1-- Add lifecycle-aware retention defaults without changing existing site expiry.2ALTER TABLE vaults ADD COLUMN default_ttl INTEGER3 CHECK (default_ttl IS NULL OR default_ttl BETWEEN 0 AND 3650);45-- Enrich the conventional slots only when they already have the conventional6-- names. Occupied/custom slots and existing names elsewhere are left alone.7UPDATE vaults SET default_ttl = 148WHERE slot = 0 AND name = 'personal';9UPDATE vaults SET default_ttl = 010WHERE slot = 15 AND name = 'public';1112INSERT OR IGNORE INTO vaults (slot, name, description, default_ttl, created_at)13VALUES (0, 'personal', 'Personal and temporary shares', 14, unixepoch());14INSERT OR IGNORE INTO vaults (slot, name, description, default_ttl, created_at)15VALUES (15, 'public', 'Durable public app origins', 0, unixepoch());1617CREATE TABLE IF NOT EXISTS vault_defaults (18 lifecycle TEXT PRIMARY KEY CHECK (lifecycle IN ('temporary', 'permanent')),19 vault_slot INTEGER NOT NULL REFERENCES vaults(slot)20);21INSERT OR IGNORE INTO vault_defaults (lifecycle, vault_slot)22SELECT 'temporary', slot FROM vaults WHERE slot = 0 AND name = 'personal';23INSERT OR IGNORE INTO vault_defaults (lifecycle, vault_slot)24SELECT 'permanent', slot FROM vaults WHERE slot = 15 AND name = 'public';2526ALTER TABLE sites ADD COLUMN content_security_policy TEXT;2728-- This is deliberately separate from sites: deleting or expiring content must29-- not make an app origin reusable by another application.30CREATE TABLE IF NOT EXISTS app_reservations (31 address INTEGER PRIMARY KEY CHECK (address BETWEEN 0 AND 65535),32 vault_slot INTEGER NOT NULL REFERENCES vaults(slot),33 alias TEXT NOT NULL,34 created_at INTEGER NOT NULL,35 retired_at INTEGER,36 UNIQUE (vault_slot, alias)37);