-- Multi-device key sync: encrypted recovery backup + QR provisioning relay.
-- Everything stored here is CIPHERTEXT the server cannot read.

-- One encrypted backup blob per user, decryptable only with the user's recovery
-- code (client-side PBKDF2 + AES-GCM). Server sees {salt, iv, ct} — opaque.
CREATE TABLE key_backups (
  user_id     TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
  payload     TEXT NOT NULL,
  updated_at  INTEGER NOT NULL
);

-- Short-lived QR-linking channel. The new device publishes its ephemeral ECDH
-- public key; the authorizing device drops back a blob encrypted to that key.
-- The server only relays ciphertext. `id` is an unguessable capability token.
CREATE TABLE provisions (
  id             TEXT PRIMARY KEY,
  ephemeral_pub  TEXT NOT NULL,
  payload        TEXT,
  created_at     INTEGER NOT NULL,
  claimed_at     INTEGER
);