# @lssm-tech/integration.governed-product-data-postgres

Product-local encrypted PostgreSQL persistence for governed projection copies.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.5`
- Package path: `packages/integrations/governed-product-data-postgres`
- Manifest path: `packages/integrations/governed-product-data-postgres/package.json`
- Manifest Git blob: `988b580e89bec5fc1b4fd8bec3ad508cdeaf85a3`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.governed-product-data-postgres](https://lssm.co/docs/packages/integration.governed-product-data-postgres/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.governed-product-data-postgres.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "forms-and-data",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "integrations",
    "catalogKind": "integration",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Forms, data views and data exchange](https://lssm.co/docs/areas/forms-and-data/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/governed-product-data-postgres/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/README.md",
  "blobSha": "b91e0d6329adede4047d57c7e8ef1a613dee88d5",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# @lssm-tech/integration.governed-product-data-postgres

Product-local PostgreSQL persistence for encrypted governed projection copies.
It is deliberately separate from the central grant/catalog database: each
product or customer-hosted vertical binds its own database, runtime role,
region, and key service.

The adapter stores authenticated ciphertext supplied by the product host. It
does not encrypt, decrypt, or retain source credentials. Every row is scoped to
one RP-specific pairwise subject with forced RLS. Revocation and erasure delete
the exact local materialization, verify its absence, and durably record an
idempotent payload-free receipt in the same transaction.

`PostgresGovernedProductMaterializationPort` accepts one schema-valid encrypted
dispatch and returns a stable payload-free stored/replayed receipt. It persists
the exact purpose, lawful-basis reference, consent receipt reference when
required, receiver region, expiry, retention horizon, fields, watermark, and
receiver key reference alongside ciphertext. Direct persistence after grant or
retention expiry is rejected. Once revocation or erasure is acknowledged, a
durable grant/projection block prevents rematerialization under a fresh record
identifier.

`PostgresGovernedProductRecoveryPort` implements the product side of
`createGovernedRecoveryIngress`. Export is fail-closed until the source product
injects an authoritative export port that has already stored a user-retrievable
artifact and returns its durable evidence reference. An exact retry reuses the
durable export receipt before invoking that artifact producer again; a changed
request under the same job id is an idempotency conflict. Because separate
workers can race before the first receipt commits, the injected artifact port
must also make storage idempotent by the governed export job id.

`createPostgresGovernedProductDataIngresses` composes both ports. Recovery may
remain independently active, but materialization is created only when an exact
consumer region and a non-empty, unique source-binding registry are supplied.
Each source binding uses its own bearer; there is no ecosystem-wide delivery
token.

Application hosts should use
`createConnectedPostgresGovernedProductDataIngresses` when starting from
connection settings. It owns raw PostgreSQL provider construction inside this
integration and returns only the bounded recovery/materialization ingress
surface.

Apply `migratePostgresGovernedProductData` with a migration role before binding
the least-privilege runtime role. Production activation requires independent
security review and an end-to-end revoke/erasure/export rehearsal.

## Isolated live qualification

`bun run qualify:live` installs the canonical central metadata and product-copy
schemas in the dedicated EU qualification project, creates three hardened
no-login roles, and runs a synthetic store/replay/isolation/revocation/erasure
rehearsal plus an injected export callback, export-receipt replay, transaction
rollback, and zero-row cleanup proof. It fails closed unless every explicit environment value identifies
the non-production `billowing-queen-67154386` project, its
`lssm_governed_data` database, and its migration owner.

Obtain the direct connection string without printing or persisting it, then
pass it only to the child process:

```sh
qualification_url="$(bunx --bun neonctl@latest connection-string \
  --project-id billowing-queen-67154386 \
  --database-name lssm_governed_data \
  --role-name lssm_governed_migration \
  --no-pooled --ssl require --no-color)"

GOVERNED_DATA_QUALIFICATION_AUTHORIZED=1 \
GOVERNED_DATA_QUALIFICATION_DATABASE_URL="$qualification_url" \
GOVERNED_DATA_QUALIFICATION_PROJECT_ID=billowing-queen-67154386 \
GOVERNED_DATA_QUALIFICATION_REGION=aws-eu-central-1 \
bun run qualify:live
```


The receipt contains only counts and boolean lifecycle results. The workflow
never binds a product, copies real identity data, provisions a key service, or
qualifies durable user-retrievable artifact storage. Production still requires
a separate database/runtime role/region/key boundary for each receiver plus
independent worker, artifact delivery, restoration, and rollback evidence.


## Declared capabilities

### Encrypted governed product projections

Capability ID: `governed.product-data.postgres`

Persist encrypted, product-local governed projection copies with subject-scoped RLS, revocation, erasure, and durable recovery receipts.

Use cases:

- Materialize a governed ecosystem projection inside a receiving product database
- Prove revocation or erasure only after the exact product-local copy is absent

Constraints:

```json
{
  "platforms": [
    "server"
  ],
  "runtimes": [
    "bun",
    "node"
  ],
  "avoidWhen": [
    "The product needs to own consent, central grants, source records, or encryption keys; those authorities stay outside this integration.",
    "The storage design cannot enforce subject-scoped PostgreSQL RLS and encrypted-at-rest projection payloads."
  ],
  "requires": [
    "PostgreSQL",
    "governed projection ports",
    "external key custody"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "governed data",
    "encrypted projection",
    "product-local PostgreSQL",
    "RLS"
  ],
  "pythonEquivalents": [
    "SQLAlchemy encrypted projection repository"
  ],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 75
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/integration.governed-product-data-postgres",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.governed-product-data-postgres/ingress-runtime",
    "symbols": [
      "createConnectedPostgresGovernedProductDataIngresses"
    ]
  }
]
```

## Catalogue metadata

```json
{
  "family": "integrations",
  "kind": "integration",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "bun",
    "node"
  ],
  "entrypoints": [
    ".",
    "./ingress-runtime",
    "./materialization-port",
    "./recovery-port",
    "./store"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "governed.product-data.postgres",
    "from": "@lssm-tech/integration.governed-product-data-postgres",
    "symbols": []
  },
  {
    "capabilityId": "governed.product-data.postgres",
    "from": "@lssm-tech/integration.governed-product-data-postgres/ingress-runtime",
    "symbols": [
      "createConnectedPostgresGovernedProductDataIngresses"
    ]
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.governed-product-data-postgres` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/index.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/database` — subpath `./database`
  - `unconditional`: `./src/database.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/database.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/export-replay` — subpath `./export-replay`
  - `unconditional`: `./src/export-replay.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/export-replay.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/ingress-runtime` — subpath `./ingress-runtime`
  - `unconditional`: `./src/ingress-runtime.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/ingress-runtime.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/materialization-authority` — subpath `./materialization-authority`
  - `unconditional`: `./src/materialization-authority.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/materialization-authority.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/materialization-blocks` — subpath `./materialization-blocks`
  - `unconditional`: `./src/materialization-blocks.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/materialization-blocks.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/materialization-port` — subpath `./materialization-port`
  - `unconditional`: `./src/materialization-port.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/materialization-port.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/materialization-purge` — subpath `./materialization-purge`
  - `unconditional`: `./src/materialization-purge.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/materialization-purge.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/materialization-store` — subpath `./materialization-store`
  - `unconditional`: `./src/materialization-store.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/materialization-store.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/migrations` — subpath `./migrations`
  - `unconditional`: `./src/migrations.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/migrations.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/pglite-test-support` — subpath `./pglite-test-support`
  - `unconditional`: `./src/pglite-test-support.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/pglite-test-support.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/recovery-port` — subpath `./recovery-port`
  - `unconditional`: `./src/recovery-port.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/recovery-port.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/recovery-results` — subpath `./recovery-results`
  - `unconditional`: `./src/recovery-results.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/recovery-results.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/store` — subpath `./store`
  - `unconditional`: `./src/store.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/store.ts); verified source file.

- `@lssm-tech/integration.governed-product-data-postgres/store-records` — subpath `./store-records`
  - `unconditional`: `./src/store-records.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/governed-product-data-postgres/src/store-records.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "scripts/qualification-config.ts",
    "scripts/qualification-database.ts",
    "scripts/qualification-fixture.ts",
    "scripts/qualification-rehearsal-cleanup.ts",
    "scripts/qualification-rehearsal.ts",
    "scripts/qualification-rehearsal-proofs.ts",
    "scripts/qualification-role-boundaries.ts",
    "scripts/qualify-live.ts",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./database": {
      "types": "./dist/database.d.ts",
      "bun": "./dist/database.js",
      "node": "./dist/node/database.js",
      "default": "./dist/database.js"
    },
    "./export-replay": {
      "types": "./dist/export-replay.d.ts",
      "bun": "./dist/export-replay.js",
      "node": "./dist/node/export-replay.js",
      "default": "./dist/export-replay.js"
    },
    "./ingress-runtime": {
      "types": "./dist/ingress-runtime.d.ts",
      "bun": "./dist/ingress-runtime.js",
      "node": "./dist/node/ingress-runtime.js",
      "default": "./dist/ingress-runtime.js"
    },
    "./materialization-authority": {
      "types": "./dist/materialization-authority.d.ts",
      "bun": "./dist/materialization-authority.js",
      "node": "./dist/node/materialization-authority.js",
      "default": "./dist/materialization-authority.js"
    },
    "./materialization-blocks": {
      "types": "./dist/materialization-blocks.d.ts",
      "bun": "./dist/materialization-blocks.js",
      "node": "./dist/node/materialization-blocks.js",
      "default": "./dist/materialization-blocks.js"
    },
    "./materialization-port": {
      "types": "./dist/materialization-port.d.ts",
      "bun": "./dist/materialization-port.js",
      "node": "./dist/node/materialization-port.js",
      "default": "./dist/materialization-port.js"
    },
    "./materialization-purge": {
      "types": "./dist/materialization-purge.d.ts",
      "bun": "./dist/materialization-purge.js",
      "node": "./dist/node/materialization-purge.js",
      "default": "./dist/materialization-purge.js"
    },
    "./materialization-store": {
      "types": "./dist/materialization-store.d.ts",
      "bun": "./dist/materialization-store.js",
      "node": "./dist/node/materialization-store.js",
      "default": "./dist/materialization-store.js"
    },
    "./migrations": {
      "types": "./dist/migrations.d.ts",
      "bun": "./dist/migrations.js",
      "node": "./dist/node/migrations.js",
      "default": "./dist/migrations.js"
    },
    "./pglite-test-support": {
      "types": "./dist/pglite-test-support.d.ts",
      "bun": "./dist/pglite-test-support.js",
      "node": "./dist/node/pglite-test-support.js",
      "default": "./dist/pglite-test-support.js"
    },
    "./recovery-port": {
      "types": "./dist/recovery-port.d.ts",
      "bun": "./dist/recovery-port.js",
      "node": "./dist/node/recovery-port.js",
      "default": "./dist/recovery-port.js"
    },
    "./recovery-results": {
      "types": "./dist/recovery-results.d.ts",
      "bun": "./dist/recovery-results.js",
      "node": "./dist/node/recovery-results.js",
      "default": "./dist/recovery-results.js"
    },
    "./store": {
      "types": "./dist/store.d.ts",
      "bun": "./dist/store.js",
      "node": "./dist/node/store.js",
      "default": "./dist/store.js"
    },
    "./store-records": {
      "types": "./dist/store-records.d.ts",
      "bun": "./dist/store-records.js",
      "node": "./dist/node/store-records.js",
      "default": "./dist/store-records.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/integration.governed-data-postgres](https://lssm.co/docs/packages/integration.governed-data-postgres/): `workspace:^`
- [@lssm-tech/integration.provider-database](https://lssm.co/docs/packages/integration.provider-database/): `workspace:^`
- [@lssm-tech/lib.contracts-integrations](https://lssm.co/docs/packages/lib.contracts-integrations/): `workspace:^`
- [@lssm-tech/lib.data-exchange-core](https://lssm.co/docs/packages/lib.data-exchange-core/): `workspace:^`
- [@lssm-tech/lib.data-exchange-server](https://lssm.co/docs/packages/lib.data-exchange-server/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- `@electric-sql/pglite`: `catalog:data`
- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "clean": "rimraf dist .turbo",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "lint:fix": "node ../../../scripts/biome.cjs check --write .",
  "prebuild": "contractspec-bun-build prebuild",
  "qualify:live": "bun scripts/qualify-live.ts",
  "test": "bun test",
  "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.qualification.json"
}
```

## Declared documentation links

- [Governed product data PostgreSQL integration](https://www.npmjs.com/package/%40lssm-tech%2Fintegration.governed-product-data-postgres) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Fintegration.governed-product-data-postgres",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.governed-product-data-postgres.txt",
  "route": "/llms/integration.governed-product-data-postgres",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.governed-product-data-postgres.txt",
  "blobSha": "b91e0d6329adede4047d57c7e8ef1a613dee88d5",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```