[
  {
    "type": "create_table",
    "description": "Create oauthStateTokens table for OAuth CSRF state storage (replaces session-based storage)",
    "database": "kiosk_users",
    "check_query": "SHOW TABLES LIKE 'oauthStateTokens'",
    "sql": "CREATE TABLE `oauthStateTokens` (\n  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,\n  `token` varchar(128) NOT NULL COMMENT 'State token value (hex)',\n  `provider` varchar(50) NOT NULL COMMENT 'OAuth provider name',\n  `typeNum` varchar(10) NOT NULL COMMENT 'Store identifier',\n  `expiresAt` datetime NOT NULL COMMENT 'Token expiration',\n  `createdAt` timestamp NOT NULL DEFAULT current_timestamp(),\n  PRIMARY KEY (`id`),\n  UNIQUE KEY `uk_token` (`token`),\n  KEY `idx_expires` (`expiresAt`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='OAuth state tokens for CSRF protection across browser contexts'"
  }
]