-- Scoped credential for externally managed certificate deployment. The cleartext
-- token is never persisted; only a SHA-256 digest and non-secret key id are stored.
CREATE TABLE IF NOT EXISTS certificate_api_credential (
    id INTEGER PRIMARY KEY CHECK (id = 1),
    key_id TEXT NOT NULL UNIQUE CHECK (length(key_id) BETWEEN 3 AND 64),
    token_hash TEXT NOT NULL CHECK (length(token_hash) = 64),
    created_at INTEGER NOT NULL,
    last_used_at INTEGER
);