"""DDL for mcp_user_keys — per-user credentials for MCP servers (BYOK).

A server config declares a ``user_key`` slot (header or env destination).
Users may save their own key, which overrides the default plaintext
credential in ``mcp_servers.d/*.json`` for their tool calls; users without a
key fall back to the default. Keys are stored Fernet-encrypted.
"""

_DDL = """
CREATE TABLE IF NOT EXISTS mcp_user_keys (
    user_id      TEXT NOT NULL REFERENCES navi_users(id) ON DELETE CASCADE,
    server_name  TEXT NOT NULL,
    key_enc      TEXT NOT NULL,
    updated_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
    PRIMARY KEY (user_id, server_name)
);
"""


async def ensure_tables(pool) -> None:
    await pool.execute(_DDL)