-- Phase 2: A2A tenant-aware ingress.
-- We expose ZeroClaw's spec-conforming Agent2Agent server, but ONLY via cm-api's
-- edge: the raw daemon (:42617) stays internal. These tables hold per-workspace
-- opt-in + the external bearer tokens cm-api checks before proxying a task to the
-- daemon (injecting the internal ZEROCLAW_TOKEN itself).

CREATE TABLE workspace_a2a (
    workspace_id    UUID PRIMARY KEY REFERENCES workspaces (id) ON DELETE CASCADE,
    enabled         BOOLEAN NOT NULL DEFAULT false,
    -- The edge base URL advertised in discovery cards (points at cm-api, never
    -- the daemon), e.g. https://api.clawmates.work/api/a2a/<workspace>.
    public_base_url TEXT,
    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE a2a_tokens (
    id             UUID PRIMARY KEY,
    workspace_id   UUID NOT NULL REFERENCES workspaces (id) ON DELETE CASCADE,
    -- NULL = any published alias in the workspace; else this token may only
    -- invoke the named claw alias.
    alias          TEXT,
    token          UUID NOT NULL UNIQUE,
    exposed_skills TEXT[] NOT NULL DEFAULT '{}',
    enabled        BOOLEAN NOT NULL DEFAULT true,
    label          TEXT,
    created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
    last_used_at   TIMESTAMPTZ
);

CREATE INDEX a2a_tokens_workspace ON a2a_tokens (workspace_id);