{"id":"@lssm-tech/app.organization-planning-host","slug":"app.organization-planning-host","name":"@lssm-tech/app.organization-planning-host","version":"0.1.6","path":"packages/apps/organization-planning-host","manifestPath":"packages/apps/organization-planning-host/package.json","manifestBlobSha":"8373d65d54e7fce6c5a089b3856c8a087ffa2e58","layer":"apps","physicalArea":null,"primaryArea":"company-and-work","classification":{"privateDeclared":true,"catalogFamily":null,"catalogKind":null,"catalogStatus":null,"adoptionMode":null,"stability":null},"description":"Thin OPA host: mounts the organization-planning operation registry on REST, GraphQL, and MCP surfaces via the shared contracts-runtime adapters.","descriptionOrigin":"package.json","catalog":{"visualTesting":{"status":"deferred","owner":"@contractspec-core","targetWave":"wave-3-react-packages","rationale":"Foundational Storybook adoption establishes shared catalogs and guardrails before this package migrates."}},"canonicalImports":[],"scripts":{"clean":"rimraf dist .turbo","lint":"bun lint:fix","lint:fix":"node ../../../scripts/biome.cjs check --write .","lint:check":"node ../../../scripts/biome.cjs check .","test":"bun test","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/integration.authos-better-auth":"workspace:*","@lssm-tech/lib.contracts-runtime-server-graphql":"workspace:*","@lssm-tech/lib.contracts-runtime-server-mcp":"workspace:*","@lssm-tech/lib.contracts-runtime-server-rest":"workspace:*","@lssm-tech/lib.contracts-spec":"workspace:*","@lssm-tech/lib.design-system":"workspace:*","@lssm-tech/lib.identity-rbac":"workspace:*","@lssm-tech/lib.logger":"workspace:*","@lssm-tech/lib.organization-planning-runtime":"workspace:*","@lssm-tech/lib.organization-planning-spec":"workspace:*","@lssm-tech/lib.translation-runtime":"workspace:*","@lssm-tech/module.organization-planning":"workspace:*","@lssm-tech/opa-booking-react":"workspace:*","@modelcontextprotocol/sdk":"catalog:ai","@pothos/core":"catalog:graphql","lucide-react":"catalog:ui","next":"catalog:","react":"catalog:","react-dom":"catalog:","zod":"catalog:"},"devDependencies":{"@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","@types/react":"catalog:types","@types/react-dom":"catalog:types","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":null,"publishExports":null,"types":null,"files":null,"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[],"entryCount":0,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/organization-planning-host","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/organization-planning-host/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/organization-planning-host/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.organization-planning-host.txt"},"readme":{"status":"available","body":"# @lssm-tech/app.organization-planning-host\n\nWebsite: https://contractspec.io\n\n**Thin OPA host — mounts the organization-planning operation registry on REST,\nGraphQL, and MCP.**\n\n## What It Provides\n\n- **Layer**: `app.` (thin deployable host; transport wiring only).\n- Exposes `buildOpaOps()` (from `@lssm-tech/lib.organization-planning-runtime`)\n  identically on three surfaces via existing contracts-runtime adapters:\n  - **REST** — `createOpaRestHandler(ctxFactory)`, served by the Next App Router\n    catch-all at `app/api/ops/[...route]/route.ts`.\n  - **GraphQL** — `createOpaGraphqlBuilder()` returns a Pothos builder with the OPA\n    query/mutation fields.\n  - **MCP** — `mountOpaMcp(server, ctxFactories)` registers the OPA tools.\n- Serves the **public booking page** at `app/book/[link]/page.tsx`. The page\n  speaks the OPA v2 public booking protocol through\n  `@lssm-tech/opa-booking-react` (`useOpaBooking` plus the typed\n  `./availability` projections): anonymous visitors load the availability\n  quote, pick a slot and create a booking intent bound to its\n  `availabilityRef`/`slotRef`. The booking link must allowlist this host's\n  origin; only name, email, timezone and locale are sent.\n\n## Auth\n\nFail-closed at every step. The REST route\n(`app/api/ops/[...route]/route.ts`) composes three pieces:\n\n1. **Session projection** (`src/session-context.ts`,\n   `createOpaHostSessionContext`). An `Authorization: Bearer` token is checked\n   against AuthOS (`/api/auth/get-session`, through\n   `createBetterAuthBearerSessionReader`) and then against the caller's own\n   CompanyOS authority (`GET /api/companyos/auth/authority`, same bearer, no\n   cookies or redirects, 1.5 s budget, answer at most 5 s old). The session and\n   active organization must match, and the identity is read again after the\n   authority read. The result is\n   `{ actor: 'user', userId, organizationId, tenantId, workspaceId, roles }`,\n   where `tenantId`/`workspaceId` use the OPA ref grammar\n   (`tenant:<segment>`, `workspace:<segment>`) and `roles` is the CompanyOS\n   persona (`grantRole`). Anything else is `{ actor: 'anonymous' }`, which the\n   REST adapter rejects with 401 on every non-public operation.\n   **Module entitlement** (`src/opa-workspace-module.ts`). Like the monolith's\n   `requireWorkspaceModule(session, 'opa')`, the host requires `opa` in the\n   authority read's `enabledModules`. When the list is missing or lacks `opa`,\n   the user ctx gets a `decide` that answers 403 on every non-public\n   operation, whatever the persona; public operations stay reachable as for\n   an anonymous caller. A malformed `enabledModules` is treated as no\n   authority (401).\n2. **RBAC binding** (`src/opa-host-rbac.ts`, `createOpaHostRbac`). Identity\n   RBAC's `RBACPolicyEngine` plus one user-bound, tenant-tagged binding per\n   CompanyOS persona. `opa.loop.execute` (admin, founder approver, operations\n   manager) and `opa.booking.approve` (admin, founder approver) follow the\n   api-application-monolith bindings. The profile capabilities\n   (`opa.profile.read`/`manage`/`publish`) and every capability of the\n   meeting-workspace operations a deployment can install through\n   `OpaBuildDeps` (`opa.meeting_policy.*`, `opa.meeting_workspace.*`,\n   `opa.meeting_context.*`, `opa.meeting_artifact.*`,\n   `opa.meeting_work_session.*`, `opa.meeting_outcome.*`,\n   `opa.meeting_dispatch.*`, `opa.meeting_share.*`,\n   `opa.recording.source_bind`) go to the OPA personas of the\n   managed-companyos coverage manifest (founder approver, operations manager)\n   and the admin. The manifest gives the other personas no OPA coverage, so\n   they get only the meeting capabilities of their AuthOS built-in role\n   template:\n\n   | Persona | Meeting operations allowed |\n   | --- | --- |\n   | `expert_reviewer` | `opa.meeting_workspace.get`, `opa.meeting_artifact.list`/`get`, `opa.meeting_artifact.review_decide` |\n   | `auditor` | `opa.meeting_workspace.get`, `opa.meeting_artifact.list`/`get` (read-only) |\n   | `frontline_staff` | `opa.meeting_workspace.get` |\n   | `ai_operator` | none (not an assignable AuthOS role) |\n\n   Every other operation answers 403 for these personas, including\n   `opa.meeting_work_session.*`, policy, context, dispatch and sharing, and\n   unknown roles get no binding at all. The runtime authority port still\n   checks the actor's own grant on each meeting resource. An operation group\n   whose capabilities have no persona grant answers 403 for every persona\n   until its capabilities are mapped in `src/opa-host-rbac.ts`.\n3. **Policy decision point** (`src/opa-host-policy.ts`). When\n   `createOpaRestHandler(ctxFactory, { rbac })` is given an RBAC port, every\n   request context gets a `decide` that requires the operation's declared\n   capability for a resolved tenant and workspace actor. Public\n   (`policy.auth: 'anonymous'`) operations pass, unknown operations and missing\n   grants are 403, and a context `decide` can only narrow the result. Bindings\n   are tenant-scoped like the runtime's `authorizeOpaOperation`\n   (`src/opa-host-tenant-scope.ts`): grants tagged, scoped or targeted to\n   another tenant are dropped, and own-tenant `tenantId` or `tenant`-scope\n   grants are honored. The runtime authority port still rejects a resource\n   from another workspace (403). Without an RBAC port,\n   `createOpaRestHandler` is default-deny: a non-anonymous ctx that brings no\n   `decide` of its own (such as the one `createOpaHostSessionContext`\n   projects) gets one that answers 403 on every non-public operation. Pair\n   the session projection with `{ rbac }`.\n\nKnown scope: the CompanyOS authority read does not return the selected team\nor sub-workspace, so the host scopes OPA to the active organization's\nworkspace (`workspace:<segment(activeOrganizationId)>`). The route binds no\nprofile or meeting persistence, so it serves only the operation groups a\ndeployment configures through `OpaBuildDeps`.\n\n| Variable | Purpose |\n| --- | --- |\n| `OPA_HOST_AUTHOS_BASE_URL` | Origin (no path) of the CompanyOS API, which serves AuthOS and the authority read. Unset → every caller is anonymous. HTTPS only, except `http://localhost`. A value that is not an exact origin (trailing slash, path, credentials, HTTP on another host) is logged once as `opa_host.invalid_authos_base_url` when the route loads, and every caller is then anonymous; public operations keep working. |\n| `OPA_HOST_INSECURE_DEV` | `1` enables the LOCAL-ONLY `x-opa-dev-user`/`-tenant`/`-workspace`/`-roles` headers when no bearer is sent. Ignored when `NODE_ENV=production`; the dev subject still needs a persona in `x-opa-dev-roles`. |\n\nThe MCP mount (`mountOpaMcp`) still takes the caller's `toolCtx`; it does not\nuse this session projection yet.\n\n## Local Commands\n\n- `bun run test` — smoke tests (3 surface mounts + REST round-trip), session\n  projection, REST default-deny and RBAC tests\n- `bun run typecheck` — TypeScript check\n- `bun run lint:check` — Biome check\n","sourcePath":"packages/apps/organization-planning-host/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/organization-planning-host/README.md","blobSha":"90f391c9319883b4e6eefc7875d89f99931a1a42","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"company-and-work","areaTitle":"Company, work and service operations","displayName":"app.organization-planning-host","runtimes":[],"platforms":[],"kind":"apps","scope":"Workspace only","canonicalRoute":"/docs/packages/app.organization-planning-host/","contextUrl":"/docs/packages/app.organization-planning-host.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}