-- 2026-10 security audit (integrations / MCP / editor / scanners): additive indexes for the new cron sweeps -- and the webhook secret envelope. Legacy webhook secrets are re-encrypted lazily on first read (see -- src/server/webhooks/legacy.ts), so no data migration runs here. -- INT-A24: oauth_codes / oauth_refresh_tokens / oauth_clients are now swept by runMcpCron. CREATE INDEX IF NOT EXISTS oauth_codes_expires ON oauth_codes(expires_at); CREATE INDEX IF NOT EXISTS oauth_refresh_tokens_expires ON oauth_refresh_tokens(expires_at); CREATE INDEX IF NOT EXISTS oauth_clients_unused ON oauth_clients(kind, last_used_at, created_at); -- INT-A27: delivery logs are pruned after 30 days. CREATE INDEX IF NOT EXISTS integration_deliveries_created ON integration_deliveries(created_at); CREATE INDEX IF NOT EXISTS webhook_deliveries_created ON webhook_deliveries(created_at); -- INT-A6: the per-account container cap counts an account's open sessions on every start. CREATE INDEX IF NOT EXISTS editor_container_sessions_account_open ON editor_container_sessions(account_id) WHERE stopped_at IS NULL;