"""Per-project projection eligibility (rollout blocker, design §15).

disabled: no automatic reconciliation or Cloud writes for this project.
shadow:   Core reconciles and drift can be inspected; no Cloud writes.
enabled:  reconciliation and Cloud projection writes may run.

Every existing project starts disabled, so no environment-wide sync can reach it.

Revision ID: 196
Revises: 195
"""
import sqlalchemy as sa
from alembic import op

revision = "196"
down_revision = "195"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.add_column(
        "project_auth_config",
        sa.Column("projection_state", sa.Text(), nullable=False, server_default="disabled"),
    )
    op.create_check_constraint(
        "ck_project_auth_config_projection_state",
        "project_auth_config",
        "projection_state IN ('disabled', 'shadow', 'enabled')",
    )


def downgrade() -> None:
    op.drop_constraint(
        "ck_project_auth_config_projection_state", "project_auth_config", type_="check"
    )
    op.drop_column("project_auth_config", "projection_state")