-- Encrypted application secrets. Ciphertext is protected by the local master
-- key stored outside SQLite. Plaintext credentials must never be persisted here.
CREATE TABLE IF NOT EXISTS secret_store (
    secret_id TEXT PRIMARY KEY CHECK (length(secret_id) BETWEEN 1 AND 256),
    provider TEXT NOT NULL CHECK (length(provider) BETWEEN 1 AND 64),
    encryption_version INTEGER NOT NULL CHECK (encryption_version > 0),
    nonce BLOB NOT NULL CHECK (length(nonce) = 12),
    ciphertext BLOB NOT NULL,
    metadata TEXT NOT NULL DEFAULT '{}' CHECK (length(metadata) <= 4096),
    created_at INTEGER NOT NULL,
    updated_at INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS secret_store_provider ON secret_store(provider);