-- Persist active connect credentials so the agent can replay them on reconnect.
-- Without this table, an agent restart drops all active user tunnels until each
-- user reconnects.  The connect handler writes here; disconnect deletes; the
-- gRPC Register handler calls CredentialsForNode to replay on full resync.
CREATE TABLE connect_credentials (
  node_id     BIGINT UNSIGNED NOT NULL,
  dp_uuid     CHAR(36) NOT NULL,
  protocol    TINYINT NOT NULL DEFAULT 3,     -- agentv1.ProtocolBoth = 3
  flow        VARCHAR(64) NOT NULL DEFAULT 'xtls-rprx-vision',
  expires_at  DATETIME(6) NOT NULL,
  created_at  DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
  PRIMARY KEY (node_id, dp_uuid),
  INDEX idx_node_expires (node_id, expires_at),
  CONSTRAINT fk_cc_node FOREIGN KEY (node_id) REFERENCES nodes(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;