-- Secrets for OxygenFlow jobs (hub spec §13.2, #107), per level like

-- flow_variables. A job gets only the secrets its pipeline declares by

-- name, as files Flow mounts (OxygenFlow spec §9), never in the

-- environment. Values are sealed with keys/secrets.key.

CREATE TABLE flow_secrets (

    scope       TEXT NOT NULL CHECK (scope IN ('site', 'org', 'repo')),

    scope_id    INTEGER NOT NULL DEFAULT 0,

    name        TEXT NOT NULL,

    value       BLOB NOT NULL,

    updated_ms  INTEGER NOT NULL,

    PRIMARY KEY (scope, scope_id, name)

);