-- +brant Up

-- Agent issuance moved to tokens.sr.ht, so spec.sr.ht stops holding a
-- credential of its own.
--
-- agent_token was one instance-wide shared secret with no owner, no expiry and
-- no grants: every agent on the instance presented the same string, and the only
-- boundary around it was the refs rule (an agent credential may only move refs
-- under proposals/*). That rule is untouched and still the boundary that
-- matters; what changes is that the credential is now per-agent, owned, expiring
-- and grant-carrying, and is verified by signature rather than by a lookup here.
--
-- DEPLOY GATE: applying this locks out every agent still configured with the
-- shared secret, over HTTP and over `git push` alike. Every one of them must
-- hold a tokens.sr.ht working token *before* this migration runs.
--
-- The rows are dropped with the table and the Down below cannot bring them back:
-- only sha256 hashes were ever stored, and nothing derives a token from its
-- hash. A rollback therefore restores the shape of the old plane and none of its
-- credentials, which have to be re-issued.
DROP TABLE agent_token;

-- +brant Down
CREATE TABLE agent_token (
	id            SERIAL PRIMARY KEY,
	name          TEXT NOT NULL,
	token_hash    BYTEA NOT NULL UNIQUE,
	created       TIMESTAMPTZ NOT NULL DEFAULT now(),
	revoked       TIMESTAMPTZ
);