Index: src/config/database.js
===================================================================
--- src/config/database.js	(revision 928d1c7ba5c6f2dd3d97312711ad81f25f420cdd)
+++ src/config/database.js	(revision 9e9e6f98000b96d6c64d6c0cc5d9eb951ada9804)
@@ -323,4 +323,16 @@
       default_min_cents INTEGER DEFAULT 0,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
+    -- One row per passkey. NO patron identity is stored (design decision):
+    -- {passkey, site, proven cents, expiry}. Not traceable to a person.
+    CREATE TABLE IF NOT EXISTS paid_entitlements (
+      credential_id TEXT PRIMARY KEY,   -- WebAuthn credential id (opaque, base64url)
+      site_id TEXT NOT NULL,
+      public_key TEXT NOT NULL,         -- COSE public key, base64url
+      counter INTEGER DEFAULT 0,
+      transports TEXT,
+      min_cents INTEGER DEFAULT 0,      -- the amount proven at link time
+      expires_at INTEGER NOT NULL,      -- unix seconds; re-link after
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
     CREATE TABLE IF NOT EXISTS ap_outbox (