"""Correct the closed manifest projection without altering applied history."""

from alembic import op

revision = "20260817_513"
down_revision = "20260817_512"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute(r"""
      CREATE OR REPLACE FUNCTION public.tenant_control_read_manifests(p_payload jsonb)
      RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog,public AS $tenant_read_manifests$
      DECLARE v_state jsonb; v_tenant text;
      BEGIN
        v_state:=public.tenant_control_read_state(p_payload); v_tenant:=v_state->>'tenant_id'; PERFORM set_config('dataops.tenant_id',v_tenant,true);
        RETURN jsonb_build_object('tenant_id',v_tenant,'manifests',coalesce((SELECT jsonb_agg(jsonb_build_object('resource_type',resource_type,'digest',digest,'namespace',namespace,'provider_enabled',provider_enabled) ORDER BY resource_type,namespace) FROM public.tenant_resource_manifests WHERE tenant_id=v_tenant),'[]'::jsonb));
      END; $tenant_read_manifests$;
      ALTER FUNCTION public.tenant_control_read_manifests(jsonb) OWNER TO dataops_tenant_foundation_owner;
      REVOKE ALL ON FUNCTION public.tenant_control_read_manifests(jsonb) FROM PUBLIC,dataops_app_runtime;
      GRANT EXECUTE ON FUNCTION public.tenant_control_read_manifests(jsonb) TO dataops_tenant_control;
    """)


def downgrade() -> None:
    op.execute("""
      DO $$ BEGIN
        IF EXISTS (SELECT 1 FROM public.tenant_resource_manifests LIMIT 1) THEN RAISE EXCEPTION 'tenant manifest reader downgrade refused while manifests exist'; END IF;
      END $$;
    """)