feat(site): deployed_secrets (LocalDb-replicated ciphertext) + node-local mirrored_secrets ledger

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Persistence/SiteStorageSchema.cs

@@ -3,7 +3,8 @@ using Microsoft.Data.Sqlite;
 namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 
 /// <summary>
-/// DDL for the site's nine configuration tables, extracted from
+/// DDL for the site's eleven configuration tables (nine original plus
+/// <c>deployed_secrets</c> and <c>mirrored_secrets</c>), extracted from
 /// <see cref="SiteStorageService"/> so it can be applied by whoever owns the database
 /// file.
 /// <para>
@@ -22,7 +23,7 @@ namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 public static class SiteStorageSchema
 {
     /// <summary>
-    /// Creates the nine site configuration tables when absent, and additively upgrades
+    /// Creates the eleven site configuration tables when absent, and additively upgrades
     /// tables created by an older build. Idempotent — safe to run on every startup.
     /// </summary>
     /// <param name="connection">An open connection to the database that should hold the tables.</param>
@@ -111,6 +112,30 @@ public static class SiteStorageSchema
                 metadata_json        TEXT,
                 PRIMARY KEY (instance_unique_name, source_canonical_name, source_reference)
             );
+
+            -- Deployed secrets (ciphertext only — see SecretArtifact). Replicated between the
+            -- two site nodes by LocalDb CDC (SiteLocalDbSetup.ReplicatedTables). A full-set
+            -- upsert soft-deletes rows absent from the incoming set via is_removed, never a
+            -- mass DELETE on a replicated table (that would ship as a destructive resync).
+            CREATE TABLE IF NOT EXISTS deployed_secrets (
+                name           TEXT PRIMARY KEY,
+                row_json       TEXT NOT NULL,
+                revision       INTEGER NOT NULL,
+                updated_utc    TEXT NOT NULL,
+                is_removed     INTEGER NOT NULL DEFAULT 0,
+                deployment_id  TEXT NOT NULL,
+                applied_at     TEXT NOT NULL
+            );
+
+            -- Node-local ledger of which secret names THIS node has mirrored into its own
+            -- secret store. Deliberately NOT in SiteLocalDbSetup.ReplicatedTables: mirroring
+            -- is a per-node action against a per-node secret store, so which names are
+            -- mirrored (and at what revision) is node-specific, not site-wide state.
+            CREATE TABLE IF NOT EXISTS mirrored_secrets (
+                name           TEXT PRIMARY KEY,
+                revision       INTEGER NOT NULL,
+                mirrored_at    TEXT NOT NULL
+            );
         ";
             command.ExecuteNonQuery();
         }