v0.24.5

migrations/0005_certificate_api.sql

@@ -0,0 +1,9 @@
+-- Scoped credential for externally managed certificate deployment. The cleartext
+-- token is never persisted; only a SHA-256 digest and non-secret key id are stored.
+CREATE TABLE IF NOT EXISTS certificate_api_credential (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    key_id TEXT NOT NULL UNIQUE CHECK (length(key_id) BETWEEN 3 AND 64),
+    token_hash TEXT NOT NULL CHECK (length(token_hash) = 64),
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER
+);