ALTER TABLE osint.assets
  ALTER COLUMN content DROP NOT NULL,
  ADD COLUMN storage_provider TEXT NOT NULL DEFAULT 'postgres' CHECK (storage_provider IN ('postgres','s3')),
  ADD COLUMN storage_bucket TEXT,
  ADD COLUMN object_key TEXT,
  ADD COLUMN etag TEXT;

ALTER TABLE osint.assets
  ADD CONSTRAINT assets_storage_location_check CHECK (
    (storage_provider = 'postgres' AND content IS NOT NULL AND storage_bucket IS NULL AND object_key IS NULL)
    OR (storage_provider = 's3' AND content IS NULL AND storage_bucket IS NOT NULL AND object_key IS NOT NULL)
  ),
  ADD CONSTRAINT assets_object_location_unique UNIQUE (storage_bucket,object_key);

COMMENT ON COLUMN osint.assets.content IS 'Compatibility storage for assets created before object storage. New uploads use the private S3/MinIO bucket.';
COMMENT ON COLUMN osint.assets.object_key IS 'Private object key; clients retrieve bytes through the authenticated application asset endpoint.';