-- Repository mirrors: outbound (push to a remote) and inbound (pull from a
-- remote). Credentials are stored so the periodic sync can authenticate; prefer
-- a scoped access token over a password.
CREATE TABLE mirrors (
    id            TEXT PRIMARY KEY,
    repo_id       TEXT NOT NULL REFERENCES repos(id) ON DELETE CASCADE,
    direction     TEXT NOT NULL,          -- 'push' | 'pull'
    remote_url    TEXT NOT NULL,
    username      TEXT,
    secret        TEXT,                   -- password / token (reversible by design)
    branch_filter TEXT,                   -- push only; blank = all branches
    interval_secs BIGINT NOT NULL,        -- 0 = manual sync only
    sync_on_push  INTEGER NOT NULL,       -- push mirrors: sync after a received push
    last_sync_at  BIGINT,
    last_error    TEXT,
    created_at    BIGINT NOT NULL
);
CREATE INDEX idx_mirrors_repo ON mirrors (repo_id);