BEGIN;
CREATE TABLE trusted_login_device (
    token_hash char(64) PRIMARY KEY,
    realm text NOT NULL CHECK (realm IN ('customer','operator')),
    phone_digest char(64) NOT NULL,
    credential_digest char(64) NOT NULL,
    verified_at timestamptz NOT NULL,
    expires_at timestamptz NOT NULL,
    revoked_at timestamptz
);
CREATE INDEX trusted_login_device_phone_idx ON trusted_login_device(realm,phone_digest);
CREATE INDEX trusted_login_device_expiry_idx ON trusted_login_device(expires_at);
COMMIT;