-- SNS: credentials and approval records never enter public payloads.
CREATE TABLE IF NOT EXISTS public.owner_social_accounts (
    account_id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id uuid NOT NULL,
    provider smallint NOT NULL CHECK (provider IN (1,2)),
    provider_user_id varchar(200) NOT NULL,
    handle varchar(200) NOT NULL,
    profile_url text NOT NULL,
    access_token text,
    refresh_token text,
    access_expires_at timestamptz,
    scopes jsonb NOT NULL DEFAULT '[]',
    status varchar(20) NOT NULL DEFAULT 'linked',
    last_error text,
    created_at timestamptz NOT NULL DEFAULT now(),
    updated_at timestamptz NOT NULL DEFAULT now(),
    deleted boolean NOT NULL DEFAULT false
);
CREATE UNIQUE INDEX IF NOT EXISTS uq_social_account ON public.owner_social_accounts(user_id, provider) WHERE deleted=false AND status IN ('linked','needs_reauth');