"""encrypt vault item name client-side

Revision ID: c3d4e5f6a7b8
Revises: a1b2c3d4e5f6
Create Date: 2026-04-26 00:00:00.000000

Adds enc_name (AES-256-GCM ciphertext) and iv_name (nonce) columns to vault_items.
The plaintext name column is retained for backward-compatibility and audit logs only.
Clients populate enc_name/iv_name on create/update; the server never decrypts it.
"""
from alembic import op
import sqlalchemy as sa

revision = 'c3d4e5f6a7b8'
down_revision = 'a1b2c3d4e5f6'
branch_labels = None
depends_on = None


def upgrade():
    op.add_column('vault_items', sa.Column('enc_name', sa.Text(), nullable=True))
    op.add_column('vault_items', sa.Column('iv_name', sa.String(length=64), nullable=True))


def downgrade():
    op.drop_column('vault_items', 'iv_name')
    op.drop_column('vault_items', 'enc_name')