-- Admin-configurable backup destinations (Phase 4b).
-- Each row is a place scheduled/manual full-bundle backups are pushed to.
-- Secrets inside `config` are AES-GCM-encrypted by the application layer.

CREATE TABLE IF NOT EXISTS "backup_destinations" (
  "id" text PRIMARY KEY NOT NULL,
  "name" text NOT NULL,
  "type" text NOT NULL,
  "enabled" boolean DEFAULT false NOT NULL,
  "config" jsonb DEFAULT '{}'::jsonb NOT NULL,
  "retention_count" integer,
  "encrypt_bundle" boolean DEFAULT false NOT NULL,
  "encryption_key_encrypted" text,
  "last_run_at" timestamptz,
  "last_status" text,
  "last_error" text,
  "last_backup_bytes" bigint,
  "created_at" timestamptz DEFAULT now() NOT NULL,
  "updated_at" timestamptz DEFAULT now() NOT NULL
);

CREATE INDEX IF NOT EXISTS "idx_backup_destinations_enabled"
  ON "backup_destinations" ("enabled");
