{"id":"@lssm-tech/integration.meeting-intake-worker-postgres-http","slug":"integration.meeting-intake-worker-postgres-http","name":"@lssm-tech/integration.meeting-intake-worker-postgres-http","version":"0.1.3","path":"packages/integrations/meeting-intake-worker-postgres-http","manifestPath":"packages/integrations/meeting-intake-worker-postgres-http/package.json","manifestBlobSha":"809addf6ba549f9fbad91a9e03a7b7384eaebf24","layer":"integrations","physicalArea":null,"primaryArea":"company-and-work","classification":{"privateDeclared":true,"catalogFamily":null,"catalogKind":null,"catalogStatus":null,"adoptionMode":null,"stability":null},"description":"Production PostgreSQL queue and protected HTTP execution composition for the OPA meeting intake worker.","descriptionOrigin":"package.json","catalog":{},"canonicalImports":[],"scripts":{"build":"contractspec-bun-build build","build:bundle":"contractspec-bun-build transpile","build:types":"contractspec-bun-build types","clean":"rimraf dist .turbo","lint:check":"node ../../../scripts/biome.cjs check .","test":"bun test","prebuild":"contractspec-bun-build prebuild","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/lib.organization-planning-runtime":"workspace:^","@lssm-tech/lib.organization-planning-spec":"workspace:^","postgres":"^3.4.9"},"devDependencies":{"@electric-sql/pglite":"catalog:data","@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","@types/bun":"catalog:types","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./composition":"./src/composition.ts","./config":"./src/config.ts","./execution-readiness":"./src/execution-readiness.ts","./execution-service":"./src/execution-service.ts","./http-boundary":"./src/http-boundary.ts","./jobs":"./src/jobs.ts","./postgres":"./src/postgres.ts","./reauthorization":"./src/reauthorization.ts"},"publishExports":{".":{"types":"./dist/index.d.ts","bun":"./dist/index.js","node":"./dist/node/index.js","default":"./dist/index.js"},"./composition":{"types":"./dist/composition.d.ts","bun":"./dist/composition.js","node":"./dist/node/composition.js","default":"./dist/composition.js"},"./config":{"types":"./dist/config.d.ts","bun":"./dist/config.js","node":"./dist/node/config.js","default":"./dist/config.js"},"./execution-readiness":{"types":"./dist/execution-readiness.d.ts","bun":"./dist/execution-readiness.js","node":"./dist/node/execution-readiness.js","default":"./dist/execution-readiness.js"},"./execution-service":{"types":"./dist/execution-service.d.ts","bun":"./dist/execution-service.js","node":"./dist/node/execution-service.js","default":"./dist/execution-service.js"},"./http-boundary":{"types":"./dist/http-boundary.d.ts","bun":"./dist/http-boundary.js","node":"./dist/node/http-boundary.js","default":"./dist/http-boundary.js"},"./jobs":{"types":"./dist/jobs.d.ts","bun":"./dist/jobs.js","node":"./dist/node/jobs.js","default":"./dist/jobs.js"},"./postgres":{"types":"./dist/postgres.d.ts","bun":"./dist/postgres.js","node":"./dist/node/postgres.js","default":"./dist/postgres.js"},"./reauthorization":{"types":"./dist/reauthorization.d.ts","bun":"./dist/reauthorization.js","node":"./dist/node/reauthorization.js","default":"./dist/reauthorization.js"}},"types":"./dist/index.d.ts","files":null,"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./composition","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/composition","target":"./src/composition.ts","targets":[{"conditions":[],"target":"./src/composition.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/composition.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/composition.ts","sourceStatus":"verified source file"}]},{"subpath":"./config","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/config","target":"./src/config.ts","targets":[{"conditions":[],"target":"./src/config.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/config.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/config.ts","sourceStatus":"verified source file"}]},{"subpath":"./execution-readiness","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/execution-readiness","target":"./src/execution-readiness.ts","targets":[{"conditions":[],"target":"./src/execution-readiness.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/execution-readiness.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/execution-readiness.ts","sourceStatus":"verified source file"}]},{"subpath":"./execution-service","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/execution-service","target":"./src/execution-service.ts","targets":[{"conditions":[],"target":"./src/execution-service.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/execution-service.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/execution-service.ts","sourceStatus":"verified source file"}]},{"subpath":"./http-boundary","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/http-boundary","target":"./src/http-boundary.ts","targets":[{"conditions":[],"target":"./src/http-boundary.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/http-boundary.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/http-boundary.ts","sourceStatus":"verified source file"}]},{"subpath":"./jobs","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/jobs","target":"./src/jobs.ts","targets":[{"conditions":[],"target":"./src/jobs.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/jobs.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/jobs.ts","sourceStatus":"verified source file"}]},{"subpath":"./postgres","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/postgres","target":"./src/postgres.ts","targets":[{"conditions":[],"target":"./src/postgres.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/postgres.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/postgres.ts","sourceStatus":"verified source file"}]},{"subpath":"./reauthorization","importPath":"@lssm-tech/integration.meeting-intake-worker-postgres-http/reauthorization","target":"./src/reauthorization.ts","targets":[{"conditions":[],"target":"./src/reauthorization.ts","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/src/reauthorization.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/src/reauthorization.ts","sourceStatus":"verified source file"}]}],"entryCount":9,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.meeting-intake-worker-postgres-http.txt"},"readme":{"status":"available","body":"# Meeting Intake Worker PostgreSQL/HTTP Composition\n\nProduction composition for `@lssm-tech/app.meeting-intake-worker`. It claims\nthe canonical owner-scoped PostgreSQL queue and invokes one protected HTTPS\nexecution service. Only opaque job, connection, and protected-configuration\nreferences cross the boundary; provider credentials and meeting content do not.\nThe database lease token remains inside the worker and is never sent to the\nexecution service.\n\nConfigure:\n\n- `OPA_MEETING_INTAKE_WORKER_COMPOSITION_MODULE=@lssm-tech/integration.meeting-intake-worker-postgres-http`\n- `OPA_MEETING_INTAKE_DATABASE_URL`\n- `OPA_MEETING_INTAKE_OWNER_SCOPES_JSON` with 1–100 unique exact five-axis scopes\n- `OPA_MEETING_INTAKE_EXECUTION_URL` using HTTPS\n- `OPA_MEETING_INTAKE_EXECUTION_TOKEN`, at least 32 UTF-8 bytes\n- optional bounded SSL, interval, limit, lease, attempt, and timeout settings\n- optional `OPA_MEETING_INTAKE_JOBS_JSON`, 1–100 declared jobs (see below)\n\nA misconfigured worker fails at start with\n`meeting_intake_worker_configuration_invalid: <KEY>,<KEY>`, naming every\nmissing or invalid key and never a value. `meetingIntakeWorkerReadiness()`\n(`./config`) returns the same names without throwing.\n\n## Declared jobs and provisioning ownership (`./jobs`)\n\n`OPA_MEETING_INTAKE_JOBS_JSON` is for self-hosted or worker deployments. Each\nentry names an `ownerScope` from the served scopes, a `jobRef`, a\n`connectionRef` and a `protectedConfigRef` (opaque references, unique `jobRef`\nand `connectionRef` per scope), an optional `scheduleIntervalSeconds`\n(60–86400, default 900) and an optional `enabled` (default `true`). The worker\nupserts the declared jobs of a scope once before its first claim, so a restart\nre-enables a paused job.\n\nWhen the variable is unset, the worker declares and provisions nothing. It\ndefers to the CompanyOS API provisioner and only claims jobs that already\nexist in its served scopes.\n\nA scope must have one provisioner. Before every claim of a scope with declared\njobs, the worker looks for an enabled job of the API owner opt-in provisioner\n(`MEETING_INTAKE_API_OWNER_JOB_PREFIX`, `meeting-intake-job:auto:`). That\nprefix is reserved: a declared `jobRef` using it makes\n`OPA_MEETING_INTAKE_JOBS_JSON` invalid. If such a job exists, the worker skips\nthat scope and keeps serving the others:\n\n- it claims nothing in the scope;\n- it emits `meeting_intake.provisioning_blocked` (metric\n  `opa_meeting_intake_provisioning_blocked_total`) once each time the scope\n  becomes blocked;\n- it still applies the scope's declared `enabled: false` jobs, because\n  disabling a job cannot create a second provisioner.\n\nA `connectionRef` belongs to one job row per scope (`unique(owner,\nconnection_ref)`), even a disabled one. When another row already holds a\ndeclared job's `connectionRef` (for example after a `jobRef` rename), the\nupsert's unique violation does not stop the worker: the scope is skipped the\nsame way with the blocker `meeting_intake_declared_job_conflict` and the\ndeclared `jobRef`, and every later claim retries the write. The worker never\ndeletes or re-points the other row; a database operator does.\n\n`provisioningBlockers()` on the composition lists the scopes skipped by their\nlatest claim, each with its readiness blocker\n(`meeting_intake_api_provisioner_conflict` or\n`meeting_intake_declared_job_conflict`); the worker app's `/readyz` reports\nthem and fails closed, answering `503` while any remains (its other scopes keep\nrunning). PGlite tests run the provisioner check\nand the `23505` connection conflict as `opa_app` under the 0041 FORCE RLS\npolicies. `findMeetingIntakeProvisioningBlocker()`\nruns the owner-scoped API provisioner check, and\n`MeetingIntakeProvisioningBlockedError` lets a host fail closed on a blocker.\n\n## Reauthorization (`./reauthorization`)\n\nThe HTTP boundary keeps the execution service's closed, redacted error code\n(for example `granola_auth_failed`) instead of `execution_http_<status>`. A\ncode in `MEETING_INTAKE_REAUTHORIZATION_CODES` (the three Granola credential\ncodes and `calendar_reauthorization_required`, the credential lapses the\nCompanyOS API cron also recognizes) emits\n`meeting_intake.reauthorization_required` (metric\n`opa_meeting_intake_reauthorization_required_total`) and, for a job this worker\ndeclared, pauses it (`SqlMeetingIntakeJobControl.pause`, owner-scoped, FORCE\nRLS); a worker restart re-provisions and re-enables it. The worker never pauses\na job provisioned elsewhere (no declared jobs): that provisioner keeps control\nand the alert reports `jobPaused: false`. Alerts carry opaque references and\nclosed codes only; the default sink writes one JSON line to stderr.\n\n## Executor readiness (`./execution-readiness`)\n\n`meetingIntakeExecutionReadiness(env, expectedPath)` names the API host keys\nthat are unset or unusable for the protected executor route: the execution\nURL (HTTPS and the mounted path), the token (at least 32 bytes), the owner\nscopes and protected configurations, and the Granola credential each\nconfigured recorder transport needs. A calendar-only configuration (no\n`recorder`, or `recorder: null`) needs no Granola credential. It never echoes\na value. The CompanyOS API serves it, with the in-process cron and calendar\nsync readiness, on the service-authorized operator route\n`GET /api/opa/meeting-intake/readiness` (key names and states only).\n\nThe operator runbook is `docs/operations/founder-ops-v2/meetings-enable.md`\n(section 3).\n\nThe execution service must authenticate the worker, resolve the protected\nconfiguration and provider credentials server-side, re-prove current owner and\nprovider authority, run calendar/recorder intake idempotently by\n`executionRef`, persist occurrence/review/binding results, and return exactly:\n\n```json\n{\n  \"version\": \"v1\",\n  \"requestRef\": \"request:opaque\",\n  \"executionRef\": \"execution:opaque\",\n  \"status\": \"completed\",\n  \"providerReceiptRef\": \"receipt:opaque\"\n}\n```\n\nNon-200 responses fail closed. HTTP 408, 429, and 5xx are retryable; other 4xx\nand malformed or mismatched receipts are terminal.\n\n## Protected execution service\n\n`./execution-service` provides the server side of this boundary as a\n`Request -> Response` handler. It authenticates the worker token in constant\ntime, accepts only configured exact owner scopes, re-proves authority through\nthe host `authorize` port, executes once per `executionRef` (a replay returns\nthe stored receipt; a changed request under the same reference is `409`) and\nreturns the exact v1 receipt. Executor failures map to `503` (retryable) or\n`422` (terminal) with a redacted code. Hosts compose `execute` from the\ncalendar/recorder evidence ingestion and governed binding; credentials are\nresolved server-side from `protectedConfigRef` and never cross the boundary.\n","sourcePath":"packages/integrations/meeting-intake-worker-postgres-http/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/meeting-intake-worker-postgres-http/README.md","blobSha":"e536dfa9e1aab5dda9ea8ade61f4022fe784fd83","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"company-and-work","areaTitle":"Company, work and service operations","displayName":"integration.meeting-intake-worker-postgres-http","runtimes":[],"platforms":[],"kind":"integrations","scope":"Workspace only","canonicalRoute":"/docs/packages/integration.meeting-intake-worker-postgres-http/","contextUrl":"/docs/packages/integration.meeting-intake-worker-postgres-http.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}