# @lssm-tech/integration.runtime-managed

Managed runtime compatibility wrapper for Builder.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.5`
- Package path: `packages/integrations/runtime-managed`
- Manifest path: `packages/integrations/runtime-managed/package.json`
- Manifest Git blob: `fd66a50bbb1aa0564413f8da69683b5705c17494`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.runtime-managed](https://lssm.co/docs/packages/integration.runtime-managed/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.runtime-managed.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "delivery-and-infrastructure",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "runtime",
    "catalogKind": "integration",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Delivery, infrastructure and runtime operations](https://lssm.co/docs/areas/delivery-and-infrastructure/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/runtime-managed/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/README.md",
  "blobSha": "a4f2c8d6bf2c7e3040c42d79d79bf450bda6c3a5",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# @lssm-tech/integration.runtime-managed

Managed runtime compatibility wrapper for Builder, plus the managed **database
runtime** preset (`./database`).

## `createDatabaseRuntime()`

`createDatabaseRuntime(options)` composes the governed Postgres provider, the O2
observability binding, tenant-scoped RLS access, and the pre-bound governed
read / relational-read / mutation resolvers into one preset. It returns:

| member            | description                                                              |
| ----------------- | ------------------------------------------------------------------------ |
| `provider`        | Tenant-scoped `DatabaseProvider` (ambient tenant; fail-closed when none) |
| `governedQuery`   | Pre-bound resolver factory (data-view **and** relational descriptors)    |
| `governedMutation`| Pre-bound `executeGovernedMutation`                                       |
| `withTenant(id)`  | Returns a slice bound to a fixed tenant id                               |
| `close()`         | Closes the underlying pool once                                          |

```ts
import { createDatabaseRuntime } from '@lssm-tech/integration.runtime-managed/database';

const db = createDatabaseRuntime({
  connection: { connectionString: process.env.DATABASE_URL },
  pooler: 'transaction-pooler',
  instrumentation, // lib.observability Instrumentation facade (optional)
});

const tenant = db.withTenant('tenant-42');
const list = tenant.governedQuery({ descriptor }); // (envelope, ctx) => ContractResult
await tenant.governedMutation(mutationDescriptor);
```


### Tenant scoping (RLS, Critic N6)

The raw provider is never exposed. Every read/write runs inside a transaction
that first issues `set_config('app.tenant_id', <id>, true)`, so Postgres RLS
policies see the active tenant. The top-level `provider` resolves the tenant
from `resolveTenantId` (or the auth seam) per call and **fails closed** when no
tenant context is present; use `withTenant(id)` in server contexts that already
know the tenant. `TransportContext.principal` is carried onto resolver ctx and
never stripped (AC14); `policyDecisionRef` / `policy.auth` enforcement stays in
the handlers.

### Pooler modes (AC3)

`pooler` selects connection sizing and SSL. Prepared statements are **always
disabled** — `SupabasePostgresProvider` hard-sets `prepare: false`, which the
Supabase transaction pooler (pgBouncer transaction mode) requires.

| mode                 | maxConnections | sslMode   | notes                                            |
| -------------------- | -------------- | --------- | ------------------------------------------------ |
| `transaction-pooler` | 1              | `require` | Default. pgBouncer txn mode; no prepared stmts.  |
| `session-pooler`     | 10             | `require` | Backend held per connection for the session.     |
| `direct`             | 10             | `prefer`  | Direct Postgres connection (no pooler).          |

Override sizing/SSL via `connection.maxConnections` / `connection.sslMode`.

### Observability (O2)

Pass an `instrumentation` (the `lib.observability` Instrumentation facade) and
each governed read/write emits one span plus a `database.query` /
`database.mutation` duration metric. The tenant `set_config` statement is
classified as a session statement and excluded from the data-latency histograms.


## Declared capabilities

### Integration Runtime Managed

Capability ID: `package.lssm.tech.integration.runtime.managed`

Managed runtime compatibility wrapper for Builder.

Use cases:

- Adopt managed runtime compatibility wrapper for builder

Constraints:

```json
{
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "avoidWhen": [
    "The @lssm-tech/integration.runtime-managed package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "integration",
    "runtime",
    "managed"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/integration.runtime-managed",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.runtime-managed/database",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.runtime-managed/database/create-database-runtime",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.runtime-managed/database/observability-binding",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.runtime-managed/database/pooler",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.runtime-managed/database/tenant-scope",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.runtime-managed/integration",
    "symbols": []
  }
]
```

## Catalogue metadata

```json
{
  "family": "runtime",
  "kind": "integration",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./database",
    "./database/create-database-runtime",
    "./database/observability-binding",
    "./database/pooler",
    "./database/tenant-scope",
    "./integration"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed/database",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed/database/create-database-runtime",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed/database/observability-binding",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed/database/pooler",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed/database/tenant-scope",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.runtime.managed",
    "from": "@lssm-tech/integration.runtime-managed/integration",
    "symbols": []
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.runtime-managed` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/index.ts); verified source file.

- `@lssm-tech/integration.runtime-managed/database` — subpath `./database`
  - `unconditional`: `./src/database/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/database/index.ts); verified source file.

- `@lssm-tech/integration.runtime-managed/database/create-database-runtime` — subpath `./database/create-database-runtime`
  - `unconditional`: `./src/database/create-database-runtime.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/database/create-database-runtime.ts); verified source file.

- `@lssm-tech/integration.runtime-managed/database/observability-binding` — subpath `./database/observability-binding`
  - `unconditional`: `./src/database/observability-binding.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/database/observability-binding.ts); verified source file.

- `@lssm-tech/integration.runtime-managed/database/pooler` — subpath `./database/pooler`
  - `unconditional`: `./src/database/pooler.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/database/pooler.ts); verified source file.

- `@lssm-tech/integration.runtime-managed/database/tenant-scope` — subpath `./database/tenant-scope`
  - `unconditional`: `./src/database/tenant-scope.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/database/tenant-scope.ts); verified source file.

- `@lssm-tech/integration.runtime-managed/integration` — subpath `./integration`
  - `unconditional`: `./src/integration.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/runtime-managed/src/integration.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "browser": "./dist/browser/index.js",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./database": {
      "types": "./dist/database/index.d.ts",
      "browser": "./dist/browser/database/index.js",
      "bun": "./dist/database/index.js",
      "node": "./dist/node/database/index.js",
      "default": "./dist/database/index.js"
    },
    "./database/create-database-runtime": {
      "types": "./dist/database/create-database-runtime.d.ts",
      "browser": "./dist/browser/database/create-database-runtime.js",
      "bun": "./dist/database/create-database-runtime.js",
      "node": "./dist/node/database/create-database-runtime.js",
      "default": "./dist/database/create-database-runtime.js"
    },
    "./database/observability-binding": {
      "types": "./dist/database/observability-binding.d.ts",
      "browser": "./dist/browser/database/observability-binding.js",
      "bun": "./dist/database/observability-binding.js",
      "node": "./dist/node/database/observability-binding.js",
      "default": "./dist/database/observability-binding.js"
    },
    "./database/pooler": {
      "types": "./dist/database/pooler.d.ts",
      "browser": "./dist/browser/database/pooler.js",
      "bun": "./dist/database/pooler.js",
      "node": "./dist/node/database/pooler.js",
      "default": "./dist/database/pooler.js"
    },
    "./database/tenant-scope": {
      "types": "./dist/database/tenant-scope.d.ts",
      "browser": "./dist/browser/database/tenant-scope.js",
      "bun": "./dist/database/tenant-scope.js",
      "node": "./dist/node/database/tenant-scope.js",
      "default": "./dist/database/tenant-scope.js"
    },
    "./integration": {
      "types": "./dist/integration.d.ts",
      "browser": "./dist/browser/integration.js",
      "bun": "./dist/integration.js",
      "node": "./dist/node/integration.js",
      "default": "./dist/integration.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/integration.provider-database](https://lssm.co/docs/packages/integration.provider-database/): `workspace:^`
- [@lssm-tech/integration.runtime](https://lssm.co/docs/packages/integration.runtime/): `workspace:^`
- [@lssm-tech/lib.contracts-integrations](https://lssm.co/docs/packages/lib.contracts-integrations/): `workspace:^`
- [@lssm-tech/lib.contracts-runtime-core](https://lssm.co/docs/packages/lib.contracts-runtime-core/): `workspace:^`
- [@lssm-tech/lib.contracts-spec-core](https://lssm.co/docs/packages/lib.contracts-spec-core/): `workspace:^`
- [@lssm-tech/lib.observability](https://lssm.co/docs/packages/lib.observability/): `workspace:^`
- [@lssm-tech/lib.provider-spec](https://lssm.co/docs/packages/lib.provider-spec/): `workspace:^`
- [@lssm-tech/lib.schema](https://lssm.co/docs/packages/lib.schema/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "dev": "contractspec-bun-build dev",
  "clean": "rimraf dist .turbo",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "lint:fix": "node ../../../scripts/biome.cjs check --write --unsafe --only=nursery/useSortedClasses . && node ../../../scripts/biome.cjs check --write .",
  "test": "bun test",
  "prebuild": "contractspec-bun-build prebuild",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Integration Runtime Managed documentation](https://www.npmjs.com/package/%40lssm-tech%2Fintegration.runtime-managed) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Fintegration.runtime-managed",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.runtime-managed.txt",
  "route": "/llms/integration.runtime-managed",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.runtime-managed.txt",
  "blobSha": "a4f2c8d6bf2c7e3040c42d79d79bf450bda6c3a5",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```