BEGIN;

CREATE TABLE hardware_agent_provider_credential (
    id                    uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    public_id             uuid NOT NULL UNIQUE DEFAULT gen_random_uuid(),
    tenant_id             uuid NOT NULL REFERENCES tenant(id),
    device_id             uuid NOT NULL,
    provider              varchar(40) NOT NULL DEFAULT 'volcengine',
    credential_ref        varchar(500) NOT NULL UNIQUE,
    instance_id           varchar(200) NOT NULL,
    product_key           varchar(200) NOT NULL,
    provider_device_name  varchar(128) NOT NULL,
    hardware_id           varchar(200) NOT NULL,
    key_version           bigint NOT NULL DEFAULT 1 CHECK (key_version > 0),
    encrypted_secret      bytea NOT NULL,
    nonce                 bytea NOT NULL,
    status                varchar(24) NOT NULL DEFAULT 'ACTIVE'
                          CHECK (status IN ('ACTIVE', 'REVOKED')),
    issued_at             timestamptz NOT NULL DEFAULT now(),
    rotated_at            timestamptz,
    revoked_at            timestamptz,
    created_at            timestamptz NOT NULL DEFAULT now(),
    updated_at            timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT hardware_agent_provider_credential_device_tenant_fk
        FOREIGN KEY (device_id, tenant_id) REFERENCES device (id, tenant_id),
    CONSTRAINT hardware_agent_provider_credential_device_key UNIQUE (device_id),
    CONSTRAINT hardware_agent_provider_credential_provider_name_key
        UNIQUE (provider, instance_id, product_key, provider_device_name)
);

CREATE INDEX hardware_agent_provider_credential_tenant_status_idx
    ON hardware_agent_provider_credential (tenant_id, status, updated_at DESC);

COMMENT ON TABLE hardware_agent_provider_credential IS
    'Platform-managed per-device provider credentials. Product secrets remain outside the database; device secrets are AEAD-encrypted with a dedicated platform master key.';

COMMENT ON COLUMN hardware_agent_provider_credential.encrypted_secret IS
    'Volcengine device_secret encrypted with VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY; never returned in logs or audit detail.';

COMMIT;