{"id":"@lssm-tech/integration.personal-os-state-postgres","slug":"integration.personal-os-state-postgres","name":"@lssm-tech/integration.personal-os-state-postgres","version":"2.0.5","path":"packages/integrations/personal-os-state-postgres","manifestPath":"packages/integrations/personal-os-state-postgres/package.json","manifestBlobSha":"ffbb45d247f781cb004248d8fad0ec18d822eba1","layer":"integrations","physicalArea":null,"primaryArea":"personal-and-learning","classification":{"privateDeclared":null,"catalogFamily":"integrations","catalogKind":"integration","catalogStatus":"active","adoptionMode":"adoptable","stability":"experimental"},"description":"Subject-bound PostgreSQL event, encrypted projection, rights, and outbox persistence for PersonalOS.","descriptionOrigin":"package.json","catalog":{"family":"integrations","kind":"integration","status":"active","adoptionMode":"adoptable","stability":"experimental","platforms":["web","server"],"runtimes":["node","browser"],"entrypoints":[".","./authority-decisions","./backup","./database","./encrypted-state","./migration-rehearsal","./migration-runner","./migrations","./outbox","./personalization","./personalization-delivery","./personalization-denial-audit","./personalization-preferences","./rolemorph-audit","./rights","./store","./types"],"documentation":[{"title":"Integration Personal Os State Postgres documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fintegration.personal-os-state-postgres","kind":"readme"}],"examples":[],"replacements":[],"capabilities":[{"id":"package.lssm.tech.integration.personal.os.state.postgres","title":"Integration Personal Os State Postgres","description":"Subject-bound PostgreSQL event, encrypted projection, rights, and outbox persistence for PersonalOS.","status":"active","useCases":["Adopt subject-bound postgresql event, encrypted projection, rights, and outbox persistence for personalos"],"aliases":["integration","personal","state","postgres"],"pythonEquivalents":[],"canonicalImports":[{"from":"@lssm-tech/integration.personal-os-state-postgres","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/authority-decisions","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/backup","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/database","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/encrypted-state","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/migration-rehearsal","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/migration-runner","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/migrations","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/outbox","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/personalization","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/personalization-delivery","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/personalization-denial-audit","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/personalization-preferences","symbols":[]},{"from":"@lssm-tech/integration.personal-os-state-postgres/rolemorph-audit","symbols":[]}],"constraints":{"platforms":["web","server"],"runtimes":["node","browser"],"avoidWhen":["The @lssm-tech/integration.personal-os-state-postgres package constraints do not match the target runtime or platform."],"requires":["TypeScript"]},"alternatives":[],"relationships":[],"resolutionPriority":50}]},"canonicalImports":[{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/authority-decisions","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/backup","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/database","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/encrypted-state","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/migration-rehearsal","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/migration-runner","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/migrations","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/outbox","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/personalization","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/personalization-delivery","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/personalization-denial-audit","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/personalization-preferences","symbols":[]},{"capabilityId":"package.lssm.tech.integration.personal.os.state.postgres","from":"@lssm-tech/integration.personal-os-state-postgres/rolemorph-audit","symbols":[]}],"scripts":{"build":"contractspec-bun-build build","build:bundle":"contractspec-bun-build transpile","build:types":"contractspec-bun-build types","clean":"rimraf dist .turbo","lint:check":"node ../../../scripts/biome.cjs check .","lint:fix":"node ../../../scripts/biome.cjs check --write .","test":"bun test","prebuild":"contractspec-bun-build prebuild","qualify:postgres":"bash scripts/qualify-durable-postgres.sh","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/lib.contracts-integrations":"workspace:^","@lssm-tech/lib.contracts-runtime-kernel":"workspace:^","@lssm-tech/lib.contracts-spec-core":"workspace:^","@lssm-tech/lib.personal-os-runtime":"workspace:^","@lssm-tech/lib.personal-os-spec":"workspace:^","@lssm-tech/lib.personalization":"workspace:^"},"devDependencies":{"@electric-sql/pglite":"catalog:data","@lssm-tech/integration.provider-database":"workspace:^","@lssm-tech/lib.surface-runtime":"workspace:^","@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","@types/bun":"catalog:types","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./authority-decisions":"./src/authority-decisions.ts","./backup":"./src/backup.ts","./database":"./src/database.ts","./encrypted-state":"./src/encrypted-state.ts","./migration-rehearsal":{"browser":null,"default":"./src/migration-rehearsal.ts"},"./migration-runner":{"browser":null,"default":"./src/migration-runner.ts"},"./migrations":"./src/migrations.ts","./outbox":"./src/outbox.ts","./personalization":{"browser":null,"default":"./src/personalization.ts"},"./personalization-delivery":{"browser":null,"default":"./src/personalization-delivery.ts"},"./personalization-denial-audit":{"browser":null,"default":"./src/personalization-denial-audit.ts"},"./personalization-preferences":{"browser":null,"default":"./src/personalization-preferences.ts"},"./rolemorph-audit":{"browser":null,"default":"./src/rolemorph-audit.ts"},"./rights":"./src/rights.ts","./store":"./src/store.ts","./types":"./src/types.ts"},"publishExports":{".":{"types":"./dist/index.d.ts","browser":"./dist/browser/index.js","bun":"./dist/index.js","node":"./dist/node/index.js","default":"./dist/index.js"},"./authority-decisions":{"types":"./dist/authority-decisions.d.ts","browser":"./dist/browser/authority-decisions.js","bun":"./dist/authority-decisions.js","node":"./dist/node/authority-decisions.js","default":"./dist/authority-decisions.js"},"./backup":{"types":"./dist/backup.d.ts","browser":"./dist/browser/backup.js","bun":"./dist/backup.js","node":"./dist/node/backup.js","default":"./dist/backup.js"},"./database":{"types":"./dist/database.d.ts","browser":"./dist/browser/database.js","bun":"./dist/database.js","node":"./dist/node/database.js","default":"./dist/database.js"},"./encrypted-state":{"types":"./dist/encrypted-state.d.ts","browser":"./dist/browser/encrypted-state.js","bun":"./dist/encrypted-state.js","node":"./dist/node/encrypted-state.js","default":"./dist/encrypted-state.js"},"./migration-rehearsal":{"types":"./dist/migration-rehearsal.d.ts","browser":null,"bun":"./dist/migration-rehearsal.js","node":"./dist/node/migration-rehearsal.js","default":"./dist/migration-rehearsal.js"},"./migration-runner":{"types":"./dist/migration-runner.d.ts","browser":null,"bun":"./dist/migration-runner.js","node":"./dist/node/migration-runner.js","default":"./dist/migration-runner.js"},"./migrations":{"types":"./dist/migrations.d.ts","browser":"./dist/browser/migrations.js","bun":"./dist/migrations.js","node":"./dist/node/migrations.js","default":"./dist/migrations.js"},"./outbox":{"types":"./dist/outbox.d.ts","browser":"./dist/browser/outbox.js","bun":"./dist/outbox.js","node":"./dist/node/outbox.js","default":"./dist/outbox.js"},"./personalization":{"types":"./dist/personalization.d.ts","browser":null,"bun":"./dist/personalization.js","node":"./dist/node/personalization.js","default":"./dist/personalization.js"},"./personalization-delivery":{"types":"./dist/personalization-delivery.d.ts","browser":null,"bun":"./dist/personalization-delivery.js","node":"./dist/node/personalization-delivery.js","default":"./dist/personalization-delivery.js"},"./personalization-denial-audit":{"types":"./dist/personalization-denial-audit.d.ts","browser":null,"bun":"./dist/personalization-denial-audit.js","node":"./dist/node/personalization-denial-audit.js","default":"./dist/personalization-denial-audit.js"},"./personalization-preferences":{"types":"./dist/personalization-preferences.d.ts","browser":null,"bun":"./dist/personalization-preferences.js","node":"./dist/node/personalization-preferences.js","default":"./dist/personalization-preferences.js"},"./rolemorph-audit":{"types":"./dist/rolemorph-audit.d.ts","browser":null,"bun":"./dist/rolemorph-audit.js","node":"./dist/node/rolemorph-audit.js","default":"./dist/rolemorph-audit.js"},"./rights":{"types":"./dist/rights.d.ts","browser":"./dist/browser/rights.js","bun":"./dist/rights.js","node":"./dist/node/rights.js","default":"./dist/rights.js"},"./store":{"types":"./dist/store.d.ts","browser":"./dist/browser/store.js","bun":"./dist/store.js","node":"./dist/node/store.js","default":"./dist/store.js"},"./types":{"types":"./dist/types.d.ts","browser":"./dist/browser/types.js","bun":"./dist/types.js","node":"./dist/node/types.js","default":"./dist/types.js"}},"types":"./dist/index.d.ts","files":["dist","README.md"],"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/integration.personal-os-state-postgres","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./authority-decisions","importPath":"@lssm-tech/integration.personal-os-state-postgres/authority-decisions","target":"./src/authority-decisions.ts","targets":[{"conditions":[],"target":"./src/authority-decisions.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/authority-decisions.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/authority-decisions.ts","sourceStatus":"verified source file"}]},{"subpath":"./backup","importPath":"@lssm-tech/integration.personal-os-state-postgres/backup","target":"./src/backup.ts","targets":[{"conditions":[],"target":"./src/backup.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/backup.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/backup.ts","sourceStatus":"verified source file"}]},{"subpath":"./database","importPath":"@lssm-tech/integration.personal-os-state-postgres/database","target":"./src/database.ts","targets":[{"conditions":[],"target":"./src/database.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/database.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/database.ts","sourceStatus":"verified source file"}]},{"subpath":"./encrypted-state","importPath":"@lssm-tech/integration.personal-os-state-postgres/encrypted-state","target":"./src/encrypted-state.ts","targets":[{"conditions":[],"target":"./src/encrypted-state.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/encrypted-state.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/encrypted-state.ts","sourceStatus":"verified source file"}]},{"subpath":"./migration-rehearsal","importPath":"@lssm-tech/integration.personal-os-state-postgres/migration-rehearsal","target":{"browser":null,"default":"./src/migration-rehearsal.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/migration-rehearsal.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/migration-rehearsal.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/migration-rehearsal.ts","sourceStatus":"verified source file"}]},{"subpath":"./migration-runner","importPath":"@lssm-tech/integration.personal-os-state-postgres/migration-runner","target":{"browser":null,"default":"./src/migration-runner.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/migration-runner.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/migration-runner.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/migration-runner.ts","sourceStatus":"verified source file"}]},{"subpath":"./migrations","importPath":"@lssm-tech/integration.personal-os-state-postgres/migrations","target":"./src/migrations.ts","targets":[{"conditions":[],"target":"./src/migrations.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/migrations.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/migrations.ts","sourceStatus":"verified source file"}]},{"subpath":"./outbox","importPath":"@lssm-tech/integration.personal-os-state-postgres/outbox","target":"./src/outbox.ts","targets":[{"conditions":[],"target":"./src/outbox.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/outbox.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/outbox.ts","sourceStatus":"verified source file"}]},{"subpath":"./personalization","importPath":"@lssm-tech/integration.personal-os-state-postgres/personalization","target":{"browser":null,"default":"./src/personalization.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/personalization.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/personalization.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization.ts","sourceStatus":"verified source file"}]},{"subpath":"./personalization-delivery","importPath":"@lssm-tech/integration.personal-os-state-postgres/personalization-delivery","target":{"browser":null,"default":"./src/personalization-delivery.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/personalization-delivery.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/personalization-delivery.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization-delivery.ts","sourceStatus":"verified source file"}]},{"subpath":"./personalization-denial-audit","importPath":"@lssm-tech/integration.personal-os-state-postgres/personalization-denial-audit","target":{"browser":null,"default":"./src/personalization-denial-audit.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/personalization-denial-audit.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/personalization-denial-audit.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization-denial-audit.ts","sourceStatus":"verified source file"}]},{"subpath":"./personalization-preferences","importPath":"@lssm-tech/integration.personal-os-state-postgres/personalization-preferences","target":{"browser":null,"default":"./src/personalization-preferences.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/personalization-preferences.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/personalization-preferences.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization-preferences.ts","sourceStatus":"verified source file"}]},{"subpath":"./rolemorph-audit","importPath":"@lssm-tech/integration.personal-os-state-postgres/rolemorph-audit","target":{"browser":null,"default":"./src/rolemorph-audit.ts"},"targets":[{"conditions":["browser"],"target":null,"sourcePath":null,"sourceUrl":null,"sourceStatus":"blocked export"},{"conditions":["default"],"target":"./src/rolemorph-audit.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/rolemorph-audit.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/rolemorph-audit.ts","sourceStatus":"verified source file"}]},{"subpath":"./rights","importPath":"@lssm-tech/integration.personal-os-state-postgres/rights","target":"./src/rights.ts","targets":[{"conditions":[],"target":"./src/rights.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/rights.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/rights.ts","sourceStatus":"verified source file"}]},{"subpath":"./store","importPath":"@lssm-tech/integration.personal-os-state-postgres/store","target":"./src/store.ts","targets":[{"conditions":[],"target":"./src/store.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/store.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/store.ts","sourceStatus":"verified source file"}]},{"subpath":"./types","importPath":"@lssm-tech/integration.personal-os-state-postgres/types","target":"./src/types.ts","targets":[{"conditions":[],"target":"./src/types.ts","sourcePath":"packages/integrations/personal-os-state-postgres/src/types.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/types.ts","sourceStatus":"verified source file"}]}],"entryCount":17,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[{"title":"Integration Personal Os State Postgres documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fintegration.personal-os-state-postgres","kind":"readme","pinnedUrl":null,"sourceStatus":"declared link; destination not verified"}],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.personal-os-state-postgres.txt"},"readme":{"status":"available","body":"# `@lssm-tech/integration.personal-os-state-postgres`\n\nServer-authoritative PostgreSQL state for PersonalOS. It provides subject-bound\nimmutable events and receipts, idempotent optimistic commits, encrypted\nsnapshots/projections, transactional outbox delivery, and export/deletion jobs.\nAn integrity-only inspector compares row counts and encrypted digests after a\nhost-managed backup restore without exposing personal values.\n\nThe local PGlite restore rehearsal archives the complete data directory of an\nin-memory primary to an isolated backup, discards the primary, restores a new\ncluster from the archive, and proves encrypted manifest parity, snapshot\nhydration, and idempotent command replay. Each step runs under a bounded\ndeadline that names the stalled step. A post-restore digest mutation is\ndetected. A separate on-disk test closes and reopens a file-backed cluster and\nproves the same manifest parity, snapshot hydration, and audit replay. These\nrepeatable local rehearsals do not qualify managed PostgreSQL backup transport,\nKMS recovery, regional failover, operator runbooks, recovery objectives, or a\nproduction restore drill.\n\nThe adapter never encrypts data itself: callers must supply ciphertext, nonce,\nalgorithm, key reference, canonical AAD digest, and cipher-integrity digest from\ntheir managed key service. Snapshots persist the exact subject ref and semantic\nstate digest separately from randomized ciphertext. Event envelopes\ncontain digests and references only. Apply the migration before serving traffic;\nforced RLS is mandatory, and each operation uses transaction-local subject scope.\n\nRights jobs, consent, sharing, delegation, connection, and deletion commands are\nonline-only and must be authorized before reaching this adapter.\n\nThe server-only `./personalization` subpath adds a durable `BehaviorStore` for\nPersonalOS behavior evidence. It revalidates exact subject, tenant, event,\npurpose, active consent, revocation freshness, retention, and pre-sanitized\nmetadata before encryption or database effects. PostgreSQL stores minimized\nindexes, digests, consent/evidence references, and host-produced AES-256-GCM\nciphertext; it never stores decrypted event JSON. Reads verify both cipher and\nsemantic event integrity before returning evidence.\n\nCorrections insert the exact authorized replacement before superseding the\noriginal. Missing or cross-scope replacements cannot drop data. Export and\ndelete require fresh exact rights decisions and leave digest-bound idempotency\nreceipts. Expired ciphertext is purged with cascading delivery work.\n`./personalization-delivery` provides leases, retry, stale-worker rejection,\nbounded dead-letter, and dead-letter-count primitives for host workers.\n\nThe server-only `./personalization-preferences` subpath persists explicit\nseven-dimension preference patches for the exact subject and tenant. Only\nuser, workspace-user, and surface scopes are durable. Every save or reset uses\nfresh subject-only authorization, a domain-separated request digest, optimistic\nrevision, and exact idempotency. Reset writes an encrypted empty explicit patch\nat the next revision, so stale commands cannot resurrect prior choices. Export\nand deletion require fresh rights authorization; PostgreSQL stores ciphertext,\nsemantic/cipher/AAD digests, opaque scope keys, and digest-only receipts—never\nthe preference values themselves.\n\nThe server-only `./personalization-denial-audit` subpath records denied export\nand fine-tuning decisions in a forced-RLS, subject-and-tenant-bound table. A\ntrusted verifier must bind every categorical field and the canonical record\ndigest before insertion. Exact retries replay, idempotency or operation\ncollisions fail closed, and the table never stores the attempted payload.\nBehavior and preference exports derive the audit request digest from the exact\nrights request and record or replay the denial before returning the authority\nfailure. If the denial recorder or integrity port is absent, export fails closed\nas an audit-composition error rather than emitting an unaudited denial.\n\nPGlite coverage includes disk restart, forced-RLS isolation, ciphertext\nsubstitution, consent denial, metadata rejection, batch rollback, replay and\nidempotency conflict, correction no-data-loss, export/delete, expiry purge, and\nworker retry/dead-letter behavior. Preference coverage additionally proves\nrevision conflict, reset, rights denial with no data loss, tenant isolation,\nciphertext tamper denial, restart hydration, and value-free receipts. Managed KMS operations,\nbackup/replica/cache deletion propagation, production alert delivery, and\ncanary evidence remain host qualification gates.\n\nProduction hosts use `commitState` to persist the encrypted aggregate snapshot\nin the same transaction as its command result, exact authority receipt, event,\nand outbox records. `getSnapshot`, `loadEvent`, and `(recordedAt,eventId)` cursor\npages support restart hydration and deterministic workers. The compatibility\n`commit` method remains available for event-only callers, but it is not the\nproduction workspace state seam.\n\nBoth commit methods require a configured `authorityReceiptVerifier` and the\ntwo-phase authority proposal (draft plus before/proposed state digests). Exact\ncommand/receipt equality alone is not authority: the verifier must validate its\nsignature/replay evidence and return an integrity-bound canonical receipt digest.\nMissing, stale, mismatched, or unverified results fail closed before persistence.\nThe adapter recomputes AAD and cipher integrity, rejects subject-version or\nproposal substitution, and never compares receipt semantics to ciphertext bytes.\n`PostgresPersonalAuthorityDecisionStore` durably records verified denied and\nconfirmation-required outcomes using only command/receipt/draft/proposal\ndigests, minimal identifiers, and timestamps. It never stores raw reasons,\nconsent detail, evidence payloads, events, snapshots, or outbox work.\n\nThe server-only `./rolemorph-audit` subpath implements the canonical durable\nRoleMorph audit sink. It requires an exact subject-bound store plus a\nhost-keyed pseudonymizer, rejects undeclared or payload-like fields, and stores\nonly the minimized policy decision with a canonical digest. A successful write\ncreates pending delivery work before the governed result proceeds. Exact worker\nleases support acknowledgement, bounded retry, dead-letter health, and explicit\nincident recovery. Forced RLS hides other subjects, and the backup inspector\nincludes audit row counts and record digests. External log shipping, alert\nrouting, managed PostgreSQL recovery, and production canaries remain host gates.\n\n## RT-008 activation state\n\n`PostgresPersonalDomainActivationStore` keeps one subject activation per\nprivate domain (finance, health, life-admin) under forced RLS. Rows hold only\nthe validated record (ids, status, origin, evidence refs) and its digest; a\ndigest mismatch reads as no activation, so tampering fails closed.\n`runPostgresPersonalActivationCarryForward` is the one-time, idempotent\nbackfill: subjects with a current consent receive a revocable\n`carried_forward_migration` record citing the consent ids and migration id;\nothers stay dormant; re-runs replay the ledger. Run order: apply\n`migratePostgresPersonalStore`, run the backfill for every AuthOS subject, then\nenable the activation gate on finance, health and life-admin.\n\n`createPostgresPersonalDomainActivationHost` binds the production activation\nstore, the key-recovery probe (fresh `bound` attestations written by the host\nkey service after verifying recoverability) and the outbox-processor probe\n(fresh per-destination heartbeats written by the processor loop). Absent,\nstale or revoked evidence fails closed.\n\n## Packaged migration runner\n\nThe server-only `./migration-runner` subpath is the packaged install step for\nPersonalOS (install-sequence step 5). `runPostgresPersonalOsMigrations` applies\nthe store DDL under an advisory lock and records each store revision in the\nappend-only, digest-bound `<schema>.personal_os_schema_migrations` ledger in\nthe same transaction; a current ledger skips the DDL, and an unknown or\ndigest-mismatched row fails closed before any change. It then runs the RT-008\nactivation carry-forward for every AuthOS subject the deployer supplies\n(`PersonalOsCarryForwardSource`: subjects plus consent facts from the host key\nservice, deduplicated and validated). Both halves are idempotent: a re-run\nreplays the ledgers, and an interrupted carry-forward resumes per subject and\ndomain. The report carries ledger ids and outcome counts only, never subject\nids. `carryForward: null` applies the store only, for a first install without\nexisting subjects.\n\n`PERSONAL_OS_POSTGRES_MIGRATIONS` is the catalog that founder-ops\n`qualify-migrations` reads. The store DDL is convergent, so each revision pins\nthe digest of the normalized DDL it shipped (`digestPersonalStoreMigrationSource`);\nthe runner refuses a source that drifts from the head revision. Never edit a\nshipped revision: a DDL change appends a new one.\n\n`./migration-rehearsal` (`rehearsePostgresPersonalOsMigrations`) rehearses the\nstep on a disposable database inside a throwaway `personal_os_rehearsal_*`\nschema: a fresh apply and carry-forward for synthetic subjects, an exact\nreplay, forced RLS on every subject table and an exact ledger, then it always\ndrops the schema. The `personalos-api` app wires both as `migrate` and\n`migrate:rehearse`.\n\n## Real PostgreSQL qualification\n\nThe `*.integration.test.ts` qualifiers run the store on a real PostgreSQL 17\nlogin instead of PGlite. They read `PERSONAL_OS_TEST_DATABASE_URL`, a\nsuperuser URL of a disposable loopback database whose name contains `test`,\n`disposable` or `rehearsal`, and self-skip without it. Each suite creates its\nown database owned by a `LOGIN NOSUPERUSER NOBYPASSRLS` migrator, installs it\nwith the packaged runner, grants a separate runtime login of the same kind\nschema usage and DML on the store tables (never the ledger), and drops the\ndatabase and both roles afterwards. The crash and restore suites also need\ncluster control: `PERSONAL_OS_TEST_PG_BIN` (binary directory) and\n`PERSONAL_OS_TEST_PGDATA` (data directory of that cluster).\n`bun run --cwd packages/integrations/personal-os-state-postgres qualify:postgres`\n(`PERSONAL_OS_QUALIFICATION_PG_BIN` names a PostgreSQL 17 binary directory)\ncreates a throwaway TCP-only cluster on a free loopback port, runs every\nqualifier with those variables, and deletes the cluster; an optional\ndirectory argument receives count-only crash and restore receipts.\n\nSubject isolation is proven per store table: one forced `ALL` policy each,\nno rows without a subject scope, no foreign rows under another scope, rejected\ncross-subject inserts and re-keying updates, no-op foreign updates and\ndeletes, and no way for the runtime login to disable RLS, drop a policy, set\n`row_security = off`, assume the migrator, read the ledger or create tables.\nForced RLS binds the schema owner too. Durable-store qualification covers\nracing commits and idempotent replays, `SKIP LOCKED` outbox workers, racing\nactivations, concurrent runner invocations, an interrupted carry-forward that\nresumes, a runtime backend killed mid-commit, an immediate postmaster shutdown\nwith WAL crash recovery, lease expiry and stale-worker rejection, behavior\ndelivery retry and dead-letter, retention purge with cascading delivery work,\nrights erasure, a `pg_dump` by a `BYPASSRLS` read-only backup role (a\n`NOBYPASSRLS` reader's dump is refused) restored into a new database, and a\n`pg_basebackup` started as a second cluster. These local samples do not\nqualify managed PostgreSQL, KMS recovery, regional failover, operator\nrunbooks or production recovery objectives (RPO/RTO).\n\nThe store migration grants no runtime role: the deployer grants its runtime\nlogin `USAGE` on the store schema and DML on the subject and heartbeat\ntables, as the qualifiers do. Behind the production postgres-js provider the\noutbox-processor probe binds one scalar parameter per destination, and\n`activate` serializes first activations of a subject's domain, so racing\nactivations return one `created` and `conflict` for the rest.\n","sourcePath":"packages/integrations/personal-os-state-postgres/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/README.md","blobSha":"16c52610d2bd53248deb16a2e4cb6016cfb77a58","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"personal-and-learning","areaTitle":"Personal workflows, learning and progress","displayName":"integration.personal-os-state-postgres","runtimes":["node","browser"],"platforms":["web","server"],"kind":"integration","scope":"Package manifest","canonicalRoute":"/docs/packages/integration.personal-os-state-postgres/","contextUrl":"/docs/packages/integration.personal-os-state-postgres.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}