.ts plan","database:bootstrap:fresh":"bun src/database-cli.ts bootstrap:fresh","database:adopt-0001":"bun src/database-cli.ts adopt-0001","database:migrate":"bun src/database-cli.ts migrate","database:verify":"bun src/database-cli.ts verify","database:snapshot:verify":"bun src/database-cli.ts snapshot:verify","database:reset:nonlive":"bun src/database-cli.ts reset:nonlive","database:prove:postgres":"bun src/database-cli.ts prove:postgres","dev":"bun run --watch src/app.ts","start":"bun run ./dist/index.js","lint:check":"node ../../../scripts/biome.cjs check .","test":"bun test","typecheck":"bun --bun x tsgo --project tsconfig.build.json --noEmit","prebuild":"bun run typecheck"},"scriptStatus":"complete pinned manifest","dependencies":{"@better-auth/drizzle-adapter":"1.7.5","@lssm-tech/bundle.founder-suite":"workspace:*","@lssm-tech/integration.authos-better-auth":"workspace:*","@lssm-tech/integration.communication-os-host-auth":"workspace:*","@lssm-tech/integration.crdt-loro":"workspace:*","@lssm-tech/integration.governed-product-data-postgres":"workspace:*","@lssm-tech/integration.opa-calendar-bridge":"workspace:*","@lssm-tech/integration.provider-email":"workspace:*","@lssm-tech/lib.authos-spec":"workspace:*","@lssm-tech/lib.contracts-integrations":"workspace:*","@lssm-tech/lib.contracts-runtime-server-rest":"workspace:*","@lssm-tech/lib.contracts-spec":"workspace:*","@lssm-tech/lib.data-exchange-server":"workspace:*","@lssm-tech/lib.notification":"workspace:*","@lssm-tech/lib.organization-planning-spec":"workspace:*","@lssm-tech/lib.founder-intelligence-runtime":"workspace:*","@lssm-tech/lib.founder-intelligence-spec":"workspace:*","@lssm-tech/lib.organization-planning-runtime":"workspace:*","@lssm-tech/lib.talent-spec":"workspace:*","@lssm-tech/module.executive-intelligence":"workspace:*","@lssm-tech/module.company-metrics":"workspace:*","@lssm-tech/module.forms":"workspace:*","@lssm-tech/module.founder-intelligence":"workspace:*","@lssm-tech/module.talent":"workspace:*","better-auth":"1.7.5","drizzle-orm":"catalog:data","elysia":"catalog:server","pg":"catalog:server","postgres":"^3.4.9","zod":"catalog:"},"devDependencies":{"@electric-sql/pglite":"catalog:data","@lssm-tech/tool.typescript":"workspace:*","@types/node":"catalog:types","@types/pg":"^8.23.1","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":null,"publishExports":null,"types":null,"files":null,"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[],"entryCount":0,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/api-founder-suite-monolith","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/api-founder-suite-monolith/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/api-founder-suite-monolith/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.api-founder-suite-monolith.txt"},"readme":{"status":"available","body":"# Pactena Founder Intelligence API\n\nStandalone Elysia host for Pactena Founder, Executive, and Talent Intelligence.\nThe PostgreSQL and independent AuthOS layers are live; optional email and AI\ncapabilities remain truthfully blocked until their provider credentials exist.\n\n## Environment\n\nServer-only variables:\n\n- `PACTENA_DATABASE_URL`\n- `PACTENA_DATABASE_RUNTIME_ROLE` pins the exact non-owner login expected by\n  startup and readiness. The role must own no tables and must not create roles, databases,\n  or schema objects, replicate, or bypass RLS. Runtime readiness verifies public\n  schema structure and grants but leaves the forced-RLS SEO seed inspection to\n  the explicit migration-owner verification lane.\n- `PACTENA_WAITLIST_DATABASE_URL` (low-privilege waitlist writer)\n- `DATABASE_URL` is never accepted. The waitlist credential must resolve to the\n  same protocol/host/port/database identity as `PACTENA_DATABASE_URL`.\n- `BETTER_AUTH_SECRET`\n- `BETTER_AUTH_BASE_URL` (defaults to `https://api.pactena.run`)\n- `APP_WEB_BASE_URL` (defaults to `https://app.pactena.run`)\n- `MARKETING_WEB_BASE_URL` (defaults to `https://www.pactena.run`)\n- `PACTENA_LSSM_RP_ENABLED`, `PACTENA_LSSM_RP_SECURITY_REVIEW_REF`, and\n  `PACTENA_LSSM_RP_CLIENT_SECRET` for the reviewed central LSSM OIDC relying\n  party. Enablement without review evidence or a 32+ character secret fails\n  startup closed.\n- `PACTENA_MEMBERSHIP_PROVISION_TOKEN` is the 32+ character, server-only token\n  used by central AuthOS to idempotently create an `app_pactena` membership.\n  Product routes require that local membership even when a Better Auth session\n  exists.\n- `PACTENA_GOVERNED_DATA_DATABASE_URL` selects the separate product-local\n  encrypted projection-copy store. `PACTENA_GOVERNED_RECOVERY_TOKEN` is its\n  distinct 32+ character central-worker bearer;\n  `PACTENA_GOVERNED_DATA_AUTO_MIGRATE=true` and\n  `PACTENA_GOVERNED_DATA_SSL_MODE=require|allow|prefer` control explicit schema\n  activation and transport. Do not enable the central Pactena recovery origin\n  until every governed projection copy uses this canonical store. Export stays\n  unavailable until a Pactena source exporter is bound.\n- `PACTENA_GOVERNED_DATA_REGION` and the secret-manager JSON value\n  `PACTENA_GOVERNED_MATERIALIZATION_BINDINGS` jointly enable encrypted-copy\n  admission at\n  `/internal/governed-data/materializations/:sourceApplicationId`. Each array\n  record has exact keys `sourceApplicationId` and `bearerToken`, and each\n  source-to-Pactena pair uses a distinct 32+ character bearer. Omit both to keep\n  materialization unavailable while recovery remains active. Partial topology,\n  unknown sources, purpose/field/region/expiry/retention/key drift, and\n  plaintext fail closed before persistence. Production also requires the\n  receiver key service and retention cleanup to be qualified.\n- `PACTENA_VAULT_ENCRYPTION_KEY`\n- `PACTENA_WAITLIST_TOKEN_SECRET`\n- `CRON_SECRET`\n- `OPENAI_API_KEY` and optional `PACTENA_OPENAI_MODEL` (`gpt-5.6-luna`)\n- `MISTRAL_API_KEY` and optional `PACTENA_MISTRAL_MODEL` (`mistral-small-2603`)\n- `RESEND_API_KEY` and `AUTH_EMAIL_FROM`\n- `PACTENA_FORMS_MILESTONES` (`forms.v0` by default, or `all`)\n- `PACTENA_FORMS_VERIFICATION_ENDPOINT`, bearer token, and channel list\n- `PACTENA_FORMS_AI_ENDPOINT`, bearer token, provider ID, and self-hosted flag\n- `PACTENA_FORMS_DEFENSE_ENDPOINT`, bearer token, and identifier secret for\n  distributed fail-closed abuse control\n- `COMPANY_OS_METRICS_API_ORIGIN`, `COMPANY_OS_METRICS_PACTENA_ISSUER`, and\n  `COMPANY_OS_METRICS_PACTENA_SHARED_SECRET` for short-lived, scope-bound\n  CompanyOS metric session exchange\n\nThe `/api/v1/company-metrics` peer proxy has an explicit operation allowlist,\nrequires the Pactena application origin and an idempotency key for mutations,\nand derives company scope from fresh session authority. Founder-private scope\nis not representable by this proxy.\n\nNo provider key or database URL has a fixture fallback in production.\n\n## Conversations, notifications and calendar\n\nThe CommunicationOS BFF under `/api/v1/communication-os/*` exchanges the\nsession for a scoped CommunicationOS bearer and forwards an explicit operation\nallowlist. It includes the canonical contract send\n`POST /api/v1/communication-os/communication/message/send/v3.0.0` used by the\nshared client: the app origin, a matching `idempotency-key` header and body\n`idempotencyKey`, and the session-derived workspace and space are required, so\na retry replays the original message and a founder-private room never accepts\na company-scoped send. Reconnect uses `POST .../v2/auth/realtime-ticket` and\ncursor replay through `GET .../v2/events`.\n\n`GET` and `POST /api/v1/notification-preferences` are the Pactena preference\ncenter over `@lssm-tech/lib.notification/product-channels`: in-app is always\non and updates are revision-checked. An update sends `expectedRevision`,\n`globalEnabled`, `enabledChannels` and `consentedChannels`; the BFF mints each\nconsent ref from the session (person, channel and new revision), so email is\nenabled only with that explicit consent and a client never supplies consent\nevidence. Responses list `consentedChannels`, never the refs. A stale\nrevision answers `409 idempotency_conflict`, the conflict code of the Pactena\nerror vocabulary.\n`POST /api/v1/calendar/intake` imports upcoming founder-private calendar\nmeetings the founder has not declined as digest-only OPA meeting workspaces\nthrough the shared intake materializer, and answers only its counts. Both\nmutations require the app origin and `x-csrf-token` equal to the session id,\nlike the meeting workspace, and cap the body (8 KB for preferences, 1 KB for\nintake, which takes none); the CommunicationOS send reads at most 64 KB even\nfor chunked uploads. Both answer `503 dependency_unavailable` until a\npreference store and CommunicationOS admission host, or a calendar connection\nhost and intake materializer, are bound; nothing is bound in the deployed host\ntoday.\n\nPublic signup remains disabled. Direct magic links resolve existing invited\nemails only. When the reviewed LSSM relying party is enabled, the local Pactena\nidentity may be projected from a centrally authenticated email only after the\ncentral `app_pactena` entitlement gate succeeds; the exact product scope is\nrequested and no ecosystem cookie is shared with Pactena. Central activation\nalso unregisters Pactena's local magic-link plugin and email callback. Disabling\nthe RP restores that existing-email path as the explicit rollback authority;\nthe two authorities are never enabled together.\n\nForms management is exposed at `/forms`, public forms at `/f/{opaqueToken}`,\nand the API at `/api/forms/v1`. Migrations `0003_forms_platform.sql` and\n`0004_forms_scope_hardening.sql` are the Pactena-owned immutable Forms schema\nand row-bound public-access upgrade.\n\n## Database lifecycle\n\nDatabase changes never run during startup or request handling. Operators use\nthe explicit `database:plan`, `database:bootstrap:fresh`,\n`database:adopt-0001`, `database:migrate`, `database:verify`,\n`database:snapshot:verify`, `database:reset:nonlive`, and\n`database:prove:postgres` scripts. Mutating lanes require an evidence reference;\nthe non-live reset additionally requires a typed allowlisted fingerprint, a\nfresh encrypted snapshot receipt, provider effects disabled, and approved\nsame-task Connect decision plus passed replay artifacts.\n\nMigration `0001` remains immutable at\n`sha256:216989309872df7873bb983ec37439c68c93bb8e0165035b93eadb4e6f86daff`.\nPactena-owned migration `0002` creates the fresh-only 31-table OPA v2 schema,\npins all 28 owner tables to `product_ref='pactena'`, and records both versions in\n`pactena_owned_migration_ledger`. Adoption verifies the exact `0001` catalog\nbefore recording provenance. Full reset/adoption execution remains blocked\nuntil external database, snapshot, and Connect authority exists.\n\nMigration `0005` installs the forced-RLS governed meeting workspace tables;\n`0007` adds digest-only public access grants and `0008` adds owner-scoped\ncalendar occurrence mappings plus immutable recorder-review evidence. `0009`\nadds recurring intake definitions and expiring, token-fenced execution leases.\nThe Elysia host mounts the nineteen exact `/api/v2/opa/meeting-*` and\n`/api/v2/opa/smart-meetings/*` operations with Better Auth session-derived\norganization scope. Mutations require the Pactena app origin and the current\nsession id as CSRF evidence. Meeting content is recovered from an encrypted,\noptimistically versioned owner aggregate; approval, artifact, dispatch, CRDT,\nshare, recorder, and outbox evidence remains on the dedicated SQL surfaces.\n\nThe current fresh schema contains exactly 84 public tables: 18 immutable\nPactena baseline tables, 52 OPA tables, 12 Forms tables,\n`pactena_product_memberships`, and `pactena_owned_migration_ledger`. Forms verification is pinned to the 12 tables created by immutable migrations\n`0003`/`0004`; newer shared Forms features require an explicit Pactena migration.\nIt deliberately preserves unrelated tables. Reset authorization, snapshot proof, and\nConnect replay remain pending; this inventory does not authorize execution.\n\nThe read-only readiness probe reports bounded verification phases (`ledger`,\n`tables`, `inventory`, `rls`, `grants`, `products`, or `seed`) and a safe\nSQLSTATE. It never logs SQL, credentials, connection details, or provider error\nmessages. Privilege repairs must use the explicit same-database\n`PACTENA_DATABASE_MIGRATION_URL`; never grant ledger access to `PUBLIC`.\n","sourcePath":"packages/apps/api-founder-suite-monolith/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/api-founder-suite-monolith/README.md","blobSha":"b63fdead2d474d479d09197d0ec69e20e8daeb65","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"app-composition","areaTitle":"Application composition and product hosts","displayName":"app.api-founder-suite-monolith","runtimes":[],"platforms":[],"kind":"apps","scope":"Workspace only","canonicalRoute":"/docs/packages/app.api-founder-suite-monolith/","contextUrl":"/docs/packages/app.api-founder-suite-monolith.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}