"""Widen vulnerability_packages.source for multi-scanner provenance

Revision ID: 039
Revises: 038
Create Date: 2026-07-28 09:00:00.000000

A package row now records EVERY scanner that confirmed it ("app-scan,msrc"),
not just the one that wrote first. VARCHAR(20) could not hold three names.

Idempotent.
"""
from alembic import op


revision = "039"
down_revision = "038"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute("ALTER TABLE vulnerability_packages ALTER COLUMN source TYPE VARCHAR(60);")


def downgrade() -> None:
    op.execute("ALTER TABLE vulnerability_packages ALTER COLUMN source TYPE VARCHAR(20);")
