-- Short-lived single-use terminal-WS tickets, stored hashed in Postgres so any
-- server replica (not just the one that minted it) can redeem the handshake.
-- Replaces the former in-process ticket map. Rows are deleted on redeem and
-- swept on expiry.
CREATE TABLE terminal_ws_tickets (
    token_hash   TEXT PRIMARY KEY,
    agent_id     UUID NOT NULL REFERENCES agents (id) ON DELETE CASCADE,
    workspace_id UUID NOT NULL REFERENCES workspaces (id) ON DELETE CASCADE,
    label        TEXT NOT NULL,
    expires_at   TIMESTAMPTZ NOT NULL
);
CREATE INDEX terminal_ws_tickets_expires_idx ON terminal_ws_tickets (expires_at);