@hraness/peopleblade 0.3.6 → 0.4.0

package/dist/migrations/018_exposure.sql

@@ -0,0 +1,88 @@
+PRAGMA foreign_keys = ON;
+
+-- The exposure domain is quarantined, owner-run evidence: consent events are
+-- append-only, scans and findings are immutable once recorded, and nothing in
+-- these tables may create contact methods, provider resources, or identity
+-- evidence. Findings store attribute classes and salted digests only, never
+-- raw exposed values or credential material.
+CREATE TABLE exposure_consents (
+    id INTEGER PRIMARY KEY,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    action TEXT NOT NULL CHECK(action IN ('grant','revoke')),
+    scope TEXT NOT NULL CHECK(scope IN ('self','contact')),
+    channel TEXT NOT NULL CHECK(length(channel) BETWEEN 1 AND 128),
+    note TEXT CHECK(note IS NULL OR length(note) BETWEEN 1 AND 4096),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+CREATE INDEX exposure_consents_person ON exposure_consents(person_id, id);
+
+CREATE TABLE exposure_scans (
+    id INTEGER PRIMARY KEY,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    tool TEXT NOT NULL CHECK(length(tool) BETWEEN 1 AND 64),
+    contract TEXT NOT NULL CHECK(length(contract) BETWEEN 1 AND 64),
+    artifact_sha256 TEXT CHECK(artifact_sha256 IS NULL OR (length(artifact_sha256) = 64 AND artifact_sha256 NOT GLOB '*[^0-9a-f]*')),
+    subject_input_sha256 TEXT NOT NULL CHECK(length(subject_input_sha256) = 64 AND subject_input_sha256 NOT GLOB '*[^0-9a-f]*'),
+    observed_at TEXT NOT NULL,
+    stats_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(stats_json)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(person_id, tool, artifact_sha256)
+) STRICT;
+CREATE INDEX exposure_scans_person ON exposure_scans(person_id, id);
+
+CREATE TABLE exposure_findings (
+    id INTEGER PRIMARY KEY,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    scan_id INTEGER REFERENCES exposure_scans(id) ON DELETE RESTRICT,
+    category TEXT NOT NULL CHECK(category IN (
+      'breach','data-broker','account-existence','court-record','property-record',
+      'voter-record','financial-disclosure','professional-license','face-index','web-presence'
+    )),
+    presence TEXT NOT NULL CHECK(presence IN ('found','absent','unknown')),
+    attribute_classes_json TEXT NOT NULL DEFAULT '[]'
+      CHECK(json_valid(attribute_classes_json) AND json_type(attribute_classes_json) = 'array'),
+    source TEXT NOT NULL CHECK(length(source) BETWEEN 1 AND 128),
+    binding_kind TEXT NOT NULL CHECK(binding_kind IN (
+      'exact-email','exact-phone','exact-handle','exact-profile-url','name-plus-attribute','unbound'
+    )),
+    binding_value_sha256 TEXT CHECK(binding_value_sha256 IS NULL OR (length(binding_value_sha256) = 64 AND binding_value_sha256 NOT GLOB '*[^0-9a-f]*')),
+    citation_json TEXT NOT NULL CHECK(json_valid(citation_json)),
+    confidence TEXT NOT NULL CHECK(confidence IN ('confirmed','candidate')),
+    severity TEXT NOT NULL CHECK(severity IN ('high','medium','low')),
+    observed_at TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK(
+      (binding_kind = 'unbound' AND binding_value_sha256 IS NULL)
+      OR (binding_kind <> 'unbound' AND binding_value_sha256 IS NOT NULL)
+    )
+) STRICT;
+CREATE INDEX exposure_findings_person ON exposure_findings(person_id, category, severity);
+CREATE INDEX exposure_findings_scan ON exposure_findings(scan_id);
+
+CREATE TABLE exposure_remediations (
+    id INTEGER PRIMARY KEY,
+    finding_id INTEGER NOT NULL REFERENCES exposure_findings(id) ON DELETE RESTRICT,
+    action TEXT NOT NULL CHECK(action IN ('opt-out-submitted','verified-removed','relisted','dismissed','not-applicable')),
+    channel TEXT CHECK(channel IS NULL OR length(channel) BETWEEN 1 AND 128),
+    note TEXT CHECK(note IS NULL OR length(note) BETWEEN 1 AND 4096),
+    occurred_at TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+CREATE INDEX exposure_remediations_finding ON exposure_remediations(finding_id, occurred_at, id);
+
+CREATE TRIGGER exposure_consents_immutable_update BEFORE UPDATE ON exposure_consents FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure consents are immutable'); END;
+CREATE TRIGGER exposure_consents_immutable_delete BEFORE DELETE ON exposure_consents FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure consents are immutable'); END;
+CREATE TRIGGER exposure_scans_immutable_update BEFORE UPDATE ON exposure_scans FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure scans are immutable'); END;
+CREATE TRIGGER exposure_scans_immutable_delete BEFORE DELETE ON exposure_scans FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure scans are immutable'); END;
+CREATE TRIGGER exposure_findings_immutable_update BEFORE UPDATE ON exposure_findings FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure findings are immutable'); END;
+CREATE TRIGGER exposure_findings_immutable_delete BEFORE DELETE ON exposure_findings FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure findings are immutable'); END;
+CREATE TRIGGER exposure_remediations_immutable_update BEFORE UPDATE ON exposure_remediations FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure remediations are immutable'); END;
+CREATE TRIGGER exposure_remediations_immutable_delete BEFORE DELETE ON exposure_remediations FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure remediations are immutable'); END;

package/dist/migrations/019_exposure_attestations.sql

@@ -0,0 +1,44 @@
+PRAGMA foreign_keys = ON;
+
+-- Signed aggregate-only exposure attestations. 'issued' rows are packets this
+-- database produced to hand a contact; 'received' rows are verified peer
+-- packets. person_id is NULL on a received packet whose salted identifier
+-- digests match no stored person (or match ambiguously). The packet body is
+-- immutable evidence; only the lifecycle status and the first-seen key_changed
+-- flag may update. Packet contents carry digests and aggregate counts only,
+-- never raw identifiers.
+CREATE TABLE exposure_attestations (
+    id INTEGER PRIMARY KEY,
+    direction TEXT NOT NULL CHECK(direction IN ('issued','received')),
+    person_id INTEGER REFERENCES people(id) ON DELETE RESTRICT,
+    attester_public_key TEXT NOT NULL CHECK(length(attester_public_key) BETWEEN 40 AND 256),
+    packet_sha256 TEXT NOT NULL CHECK(length(packet_sha256) = 64 AND packet_sha256 NOT GLOB '*[^0-9a-f]*'),
+    packet_json TEXT NOT NULL CHECK(json_valid(packet_json)),
+    issued_at TEXT NOT NULL,
+    status TEXT NOT NULL CHECK(status IN ('current','superseded')),
+    key_changed INTEGER NOT NULL DEFAULT 0 CHECK(key_changed IN (0,1)),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(direction, packet_sha256)
+) STRICT;
+CREATE INDEX exposure_attestations_person ON exposure_attestations(person_id, direction, status, issued_at);
+
+-- The packet is immutable evidence: only the lifecycle status may transition.
+CREATE TRIGGER exposure_attestations_immutable_update BEFORE UPDATE ON exposure_attestations
+FOR EACH ROW WHEN
+    NEW.direction <> OLD.direction
+    OR NEW.person_id IS NOT OLD.person_id
+    OR NEW.attester_public_key <> OLD.attester_public_key
+    OR NEW.packet_sha256 <> OLD.packet_sha256
+    OR NEW.packet_json <> OLD.packet_json
+    OR NEW.issued_at <> OLD.issued_at
+    OR NEW.key_changed <> OLD.key_changed
+    OR NEW.created_at <> OLD.created_at
+BEGIN SELECT RAISE(ABORT, 'exposure attestation packets are immutable'); END;
+CREATE TRIGGER exposure_attestations_immutable_delete BEFORE DELETE ON exposure_attestations FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure attestations are immutable'); END;
+
+-- The local Ed25519 attestation identity (JWK {kty,crv,x,d}). Populated lazily
+-- on the first `exposure attest`; the private component never leaves this
+-- database.
+ALTER TABLE local_state ADD COLUMN exposure_attestation_key TEXT
+    CHECK(exposure_attestation_key IS NULL OR json_valid(exposure_attestation_key));

package/dist/migrations/020_exposure_attestation_sends.sql

@@ -0,0 +1,46 @@
+PRAGMA foreign_keys = ON;
+
+-- Delivery ledger for signed exposure attestation packets sent through
+-- Ghostget's scoped messaging-automation host. One row is one dispatch
+-- attempt: identity fields (attestation, recipient, provider, route digest,
+-- intent) are immutable; the host journal ids, run state, and reason update
+-- as the delivery settles or is reconciled. Raw routes and packet contents
+-- are never stored — only digests and host journal ids.
+CREATE TABLE exposure_attestation_sends (
+    id INTEGER PRIMARY KEY,
+    attestation_id INTEGER NOT NULL REFERENCES exposure_attestations(id) ON DELETE RESTRICT,
+    person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT,
+    provider TEXT NOT NULL CHECK(provider IN ('imessage','whatsapp')),
+    coordinate_sha256 TEXT NOT NULL CHECK(length(coordinate_sha256) = 64 AND coordinate_sha256 NOT GLOB '*[^0-9a-f]*'),
+    auth_id TEXT NOT NULL CHECK(length(auth_id) BETWEEN 1 AND 128),
+    intent_id TEXT NOT NULL UNIQUE,
+    attempt INTEGER NOT NULL CHECK(attempt >= 1),
+    enrollment_id TEXT,
+    grant_id TEXT,
+    plan_id TEXT,
+    run_id TEXT,
+    state TEXT NOT NULL CHECK(state IN ('prepared','started','accepted','failed','partial','indeterminate')),
+    reason TEXT,
+    message_id TEXT,
+    provider_receipt_id TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+CREATE INDEX exposure_attestation_sends_attestation ON exposure_attestation_sends(attestation_id, state, created_at);
+CREATE INDEX exposure_attestation_sends_person ON exposure_attestation_sends(person_id, state, created_at);
+
+-- Identity fields are immutable evidence; only journal ids, run state,
+-- reason, delivery ids, and the update timestamp may change.
+CREATE TRIGGER exposure_attestation_sends_immutable_update BEFORE UPDATE ON exposure_attestation_sends
+FOR EACH ROW WHEN
+    NEW.attestation_id <> OLD.attestation_id
+    OR NEW.person_id <> OLD.person_id
+    OR NEW.provider <> OLD.provider
+    OR NEW.coordinate_sha256 <> OLD.coordinate_sha256
+    OR NEW.auth_id <> OLD.auth_id
+    OR NEW.intent_id <> OLD.intent_id
+    OR NEW.attempt <> OLD.attempt
+    OR NEW.created_at <> OLD.created_at
+BEGIN SELECT RAISE(ABORT, 'exposure attestation send identity is immutable'); END;
+CREATE TRIGGER exposure_attestation_sends_immutable_delete BEFORE DELETE ON exposure_attestation_sends FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'exposure attestation sends are immutable'); END;

package/dist/migrations/021_identity_component_projection.sql

@@ -0,0 +1,212 @@
+PRAGMA foreign_keys = ON;
+
+CREATE VIEW person_identity_components_computed AS
+WITH RECURSIVE
+accepted(left_person_id, right_person_id) AS (
+  SELECT left_person_id, right_person_id
+  FROM identity_current_decisions
+  WHERE action = 'accept'
+),
+reach(person_id, member_id) AS (
+  SELECT id, id FROM people
+  UNION
+  SELECT reach.person_id,
+    CASE WHEN accepted.left_person_id = reach.member_id
+      THEN accepted.right_person_id ELSE accepted.left_person_id END
+  FROM reach
+  JOIN accepted
+    ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+),
+raw_components(person_id, raw_canonical_person_id) AS (
+  SELECT person_id, min(member_id)
+  FROM reach
+  GROUP BY person_id
+),
+observed_targets(raw_canonical_person_id, target_person_id, decision_id) AS (
+  SELECT target.raw_canonical_person_id,
+    CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER),
+    decision.id
+  FROM identity_decisions decision
+  JOIN raw_components target ON target.person_id = CAST(
+    json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER
+  )
+  WHERE decision.action = 'accept'
+    AND json_extract(decision.evidence_json, '$.version') = 2
+    AND json_extract(decision.evidence_json, '$.kind') IN ('observed-email','observed-phone')
+),
+component_ids(raw_canonical_person_id) AS (
+  SELECT DISTINCT raw_canonical_person_id FROM raw_components
+),
+component_representatives(raw_canonical_person_id, canonical_person_id) AS (
+  SELECT component.raw_canonical_person_id,
+    coalesce((
+      SELECT target.target_person_id
+      FROM observed_targets target
+      WHERE target.raw_canonical_person_id = component.raw_canonical_person_id
+      ORDER BY target.decision_id
+      LIMIT 1
+    ), component.raw_canonical_person_id)
+  FROM component_ids component
+)
+SELECT raw.person_id, representative.canonical_person_id
+FROM raw_components raw
+JOIN component_representatives representative
+  ON representative.raw_canonical_person_id = raw.raw_canonical_person_id;
+
+CREATE TABLE identity_component_members(
+  person_id INTEGER PRIMARY KEY REFERENCES people(id) ON DELETE CASCADE,
+  canonical_person_id INTEGER NOT NULL REFERENCES people(id) ON DELETE RESTRICT
+) STRICT;
+
+CREATE INDEX identity_component_members_canonical
+ON identity_component_members(canonical_person_id, person_id);
+
+CREATE TABLE identity_component_refresh_state(
+  canonical_person_id INTEGER PRIMARY KEY REFERENCES people(id) ON DELETE CASCADE
+) STRICT;
+
+INSERT INTO identity_component_members(person_id, canonical_person_id)
+SELECT person_id, canonical_person_id FROM person_identity_components_computed;
+
+DROP VIEW person_identity_components;
+
+CREATE VIEW person_identity_components AS
+SELECT person_id, canonical_person_id FROM identity_component_members;
+
+CREATE TRIGGER identity_component_member_after_person_insert
+AFTER INSERT ON people FOR EACH ROW
+BEGIN
+  INSERT INTO identity_component_members(person_id, canonical_person_id)
+  VALUES (NEW.id, NEW.id);
+END;
+
+CREATE TRIGGER identity_component_members_after_accept
+AFTER INSERT ON identity_decisions FOR EACH ROW
+WHEN NEW.action = 'accept'
+BEGIN
+  DELETE FROM identity_component_refresh_state;
+  INSERT INTO identity_component_refresh_state(canonical_person_id)
+  SELECT canonical_person_id FROM identity_component_members
+  WHERE person_id IN (NEW.left_person_id, NEW.right_person_id)
+  ON CONFLICT DO NOTHING;
+  UPDATE identity_component_members
+  SET canonical_person_id = coalesce((
+    SELECT CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER)
+    FROM identity_decisions decision
+    JOIN identity_component_members target
+      ON target.person_id = CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER)
+    JOIN identity_component_refresh_state state
+      ON state.canonical_person_id = target.canonical_person_id
+    WHERE decision.action = 'accept'
+      AND json_extract(decision.evidence_json, '$.version') = 2
+      AND json_extract(decision.evidence_json, '$.kind') IN ('observed-email','observed-phone')
+    ORDER BY decision.id
+    LIMIT 1
+  ), (
+    SELECT min(member.person_id)
+    FROM identity_component_members member
+    JOIN identity_component_refresh_state state
+      ON state.canonical_person_id = member.canonical_person_id
+  ))
+  WHERE canonical_person_id IN (
+    SELECT canonical_person_id FROM identity_component_refresh_state
+  );
+  DELETE FROM identity_component_refresh_state;
+END;
+
+CREATE TRIGGER identity_component_members_after_separate
+AFTER INSERT ON identity_decisions FOR EACH ROW
+WHEN NEW.action = 'separate'
+BEGIN
+  UPDATE identity_component_members
+  SET canonical_person_id = coalesce((
+    SELECT CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER)
+    FROM identity_decisions decision
+    WHERE decision.action = 'accept'
+      AND json_extract(decision.evidence_json, '$.version') = 2
+      AND json_extract(decision.evidence_json, '$.kind') IN ('observed-email','observed-phone')
+      AND CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER) IN (
+        WITH RECURSIVE accepted(left_person_id, right_person_id) AS (
+          SELECT left_person_id, right_person_id FROM identity_current_decisions WHERE action = 'accept'
+        ), reach(member_id) AS (
+          SELECT NEW.left_person_id
+          UNION
+          SELECT CASE WHEN accepted.left_person_id = reach.member_id
+            THEN accepted.right_person_id ELSE accepted.left_person_id END
+          FROM reach JOIN accepted
+            ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+        ) SELECT member_id FROM reach
+      )
+    ORDER BY decision.id
+    LIMIT 1
+  ), (
+    WITH RECURSIVE accepted(left_person_id, right_person_id) AS (
+      SELECT left_person_id, right_person_id FROM identity_current_decisions WHERE action = 'accept'
+    ), reach(member_id) AS (
+      SELECT NEW.left_person_id
+      UNION
+      SELECT CASE WHEN accepted.left_person_id = reach.member_id
+        THEN accepted.right_person_id ELSE accepted.left_person_id END
+      FROM reach JOIN accepted
+        ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+    ) SELECT min(member_id) FROM reach
+  ))
+  WHERE person_id IN (
+    WITH RECURSIVE accepted(left_person_id, right_person_id) AS (
+      SELECT left_person_id, right_person_id FROM identity_current_decisions WHERE action = 'accept'
+    ), reach(member_id) AS (
+      SELECT NEW.left_person_id
+      UNION
+      SELECT CASE WHEN accepted.left_person_id = reach.member_id
+        THEN accepted.right_person_id ELSE accepted.left_person_id END
+      FROM reach JOIN accepted
+        ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+    ) SELECT member_id FROM reach
+  );
+
+  UPDATE identity_component_members
+  SET canonical_person_id = coalesce((
+    SELECT CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER)
+    FROM identity_decisions decision
+    WHERE decision.action = 'accept'
+      AND json_extract(decision.evidence_json, '$.version') = 2
+      AND json_extract(decision.evidence_json, '$.kind') IN ('observed-email','observed-phone')
+      AND CAST(json_extract(decision.evidence_json, '$.reviewedTarget.anchorPersonId') AS INTEGER) IN (
+        WITH RECURSIVE accepted(left_person_id, right_person_id) AS (
+          SELECT left_person_id, right_person_id FROM identity_current_decisions WHERE action = 'accept'
+        ), reach(member_id) AS (
+          SELECT NEW.right_person_id
+          UNION
+          SELECT CASE WHEN accepted.left_person_id = reach.member_id
+            THEN accepted.right_person_id ELSE accepted.left_person_id END
+          FROM reach JOIN accepted
+            ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+        ) SELECT member_id FROM reach
+      )
+    ORDER BY decision.id
+    LIMIT 1
+  ), (
+    WITH RECURSIVE accepted(left_person_id, right_person_id) AS (
+      SELECT left_person_id, right_person_id FROM identity_current_decisions WHERE action = 'accept'
+    ), reach(member_id) AS (
+      SELECT NEW.right_person_id
+      UNION
+      SELECT CASE WHEN accepted.left_person_id = reach.member_id
+        THEN accepted.right_person_id ELSE accepted.left_person_id END
+      FROM reach JOIN accepted
+        ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+    ) SELECT min(member_id) FROM reach
+  ))
+  WHERE person_id IN (
+    WITH RECURSIVE accepted(left_person_id, right_person_id) AS (
+      SELECT left_person_id, right_person_id FROM identity_current_decisions WHERE action = 'accept'
+    ), reach(member_id) AS (
+      SELECT NEW.right_person_id
+      UNION
+      SELECT CASE WHEN accepted.left_person_id = reach.member_id
+        THEN accepted.right_person_id ELSE accepted.left_person_id END
+      FROM reach JOIN accepted
+        ON accepted.left_person_id = reach.member_id OR accepted.right_person_id = reach.member_id
+    ) SELECT member_id FROM reach
+  );
+END;