-- Pending OAuth authorization-code flows (§7.8 / §10). One-time states:
-- consumed (deleted) on callback, swept on expiry.

CREATE TABLE oauth_states (
    state        TEXT PRIMARY KEY,
    workspace_id UUID NOT NULL REFERENCES workspaces (id),
    user_id      UUID NOT NULL REFERENCES users (id),
    agent_id     UUID NOT NULL REFERENCES agents (id),
    provider     TEXT NOT NULL,
    auth_type    TEXT NOT NULL CHECK (auth_type IN ('oauth', 'mcp_oauth')),
    -- Issuer for custom MCP servers; the configured default otherwise.
    issuer_url   TEXT NOT NULL,
    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
    expires_at   TIMESTAMPTZ NOT NULL
);