-- Agent grants (oxygenhub#241, keyless step 5): an account lets an agent

-- act for it. `grant` is the Oxygen grant its owner's key signed (spec

-- §14.7), which every certificate issued under it carries; the agent

-- holds only the token, which it exchanges for ten-minute certificates

-- and which signs nothing itself. Revoking stops the certificates.

CREATE TABLE agent_grants (

    id           INTEGER PRIMARY KEY,

    account_id   INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    agent        TEXT NOT NULL,

    subject      TEXT NOT NULL,

    grantor      TEXT NOT NULL,

    scope        TEXT NOT NULL,

    signed       BLOB NOT NULL,

    token_hash   TEXT NOT NULL UNIQUE,

    created_ms   INTEGER NOT NULL,

    expires_ms   INTEGER NOT NULL,

    revoked_ms   INTEGER,

    last_used_ms INTEGER

);

CREATE INDEX agent_grants_account ON agent_grants(account_id);