@hraness/peopleblade 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hraness
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,79 @@
+# @hraness/peopleblade
+
+PeopleBlade is a local-first, source-aware contact graph for people and agents.
+The authoritative database stays in private SQLite on your machine. Cloud sign-in
+and sync are optional.
+
+## Requirements
+
+- Bun 1.3.14 or newer
+- macOS or Linux for the currently tested local workflows
+- Provider-specific setup only for live sources you choose to import
+
+## Install
+
+```bash
+bun add --global @hraness/peopleblade@0.1.0
+peopleblade --version
+peopleblade init
+peopleblade stats --json
+```
+
+The default database is:
+
+- macOS: `~/Library/Application Support/PeopleBlade/peopleblade.sqlite3`
+- Linux: `${XDG_DATA_HOME:-~/.local/share}/peopleblade/peopleblade.sqlite3`
+
+Use `peopleblade --help` to list source, identity-review, notes, research, backup,
+and optional cloud commands. Every schema upgrade of an existing database creates
+a private backup before applying migrations. `peopleblade backup` creates an
+additional consistent SQLite backup on demand.
+
+Optional cloud credentials are revocable. Use `peopleblade cloud devices` to list
+authorized devices, `peopleblade cloud revoke DEVICE_ID` for a lost device, and
+`peopleblade cloud signout` to revoke the current device before removing its local
+token. The signed-in dashboard provides the lost-device recovery path when no CLI
+token remains available.
+
+### Optional Wrench-backed sources
+
+The package does not install Wrench, browser automation, KB, native model runtimes,
+or provider credentials. Beeper, Google, and WhatsApp live sync commands delegate
+through a separately reviewed `wrench` executable on `PATH` (or the absolute
+`PEOPLEBLADE_WRENCH_EXECUTABLE` path). PeopleBlade bundles only the pinned Wrench
+0.15.0 client validators needed to fence requests and receipts; it does not bundle
+or silently download Wrench's execution runtime.
+
+Existing reviewed Wrench 0.15.0 environments remain supported. A fresh public
+Wrench setup is intentionally not prescribed here until Wrench publishes a narrow,
+immutable runtime graph. Archive imports, Apple Contacts, iMessage, notes, identity
+review, backups, and optional PeopleBlade cloud commands do not require Wrench.
+
+## Privacy boundary
+
+PeopleBlade's provider import paths never retain, search, enrich from, or upload
+message text. The optional cloud projection excludes source records, raw archives,
+local paths, provider credentials, and message bodies. Ambiguous identity links
+remain reviewable instead of being silently merged.
+
+This npm artifact contains only the bundled local CLI, its pinned Wrench client
+validators and executable bridge, SQLite migrations, and package documentation.
+It does not contain the Wrench execution runtime, PeopleBlade web server, billing
+implementation, operational tooling, tests, or private product documentation.
+
+## Update or remove
+
+```bash
+bun update --global @hraness/peopleblade
+bun remove --global @hraness/peopleblade
+```
+
+Removing the package does not delete the local SQLite database or its backups.
+See [peopleblade.com](https://peopleblade.com) for supported sources and current
+product boundaries.
+
+## License
+
+The public PeopleBlade CLI package is available under the MIT License. This
+license applies to the npm package, not to PeopleBlade's private repository or
+hosted service.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,30 @@
+# Third-party notices
+
+The PeopleBlade CLI bundle includes reviewed client-boundary code from
+`@hraness/wrench` 0.15.0 (commit
+`41b16fcbf9ed0e8d8a332aa380b7187642aac2e3`) and message-bundle contract code
+from `@hraness/message-like-me` 0.4.0. Those portions are provided under the
+following license. The PeopleBlade CLI package has its own MIT grant in
+`LICENSE`; this notice preserves the attribution for the bundled portions.
+
+MIT License
+
+Copyright (c) 2026 Hraness contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cli.ts

@@ -0,0 +1,61 @@
+#!/usr/bin/env bun
+
+import { accessSync, constants, realpathSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+
+const configured = process.env.PEOPLEBLADE_WRENCH_EXECUTABLE;
+const executable = configured === undefined
+  ? Bun.which("wrench")
+  : isAbsolute(configured)
+    ? resolve(configured)
+    : null;
+
+if (executable === null) {
+  console.error(
+    configured === undefined
+      ? "PeopleBlade Wrench-backed sources require a separately reviewed `wrench` executable on PATH."
+      : "PEOPLEBLADE_WRENCH_EXECUTABLE must be an absolute executable path.",
+  );
+  process.exit(127);
+}
+
+let canonicalExecutable: string;
+try {
+  accessSync(executable, constants.X_OK);
+  canonicalExecutable = realpathSync(executable);
+} catch {
+  console.error("The configured PeopleBlade Wrench executable is unavailable or not executable.");
+  process.exit(127);
+}
+if (process.argv[1] !== undefined && canonicalExecutable === realpathSync(process.argv[1])) {
+  console.error("The PeopleBlade Wrench executable bridge cannot delegate to itself.");
+  process.exit(127);
+}
+
+const child = Bun.spawn([canonicalExecutable, ...process.argv.slice(2)], {
+  cwd: process.cwd(),
+  env: process.env,
+  stdin: "inherit",
+  stdout: "inherit",
+  stderr: "inherit",
+});
+
+let terminationTimer: ReturnType<typeof setTimeout> | null = null;
+const forward = (signal: NodeJS.Signals) => {
+  try { child.kill(signal); } catch { /* child already settled */ }
+  terminationTimer ??= setTimeout(() => {
+    try { child.kill("SIGKILL"); } catch { /* child already settled */ }
+  }, 5_000);
+  terminationTimer.unref();
+};
+const interrupt = () => forward("SIGINT");
+const terminate = () => forward("SIGTERM");
+process.on("SIGINT", interrupt);
+process.on("SIGTERM", terminate);
+try {
+  process.exitCode = await child.exited;
+} finally {
+  if (terminationTimer !== null) clearTimeout(terminationTimer);
+  process.off("SIGINT", interrupt);
+  process.off("SIGTERM", terminate);
+}

package/dist/migrations/001_core.sql

@@ -0,0 +1,223 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE local_state (
+    singleton INTEGER PRIMARY KEY CHECK(singleton = 1),
+    instance_id TEXT NOT NULL UNIQUE CHECK(length(instance_id) = 64 AND instance_id NOT GLOB '*[^0-9a-f]*'),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+INSERT INTO local_state(singleton, instance_id) VALUES (1, lower(hex(randomblob(32))));
+
+CREATE TABLE people (
+    id INTEGER PRIMARY KEY,
+    stable_key TEXT NOT NULL UNIQUE CHECK(length(stable_key) BETWEEN 3 AND 256),
+    display_name TEXT,
+    given_name TEXT,
+    middle_name TEXT,
+    family_name TEXT,
+    name_prefix TEXT,
+    name_suffix TEXT,
+    nickname TEXT,
+    organization TEXT,
+    department TEXT,
+    title TEXT,
+    birthday TEXT,
+    notes TEXT,
+    do_not_contact INTEGER NOT NULL DEFAULT 0 CHECK(do_not_contact IN (0,1)),
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+CREATE INDEX people_name ON people(display_name COLLATE NOCASE, id);
+
+CREATE TABLE source_runs (
+    id INTEGER PRIMARY KEY,
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    mode TEXT NOT NULL CHECK(length(mode) BETWEEN 1 AND 64),
+    source_sha256 TEXT NOT NULL CHECK(length(source_sha256) = 64 AND source_sha256 NOT GLOB '*[^0-9a-f]*'),
+    source_locator_sha256 TEXT CHECK(source_locator_sha256 IS NULL OR (length(source_locator_sha256) = 64 AND source_locator_sha256 NOT GLOB '*[^0-9a-f]*')),
+    completeness TEXT NOT NULL CHECK(completeness IN ('complete','partial','lower-bound','unknown')),
+    result_json TEXT NOT NULL CHECK(json_valid(result_json)),
+    started_at TEXT NOT NULL,
+    completed_at TEXT,
+    UNIQUE(provider, account_key, mode, source_sha256)
+) STRICT;
+
+CREATE TABLE contact_methods (
+    id INTEGER PRIMARY KEY,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE CASCADE,
+    kind TEXT NOT NULL CHECK(kind IN ('email','phone','url','address','date','social','other')),
+    value TEXT NOT NULL CHECK(length(value) BETWEEN 1 AND 8192),
+    normalized_value TEXT NOT NULL CHECK(length(normalized_value) BETWEEN 1 AND 8192),
+    label TEXT NOT NULL DEFAULT '' CHECK(length(label) <= 256),
+    is_primary INTEGER NOT NULL DEFAULT 0 CHECK(is_primary IN (0,1)),
+    confidence TEXT NOT NULL DEFAULT 'unknown' CHECK(confidence IN ('exact','likely','possible','unknown')),
+    first_seen_run_id INTEGER REFERENCES source_runs(id) ON DELETE SET NULL,
+    last_seen_run_id INTEGER REFERENCES source_runs(id) ON DELETE SET NULL,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(person_id, kind, normalized_value, label)
+) STRICT;
+CREATE INDEX contact_methods_lookup ON contact_methods(kind, normalized_value, person_id);
+
+CREATE TABLE provider_resources (
+    id INTEGER PRIMARY KEY,
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    resource_type TEXT NOT NULL CHECK(length(resource_type) BETWEEN 1 AND 64),
+    resource_id TEXT NOT NULL CHECK(length(resource_id) BETWEEN 1 AND 4096),
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    username TEXT,
+    profile_url TEXT,
+    display_name TEXT,
+    active INTEGER NOT NULL DEFAULT 1 CHECK(active IN (0,1)),
+    first_seen_run_id INTEGER REFERENCES source_runs(id) ON DELETE RESTRICT,
+    last_seen_run_id INTEGER REFERENCES source_runs(id) ON DELETE RESTRICT,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(provider, account_key, resource_type, resource_id)
+) STRICT;
+CREATE INDEX provider_resources_person ON provider_resources(person_id, provider, active);
+
+CREATE TABLE source_records (
+    run_id INTEGER NOT NULL REFERENCES source_runs(id) ON DELETE RESTRICT,
+    ordinal INTEGER NOT NULL CHECK(ordinal > 0),
+    record_kind TEXT NOT NULL CHECK(length(record_kind) BETWEEN 1 AND 64),
+    record_sha256 TEXT NOT NULL CHECK(length(record_sha256) = 64 AND record_sha256 NOT GLOB '*[^0-9a-f]*'),
+    person_id INTEGER REFERENCES people(id) ON DELETE RESTRICT,
+    provider_resource_id INTEGER REFERENCES provider_resources(id) ON DELETE RESTRICT,
+    resolution TEXT NOT NULL CHECK(resolution IN ('imported','matched','updated','skipped','conflict','error')),
+    projection_json TEXT NOT NULL CHECK(json_valid(projection_json)),
+    error_text TEXT,
+    PRIMARY KEY(run_id, ordinal)
+) STRICT;
+CREATE INDEX source_records_person ON source_records(person_id, run_id);
+
+CREATE TABLE interaction_metrics (
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE CASCADE,
+    sent_count INTEGER NOT NULL DEFAULT 0 CHECK(sent_count >= 0),
+    received_count INTEGER NOT NULL DEFAULT 0 CHECK(received_count >= 0),
+    interaction_count INTEGER NOT NULL DEFAULT 0 CHECK(interaction_count >= 0),
+    conversation_count INTEGER CHECK(conversation_count IS NULL OR conversation_count >= 0),
+    first_interaction_at TEXT,
+    last_interaction_at TEXT,
+    reciprocal INTEGER NOT NULL DEFAULT 0 CHECK(reciprocal IN (0,1)),
+    completeness TEXT NOT NULL CHECK(completeness IN ('complete','partial','lower-bound','unknown')),
+    last_seen_run_id INTEGER REFERENCES source_runs(id) ON DELETE SET NULL,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY(provider, account_key, person_id)
+) STRICT;
+CREATE INDEX interaction_metrics_person ON interaction_metrics(person_id, provider);
+
+CREATE TABLE interaction_events (
+    id INTEGER PRIMARY KEY,
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    external_id TEXT NOT NULL CHECK(length(external_id) BETWEEN 1 AND 4096),
+    person_id INTEGER REFERENCES people(id) ON DELETE RESTRICT,
+    occurred_at TEXT,
+    direction TEXT CHECK(direction IN ('incoming','outgoing','unknown')),
+    conversation_sha256 TEXT CHECK(conversation_sha256 IS NULL OR (length(conversation_sha256) = 64 AND conversation_sha256 NOT GLOB '*[^0-9a-f]*')),
+    event_kind TEXT NOT NULL CHECK(length(event_kind) BETWEEN 1 AND 64),
+    resolution TEXT NOT NULL CHECK(resolution IN ('matched','skipped','conflict')),
+    run_id INTEGER NOT NULL REFERENCES source_runs(id) ON DELETE RESTRICT,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    UNIQUE(provider, account_key, external_id)
+) STRICT;
+
+CREATE TABLE tags (
+    id INTEGER PRIMARY KEY,
+    name TEXT NOT NULL COLLATE NOCASE UNIQUE CHECK(length(name) BETWEEN 1 AND 256)
+) STRICT;
+CREATE TABLE person_tags (
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE CASCADE,
+    tag_id INTEGER NOT NULL REFERENCES tags(id) ON DELETE CASCADE,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY(person_id, tag_id)
+) STRICT;
+
+CREATE TABLE collections (
+    id INTEGER PRIMARY KEY,
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    resource_id TEXT NOT NULL CHECK(length(resource_id) BETWEEN 1 AND 2048),
+    name TEXT NOT NULL CHECK(length(name) BETWEEN 1 AND 1024),
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    UNIQUE(provider, account_key, resource_id)
+) STRICT;
+CREATE TABLE collection_memberships (
+    collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE CASCADE,
+    state TEXT NOT NULL CHECK(length(state) BETWEEN 1 AND 64),
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY(collection_id, person_id)
+) STRICT;
+
+CREATE TABLE identity_decisions (
+    id INTEGER PRIMARY KEY,
+    left_person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    right_person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    action TEXT NOT NULL CHECK(action IN ('accept','reject','defer','separate')),
+    evidence_sha256 TEXT NOT NULL CHECK(length(evidence_sha256) = 64 AND evidence_sha256 NOT GLOB '*[^0-9a-f]*'),
+    evidence_json TEXT NOT NULL CHECK(json_valid(evidence_json)),
+    prior_decision_id INTEGER REFERENCES identity_decisions(id) ON DELETE RESTRICT,
+    note TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK(left_person_id < right_person_id)
+) STRICT;
+CREATE UNIQUE INDEX identity_one_successor ON identity_decisions(prior_decision_id) WHERE prior_decision_id IS NOT NULL;
+
+CREATE TABLE public_enrichments (
+    id INTEGER PRIMARY KEY,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    provider TEXT NOT NULL CHECK(provider IN ('exa-luna','hunter','agent-public-web','human-public-web')),
+    input_sha256 TEXT NOT NULL CHECK(length(input_sha256) = 64 AND input_sha256 NOT GLOB '*[^0-9a-f]*'),
+    evidence_sha256 TEXT NOT NULL CHECK(length(evidence_sha256) = 64 AND evidence_sha256 NOT GLOB '*[^0-9a-f]*'),
+    evidence_json TEXT NOT NULL CHECK(json_valid(evidence_json)),
+    output_json TEXT NOT NULL CHECK(json_valid(output_json)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(person_id, provider, input_sha256, evidence_sha256)
+) STRICT;
+
+CREATE TABLE legacy_migrations (
+    id INTEGER PRIMARY KEY,
+    source_format TEXT NOT NULL CHECK(source_format = 'rolodex-v1'),
+    source_sha256 TEXT NOT NULL UNIQUE CHECK(length(source_sha256) = 64 AND source_sha256 NOT GLOB '*[^0-9a-f]*'),
+    source_locator_sha256 TEXT NOT NULL CHECK(length(source_locator_sha256) = 64 AND source_locator_sha256 NOT GLOB '*[^0-9a-f]*'),
+    result_json TEXT NOT NULL CHECK(json_valid(result_json)),
+    migrated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+
+CREATE TABLE cloud_sync_state (
+    singleton INTEGER PRIMARY KEY CHECK(singleton = 1),
+    base_url TEXT NOT NULL,
+    device_id TEXT NOT NULL,
+    last_snapshot_id TEXT,
+    last_synced_at TEXT
+) STRICT;
+
+CREATE TRIGGER people_updated_at AFTER UPDATE ON people FOR EACH ROW
+BEGIN UPDATE people SET updated_at = CURRENT_TIMESTAMP WHERE id = NEW.id; END;
+CREATE TRIGGER contact_methods_updated_at AFTER UPDATE ON contact_methods FOR EACH ROW
+BEGIN UPDATE contact_methods SET updated_at = CURRENT_TIMESTAMP WHERE id = NEW.id; END;
+CREATE TRIGGER provider_resources_updated_at AFTER UPDATE ON provider_resources FOR EACH ROW
+BEGIN UPDATE provider_resources SET updated_at = CURRENT_TIMESTAMP WHERE id = NEW.id; END;
+
+CREATE TRIGGER source_runs_immutable_update BEFORE UPDATE ON source_runs FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source runs are immutable'); END;
+CREATE TRIGGER source_runs_immutable_delete BEFORE DELETE ON source_runs FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source runs are immutable'); END;
+CREATE TRIGGER source_records_immutable_update BEFORE UPDATE ON source_records FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source records are immutable'); END;
+CREATE TRIGGER source_records_immutable_delete BEFORE DELETE ON source_records FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source records are immutable'); END;
+CREATE TRIGGER public_enrichments_immutable_update BEFORE UPDATE ON public_enrichments FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'public enrichments are immutable'); END;
+CREATE TRIGGER public_enrichments_immutable_delete BEFORE DELETE ON public_enrichments FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'public enrichments are immutable'); END;

package/dist/migrations/002_incremental_sources.sql

@@ -0,0 +1,93 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE local_revisions (
+    singleton INTEGER PRIMARY KEY CHECK(singleton = 1),
+    identity_revision INTEGER NOT NULL DEFAULT 0 CHECK(identity_revision >= 0)
+) STRICT;
+INSERT INTO local_revisions(singleton, identity_revision) VALUES (1, 0);
+
+CREATE TABLE provider_accounts (
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    auth_id TEXT NOT NULL CHECK(length(auth_id) BETWEEN 1 AND 128),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    auth_sha256 TEXT NOT NULL CHECK(length(auth_sha256) = 64 AND auth_sha256 NOT GLOB '*[^0-9a-f]*'),
+    first_seen_at TEXT NOT NULL,
+    last_seen_at TEXT NOT NULL,
+    PRIMARY KEY(provider, auth_id),
+    UNIQUE(provider, account_key)
+) STRICT;
+
+CREATE TRIGGER provider_accounts_identity_immutable BEFORE UPDATE OF provider,auth_id,account_key,auth_sha256 ON provider_accounts FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'provider account binding is immutable'); END;
+
+CREATE TABLE archive_accounts (
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    owner_key TEXT NOT NULL COLLATE NOCASE CHECK(length(owner_key) BETWEEN 1 AND 256),
+    current_run_id INTEGER NOT NULL REFERENCES source_runs(id) ON DELETE RESTRICT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY(provider, account_key),
+    UNIQUE(provider, owner_key)
+) STRICT;
+CREATE TRIGGER archive_accounts_identity_immutable BEFORE UPDATE OF provider,account_key,owner_key ON archive_accounts FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'archive account binding is immutable'); END;
+CREATE TRIGGER archive_accounts_run_insert BEFORE INSERT ON archive_accounts FOR EACH ROW
+BEGIN
+    SELECT CASE WHEN NOT EXISTS (
+      SELECT 1 FROM source_runs run WHERE run.id=NEW.current_run_id AND run.provider=NEW.provider AND run.account_key=NEW.account_key
+    ) THEN RAISE(ABORT, 'archive account run realm mismatch') END;
+END;
+CREATE TRIGGER archive_accounts_run_update BEFORE UPDATE OF current_run_id ON archive_accounts FOR EACH ROW
+BEGIN
+    SELECT CASE WHEN NEW.current_run_id <= OLD.current_run_id THEN RAISE(ABORT, 'archive account run must advance') END;
+    SELECT CASE WHEN NOT EXISTS (
+      SELECT 1 FROM source_runs run WHERE run.id=NEW.current_run_id AND run.provider=NEW.provider AND run.account_key=NEW.account_key
+    ) THEN RAISE(ABORT, 'archive account run realm mismatch') END;
+END;
+
+CREATE TRIGGER contact_methods_identity_insert AFTER INSERT ON contact_methods FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+CREATE TRIGGER contact_methods_identity_update AFTER UPDATE ON contact_methods FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+CREATE TRIGGER contact_methods_identity_delete AFTER DELETE ON contact_methods FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+
+CREATE TABLE provider_checkpoints (
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    stream_key TEXT NOT NULL CHECK(length(stream_key) BETWEEN 1 AND 128),
+    source_locator_sha256 TEXT NOT NULL CHECK(length(source_locator_sha256) = 64 AND source_locator_sha256 NOT GLOB '*[^0-9a-f]*'),
+    schema_sha256 TEXT NOT NULL CHECK(length(schema_sha256) = 64 AND schema_sha256 NOT GLOB '*[^0-9a-f]*'),
+    generation_sha256 TEXT CHECK(generation_sha256 IS NULL OR (length(generation_sha256) = 64 AND generation_sha256 NOT GLOB '*[^0-9a-f]*')),
+    cursor TEXT NOT NULL CHECK(length(cursor) BETWEEN 1 AND 256),
+    cursor_anchor_sha256 TEXT CHECK(cursor_anchor_sha256 IS NULL OR (length(cursor_anchor_sha256) = 64 AND cursor_anchor_sha256 NOT GLOB '*[^0-9a-f]*')),
+    last_run_id INTEGER NOT NULL REFERENCES source_runs(id) ON DELETE RESTRICT,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY(provider, account_key, stream_key)
+) STRICT;
+
+CREATE TRIGGER provider_checkpoint_run_insert BEFORE INSERT ON provider_checkpoints FOR EACH ROW
+BEGIN
+    SELECT CASE WHEN NOT EXISTS (
+        SELECT 1 FROM source_runs run
+        WHERE run.id = NEW.last_run_id AND run.provider = NEW.provider AND run.account_key = NEW.account_key
+    ) THEN RAISE(ABORT, 'checkpoint run realm mismatch') END;
+END;
+CREATE TRIGGER provider_checkpoint_run_update BEFORE UPDATE ON provider_checkpoints FOR EACH ROW
+BEGIN
+    SELECT CASE WHEN NEW.provider <> OLD.provider OR NEW.account_key <> OLD.account_key OR NEW.stream_key <> OLD.stream_key
+        THEN RAISE(ABORT, 'checkpoint identity is immutable') END;
+    SELECT CASE WHEN NEW.last_run_id <= OLD.last_run_id
+        THEN RAISE(ABORT, 'checkpoint run must advance') END;
+    SELECT CASE WHEN NOT EXISTS (
+        SELECT 1 FROM source_runs run
+        WHERE run.id = NEW.last_run_id AND run.provider = NEW.provider AND run.account_key = NEW.account_key
+    ) THEN RAISE(ABORT, 'checkpoint run realm mismatch') END;
+END;
+
+CREATE TRIGGER interaction_events_immutable_update BEFORE UPDATE ON interaction_events FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'interaction events are immutable'); END;
+CREATE TRIGGER interaction_events_immutable_delete BEFORE DELETE ON interaction_events FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'interaction events are immutable'); END;

package/dist/migrations/003_identity_review.sql

@@ -0,0 +1,67 @@
+PRAGMA foreign_keys = ON;
+
+CREATE VIEW identity_current_decisions AS
+SELECT decision.*
+FROM identity_decisions decision
+WHERE NOT EXISTS (
+  SELECT 1 FROM identity_decisions successor WHERE successor.prior_decision_id = decision.id
+);
+
+CREATE VIEW person_identity_components AS
+WITH RECURSIVE
+accepted(left_person_id, right_person_id) AS (
+  SELECT left_person_id, right_person_id
+  FROM identity_current_decisions
+  WHERE action = 'accept'
+),
+reach(person_id, member_id) AS (
+  SELECT id, id FROM people
+  UNION
+  SELECT reach.person_id,
+    CASE WHEN accepted.left_person_id = reach.member_id
+      THEN accepted.right_person_id ELSE accepted.left_person_id END
+  FROM reach
+  JOIN accepted
+    ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+)
+SELECT person_id, min(member_id) AS canonical_person_id
+FROM reach
+GROUP BY person_id;
+
+CREATE TRIGGER identity_decisions_immutable_update
+BEFORE UPDATE ON identity_decisions FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'identity decisions are immutable'); END;
+
+CREATE TRIGGER identity_decisions_immutable_delete
+BEFORE DELETE ON identity_decisions FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'identity decisions are immutable'); END;
+
+CREATE TRIGGER identity_decisions_predecessor
+BEFORE INSERT ON identity_decisions FOR EACH ROW
+WHEN NEW.prior_decision_id IS NOT NULL
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM identity_current_decisions prior
+    WHERE prior.id = NEW.prior_decision_id
+      AND prior.left_person_id = NEW.left_person_id
+      AND prior.right_person_id = NEW.right_person_id
+  ) THEN RAISE(ABORT, 'identity predecessor must be the current decision for the same pair') END;
+END;
+
+CREATE TRIGGER identity_decisions_revision
+AFTER INSERT ON identity_decisions FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+
+CREATE TRIGGER provider_resources_identity_insert
+AFTER INSERT ON provider_resources FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+CREATE TRIGGER provider_resources_identity_update
+AFTER UPDATE OF provider,account_key,resource_type,resource_id,person_id,username,profile_url,active ON provider_resources FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+CREATE TRIGGER provider_resources_identity_delete
+AFTER DELETE ON provider_resources FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+
+CREATE TRIGGER people_identity_update
+AFTER UPDATE OF display_name,given_name,middle_name,family_name,name_prefix,name_suffix,nickname,organization,department,title ON people FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;

package/dist/migrations/004_source_realms_and_observations.sql

@@ -0,0 +1,91 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE source_bindings (
+    id INTEGER PRIMARY KEY,
+    authority TEXT NOT NULL CHECK(length(authority) BETWEEN 1 AND 64),
+    auth_id TEXT NOT NULL CHECK(length(auth_id) BETWEEN 1 AND 128),
+    subject_sha256 TEXT NOT NULL CHECK(length(subject_sha256) = 64 AND subject_sha256 NOT GLOB '*[^0-9a-f]*'),
+    auth_sha256 TEXT NOT NULL CHECK(length(auth_sha256) = 64 AND auth_sha256 NOT GLOB '*[^0-9a-f]*'),
+    first_seen_at TEXT NOT NULL,
+    last_seen_at TEXT NOT NULL,
+    complete_realm_inventory_observed_at TEXT,
+    complete_realm_inventory_sha256 TEXT,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    CHECK(
+      (complete_realm_inventory_observed_at IS NULL AND complete_realm_inventory_sha256 IS NULL)
+      OR (
+        complete_realm_inventory_observed_at IS NOT NULL
+        AND length(complete_realm_inventory_sha256) = 64
+        AND complete_realm_inventory_sha256 NOT GLOB '*[^0-9a-f]*'
+      )
+    ),
+    UNIQUE(authority, auth_id),
+    UNIQUE(authority, subject_sha256)
+) STRICT;
+
+CREATE TRIGGER source_bindings_identity_immutable
+BEFORE UPDATE OF authority,auth_id,subject_sha256,auth_sha256 ON source_bindings FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source binding identity is immutable'); END;
+
+CREATE TABLE source_realms (
+    id INTEGER PRIMARY KEY,
+    source_binding_id INTEGER NOT NULL REFERENCES source_bindings(id) ON DELETE RESTRICT,
+    authority TEXT NOT NULL CHECK(length(authority) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    service TEXT NOT NULL CHECK(length(service) BETWEEN 1 AND 64),
+    identity_namespace TEXT NOT NULL CHECK(length(identity_namespace) BETWEEN 1 AND 128),
+    external_id_sha256 TEXT NOT NULL CHECK(length(external_id_sha256) = 64 AND external_id_sha256 NOT GLOB '*[^0-9a-f]*'),
+    active INTEGER NOT NULL DEFAULT 1 CHECK(active IN (0,1)),
+    first_seen_at TEXT NOT NULL,
+    last_seen_at TEXT NOT NULL,
+    state_observed_at TEXT NOT NULL,
+    materialized_source_sha256 TEXT CHECK(
+      materialized_source_sha256 IS NULL OR (
+        length(materialized_source_sha256) = 64
+        AND materialized_source_sha256 NOT GLOB '*[^0-9a-f]*'
+      )
+    ),
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    UNIQUE(authority, account_key),
+    UNIQUE(source_binding_id, external_id_sha256)
+) STRICT;
+CREATE INDEX source_realms_binding ON source_realms(source_binding_id, active, service);
+
+CREATE TRIGGER source_realms_identity_immutable
+BEFORE UPDATE OF source_binding_id,authority,account_key,identity_namespace,external_id_sha256
+ON source_realms FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source realm identity is immutable'); END;
+
+ALTER TABLE provider_resources ADD COLUMN source_realm_id INTEGER REFERENCES source_realms(id) ON DELETE RESTRICT;
+CREATE INDEX provider_resources_realm ON provider_resources(source_realm_id, active, person_id);
+
+ALTER TABLE contact_methods ADD COLUMN provider_resource_id INTEGER REFERENCES provider_resources(id) ON DELETE RESTRICT;
+ALTER TABLE contact_methods ADD COLUMN active INTEGER NOT NULL DEFAULT 1 CHECK(active IN (0,1));
+ALTER TABLE contact_methods ADD COLUMN identity_eligible INTEGER NOT NULL DEFAULT 1 CHECK(identity_eligible IN (0,1));
+CREATE INDEX contact_methods_resource ON contact_methods(provider_resource_id, active, kind);
+
+CREATE TABLE person_field_observations (
+    id INTEGER PRIMARY KEY,
+    provider_resource_id INTEGER NOT NULL REFERENCES provider_resources(id) ON DELETE RESTRICT,
+    field TEXT NOT NULL CHECK(field IN (
+      'display_name','given_name','middle_name','family_name','name_prefix','name_suffix',
+      'nickname','organization','department','title','birthday'
+    )),
+    value TEXT NOT NULL CHECK(length(value) BETWEEN 1 AND 8192),
+    basis TEXT NOT NULL CHECK(length(basis) BETWEEN 1 AND 128),
+    priority INTEGER NOT NULL CHECK(priority BETWEEN 0 AND 1000),
+    active INTEGER NOT NULL DEFAULT 1 CHECK(active IN (0,1)),
+    first_seen_run_id INTEGER NOT NULL REFERENCES source_runs(id) ON DELETE RESTRICT,
+    last_seen_run_id INTEGER NOT NULL REFERENCES source_runs(id) ON DELETE RESTRICT,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    UNIQUE(provider_resource_id, field, value, basis)
+) STRICT;
+CREATE INDEX person_field_observations_current
+ON person_field_observations(provider_resource_id, field, active, priority DESC, id);
+
+CREATE TRIGGER person_field_observations_identity_revision_insert
+AFTER INSERT ON person_field_observations FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;
+CREATE TRIGGER person_field_observations_identity_revision_update
+AFTER UPDATE OF value,basis,priority,active ON person_field_observations FOR EACH ROW
+BEGIN UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1; END;