Source snapshot bcc79fcc · Declared package version 2.0.5. This page combines the checked-in package guide and manifest; commands and runtime behavior were not executed in this review.
Product-local PostgreSQL persistence for encrypted governed projection copies. It is deliberately separate from the central grant/catalog database: each product or customer-hosted vertical binds its own database, runtime role, region, and key service.
The adapter stores authenticated ciphertext supplied by the product host. It does not encrypt, decrypt, or retain source credentials. Every row is scoped to one RP-specific pairwise subject with forced RLS. Revocation and erasure delete the exact local materialization, verify its absence, and durably record an idempotent payload-free receipt in the same transaction.
PostgresGovernedProductMaterializationPort accepts one schema-valid encrypted dispatch and returns a stable payload-free stored/replayed receipt. It persists the exact purpose, lawful-basis reference, consent receipt reference when required, receiver region, expiry, retention horizon, fields, watermark, and receiver key reference alongside ciphertext. Direct persistence after grant or retention expiry is rejected. Once revocation or erasure is acknowledged, a durable grant/projection block prevents rematerialization under a fresh record identifier.
PostgresGovernedProductRecoveryPort implements the product side of
createGovernedRecoveryIngress. Export is fail-closed until the source product injects an authoritative export port that has already stored a user-retrievable artifact and returns its durable evidence reference. An exact retry reuses the durable export receipt before invoking that artifact producer again; a changed request under the same job id is an idempotency conflict. Because separate workers can race before the first receipt commits, the injected artifact port must also make storage idempotent by the governed export job id.
createPostgresGovernedProductDataIngresses composes both ports. Recovery may remain independently active, but materialization is created only when an exact consumer region and a non-empty, unique source-binding registry are supplied. Each source binding uses its own bearer; there is no ecosystem-wide delivery token.
Application hosts should use
createConnectedPostgresGovernedProductDataIngresses when starting from connection settings. It owns raw PostgreSQL provider construction inside this integration and returns only the bounded recovery/materialization ingress surface.
Apply migratePostgresGovernedProductData with a migration role before binding the least-privilege runtime role. Production activation requires independent security review and an end-to-end revoke/erasure/export rehearsal.
Isolated live qualification
bun run qualify:live installs the canonical central metadata and product-copy schemas in the dedicated EU qualification project, creates three hardened no-login roles, and runs a synthetic store/replay/isolation/revocation/erasure rehearsal plus an injected export callback, export-receipt replay, transaction rollback, and zero-row cleanup proof. It fails closed unless every explicit environment value identifies the non-production billowing-queen-67154386 project, its
lssm_governed_data database, and its migration owner.
Obtain the direct connection string without printing or persisting it, then pass it only to the child process:
The receipt contains only counts and boolean lifecycle results. The workflow never binds a product, copies real identity data, provisions a key service, or qualifies durable user-retrievable artifact storage. Production still requires a separate database/runtime role/region/key boundary for each receiver plus independent worker, artifact delivery, restoration, and rollback evidence.
Declared capabilities.
Encrypted governed product projections
Persist encrypted, product-local governed projection copies with subject-scoped RLS, revocation, erasure, and durable recovery receipts.
Use it to
Materialize a governed ecosystem projection inside a receiving product database
Prove revocation or erasure only after the exact product-local copy is absent
Requires
PostgreSQL
governed projection ports
external key custody
Choose another boundary when
The product needs to own consent, central grants, source records, or encryption keys; those authorities stay outside this integration.
The storage design cannot enforce subject-scoped PostgreSQL RLS and encrypted-at-rest projection payloads.
These are package-manifest entry points. Named symbols listed above come from the capability catalogue; this is not an exhaustive TypeScript symbol reference.
