-- Multiple scoped credentials for external certificate automation. Existing
-- 0.23/0.24 singleton credentials are copied once and the legacy row is cleared
-- so this idempotent migration can run safely on every startup.
CREATE TABLE IF NOT EXISTS certificate_api_credentials (
    key_id TEXT PRIMARY KEY CHECK (length(key_id) BETWEEN 3 AND 64),
    token_hash TEXT NOT NULL CHECK (length(token_hash) = 64),
    comment TEXT NOT NULL DEFAULT '' CHECK (length(comment) <= 256),
    created_at INTEGER NOT NULL,
    last_used_at INTEGER
);

INSERT OR IGNORE INTO certificate_api_credentials(key_id, token_hash, comment, created_at, last_used_at)
SELECT key_id, token_hash, '', created_at, last_used_at
FROM certificate_api_credential;

DELETE FROM certificate_api_credential;