-- Stable principal mapping from OIDC issuer+subject pairs.
-- Feature package remora-identity owns this schema.

CREATE TABLE principal_identities (
    principal_id TEXT PRIMARY KEY,
    issuer TEXT NOT NULL,
    subject TEXT NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    UNIQUE (issuer, subject)
);