# @lssm-tech/integration.meeting-effect-worker-postgres-http Production PostgreSQL, BYOK, authority, rollout, and HTTP delivery composition for the meeting effect worker. ## Source and release context - Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498` - Repository: `lssm-tech/contractspec` - Declared package version: `0.1.3` - Package path: `packages/integrations/meeting-effect-worker-postgres-http` - Manifest path: `packages/integrations/meeting-effect-worker-postgres-http/package.json` - Manifest Git blob: `4c3e8dd5cd28278d91efb88d8c2e44e6704155c4` - Manifest origin: pinned GitHub manifest fetch - Manual: [@lssm-tech/integration.meeting-effect-worker-postgres-http](https://lssm.co/docs/packages/integration.meeting-effect-worker-postgres-http/) - Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/) This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review. Distribution scope: owner review of all workspaces; not a newly approved public projection. - [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http) - [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/package.json) - [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/README.md) - [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.meeting-effect-worker-postgres-http.txt) ## Package metadata ```json { "layer": "integrations", "physicalArea": null, "primaryArea": "company-and-work", "classification": { "privateDeclared": true, "catalogFamily": null, "catalogKind": null, "catalogStatus": null, "adoptionMode": null, "stability": null }, "descriptionOrigin": "package.json", "manifestComplete": true, "publicationPolicyApplied": false } ``` Manifest private flag: true — workspace only. Primary area: [Company, work and service operations](https://lssm.co/docs/areas/company-and-work/) ## Package guide ```json { "status": "available", "sourcePath": "packages/integrations/meeting-effect-worker-postgres-http/README.md", "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/README.md", "blobSha": "380d2b775045bedb14c5f38b647729239a51f542", "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498", "origin": "README recovered byte-for-byte from pinned aggregate guide", "integrity": "exact Git blob match", "executionStatus": "not executed" } ``` The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations. # Meeting Effect Worker PostgreSQL + HTTP Composition Production composition for `@lssm-tech/app.meeting-effect-worker`. It claims only explicitly assigned owner scopes, binds all five RLS axes inside PostgreSQL transactions, decrypts meeting state with the shared versioned BYOK cipher, obtains fresh authority and effect-time reproof from a host authority service, enforces the host rollout contract, and submits approved artifacts to a live delivery service. The package does not contain a success stub or a generic “delivered” fallback. A delivery is successful only after the configured HTTPS service returns an exact, identity-matched provider receipt. Network errors, timeouts, non-200 responses, malformed JSON, stale authority, missing rollout, and receipt mismatches all fail closed and flow into the worker's bounded retry policy; typed permanent rejections are dead-lettered with their failure code. ## Host configuration Set the worker host's module to: ```text OPA_MEETING_EFFECT_WORKER_COMPOSITION_MODULE=@lssm-tech/integration.meeting-effect-worker-postgres-http ``` Required variables: | Variable | Contract | | --- | --- | | `OPA_MEETING_EFFECT_DATABASE_URL` | PostgreSQL URL for the governed meeting schema. | | `OPA_MEETING_EFFECT_OWNER_SCOPES_JSON` | JSON array of 1–100 strict `OpaOwnerScope` values; duplicates are rejected. | | `OPA_MEETING_EFFECT_AUTHORITY_URL` | HTTPS endpoint for fresh resolution and effect-time reproof. | | `OPA_MEETING_EFFECT_DELIVERY_URL` | HTTPS endpoint that performs real provider delivery. | | `OPA_MEETING_EFFECT_AUTHORITY_TOKEN` | Authority-only bearer credential of at least 32 UTF-8 bytes. | | `OPA_MEETING_EFFECT_DELIVERY_TOKEN` | Delivery-only bearer credential of at least 32 UTF-8 bytes. | | `OPA_MEETING_EFFECT_ROLLOUTS_JSON` | Strict rollout-config array with one entry for each assigned product. | | `OPA_BYOK_KEY_VERSION` | Active version used by `EnvMasterKeySource`. | | `OPA_BYOK_MASTER_KEY_v1`, `_v2`, `_v3` | Current and retained rotation keys; each configured value is at least 32 decoded bytes. | Optional bounded settings are `OPA_MEETING_EFFECT_DATABASE_SSL_MODE` (`require`, `prefer`, or explicit `allow`), `OPA_MEETING_EFFECT_INTERVAL_MS`, `OPA_MEETING_EFFECT_LIMIT`, `OPA_MEETING_EFFECT_LEASE_MS`, `OPA_MEETING_EFFECT_MAX_ATTEMPTS`, and `OPA_MEETING_EFFECT_HTTP_TIMEOUT_MS`. `OPA_MEETING_EFFECT_KILL_SWITCH=1` stops new claims (readiness reports `paused`); any value other than unset, empty, `0` or `1` is rejected at startup. The database must have migration `0166` (`opaMeetingFollowUpMigrationStatements`): it adds the `dead_letter` outbox state, `last_error_code`, `provider_receipt_ref` and the host delivery ledger. Without it, settling a lease fails and the effect is retried after its lease expires. ## HTTPS boundary Both endpoints receive authenticated JSON `POST` requests and must return HTTP 200 with `application/json`. Authority requests carry `version`, a unique `requestRef`, the full lease, and either `operation: "resolve"` or `operation: "reprove"`. An allow response must echo the request reference and return an active, strict runtime authority containing `opa.meeting_dispatch.execute`; a deny response contains only `version`, `requestRef`, and `decision: "deny"`. Delivery requests use the v2 envelope defined by `OpaMeetingEffectDeliveryRequestSchema` in `@lssm-tech/lib.organization-planning-spec`: `operation: "deliver"`, a `requestRef`, the effect reference as `idempotencyKey`, the owner scope, plan and meeting references, the approved effect (target, artifact, recipient and effect digest), the approved artifact digest and the plan approval receipt. Artifact content is never sent; the host reloads and re-verifies it. The API host (`/api/internal/opa/meeting-effects/deliver`) routes targets to its follow-up adapters and answers with `OpaMeetingEffectDeliveryResponseSchema`: ```json { "version": "v2", "requestRef": "meeting-effect-request:...", "effectRef": "meeting-dispatch-effect:...", "status": "delivered", "providerReceiptRef": "provider-receipt:..." } ``` `status` may also be `drafted` (calendar proposals) or `rejected` with a failure `code` and `retryable` flag. Permanent rejections dead-letter the effect at once; retryable ones follow the bounded exponential backoff (1 s doubling to 5 min, `OPA_MEETING_EFFECT_MAX_ATTEMPTS`, then `attempts_exhausted`). The distinct authority and delivery bearers are sent only in the `Authorization` header. They are never included in configuration errors, response bodies, rollout digests, or persisted meeting state. ## Declared capabilities This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source. ## Canonical imports Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference. ```json [] ``` ## Declared export entry points Scope: manifest-declared export entrypoints and catalog-declared imports. Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted. Installation status: not verified. - `@lssm-tech/integration.meeting-effect-worker-postgres-http` — subpath `.` - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/src/index.ts); verified source file. - `@lssm-tech/integration.meeting-effect-worker-postgres-http/composition` — subpath `./composition` - `unconditional`: `./src/composition.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/src/composition.ts); verified source file. - `@lssm-tech/integration.meeting-effect-worker-postgres-http/config` — subpath `./config` - `unconditional`: `./src/config.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/src/config.ts); verified source file. - `@lssm-tech/integration.meeting-effect-worker-postgres-http/http-boundary` — subpath `./http-boundary` - `unconditional`: `./src/http-boundary.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/src/http-boundary.ts); verified source file. - `@lssm-tech/integration.meeting-effect-worker-postgres-http/postgres` — subpath `./postgres` - `unconditional`: `./src/postgres.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-effect-worker-postgres-http/src/postgres.ts); verified source file. ## Package publication metadata These are source-manifest declarations, not a registry installation check. ```json { "types": "./dist/index.d.ts", "files": null, "publishExports": { ".": { "types": "./dist/index.d.ts", "bun": "./dist/index.js", "node": "./dist/node/index.js", "default": "./dist/index.js" }, "./composition": { "types": "./dist/composition.d.ts", "bun": "./dist/composition.js", "node": "./dist/node/composition.js", "default": "./dist/composition.js" }, "./config": { "types": "./dist/config.d.ts", "bun": "./dist/config.js", "node": "./dist/node/config.js", "default": "./dist/config.js" }, "./http-boundary": { "types": "./dist/http-boundary.d.ts", "bun": "./dist/http-boundary.js", "node": "./dist/node/http-boundary.js", "default": "./dist/http-boundary.js" }, "./postgres": { "types": "./dist/postgres.d.ts", "bun": "./dist/postgres.js", "node": "./dist/node/postgres.js", "default": "./dist/postgres.js" } } } ``` ## Dependencies Metadata status: complete pinned manifest. ### Runtime dependencies - [@lssm-tech/lib.organization-planning-runtime](https://lssm.co/docs/packages/lib.organization-planning-runtime/): `workspace:^` - [@lssm-tech/lib.organization-planning-spec](https://lssm.co/docs/packages/lib.organization-planning-spec/): `workspace:^` - `postgres`: `^3.4.9` ### Peer dependencies No declarations in the inspected manifest. ### Optional dependencies No declarations in the inspected manifest. ### Development dependencies - [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*` - [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*` - `@types/bun`: `catalog:types` - `typescript`: `catalog:` ### Peer dependency metadata ```json {} ``` ### Bundled dependencies ```json null ``` ## Package scripts Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest. ```json { "build": "contractspec-bun-build build", "build:bundle": "contractspec-bun-build transpile", "build:types": "contractspec-bun-build types", "clean": "rimraf dist .turbo", "lint:check": "node ../../../scripts/biome.cjs check .", "test": "bun test", "prebuild": "contractspec-bun-build prebuild", "typecheck": "tsgo --noEmit" } ``` ## Declared documentation links No additional documentation links are declared in the inspected catalogue. ## Existing agent-guide projection ```json { "path": "packages/apps/web-landing/public/llms-packages/integration.meeting-effect-worker-postgres-http.txt", "route": "/llms/integration.meeting-effect-worker-postgres-http", "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.meeting-effect-worker-postgres-http.txt", "blobSha": "380d2b775045bedb14c5f38b647729239a51f542", "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498", "bodyEqualsReadme": true, "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt", "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf" } ```