@hraness/peopleblade 0.1.0

package/dist/migrations/005_identity_representatives.sql

@@ -0,0 +1,87 @@
+PRAGMA foreign_keys = ON;
+
+CREATE UNIQUE INDEX identity_one_root_per_pair
+ON identity_decisions(left_person_id, right_person_id)
+WHERE prior_decision_id IS NULL;
+
+CREATE TRIGGER identity_decisions_legal_transition
+BEFORE INSERT ON identity_decisions FOR EACH ROW
+BEGIN
+  SELECT CASE WHEN NEW.prior_decision_id IS NULL AND NEW.action = 'separate'
+    THEN RAISE(ABORT, 'identity separation requires a current accepted decision') END;
+  SELECT CASE WHEN NEW.prior_decision_id IS NOT NULL AND EXISTS (
+    SELECT 1 FROM identity_current_decisions prior
+    WHERE prior.id = NEW.prior_decision_id
+      AND (
+        (prior.action = 'accept' AND NEW.action <> 'separate')
+        OR (prior.action IN ('reject','defer') AND (
+          NEW.action = 'separate' OR NEW.evidence_sha256 = prior.evidence_sha256
+        ))
+        OR (prior.action = 'separate' AND (
+          NEW.action = 'separate'
+          OR NEW.evidence_sha256 = coalesce(
+            json_extract(prior.evidence_json, '$.acceptedEvidenceSha256'),
+            prior.evidence_sha256
+          )
+        ))
+      )
+  ) THEN RAISE(ABORT, 'illegal identity decision transition') END;
+END;
+
+DROP VIEW person_identity_components;
+
+CREATE VIEW person_identity_components AS
+WITH RECURSIVE
+accepted(left_person_id, right_person_id) AS (
+  SELECT left_person_id, right_person_id
+  FROM identity_current_decisions
+  WHERE action = 'accept'
+),
+reach(person_id, member_id) AS (
+  SELECT id, id FROM people
+  UNION
+  SELECT reach.person_id,
+    CASE WHEN accepted.left_person_id = reach.member_id
+      THEN accepted.right_person_id ELSE accepted.left_person_id END
+  FROM reach
+  JOIN accepted
+    ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+),
+raw_components(person_id, raw_canonical_person_id) AS (
+  SELECT person_id, min(member_id)
+  FROM reach
+  GROUP BY person_id
+),
+-- A reviewed target is durable representative evidence. Superseding the edge may
+-- split the graph, but must not change the representative of any component that
+-- still contains that richer target.
+observed_targets(raw_canonical_person_id, target_person_id, decision_id) AS (
+  SELECT target.raw_canonical_person_id,
+    CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER),
+    decision.id
+  FROM identity_decisions decision
+  JOIN raw_components target ON target.person_id = CAST(
+    json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER
+  )
+  WHERE decision.action = 'accept'
+    AND json_extract(decision.evidence_json, '$.version') = 2
+    AND json_extract(decision.evidence_json, '$.kind') IN ('observed-email','observed-phone')
+),
+component_ids(raw_canonical_person_id) AS (
+  SELECT DISTINCT raw_canonical_person_id FROM raw_components
+),
+component_representatives(raw_canonical_person_id, canonical_person_id) AS (
+  SELECT component.raw_canonical_person_id,
+    coalesce((
+      SELECT target.target_person_id
+      FROM observed_targets target
+      WHERE target.raw_canonical_person_id = component.raw_canonical_person_id
+      ORDER BY target.decision_id
+      LIMIT 1
+    ), component.raw_canonical_person_id)
+  FROM component_ids component
+)
+SELECT raw.person_id, representative.canonical_person_id
+FROM raw_components raw
+JOIN component_representatives representative
+  ON representative.raw_canonical_person_id = raw.raw_canonical_person_id;

package/dist/migrations/006_profile_url_trust.sql

@@ -0,0 +1,15 @@
+ALTER TABLE provider_resources
+ADD COLUMN profile_url_identity_eligible INTEGER NOT NULL DEFAULT 0
+CHECK(profile_url_identity_eligible IN (0,1));
+
+UPDATE provider_resources
+SET profile_url_identity_eligible = 1
+WHERE provider IN ('instagram','linkedin')
+  AND profile_url IS NOT NULL
+  AND trim(profile_url) <> '';
+
+CREATE TRIGGER provider_resources_profile_url_identity_update
+AFTER UPDATE OF profile_url_identity_eligible ON provider_resources FOR EACH ROW
+BEGIN
+  UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1;
+END;

package/dist/migrations/007_person_notes.sql

@@ -0,0 +1,39 @@
+PRAGMA foreign_keys = ON;
+
+-- Dated CRM notes. people.notes remains a legacy free-text blob and is not queried.
+CREATE TABLE person_notes (
+    id INTEGER PRIMARY KEY,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    occurred_at TEXT NOT NULL CHECK(length(occurred_at) BETWEEN 20 AND 64),
+    source TEXT NOT NULL CHECK(length(source) BETWEEN 1 AND 64 AND source GLOB '[a-z][a-z0-9-]*'),
+    source_id TEXT CHECK(source_id IS NULL OR (length(source_id) BETWEEN 1 AND 256)),
+    title TEXT CHECK(title IS NULL OR length(title) BETWEEN 1 AND 1024),
+    body TEXT NOT NULL CHECK(length(body) BETWEEN 1 AND 65536),
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+CREATE INDEX person_notes_person_occurred ON person_notes(person_id, occurred_at DESC, id);
+CREATE INDEX person_notes_occurred ON person_notes(occurred_at, id);
+CREATE INDEX person_notes_source ON person_notes(source, occurred_at, id);
+CREATE UNIQUE INDEX person_notes_source_identity
+ON person_notes(source, source_id, person_id)
+WHERE source_id IS NOT NULL;
+
+CREATE VIRTUAL TABLE person_notes_fts USING fts5(
+    title,
+    body,
+    content='person_notes',
+    content_rowid='id',
+    tokenize='unicode61 remove_diacritics 2'
+);
+
+CREATE TRIGGER person_notes_fts_insert AFTER INSERT ON person_notes FOR EACH ROW
+BEGIN
+    INSERT INTO person_notes_fts(rowid, title, body)
+    VALUES (NEW.id, coalesce(NEW.title, ''), NEW.body);
+END;
+
+CREATE TRIGGER person_notes_immutable_update BEFORE UPDATE ON person_notes FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'person notes are append-only'); END;
+CREATE TRIGGER person_notes_immutable_delete BEFORE DELETE ON person_notes FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'person notes are append-only'); END;

package/dist/migrations/008_name_identity_trust.sql

@@ -0,0 +1,33 @@
+PRAGMA foreign_keys = ON;
+
+-- Name matching is a separate identity capability from retaining a provider's
+-- display metadata. New and unknown resource kinds fail closed until their
+-- ingester explicitly opts the resource's names into automatic identity use.
+ALTER TABLE provider_resources
+ADD COLUMN name_identity_eligible INTEGER NOT NULL DEFAULT 0
+CHECK(name_identity_eligible IN (0,1));
+
+-- Preserve the established trust contract for existing user-maintained address
+-- books, both bounded exact Google contact collections, and reviewed LinkedIn
+-- profiles. Review-only sources such as Beeper retain the fail-closed default.
+UPDATE provider_resources
+SET name_identity_eligible = 1
+WHERE provider = 'apple'
+   OR provider = 'linkedin'
+   OR (
+     provider IN ('google','google-contacts')
+     AND resource_type IN ('contacts','other-contacts')
+   );
+
+-- The policy backfill changes the identity-search surface. Publish that change
+-- exactly once; the steady-state row trigger below intentionally does not exist
+-- while the historical rows are updated.
+UPDATE local_revisions
+SET identity_revision = identity_revision + 1
+WHERE singleton = 1;
+
+CREATE TRIGGER provider_resources_name_identity_update
+AFTER UPDATE OF name_identity_eligible ON provider_resources FOR EACH ROW
+BEGIN
+  UPDATE local_revisions SET identity_revision = identity_revision + 1 WHERE singleton = 1;
+END;

package/dist/migrations/009_provider_collection_states.sql

@@ -0,0 +1,23 @@
+PRAGMA foreign_keys = ON;
+
+-- A complete provider collection is fetched before its import transaction.
+-- Retain the exact materialized projection and observation time so an older
+-- fetch cannot overwrite newer local state after waiting for the writer lock.
+CREATE TABLE provider_collection_states (
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    collection_key TEXT NOT NULL CHECK(length(collection_key) BETWEEN 1 AND 64),
+    state_observed_at TEXT NOT NULL,
+    materialized_source_sha256 TEXT NOT NULL CHECK(
+      length(materialized_source_sha256) = 64
+      AND materialized_source_sha256 NOT GLOB '*[^0-9a-f]*'
+    ),
+    PRIMARY KEY(provider, account_key, collection_key),
+    FOREIGN KEY(provider, account_key)
+      REFERENCES provider_accounts(provider, account_key) ON DELETE RESTRICT
+) STRICT;
+
+-- Legacy mutable state cannot be reconstructed from the newest immutable run:
+-- an exact cached A -> B -> A replay intentionally reuses A's older run. Leave
+-- upgraded realms unbound until one strictly newer live collection observation
+-- establishes the exact current projection.

package/dist/migrations/010_source_execution_receipts.sql

@@ -0,0 +1,51 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE source_execution_receipts (
+    id INTEGER PRIMARY KEY,
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    capability TEXT NOT NULL CHECK(length(capability) BETWEEN 1 AND 64),
+    operation TEXT NOT NULL CHECK(length(operation) BETWEEN 1 AND 128),
+    transport TEXT NOT NULL CHECK(length(transport) BETWEEN 1 AND 64),
+    implementation_id TEXT NOT NULL CHECK(length(implementation_id) BETWEEN 1 AND 128),
+    implementation_version TEXT CHECK(implementation_version IS NULL OR length(implementation_version) BETWEEN 1 AND 64),
+    implementation_sha256 TEXT CHECK(
+      implementation_sha256 IS NULL OR (
+        length(implementation_sha256) = 64
+        AND implementation_sha256 NOT GLOB '*[^0-9a-f]*'
+      )
+    ),
+    contract_sha256 TEXT CHECK(
+      contract_sha256 IS NULL OR (
+        length(contract_sha256) = 64
+        AND contract_sha256 NOT GLOB '*[^0-9a-f]*'
+      )
+    ),
+    external_run_id_sha256 TEXT NOT NULL CHECK(
+      length(external_run_id_sha256) = 64
+      AND external_run_id_sha256 NOT GLOB '*[^0-9a-f]*'
+    ),
+    input_sha256 TEXT NOT NULL CHECK(
+      length(input_sha256) = 64
+      AND input_sha256 NOT GLOB '*[^0-9a-f]*'
+    ),
+    outcome TEXT NOT NULL CHECK(outcome IN ('succeeded','failed','indeterminate')),
+    usage_json TEXT NOT NULL CHECK(json_valid(usage_json)),
+    cost_json TEXT NOT NULL CHECK(json_valid(cost_json)),
+    metadata_json TEXT NOT NULL CHECK(json_valid(metadata_json)),
+    started_at TEXT NOT NULL,
+    completed_at TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(provider, account_key, operation, external_run_id_sha256)
+) STRICT;
+
+CREATE INDEX source_execution_receipts_account
+ON source_execution_receipts(provider, account_key, capability, created_at, id);
+
+CREATE TRIGGER source_execution_receipts_immutable_update
+BEFORE UPDATE ON source_execution_receipts FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source execution receipts are immutable'); END;
+
+CREATE TRIGGER source_execution_receipts_immutable_delete
+BEFORE DELETE ON source_execution_receipts FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source execution receipts are immutable'); END;

package/dist/migrations/011_source_account_convergence.sql

@@ -0,0 +1,125 @@
+PRAGMA foreign_keys = ON;
+
+-- Live provider accounts converge on the same authorization-binding and
+-- account-realm graph used by Beeper. The legacy provider_accounts table is
+-- retained as immutable compatibility evidence for one release.
+DROP TRIGGER provider_checkpoint_run_update;
+CREATE TRIGGER provider_checkpoint_run_update
+BEFORE UPDATE OF provider,account_key,stream_key,last_run_id ON provider_checkpoints
+FOR EACH ROW
+BEGIN
+    SELECT CASE WHEN NEW.provider <> OLD.provider OR NEW.account_key <> OLD.account_key OR NEW.stream_key <> OLD.stream_key
+        THEN RAISE(ABORT, 'checkpoint identity is immutable') END;
+    SELECT CASE WHEN NEW.last_run_id <= OLD.last_run_id
+        THEN RAISE(ABORT, 'checkpoint run must advance') END;
+    SELECT CASE WHEN NOT EXISTS (
+        SELECT 1 FROM source_runs run
+        WHERE run.id = NEW.last_run_id AND run.provider = NEW.provider AND run.account_key = NEW.account_key
+    ) THEN RAISE(ABORT, 'checkpoint run realm mismatch') END;
+END;
+
+ALTER TABLE provider_checkpoints
+ADD COLUMN source_realm_id INTEGER REFERENCES source_realms(id) ON DELETE RESTRICT;
+CREATE INDEX provider_checkpoints_realm
+ON provider_checkpoints(source_realm_id, stream_key);
+
+ALTER TABLE provider_collection_states
+ADD COLUMN source_realm_id INTEGER REFERENCES source_realms(id) ON DELETE RESTRICT;
+CREATE INDEX provider_collection_states_realm
+ON provider_collection_states(source_realm_id, collection_key);
+
+CREATE TABLE source_account_convergence (
+    provider TEXT NOT NULL CHECK(length(provider) BETWEEN 1 AND 64),
+    account_key TEXT NOT NULL COLLATE NOCASE CHECK(length(account_key) BETWEEN 1 AND 256),
+    source_realm_id INTEGER NOT NULL REFERENCES source_realms(id) ON DELETE RESTRICT,
+    migrated_at TEXT NOT NULL,
+    evidence_sha256 TEXT NOT NULL CHECK(
+      length(evidence_sha256) = 64
+      AND evidence_sha256 NOT GLOB '*[^0-9a-f]*'
+    ),
+    PRIMARY KEY(provider, account_key),
+    UNIQUE(source_realm_id)
+) STRICT;
+
+CREATE TRIGGER provider_resources_realm_insert
+BEFORE INSERT ON provider_resources
+WHEN NEW.source_realm_id IS NOT NULL
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM source_realms realm
+    WHERE realm.id=NEW.source_realm_id
+      AND realm.authority=NEW.provider
+      AND realm.account_key=NEW.account_key
+  ) THEN RAISE(ABORT, 'provider resource realm mismatch') END;
+END;
+
+CREATE TRIGGER provider_resources_realm_update
+BEFORE UPDATE OF source_realm_id,provider,account_key ON provider_resources
+BEGIN
+  SELECT CASE WHEN OLD.source_realm_id IS NOT NULL AND NEW.source_realm_id IS NULL
+    THEN RAISE(ABORT, 'provider resource realm cannot be detached') END;
+  SELECT CASE WHEN NEW.source_realm_id IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM source_realms realm
+    WHERE realm.id=NEW.source_realm_id
+      AND realm.authority=NEW.provider
+      AND realm.account_key=NEW.account_key
+  ) THEN RAISE(ABORT, 'provider resource realm mismatch') END;
+END;
+
+CREATE TRIGGER provider_checkpoints_realm_insert
+BEFORE INSERT ON provider_checkpoints
+WHEN NEW.source_realm_id IS NOT NULL
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM source_realms realm
+    WHERE realm.id=NEW.source_realm_id
+      AND realm.authority=NEW.provider
+      AND realm.account_key=NEW.account_key
+  ) THEN RAISE(ABORT, 'provider checkpoint realm mismatch') END;
+END;
+
+CREATE TRIGGER provider_checkpoints_realm_update
+BEFORE UPDATE OF source_realm_id,provider,account_key ON provider_checkpoints
+BEGIN
+  SELECT CASE WHEN OLD.source_realm_id IS NOT NULL AND NEW.source_realm_id IS NULL
+    THEN RAISE(ABORT, 'provider checkpoint realm cannot be detached') END;
+  SELECT CASE WHEN NEW.source_realm_id IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM source_realms realm
+    WHERE realm.id=NEW.source_realm_id
+      AND realm.authority=NEW.provider
+      AND realm.account_key=NEW.account_key
+  ) THEN RAISE(ABORT, 'provider checkpoint realm mismatch') END;
+END;
+
+CREATE TRIGGER provider_collection_states_realm_insert
+BEFORE INSERT ON provider_collection_states
+WHEN NEW.source_realm_id IS NOT NULL
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1 FROM source_realms realm
+    WHERE realm.id=NEW.source_realm_id
+      AND realm.authority=NEW.provider
+      AND realm.account_key=NEW.account_key
+  ) THEN RAISE(ABORT, 'provider collection realm mismatch') END;
+END;
+
+CREATE TRIGGER provider_collection_states_realm_update
+BEFORE UPDATE OF source_realm_id,provider,account_key ON provider_collection_states
+BEGIN
+  SELECT CASE WHEN OLD.source_realm_id IS NOT NULL AND NEW.source_realm_id IS NULL
+    THEN RAISE(ABORT, 'provider collection realm cannot be detached') END;
+  SELECT CASE WHEN NEW.source_realm_id IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM source_realms realm
+    WHERE realm.id=NEW.source_realm_id
+      AND realm.authority=NEW.provider
+      AND realm.account_key=NEW.account_key
+  ) THEN RAISE(ABORT, 'provider collection realm mismatch') END;
+END;
+
+CREATE TRIGGER source_account_convergence_immutable_update
+BEFORE UPDATE ON source_account_convergence FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source account convergence evidence is immutable'); END;
+
+CREATE TRIGGER source_account_convergence_immutable_delete
+BEFORE DELETE ON source_account_convergence FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source account convergence evidence is immutable'); END;