@rotorsoft/act-sqlite 1.4.1 → 1.5.0

package/dist/@types/sqlite-store.d.ts

@@ -1,4 +1,5 @@
 import type { BlockedLease, Committed, EventMeta, Lease, Message, Query, QueryStatsOptions, QueryStreams, QueryStreamsResult, Schemas, Store, StreamFilter, StreamPosition, StreamStats } from "@rotorsoft/act";
+import { type Encryption } from "@rotorsoft/act-crypto";
 /**
  * SQLite store configuration
  */
@@ -7,6 +8,33 @@ export interface SqliteConfig {
     url: string;
     /** Auth token for libSQL server connections (optional) */
     authToken?: string;
+    /**
+     * Adapter-layer envelope encryption for the `events.pii` column.
+     * Optional — when present, every non-null PII payload is encrypted
+     * before INSERT and decrypted on every read; when absent, the
+     * column is stored and read as plaintext (the framework's default
+     * behavior).
+     *
+     * Cipher and wire format come from `@rotorsoft/act-crypto`:
+     * AES-256-GCM with a versioned base64-framed envelope. The TEXT
+     * column stores `JSON.stringify(...)`-ed values either way, so
+     * encrypted writes land as a JSON-stringified base64 string and
+     * plaintext writes as a JSON-stringified object. The read path
+     * discriminates by `typeof` after `JSON.parse` — strings get
+     * decrypted, objects pass through — which makes mixed-data
+     * rollouts transparent.
+     *
+     * `forget_pii` semantics are unchanged: the column is set to
+     * `NULL` regardless of whether the prior value was plaintext or
+     * ciphertext.
+     *
+     * Encryption at rest at the **storage** layer (SQLite SEE, an
+     * encrypted volume, OS-level FDE) composes orthogonally with
+     * adapter-layer encryption. See
+     * `docs/docs/guides/pii-encryption-at-rest.md` for the decision
+     * matrix.
+     */
+    pii_encryption?: Encryption;
 }
 /** Translate a stream filter (regex-shaped or plain substring) into a
  *  SQL LIKE pattern. Honors `^` / `$` anchors and converts `.*` → `%`,
@@ -49,7 +77,34 @@ export declare function streamPatternToLike(input: string): string;
  */
 export declare class SqliteStore implements Store {
     private client;
+    /**
+     * Memoized key resolver for the optional `pii_encryption` envelope.
+     * Initialized in the constructor when encryption is configured;
+     * `undefined` otherwise. The resolver caches the operator's key on
+     * first use — rotation means restarting the store with a fresh
+     * provider.
+     */
+    private readonly _resolve_pii_key;
     constructor(config?: Partial<SqliteConfig>);
+    /**
+     * Write-side pii encoder: encrypts when `pii_encryption` is configured,
+     * stringifies for the TEXT column either way. `null` passes through so
+     * `forget_pii` semantics survive intact (the row format skips the
+     * column entirely on a `NULL` write).
+     *
+     * @internal
+     */
+    private _stringify_pii_for_write;
+    /**
+     * Read-side pii decoder: parses the TEXT column, and when
+     * `pii_encryption` is configured, transparently decrypts any value
+     * that came back as a JSON string. Plaintext writes deserialize to
+     * objects and pass through — which is what makes mixed-data
+     * rollouts (some pre-encryption rows, some post-) read cleanly.
+     *
+     * @internal
+     */
+    private _parse_pii_from_read;
     seed(): Promise<void>;
     drop(): Promise<void>;
     dispose(): Promise<void>;
@@ -133,5 +188,23 @@ export declare class SqliteStore implements Store {
      * from the source.
      */
     restore(driver: (callback: (event: Committed<Schemas, keyof Schemas>) => Promise<number>) => Promise<void>): Promise<void>;
+    /**
+     * Wipe the sensitive-data payload for every event on the stream — the
+     * physical-erasure side of the sensitive-data epic (#566). Sets
+     * `events.pii` to `NULL` for the stream's events; `events.data` and
+     * the rest of the row are never touched.
+     *
+     * Single `UPDATE` under SQLite's writer lock, bounded by events-per-
+     * stream. Idempotent — the `pii IS NOT NULL` predicate filters out
+     * already-wiped rows so a second call returns `0`.
+     *
+     * SQLite doesn't auto-reclaim space; freed pages stay in the file
+     * until an operator-scheduled `PRAGMA incremental_vacuum` or a full
+     * `VACUUM`. The production checklist documents the cadence.
+     *
+     * @param stream Target stream
+     * @returns Count of events whose `pii` was set to `NULL`
+     */
+    forget_pii(stream: string): Promise<number>;
 }
 //# sourceMappingURL=sqlite-store.d.ts.map

package/dist/@types/sqlite-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-store.d.ts","sourceRoot":"","sources":["../../src/sqlite-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,SAAS,EACT,KAAK,EACL,OAAO,EACP,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,OAAO,EACP,KAAK,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAExB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,WAAY,YAAW,KAAK;IACvC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM;IAQxC,IAAI;IA6DJ,IAAI;IAKJ,OAAO;IAMP,MAAM,CAAC,CAAC,SAAS,OAAO,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,EAC3B,IAAI,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IA2D7B,KAAK,CAAC,CAAC,SAAS,OAAO,EAC3B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,EAChD,KAAK,CAAC,EAAE,KAAK,GACZ,OAAO,CAAC,MAAM,CAAC;IAyEZ,SAAS,CACb,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;;;;IA4CE,KAAK,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM;IA8FT,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE;IAqBnB,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE;IAoBlC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAqChB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY;IAiCpC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY;IAqCtC,aAAa,CACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,EAC5C,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkE9B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,WAAW,CAAC,CAAC,SAAS,OAAO,EACjC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,cAAc,CAAC,EAC/D,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAkEvC;;;OAGG;YACW,uBAAuB;IA6DrC;;;;OAIG;YACW,sBAAsB;IAuH9B,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAenE,QAAQ,CACZ,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,SAAS,CAAC;KAClB,CAAC;iBAIW,MAAM;mBAAa,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;;IAyDnE;;;;;;;;;;OAUG;IACG,OAAO,CACX,MAAM,EAAE,CACN,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KACpE,OAAO,CAAC,IAAI,CAAC,GACjB,OAAO,CAAC,IAAI,CAAC;CA6BjB"}
+{"version":3,"file":"sqlite-store.d.ts","sourceRoot":"","sources":["../../src/sqlite-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,SAAS,EACT,KAAK,EACL,OAAO,EACP,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,OAAO,EACP,KAAK,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,UAAU,EAGhB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,WAAY,YAAW,KAAK;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsC;gBAE3D,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM;IAW9C;;;;;;;OAOG;YACW,wBAAwB;IAUtC;;;;;;;;OAQG;YACW,oBAAoB;IAc5B,IAAI;IAwEJ,IAAI;IAKJ,OAAO;IAMP,MAAM,CAAC,CAAC,SAAS,OAAO,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,EAC3B,IAAI,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IA8D7B,KAAK,CAAC,CAAC,SAAS,OAAO,EAC3B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,EAChD,KAAK,CAAC,EAAE,KAAK,GACZ,OAAO,CAAC,MAAM,CAAC;IA2EZ,SAAS,CACb,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;;;;IA4CE,KAAK,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM;IA8FT,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE;IAqBnB,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE;IAoBlC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAqChB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY;IAiCpC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY;IAqCtC,aAAa,CACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,EAC5C,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkE9B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,WAAW,CAAC,CAAC,SAAS,OAAO,EACjC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,cAAc,CAAC,EAC/D,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAkEvC;;;OAGG;YACW,uBAAuB;IA8DrC;;;;OAIG;YACW,sBAAsB;IA2H9B,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAenE,QAAQ,CACZ,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,SAAS,CAAC;KAClB,CAAC;iBAIW,MAAM;mBAAa,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;;IAyDnE;;;;;;;;;;OAUG;IACG,OAAO,CACX,MAAM,EAAE,CACN,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KACpE,OAAO,CAAC,IAAI,CAAC,GACjB,OAAO,CAAC,IAAI,CAAC;IAgChB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAOlD"}

package/dist/index.cjs

@@ -37,6 +37,7 @@ module.exports = __toCommonJS(index_exports);
 
 // src/sqlite-store.ts
 var import_client = require("@libsql/client");
+var import_act_crypto = require("@rotorsoft/act-crypto");
 var DEFAULT_CONFIG = {
   url: "file::memory:"
 };
@@ -52,12 +53,53 @@ function streamPatternToLike(input) {
 }
 var SqliteStore = class {
   client;
+  /**
+   * Memoized key resolver for the optional `pii_encryption` envelope.
+   * Initialized in the constructor when encryption is configured;
+   * `undefined` otherwise. The resolver caches the operator's key on
+   * first use — rotation means restarting the store with a fresh
+   * provider.
+   */
+  _resolve_pii_key;
   constructor(config = {}) {
     const cfg = { ...DEFAULT_CONFIG, ...config };
     this.client = (0, import_client.createClient)({
       url: cfg.url,
       authToken: cfg.authToken
     });
+    this._resolve_pii_key = cfg.pii_encryption ? (0, import_act_crypto.makeKeyResolver)(cfg.pii_encryption) : void 0;
+  }
+  /**
+   * Write-side pii encoder: encrypts when `pii_encryption` is configured,
+   * stringifies for the TEXT column either way. `null` passes through so
+   * `forget_pii` semantics survive intact (the row format skips the
+   * column entirely on a `NULL` write).
+   *
+   * @internal
+   */
+  async _stringify_pii_for_write(pii) {
+    if (pii == null) return null;
+    if (this._resolve_pii_key) {
+      return JSON.stringify(await (0, import_act_crypto.encrypt)(pii, this._resolve_pii_key));
+    }
+    return JSON.stringify(pii);
+  }
+  /**
+   * Read-side pii decoder: parses the TEXT column, and when
+   * `pii_encryption` is configured, transparently decrypts any value
+   * that came back as a JSON string. Plaintext writes deserialize to
+   * objects and pass through — which is what makes mixed-data
+   * rollouts (some pre-encryption rows, some post-) read cleanly.
+   *
+   * @internal
+   */
+  async _parse_pii_from_read(raw) {
+    if (raw == null) return null;
+    const parsed = JSON.parse(raw);
+    if (this._resolve_pii_key && typeof parsed === "string") {
+      return await (0, import_act_crypto.decrypt)(parsed, this._resolve_pii_key);
+    }
+    return parsed;
   }
   async seed() {
     await this.client.execute("PRAGMA journal_mode=WAL");
@@ -70,9 +112,14 @@ var SqliteStore = class {
         data TEXT NOT NULL,
         meta TEXT NOT NULL,
         created TEXT NOT NULL,
+        pii TEXT,
         UNIQUE(stream, version)
       )
     `);
+    try {
+      await this.client.execute("ALTER TABLE events ADD COLUMN pii TEXT");
+    } catch {
+    }
     await this.client.execute(
       "CREATE INDEX IF NOT EXISTS idx_events_stream ON events(stream)"
     );
@@ -141,16 +188,18 @@ var SqliteStore = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const committed = [];
       let version = current_version + 1;
-      for (const { name, data } of msgs) {
+      for (const { name, data, pii } of msgs) {
+        const pii_for_write = await this._stringify_pii_for_write(pii);
         const result = await tx.execute({
-          sql: "INSERT INTO events (stream, version, name, data, meta, created) VALUES (?, ?, ?, ?, ?, ?)",
+          sql: "INSERT INTO events (stream, version, name, data, meta, created, pii) VALUES (?, ?, ?, ?, ?, ?, ?)",
           args: [
             stream,
             version,
             name,
             JSON.stringify(data),
             JSON.stringify(meta),
-            now
+            now,
+            pii_for_write
           ]
         });
         committed.push({
@@ -160,7 +209,8 @@ var SqliteStore = class {
           created: new Date(now),
           name,
           data,
-          meta
+          meta,
+          ...pii == null ? {} : { pii }
         });
         version++;
       }
@@ -219,6 +269,7 @@ var SqliteStore = class {
     const result = await this.client.execute({ sql, args });
     let count = 0;
     for (const row of result.rows) {
+      const pii_value = await this._parse_pii_from_read(row.pii);
       await Promise.resolve(
         callback({
           id: Number(row.id),
@@ -227,7 +278,8 @@ var SqliteStore = class {
           created: new Date(row.created),
           name: row.name,
           data: JSON.parse(row.data),
-          meta: JSON.parse(row.meta)
+          meta: JSON.parse(row.meta),
+          pii: pii_value
         })
       );
       count++;
@@ -634,7 +686,7 @@ var SqliteStore = class {
    * `(stream, version)` unique index. Parallel queries when tail set.
    */
   async _query_stats_heads_only(from_clause, where_clause, args, want_tail) {
-    const cols = `e.id, e.stream, e.version, e.name, e.data, e.created, e.meta`;
+    const cols = `e.id, e.stream, e.version, e.name, e.data, e.created, e.meta, e.pii`;
     const head_sql = `SELECT * FROM (
       SELECT ${cols}, ROW_NUMBER() OVER (PARTITION BY e.stream ORDER BY e.version DESC) AS rn
       FROM ${from_clause}
@@ -649,24 +701,25 @@ var SqliteStore = class {
       this.client.execute({ sql: head_sql, args }),
       tail_sql ? this.client.execute({ sql: tail_sql, args }) : null
     ]);
-    const to_committed = (row) => ({
+    const to_committed = async (row) => ({
       id: Number(row.id),
       stream: row.stream,
       version: Number(row.version),
       name: row.name,
       data: JSON.parse(row.data),
       meta: JSON.parse(row.meta),
-      created: new Date(row.created)
+      created: new Date(row.created),
+      pii: await this._parse_pii_from_read(row.pii)
     });
     const out = /* @__PURE__ */ new Map();
     for (const row of headRes.rows) {
       out.set(row.stream, {
-        head: to_committed(row)
+        head: await to_committed(row)
       });
     }
     if (tailRes) {
       for (const row of tailRes.rows) {
-        out.get(row.stream).tail = to_committed(row);
+        out.get(row.stream).tail = await to_committed(row);
       }
     }
     return out;
@@ -684,10 +737,10 @@ var SqliteStore = class {
         )` : "";
     const tail_join = want_tail ? `LEFT JOIN tails t ON t.stream = h.stream` : "";
     const tail_cols = want_tail ? `, t.id AS t_id, t.stream AS t_stream, t.version AS t_version,
-           t.name AS t_name, t.data AS t_data, t.created AS t_created, t.meta AS t_meta` : "";
+           t.name AS t_name, t.data AS t_data, t.created AS t_created, t.meta AS t_meta, t.pii AS t_pii` : "";
     const sql = `
       WITH ef AS (
-        SELECT e.id, e.stream, e.version, e.name, e.data, e.created, e.meta
+        SELECT e.id, e.stream, e.version, e.name, e.data, e.created, e.meta, e.pii
         FROM ${from_clause}
         ${where_clause}
       ),
@@ -709,7 +762,7 @@ var SqliteStore = class {
       )
       ${tail_cte}
       SELECT
-        h.id, h.stream, h.version, h.name, h.data, h.created, h.meta,
+        h.id, h.stream, h.version, h.name, h.data, h.created, h.meta, h.pii,
         a.cnt AS agg_count,
         a.names AS agg_names
         ${tail_cols}
@@ -718,38 +771,41 @@ var SqliteStore = class {
       ${tail_join}
     `;
     const res = await this.client.execute({ sql, args });
-    const to_committed = (id, stream, version, name, data, meta, created) => ({
+    const to_committed = async (id, stream, version, name, data, meta, created, pii) => ({
       id: Number(id),
       stream,
       version: Number(version),
       name,
       data: JSON.parse(data),
       meta: JSON.parse(meta),
-      created: new Date(created)
+      created: new Date(created),
+      pii: await this._parse_pii_from_read(pii)
     });
     const out = /* @__PURE__ */ new Map();
     for (const row of res.rows) {
       const r = row;
       const stats = {
-        head: to_committed(
+        head: await to_committed(
           r.id,
           r.stream,
           r.version,
           r.name,
           r.data,
           r.meta,
-          r.created
+          r.created,
+          r.pii
         )
       };
       if (want_tail && r.t_id !== null && r.t_id !== void 0) {
-        stats.tail = to_committed(
+        stats.tail = await to_committed(
           r.t_id,
           r.t_stream,
           r.t_version,
           r.t_name,
           r.t_data,
           r.t_meta,
-          r.t_created
+          r.t_created,
+          r.t_pii
         );
       }
       if (want_count) stats.count = Number(r.agg_count);
@@ -839,15 +895,17 @@ var SqliteStore = class {
       await tx.execute("DELETE FROM streams");
       await tx.execute("DELETE FROM sqlite_sequence WHERE name = 'events'");
       await driver(async (event) => {
+        const pii_for_write = await this._stringify_pii_for_write(event.pii);
         const ins = await tx.execute({
-          sql: "INSERT INTO events (stream, version, name, data, meta, created) VALUES (?, ?, ?, ?, ?, ?)",
+          sql: "INSERT INTO events (stream, version, name, data, meta, created, pii) VALUES (?, ?, ?, ?, ?, ?, ?)",
           args: [
             event.stream,
             event.version,
             event.name,
             JSON.stringify(event.data),
             JSON.stringify(event.meta),
-            event.created.toISOString()
+            event.created.toISOString(),
+            pii_for_write
           ]
         });
         return Number(ins.lastInsertRowid);
@@ -858,6 +916,30 @@ var SqliteStore = class {
       throw error;
     }
   }
+  /**
+   * Wipe the sensitive-data payload for every event on the stream — the
+   * physical-erasure side of the sensitive-data epic (#566). Sets
+   * `events.pii` to `NULL` for the stream's events; `events.data` and
+   * the rest of the row are never touched.
+   *
+   * Single `UPDATE` under SQLite's writer lock, bounded by events-per-
+   * stream. Idempotent — the `pii IS NOT NULL` predicate filters out
+   * already-wiped rows so a second call returns `0`.
+   *
+   * SQLite doesn't auto-reclaim space; freed pages stay in the file
+   * until an operator-scheduled `PRAGMA incremental_vacuum` or a full
+   * `VACUUM`. The production checklist documents the cadence.
+   *
+   * @param stream Target stream
+   * @returns Count of events whose `pii` was set to `NULL`
+   */
+  async forget_pii(stream) {
+    const r = await this.client.execute({
+      sql: "UPDATE events SET pii = NULL WHERE stream = ? AND pii IS NOT NULL",
+      args: [stream]
+    });
+    return r.rowsAffected ?? 0;
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {