# @lssm-tech/app.osint-api

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `0.2.1`
- Package path: `packages/apps/osint-api`
- Manifest path: `packages/apps/osint-api/package.json`
- Manifest Git blob: `75a9954239ab680d16d2614defa4769185b7c680`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/app.osint-api](https://lssm.co/docs/packages/app.osint-api/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/osint-api)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/osint-api/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/osint-api/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.osint-api.txt)

## Package metadata

```json
{
  "layer": "apps",
  "physicalArea": null,
  "primaryArea": "intelligence-and-research",
  "classification": {
    "privateDeclared": true,
    "catalogFamily": null,
    "catalogKind": null,
    "catalogStatus": null,
    "adoptionMode": null,
    "stability": null
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: true — workspace only.

Primary area: [Intelligence, research and applications](https://lssm.co/docs/areas/intelligence-and-research/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/apps/osint-api/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/osint-api/README.md",
  "blobSha": "ba438b680ae3a113c3ae8f20ae1243fa3865ead9",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# OSINT API

REST/OpenAPI composition root for scoped OSINT and governed self-improvement
operation handlers. This app owns no domain rules. `OSINT_PORT` defaults to
`3108`.

By default the standalone service uses the managed composition: OIDC/JWKS
verification, a fresh authority decision, FORCE-RLS PostgreSQL reads, and the
durable mutation queue. Configure `OSINT_DATABASE_URL`, `OSINT_AUTHOS_ISSUER`,
`OSINT_AUTHOS_AUDIENCE`, `OSINT_AUTHOS_JWKS_URL`, and `OSINT_AUTHORITY_URL`.
Deployments may instead set an allowlisted `OSINT_API_COMPOSITION_MODULE`
matching `@lssm-tech/integration.osint-api-*`.
Set `OSINT_DEPLOYMENT_PROFILE_ID` for an explicit managed profile. Known
data-isolated deployment IDs, including Hirly France, are also recognized from
the authenticated scope and enforced even when the optional environment value
is absent; disallowed vertical reads fail before SQL.

The managed composition polls the canonical append-only outbox for
scope-isolated, replayable SSE and WebSocket sessions.
`OSINT_STREAM_POLL_INTERVAL_MS` and `OSINT_STREAM_BATCH_SIZE` tune bounded
delivery without changing authority.

The composition supplies the authenticated context resolver, shared headless
operation handler, dependency readiness probe, optional scoped stream broker,
and graceful shutdown hook. `/livez`
reports process liveness while `/readyz` fails closed on dependency health.
Authenticated SSE and WebSocket sessions both bind replay cursors to the exact
resolved scope; WebSocket upgrades are accepted only at the generated event
path and detach from the scoped broker on close.
Browser WebSocket origins default to the request origin; deployments with a
separate console origin set the explicit comma-separated `OSINT_ALLOWED_ORIGINS`.

An allowlisted composition may also supply `selfImprovement` with its own
authenticated context, headless handler, and scoped broker. The host then serves
the generated `/api/self-improvement/v1` REST/OpenAPI surface plus program-bound
SSE and WebSocket replay. The generated OpenAPI remains discoverable when the
runtime is absent, but every call and stream fails closed with `503`; production
qualification requires a concrete governed module/store/authority composition.

The managed host now supplies that composition when
`SELF_IMPROVEMENT_CONTROL_URL` and `SELF_IMPROVEMENT_WORKLOAD_TOKEN` are both
set. `SELF_IMPROVEMENT_AUTHORITY_URL` may select a separate fresh-authority
endpoint and otherwise uses `OSINT_AUTHORITY_URL`. HTTP callers provide the
explicit `x-self-improvement-*` ecosystem, tenant, workspace, optional program,
jurisdiction, and purpose headers. Readiness remains red until the FORCE-RLS
`self_improvement_*` tables have been migrated; the app never auto-migrates a
runtime database role. The managed composition also supplies the program-scoped
event broker and publishes declared lifecycle events only after successful
headless mutations.


## Declared capabilities

This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source.

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/app.osint-api` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/osint-api/src/index.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": null,
  "files": null,
  "publishExports": null
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/integration.osint-managed-runtime](https://lssm.co/docs/packages/integration.osint-managed-runtime/): `workspace:^`
- [@lssm-tech/integration.osint-transport](https://lssm.co/docs/packages/integration.osint-transport/): `workspace:^`
- [@lssm-tech/integration.self-improving-system-transport](https://lssm.co/docs/packages/integration.self-improving-system-transport/): `workspace:^`
- [@lssm-tech/lib.contracts-spec](https://lssm.co/docs/packages/lib.contracts-spec/): `workspace:^`
- [@lssm-tech/lib.osint-runtime](https://lssm.co/docs/packages/lib.osint-runtime/): `workspace:^`
- [@lssm-tech/lib.osint-spec](https://lssm.co/docs/packages/lib.osint-spec/): `workspace:^`
- [@lssm-tech/module.self-improving-system](https://lssm.co/docs/packages/module.self-improving-system/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "start": "bun run src/server.ts",
  "test": "bun test",
  "typecheck": "tsgo --noEmit",
  "lint:check": "node ../../../scripts/biome.cjs check ."
}
```

## Declared documentation links

No additional documentation links are declared in the inspected catalogue.

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/app.osint-api.txt",
  "route": "/llms/app.osint-api",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.osint-api.txt",
  "blobSha": "ba438b680ae3a113c3ae8f20ae1243fa3865ead9",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```