# @lssm-tech/integration.personal-os-state-postgres

Subject-bound PostgreSQL event, encrypted projection, rights, and outbox persistence for PersonalOS.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.5`
- Package path: `packages/integrations/personal-os-state-postgres`
- Manifest path: `packages/integrations/personal-os-state-postgres/package.json`
- Manifest Git blob: `ffbb45d247f781cb004248d8fad0ec18d822eba1`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.personal-os-state-postgres](https://lssm.co/docs/packages/integration.personal-os-state-postgres/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.personal-os-state-postgres.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "personal-and-learning",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "integrations",
    "catalogKind": "integration",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Personal workflows, learning and progress](https://lssm.co/docs/areas/personal-and-learning/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/personal-os-state-postgres/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/README.md",
  "blobSha": "16c52610d2bd53248deb16a2e4cb6016cfb77a58",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# `@lssm-tech/integration.personal-os-state-postgres`

Server-authoritative PostgreSQL state for PersonalOS. It provides subject-bound
immutable events and receipts, idempotent optimistic commits, encrypted
snapshots/projections, transactional outbox delivery, and export/deletion jobs.
An integrity-only inspector compares row counts and encrypted digests after a
host-managed backup restore without exposing personal values.

The local PGlite restore rehearsal archives the complete data directory of an
in-memory primary to an isolated backup, discards the primary, restores a new
cluster from the archive, and proves encrypted manifest parity, snapshot
hydration, and idempotent command replay. Each step runs under a bounded
deadline that names the stalled step. A post-restore digest mutation is
detected. A separate on-disk test closes and reopens a file-backed cluster and
proves the same manifest parity, snapshot hydration, and audit replay. These
repeatable local rehearsals do not qualify managed PostgreSQL backup transport,
KMS recovery, regional failover, operator runbooks, recovery objectives, or a
production restore drill.

The adapter never encrypts data itself: callers must supply ciphertext, nonce,
algorithm, key reference, canonical AAD digest, and cipher-integrity digest from
their managed key service. Snapshots persist the exact subject ref and semantic
state digest separately from randomized ciphertext. Event envelopes
contain digests and references only. Apply the migration before serving traffic;
forced RLS is mandatory, and each operation uses transaction-local subject scope.

Rights jobs, consent, sharing, delegation, connection, and deletion commands are
online-only and must be authorized before reaching this adapter.

The server-only `./personalization` subpath adds a durable `BehaviorStore` for
PersonalOS behavior evidence. It revalidates exact subject, tenant, event,
purpose, active consent, revocation freshness, retention, and pre-sanitized
metadata before encryption or database effects. PostgreSQL stores minimized
indexes, digests, consent/evidence references, and host-produced AES-256-GCM
ciphertext; it never stores decrypted event JSON. Reads verify both cipher and
semantic event integrity before returning evidence.

Corrections insert the exact authorized replacement before superseding the
original. Missing or cross-scope replacements cannot drop data. Export and
delete require fresh exact rights decisions and leave digest-bound idempotency
receipts. Expired ciphertext is purged with cascading delivery work.
`./personalization-delivery` provides leases, retry, stale-worker rejection,
bounded dead-letter, and dead-letter-count primitives for host workers.

The server-only `./personalization-preferences` subpath persists explicit
seven-dimension preference patches for the exact subject and tenant. Only
user, workspace-user, and surface scopes are durable. Every save or reset uses
fresh subject-only authorization, a domain-separated request digest, optimistic
revision, and exact idempotency. Reset writes an encrypted empty explicit patch
at the next revision, so stale commands cannot resurrect prior choices. Export
and deletion require fresh rights authorization; PostgreSQL stores ciphertext,
semantic/cipher/AAD digests, opaque scope keys, and digest-only receipts—never
the preference values themselves.

The server-only `./personalization-denial-audit` subpath records denied export
and fine-tuning decisions in a forced-RLS, subject-and-tenant-bound table. A
trusted verifier must bind every categorical field and the canonical record
digest before insertion. Exact retries replay, idempotency or operation
collisions fail closed, and the table never stores the attempted payload.
Behavior and preference exports derive the audit request digest from the exact
rights request and record or replay the denial before returning the authority
failure. If the denial recorder or integrity port is absent, export fails closed
as an audit-composition error rather than emitting an unaudited denial.

PGlite coverage includes disk restart, forced-RLS isolation, ciphertext
substitution, consent denial, metadata rejection, batch rollback, replay and
idempotency conflict, correction no-data-loss, export/delete, expiry purge, and
worker retry/dead-letter behavior. Preference coverage additionally proves
revision conflict, reset, rights denial with no data loss, tenant isolation,
ciphertext tamper denial, restart hydration, and value-free receipts. Managed KMS operations,
backup/replica/cache deletion propagation, production alert delivery, and
canary evidence remain host qualification gates.

Production hosts use `commitState` to persist the encrypted aggregate snapshot
in the same transaction as its command result, exact authority receipt, event,
and outbox records. `getSnapshot`, `loadEvent`, and `(recordedAt,eventId)` cursor
pages support restart hydration and deterministic workers. The compatibility
`commit` method remains available for event-only callers, but it is not the
production workspace state seam.

Both commit methods require a configured `authorityReceiptVerifier` and the
two-phase authority proposal (draft plus before/proposed state digests). Exact
command/receipt equality alone is not authority: the verifier must validate its
signature/replay evidence and return an integrity-bound canonical receipt digest.
Missing, stale, mismatched, or unverified results fail closed before persistence.
The adapter recomputes AAD and cipher integrity, rejects subject-version or
proposal substitution, and never compares receipt semantics to ciphertext bytes.
`PostgresPersonalAuthorityDecisionStore` durably records verified denied and
confirmation-required outcomes using only command/receipt/draft/proposal
digests, minimal identifiers, and timestamps. It never stores raw reasons,
consent detail, evidence payloads, events, snapshots, or outbox work.

The server-only `./rolemorph-audit` subpath implements the canonical durable
RoleMorph audit sink. It requires an exact subject-bound store plus a
host-keyed pseudonymizer, rejects undeclared or payload-like fields, and stores
only the minimized policy decision with a canonical digest. A successful write
creates pending delivery work before the governed result proceeds. Exact worker
leases support acknowledgement, bounded retry, dead-letter health, and explicit
incident recovery. Forced RLS hides other subjects, and the backup inspector
includes audit row counts and record digests. External log shipping, alert
routing, managed PostgreSQL recovery, and production canaries remain host gates.

## RT-008 activation state

`PostgresPersonalDomainActivationStore` keeps one subject activation per
private domain (finance, health, life-admin) under forced RLS. Rows hold only
the validated record (ids, status, origin, evidence refs) and its digest; a
digest mismatch reads as no activation, so tampering fails closed.
`runPostgresPersonalActivationCarryForward` is the one-time, idempotent
backfill: subjects with a current consent receive a revocable
`carried_forward_migration` record citing the consent ids and migration id;
others stay dormant; re-runs replay the ledger. Run order: apply
`migratePostgresPersonalStore`, run the backfill for every AuthOS subject, then
enable the activation gate on finance, health and life-admin.

`createPostgresPersonalDomainActivationHost` binds the production activation
store, the key-recovery probe (fresh `bound` attestations written by the host
key service after verifying recoverability) and the outbox-processor probe
(fresh per-destination heartbeats written by the processor loop). Absent,
stale or revoked evidence fails closed.

## Packaged migration runner

The server-only `./migration-runner` subpath is the packaged install step for
PersonalOS (install-sequence step 5). `runPostgresPersonalOsMigrations` applies
the store DDL under an advisory lock and records each store revision in the
append-only, digest-bound `<schema>.personal_os_schema_migrations` ledger in
the same transaction; a current ledger skips the DDL, and an unknown or
digest-mismatched row fails closed before any change. It then runs the RT-008
activation carry-forward for every AuthOS subject the deployer supplies
(`PersonalOsCarryForwardSource`: subjects plus consent facts from the host key
service, deduplicated and validated). Both halves are idempotent: a re-run
replays the ledgers, and an interrupted carry-forward resumes per subject and
domain. The report carries ledger ids and outcome counts only, never subject
ids. `carryForward: null` applies the store only, for a first install without
existing subjects.

`PERSONAL_OS_POSTGRES_MIGRATIONS` is the catalog that founder-ops
`qualify-migrations` reads. The store DDL is convergent, so each revision pins
the digest of the normalized DDL it shipped (`digestPersonalStoreMigrationSource`);
the runner refuses a source that drifts from the head revision. Never edit a
shipped revision: a DDL change appends a new one.

`./migration-rehearsal` (`rehearsePostgresPersonalOsMigrations`) rehearses the
step on a disposable database inside a throwaway `personal_os_rehearsal_*`
schema: a fresh apply and carry-forward for synthetic subjects, an exact
replay, forced RLS on every subject table and an exact ledger, then it always
drops the schema. The `personalos-api` app wires both as `migrate` and
`migrate:rehearse`.

## Real PostgreSQL qualification

The `*.integration.test.ts` qualifiers run the store on a real PostgreSQL 17
login instead of PGlite. They read `PERSONAL_OS_TEST_DATABASE_URL`, a
superuser URL of a disposable loopback database whose name contains `test`,
`disposable` or `rehearsal`, and self-skip without it. Each suite creates its
own database owned by a `LOGIN NOSUPERUSER NOBYPASSRLS` migrator, installs it
with the packaged runner, grants a separate runtime login of the same kind
schema usage and DML on the store tables (never the ledger), and drops the
database and both roles afterwards. The crash and restore suites also need
cluster control: `PERSONAL_OS_TEST_PG_BIN` (binary directory) and
`PERSONAL_OS_TEST_PGDATA` (data directory of that cluster).
`bun run --cwd packages/integrations/personal-os-state-postgres qualify:postgres`
(`PERSONAL_OS_QUALIFICATION_PG_BIN` names a PostgreSQL 17 binary directory)
creates a throwaway TCP-only cluster on a free loopback port, runs every
qualifier with those variables, and deletes the cluster; an optional
directory argument receives count-only crash and restore receipts.

Subject isolation is proven per store table: one forced `ALL` policy each,
no rows without a subject scope, no foreign rows under another scope, rejected
cross-subject inserts and re-keying updates, no-op foreign updates and
deletes, and no way for the runtime login to disable RLS, drop a policy, set
`row_security = off`, assume the migrator, read the ledger or create tables.
Forced RLS binds the schema owner too. Durable-store qualification covers
racing commits and idempotent replays, `SKIP LOCKED` outbox workers, racing
activations, concurrent runner invocations, an interrupted carry-forward that
resumes, a runtime backend killed mid-commit, an immediate postmaster shutdown
with WAL crash recovery, lease expiry and stale-worker rejection, behavior
delivery retry and dead-letter, retention purge with cascading delivery work,
rights erasure, a `pg_dump` by a `BYPASSRLS` read-only backup role (a
`NOBYPASSRLS` reader's dump is refused) restored into a new database, and a
`pg_basebackup` started as a second cluster. These local samples do not
qualify managed PostgreSQL, KMS recovery, regional failover, operator
runbooks or production recovery objectives (RPO/RTO).

The store migration grants no runtime role: the deployer grants its runtime
login `USAGE` on the store schema and DML on the subject and heartbeat
tables, as the qualifiers do. Behind the production postgres-js provider the
outbox-processor probe binds one scalar parameter per destination, and
`activate` serializes first activations of a subject's domain, so racing
activations return one `created` and `conflict` for the rest.


## Declared capabilities

### Integration Personal Os State Postgres

Capability ID: `package.lssm.tech.integration.personal.os.state.postgres`

Subject-bound PostgreSQL event, encrypted projection, rights, and outbox persistence for PersonalOS.

Use cases:

- Adopt subject-bound postgresql event, encrypted projection, rights, and outbox persistence for personalos

Constraints:

```json
{
  "platforms": [
    "web",
    "server"
  ],
  "runtimes": [
    "node",
    "browser"
  ],
  "avoidWhen": [
    "The @lssm-tech/integration.personal-os-state-postgres package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "integration",
    "personal",
    "state",
    "postgres"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/authority-decisions",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/backup",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/database",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/encrypted-state",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/migration-rehearsal",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/migration-runner",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/migrations",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/outbox",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization-delivery",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization-denial-audit",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization-preferences",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.personal-os-state-postgres/rolemorph-audit",
    "symbols": []
  }
]
```

## Catalogue metadata

```json
{
  "family": "integrations",
  "kind": "integration",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "web",
    "server"
  ],
  "runtimes": [
    "node",
    "browser"
  ],
  "entrypoints": [
    ".",
    "./authority-decisions",
    "./backup",
    "./database",
    "./encrypted-state",
    "./migration-rehearsal",
    "./migration-runner",
    "./migrations",
    "./outbox",
    "./personalization",
    "./personalization-delivery",
    "./personalization-denial-audit",
    "./personalization-preferences",
    "./rolemorph-audit",
    "./rights",
    "./store",
    "./types"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/authority-decisions",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/backup",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/database",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/encrypted-state",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/migration-rehearsal",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/migration-runner",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/migrations",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/outbox",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization-delivery",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization-denial-audit",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/personalization-preferences",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.personal.os.state.postgres",
    "from": "@lssm-tech/integration.personal-os-state-postgres/rolemorph-audit",
    "symbols": []
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.personal-os-state-postgres` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/index.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/authority-decisions` — subpath `./authority-decisions`
  - `unconditional`: `./src/authority-decisions.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/authority-decisions.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/backup` — subpath `./backup`
  - `unconditional`: `./src/backup.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/backup.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/database` — subpath `./database`
  - `unconditional`: `./src/database.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/database.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/encrypted-state` — subpath `./encrypted-state`
  - `unconditional`: `./src/encrypted-state.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/encrypted-state.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/migration-rehearsal` — subpath `./migration-rehearsal`
  - Conditional target declaration: `{"browser":null,"default":"./src/migration-rehearsal.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/migration-rehearsal.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/migration-rehearsal.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/migration-runner` — subpath `./migration-runner`
  - Conditional target declaration: `{"browser":null,"default":"./src/migration-runner.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/migration-runner.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/migration-runner.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/migrations` — subpath `./migrations`
  - `unconditional`: `./src/migrations.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/migrations.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/outbox` — subpath `./outbox`
  - `unconditional`: `./src/outbox.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/outbox.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/personalization` — subpath `./personalization`
  - Conditional target declaration: `{"browser":null,"default":"./src/personalization.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/personalization.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/personalization-delivery` — subpath `./personalization-delivery`
  - Conditional target declaration: `{"browser":null,"default":"./src/personalization-delivery.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/personalization-delivery.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization-delivery.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/personalization-denial-audit` — subpath `./personalization-denial-audit`
  - Conditional target declaration: `{"browser":null,"default":"./src/personalization-denial-audit.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/personalization-denial-audit.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization-denial-audit.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/personalization-preferences` — subpath `./personalization-preferences`
  - Conditional target declaration: `{"browser":null,"default":"./src/personalization-preferences.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/personalization-preferences.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/personalization-preferences.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/rolemorph-audit` — subpath `./rolemorph-audit`
  - Conditional target declaration: `{"browser":null,"default":"./src/rolemorph-audit.ts"}`
  - `browser`: **blocked by manifest (null)**; blocked export.
  - `default`: `./src/rolemorph-audit.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/rolemorph-audit.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/rights` — subpath `./rights`
  - `unconditional`: `./src/rights.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/rights.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/store` — subpath `./store`
  - `unconditional`: `./src/store.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/store.ts); verified source file.

- `@lssm-tech/integration.personal-os-state-postgres/types` — subpath `./types`
  - `unconditional`: `./src/types.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/personal-os-state-postgres/src/types.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "browser": "./dist/browser/index.js",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./authority-decisions": {
      "types": "./dist/authority-decisions.d.ts",
      "browser": "./dist/browser/authority-decisions.js",
      "bun": "./dist/authority-decisions.js",
      "node": "./dist/node/authority-decisions.js",
      "default": "./dist/authority-decisions.js"
    },
    "./backup": {
      "types": "./dist/backup.d.ts",
      "browser": "./dist/browser/backup.js",
      "bun": "./dist/backup.js",
      "node": "./dist/node/backup.js",
      "default": "./dist/backup.js"
    },
    "./database": {
      "types": "./dist/database.d.ts",
      "browser": "./dist/browser/database.js",
      "bun": "./dist/database.js",
      "node": "./dist/node/database.js",
      "default": "./dist/database.js"
    },
    "./encrypted-state": {
      "types": "./dist/encrypted-state.d.ts",
      "browser": "./dist/browser/encrypted-state.js",
      "bun": "./dist/encrypted-state.js",
      "node": "./dist/node/encrypted-state.js",
      "default": "./dist/encrypted-state.js"
    },
    "./migration-rehearsal": {
      "types": "./dist/migration-rehearsal.d.ts",
      "browser": null,
      "bun": "./dist/migration-rehearsal.js",
      "node": "./dist/node/migration-rehearsal.js",
      "default": "./dist/migration-rehearsal.js"
    },
    "./migration-runner": {
      "types": "./dist/migration-runner.d.ts",
      "browser": null,
      "bun": "./dist/migration-runner.js",
      "node": "./dist/node/migration-runner.js",
      "default": "./dist/migration-runner.js"
    },
    "./migrations": {
      "types": "./dist/migrations.d.ts",
      "browser": "./dist/browser/migrations.js",
      "bun": "./dist/migrations.js",
      "node": "./dist/node/migrations.js",
      "default": "./dist/migrations.js"
    },
    "./outbox": {
      "types": "./dist/outbox.d.ts",
      "browser": "./dist/browser/outbox.js",
      "bun": "./dist/outbox.js",
      "node": "./dist/node/outbox.js",
      "default": "./dist/outbox.js"
    },
    "./personalization": {
      "types": "./dist/personalization.d.ts",
      "browser": null,
      "bun": "./dist/personalization.js",
      "node": "./dist/node/personalization.js",
      "default": "./dist/personalization.js"
    },
    "./personalization-delivery": {
      "types": "./dist/personalization-delivery.d.ts",
      "browser": null,
      "bun": "./dist/personalization-delivery.js",
      "node": "./dist/node/personalization-delivery.js",
      "default": "./dist/personalization-delivery.js"
    },
    "./personalization-denial-audit": {
      "types": "./dist/personalization-denial-audit.d.ts",
      "browser": null,
      "bun": "./dist/personalization-denial-audit.js",
      "node": "./dist/node/personalization-denial-audit.js",
      "default": "./dist/personalization-denial-audit.js"
    },
    "./personalization-preferences": {
      "types": "./dist/personalization-preferences.d.ts",
      "browser": null,
      "bun": "./dist/personalization-preferences.js",
      "node": "./dist/node/personalization-preferences.js",
      "default": "./dist/personalization-preferences.js"
    },
    "./rolemorph-audit": {
      "types": "./dist/rolemorph-audit.d.ts",
      "browser": null,
      "bun": "./dist/rolemorph-audit.js",
      "node": "./dist/node/rolemorph-audit.js",
      "default": "./dist/rolemorph-audit.js"
    },
    "./rights": {
      "types": "./dist/rights.d.ts",
      "browser": "./dist/browser/rights.js",
      "bun": "./dist/rights.js",
      "node": "./dist/node/rights.js",
      "default": "./dist/rights.js"
    },
    "./store": {
      "types": "./dist/store.d.ts",
      "browser": "./dist/browser/store.js",
      "bun": "./dist/store.js",
      "node": "./dist/node/store.js",
      "default": "./dist/store.js"
    },
    "./types": {
      "types": "./dist/types.d.ts",
      "browser": "./dist/browser/types.js",
      "bun": "./dist/types.js",
      "node": "./dist/node/types.js",
      "default": "./dist/types.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/lib.contracts-integrations](https://lssm.co/docs/packages/lib.contracts-integrations/): `workspace:^`
- [@lssm-tech/lib.contracts-runtime-kernel](https://lssm.co/docs/packages/lib.contracts-runtime-kernel/): `workspace:^`
- [@lssm-tech/lib.contracts-spec-core](https://lssm.co/docs/packages/lib.contracts-spec-core/): `workspace:^`
- [@lssm-tech/lib.personal-os-runtime](https://lssm.co/docs/packages/lib.personal-os-runtime/): `workspace:^`
- [@lssm-tech/lib.personal-os-spec](https://lssm.co/docs/packages/lib.personal-os-spec/): `workspace:^`
- [@lssm-tech/lib.personalization](https://lssm.co/docs/packages/lib.personalization/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- `@electric-sql/pglite`: `catalog:data`
- [@lssm-tech/integration.provider-database](https://lssm.co/docs/packages/integration.provider-database/): `workspace:^`
- [@lssm-tech/lib.surface-runtime](https://lssm.co/docs/packages/lib.surface-runtime/): `workspace:^`
- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "clean": "rimraf dist .turbo",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "lint:fix": "node ../../../scripts/biome.cjs check --write .",
  "test": "bun test",
  "prebuild": "contractspec-bun-build prebuild",
  "qualify:postgres": "bash scripts/qualify-durable-postgres.sh",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Integration Personal Os State Postgres documentation](https://www.npmjs.com/package/%40lssm-tech%2Fintegration.personal-os-state-postgres) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Fintegration.personal-os-state-postgres",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.personal-os-state-postgres.txt",
  "route": "/llms/integration.personal-os-state-postgres",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.personal-os-state-postgres.txt",
  "blobSha": "16c52610d2bd53248deb16a2e4cb6016cfb77a58",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```