-- Mode on policy sets + per-rule enabled

ALTER TABLE policy_sets ADD COLUMN policy_mode TEXT NOT NULL DEFAULT 'blacklist';

ALTER TABLE policy_rules ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1;

-- Backfill set mode from agents that use the set (prefer whitelist if any agent has it)
UPDATE policy_sets
SET policy_mode = 'whitelist'
WHERE id IN (
  SELECT DISTINCT aps.set_id
  FROM agent_policy_sets aps
  INNER JOIN agents a ON a.id = aps.agent_id
  WHERE a.policy_mode = 'whitelist'
);