-- Trust plane (July 12): context attestation client registry + nonce replay ledger.
CREATE TABLE "IiosClientRegistry" (
    "clientId" TEXT NOT NULL,
    "clientType" TEXT NOT NULL,
    "ownerService" TEXT,
    "allowedAppIds" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
    "attestSecret" TEXT,
    "jwksUri" TEXT,
    "spiffeId" TEXT,
    "status" TEXT NOT NULL DEFAULT 'ACTIVE',
    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "updatedAt" TIMESTAMP(3) NOT NULL,
    CONSTRAINT "IiosClientRegistry_pkey" PRIMARY KEY ("clientId")
);

CREATE TABLE "IiosAttestationNonce" (
    "nonce" TEXT NOT NULL,
    "clientId" TEXT NOT NULL,
    "expiresAt" TIMESTAMP(3) NOT NULL,
    "firstSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    CONSTRAINT "IiosAttestationNonce_pkey" PRIMARY KEY ("nonce")
);

CREATE INDEX "IiosAttestationNonce_expiresAt_idx" ON "IiosAttestationNonce"("expiresAt");