v0.24.9

migrations/0007_secret_store.sql

@@ -0,0 +1,13 @@
+-- Encrypted application secrets. Ciphertext is protected by the local master
+-- key stored outside SQLite. Plaintext credentials must never be persisted here.
+CREATE TABLE IF NOT EXISTS secret_store (
+    secret_id TEXT PRIMARY KEY CHECK (length(secret_id) BETWEEN 1 AND 256),
+    provider TEXT NOT NULL CHECK (length(provider) BETWEEN 1 AND 64),
+    encryption_version INTEGER NOT NULL CHECK (encryption_version > 0),
+    nonce BLOB NOT NULL CHECK (length(nonce) = 12),
+    ciphertext BLOB NOT NULL,
+    metadata TEXT NOT NULL DEFAULT '{}' CHECK (length(metadata) <= 4096),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS secret_store_provider ON secret_store(provider);