-- v28 — Credential-by-reference catalog (no secrets in SQL)

IF OBJECT_ID('ctl.CredentialReference', 'U') IS NULL
BEGIN
  CREATE TABLE ctl.CredentialReference (
    RefKey           NVARCHAR(64) NOT NULL PRIMARY KEY,
    Label            NVARCHAR(256) NOT NULL,
    SecretSource     NVARCHAR(32) NOT NULL DEFAULT N'EnvVar',
    EnvPrefix        NVARCHAR(128) NULL,
    WindowsTarget    NVARCHAR(256) NULL,
    Notes            NVARCHAR(512) NULL,
    CreatedAt        DATETIME2 NOT NULL DEFAULT SYSUTCDATETIME()
  );
END;
GO

-- Example refs (no secrets — resolve at runtime from env or Windows Credential Manager)
IF NOT EXISTS (SELECT 1 FROM ctl.CredentialReference WHERE RefKey = N'integrated-default')
  INSERT INTO ctl.CredentialReference (RefKey, Label, SecretSource, Notes)
  VALUES (N'integrated-default', N'Windows Integrated Auth (default)', N'Integrated', N'Uses Trusted_Connection; no secret stored.');

IF NOT EXISTS (SELECT 1 FROM ctl.CredentialReference WHERE RefKey = N'sql-pilot')
  INSERT INTO ctl.CredentialReference (RefKey, Label, SecretSource, EnvPrefix, Notes)
  VALUES (N'sql-pilot', N'SQL auth pilot slot', N'EnvVar', N'SOVEREIGN_CRED_SQL_PILOT',
    N'Set SOVEREIGN_CRED_SQL_PILOT_USER and SOVEREIGN_CRED_SQL_PILOT_PASSWORD at runtime.');
GO
