-- §11.6 (v1.2 Hierarchies): group-KV storage — the shared read/write data for
-- a collection declared group-shared in `group_collections` (0052, kind='kv').
--
-- Identity tuple `(group_id, collection, key)`. Unlike per-app `kv_entries`
-- (0007) this is keyed by the OWNING GROUP, not by app — the whole point is
-- that many apps in the group's subtree share one store. There is no `app_id`
-- column: a shared row belongs to the group, not to whichever app wrote it.
--
-- `value` is JSONB, mirroring `kv_entries`. The reading/writing app is resolved
-- to its owning group at the service layer (walking the app's ancestor chain);
-- this table only ever sees a concrete `group_id`.
--
-- ON DELETE CASCADE on group_id: the shared store is DATA, so it dies with its
-- owning group — like `vars`/`secrets` config CASCADE, deliberately UNLIKE the
-- `scripts` (0050) RESTRICT (code is not data). Deleting an app does NOT touch
-- this table (the data is the group's, and survives the app's departure).

CREATE TABLE group_kv_entries (
    group_id    UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
    collection  TEXT NOT NULL,
    key         TEXT NOT NULL,
    value       JSONB NOT NULL,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (group_id, collection, key)
);

-- Supports list-by-collection (keyset pagination); the PK already covers
-- (group_id, collection) as a prefix but the explicit index makes intent clear.
CREATE INDEX idx_group_kv_entries_group_collection ON group_kv_entries (group_id, collection);
