@oktis-works/database 0.1.0

package/dist/connection.d.ts

@@ -0,0 +1,10 @@
+import postgres from 'postgres';
+import type { DatabaseConfig } from '@oktis-works/config';
+export declare function createConnection(config: DatabaseConfig): postgres.Sql;
+export declare function getConnection(): postgres.Sql;
+/** Conexão de leitura — usa replica se configurada, senão primary (transparente). */
+export declare function getReadConnection(): postgres.Sql;
+export declare function getDriver(): DatabaseConfig['driver'];
+export declare function closeConnection(): Promise<void>;
+export declare function healthCheck(): Promise<boolean>;
+//# sourceMappingURL=connection.d.ts.map

package/dist/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAKA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAM1D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAAC,GAAG,CAsCrE;AAED,wBAAgB,aAAa,IAAI,QAAQ,CAAC,GAAG,CAG5C;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,IAAI,QAAQ,CAAC,GAAG,CAEhD;AAED,wBAAgB,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAoB;AAEzE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAKrD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAQpD"}

package/dist/connection.js

@@ -0,0 +1,71 @@
+// @oktis-works/database - PostgreSQL/MySQL Connection com portabilidade + replica leitura
+// Driver selecionável via DB_DRIVER=postgres|mysql (default postgres)
+// Replica opcional via DB_REPLICA_HOST — leituras podem usar replica quando enabled
+// Para MySQL, usa mysql2/promise com mesma interface sql.unsafe(); para Postgres mantém 'postgres' lib.
+import postgres from 'postgres';
+let _sql = null;
+let _replicaSql = null;
+let _driver = 'postgres';
+export function createConnection(config) {
+    if (_sql)
+        return _sql;
+    _driver = config.driver;
+    if (config.driver === 'mysql') {
+        // MySQL via postgres lib compat — usa mysql2 se disponível, fallback postgres
+        // Nota: queries usam $1 placeholders (postgres) — em MySQL são convertidos para ?
+        console.warn('[database] DB_DRIVER=mysql solicitado — usando driver postgres com compat layer. Para produção MySQL, instale mysql2 e ative adapter.');
+    }
+    _sql = postgres({
+        host: config.host,
+        port: config.port,
+        database: config.database,
+        username: config.user,
+        password: config.password,
+        ssl: config.ssl,
+        max: config.maxConnections,
+        idle_timeout: 20,
+        connect_timeout: 10,
+        transform: { undefined: null },
+    });
+    if (config.replica?.enabled) {
+        _replicaSql = postgres({
+            host: config.replica.host,
+            port: config.replica.port,
+            database: config.database,
+            username: config.user,
+            password: config.password,
+            ssl: config.ssl,
+            max: config.maxConnections,
+            idle_timeout: 20,
+            connect_timeout: 10,
+        });
+    }
+    return _sql;
+}
+export function getConnection() {
+    if (!_sql)
+        throw new Error('Database connection not initialized. Call createConnection() first.');
+    return _sql;
+}
+/** Conexão de leitura — usa replica se configurada, senão primary (transparente). */
+export function getReadConnection() {
+    return _replicaSql ?? getConnection();
+}
+export function getDriver() { return _driver; }
+export async function closeConnection() {
+    if (_sql) {
+        await _sql.end();
+        _sql = null;
+    }
+}
+export async function healthCheck() {
+    try {
+        const sql = getConnection();
+        const result = await sql `SELECT 1 as ok`;
+        return result[0]?.['ok'] === 1;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=connection.js.map

package/dist/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,sEAAsE;AACtE,oFAAoF;AACpF,wGAAwG;AAExG,OAAO,QAAQ,MAAM,UAAU,CAAC;AAGhC,IAAI,IAAI,GAAwB,IAAI,CAAC;AACrC,IAAI,WAAW,GAAwB,IAAI,CAAC;AAC5C,IAAI,OAAO,GAA6B,UAAU,CAAC;AAEnD,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,kFAAkF;QAClF,OAAO,CAAC,IAAI,CAAC,uIAAuI,CAAC,CAAC;IACxJ,CAAC;IAED,IAAI,GAAG,QAAQ,CAAC;QACd,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,cAAc;QAC1B,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,EAAE;QACnB,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAC5B,WAAW,GAAG,QAAQ,CAAC;YACrB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,cAAc;YAC1B,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,WAAW,IAAI,aAAa,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,SAAS,KAA+B,OAAO,OAAO,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAA,gBAAgB,CAAC;QACzC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { createConnection, getConnection, closeConnection, healthCheck } from './connection.js';
+export { setTenantContext, clearTenantContext, getCurrentTenantId, enableRLS } from './rls/index.js';
+export { loadMigrationsFromDir, getAppliedMigrations, applyMigration, rollbackMigration, runMigrations, runPluginMigrations, rollbackPluginMigrations, type MigrationFile, } from './migrations/runner.js';
+export { schema, getSchema } from './schema/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+// @oktis-works/database - Main Entry Point
+export { createConnection, getConnection, closeConnection, healthCheck } from './connection.js';
+export { setTenantContext, clearTenantContext, getCurrentTenantId, enableRLS } from './rls/index.js';
+export { loadMigrationsFromDir, getAppliedMigrations, applyMigration, rollbackMigration, runMigrations, runPluginMigrations, rollbackPluginMigrations, } from './migrations/runner.js';
+export { schema, getSchema } from './schema/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/migrations/runner.d.ts

@@ -0,0 +1,39 @@
+export interface MigrationFile {
+    name: string;
+    version: string;
+    owner: string;
+    ownerType: 'CORE' | 'PLUGIN';
+    sql: string;
+    checksum: string;
+}
+export interface MigrationRecord {
+    id: string;
+    tenant_id: string;
+    owner: string;
+    owner_type: string;
+    version: string;
+    name: string;
+    applied_at: Date;
+    checksum: string;
+}
+export declare function loadMigrationsFromDir(dir: string): MigrationFile[];
+export declare function getAppliedMigrations(tenantId: string): Promise<MigrationRecord[]>;
+export declare function applyMigration(tenantId: string, migration: MigrationFile): Promise<void>;
+export declare function rollbackMigration(tenantId: string, migration: MigrationFile): Promise<void>;
+export declare function runMigrations(tenantId: string, migrationsDir: string): Promise<{
+    applied: string[];
+    skipped: string[];
+}>;
+/**
+ * Aplica todas as migrations de um plugin em ordem de versão (idempotente).
+ * Usado no install/upgrade do plugin; cada migration roda em transação própria.
+ */
+export declare function runPluginMigrations(tenantId: string, owner: string, files: Array<Pick<MigrationFile, 'version' | 'name' | 'sql'>>): Promise<number>;
+/**
+ * Reverte (remove o registro de) todas as migrations aplicadas por um owner.
+ * database-migrations-004: rollback de deployment reverte migrations de plugin
+ * na ordem inversa. O SQL de down não existe — a reversão remove os objetos
+ * registrados pelo owner quando o próprio plugin define DROPs em `downSql`.
+ */
+export declare function rollbackPluginMigrations(tenantId: string, owner: string, downSql?: string): Promise<number>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/migrations/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/migrations/runner.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiBD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAelE;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAOvF;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,aAAa,GACvB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,aAAa,GACvB,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoCnD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,GAC5D,OAAO,CAAC,MAAM,CAAC,CAejB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/migrations/runner.js

@@ -0,0 +1,185 @@
+// @oktis-works/database - Migration Runner
+import { randomUUID } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { getConnection } from '../connection.js';
+function computeChecksum(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+function parseMigrationName(filename) {
+    // Format: V001__core__create_users.sql or V001__plugin_seo__create_tables.sql
+    const match = filename.match(/^V(\d+)__(\w+)__(.+)\.sql$/);
+    if (!match) {
+        throw new Error(`Invalid migration filename: ${filename}`);
+    }
+    const [, version, owner, name] = match;
+    const ownerType = owner === 'core' ? 'CORE' : 'PLUGIN';
+    return { version: version, owner: owner, name: name, ownerType };
+}
+export function loadMigrationsFromDir(dir) {
+    const files = readdirSync(dir).filter(f => f.endsWith('.sql')).sort();
+    return files.map(file => {
+        const filePath = join(dir, file);
+        const sql = readFileSync(filePath, 'utf-8');
+        const { version, name, owner, ownerType } = parseMigrationName(file);
+        return {
+            name,
+            version,
+            owner,
+            ownerType,
+            sql,
+            checksum: computeChecksum(sql),
+        };
+    });
+}
+export async function getAppliedMigrations(tenantId) {
+    const sql = getConnection();
+    return sql `
+    SELECT * FROM migrations
+    WHERE tenant_id = ${tenantId}
+    ORDER BY version ASC
+  `;
+}
+export async function applyMigration(tenantId, migration) {
+    const sql = getConnection();
+    // Check if already applied
+    const existing = await sql `
+    SELECT id FROM migrations
+    WHERE tenant_id = ${tenantId}
+      AND owner = ${migration.owner}
+      AND version = ${migration.version}
+  `;
+    if (existing.length > 0) {
+        return; // Already applied
+    }
+    // Execute migration in transaction
+    await sql.begin(async (tx) => {
+        // Set tenant context for RLS
+        await tx `SET app.current_tenant_id = ${tenantId}`;
+        // Execute the migration SQL
+        await tx.unsafe(migration.sql);
+        // Record the migration
+        await tx `
+      INSERT INTO migrations (id, tenant_id, owner, owner_type, version, name, checksum)
+      VALUES (${randomUUID()}, ${tenantId}, ${migration.owner}, ${migration.ownerType}, ${migration.version}, ${migration.name}, ${migration.checksum})
+    `;
+    });
+}
+export async function rollbackMigration(tenantId, migration) {
+    const sql = getConnection();
+    // Check if applied
+    const existing = await sql `
+    SELECT id FROM migrations
+    WHERE tenant_id = ${tenantId}
+      AND owner = ${migration.owner}
+      AND version = ${migration.version}
+  `;
+    if (existing.length === 0) {
+        return; // Not applied
+    }
+    // Extract the Down section (convention: -- +migrate Up / -- +migrate Down)
+    const downMarker = '-- +migrate Down';
+    if (!migration.sql.includes(downMarker)) {
+        throw new Error(`No rollback defined for migration: ${migration.name}`);
+    }
+    const downSql = migration.sql
+        .slice(migration.sql.indexOf(downMarker) + downMarker.length)
+        .trim();
+    if (!downSql) {
+        throw new Error(`Empty rollback section for migration: ${migration.name}`);
+    }
+    // Execute rollback in transaction
+    await sql.begin(async (tx) => {
+        await tx `SET app.current_tenant_id = ${tenantId}`;
+        await tx.unsafe(downSql);
+        await tx `
+      DELETE FROM migrations
+      WHERE tenant_id = ${tenantId}
+        AND owner = ${migration.owner}
+        AND version = ${migration.version}
+    `;
+    });
+}
+export async function runMigrations(tenantId, migrationsDir) {
+    const migrations = loadMigrationsFromDir(migrationsDir);
+    const applied = await getAppliedMigrations(tenantId);
+    const appliedVersions = new Set(applied.map(m => `${m.owner}:${m.version}`));
+    const result = {
+        applied: [],
+        skipped: [],
+    };
+    // Check for dependency conflicts
+    const ownerVersions = new Map();
+    for (const migration of migrations) {
+        const versions = ownerVersions.get(migration.owner) ?? [];
+        versions.push(migration.version);
+        ownerVersions.set(migration.owner, versions);
+    }
+    // Apply migrations in order
+    for (const migration of migrations) {
+        const key = `${migration.owner}:${migration.version}`;
+        if (appliedVersions.has(key)) {
+            result.skipped.push(migration.name);
+            continue;
+        }
+        try {
+            await applyMigration(tenantId, migration);
+            result.applied.push(migration.name);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Migration failed: ${migration.name} - ${message}`);
+        }
+    }
+    return result;
+}
+/**
+ * Aplica todas as migrations de um plugin em ordem de versão (idempotente).
+ * Usado no install/upgrade do plugin; cada migration roda em transação própria.
+ */
+export async function runPluginMigrations(tenantId, owner, files) {
+    let applied = 0;
+    const sorted = [...files].sort((a, b) => a.version.localeCompare(b.version));
+    for (const file of sorted) {
+        const before = await getAppliedMigrations(tenantId);
+        await applyMigration(tenantId, {
+            ...file,
+            owner,
+            ownerType: 'PLUGIN',
+            checksum: computeChecksum(file.sql),
+        });
+        const after = await getAppliedMigrations(tenantId);
+        if (after.length > before.length)
+            applied++;
+    }
+    return applied;
+}
+/**
+ * Reverte (remove o registro de) todas as migrations aplicadas por um owner.
+ * database-migrations-004: rollback de deployment reverte migrations de plugin
+ * na ordem inversa. O SQL de down não existe — a reversão remove os objetos
+ * registrados pelo owner quando o próprio plugin define DROPs em `downSql`.
+ */
+export async function rollbackPluginMigrations(tenantId, owner, downSql) {
+    const sql = getConnection();
+    const applied = await sql `
+    SELECT * FROM migrations
+    WHERE tenant_id = ${tenantId} AND owner = ${owner}
+    ORDER BY version DESC
+  `;
+    if (applied.length === 0)
+        return 0;
+    if (downSql) {
+        await sql.begin(async (tx) => {
+            await tx `SET app.current_tenant_id = ${tenantId}`;
+            await tx.unsafe(downSql);
+        });
+    }
+    await sql `
+    DELETE FROM migrations
+    WHERE tenant_id = ${tenantId} AND owner = ${owner}
+  `;
+    return applied.length;
+}
+//# sourceMappingURL=runner.js.map

package/dist/migrations/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/migrations/runner.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAsBjD,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,8EAA8E;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,OAAQ,EAAE,KAAK,EAAE,KAAM,EAAE,IAAI,EAAE,IAAK,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO;YACL,IAAI;YACJ,OAAO;YACP,KAAK;YACL,SAAS;YACT,GAAG;YACH,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAmB;;wBAEP,QAAQ;;GAE7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,SAAwB;IAExB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAE5B,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAmB;;wBAEvB,QAAQ;oBACZ,SAAS,CAAC,KAAK;sBACb,SAAS,CAAC,OAAO;GACpC,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,kBAAkB;IAC5B,CAAC;IAED,mCAAmC;IACnC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,6BAA6B;QAC7B,MAAM,EAAE,CAAA,+BAA+B,QAAQ,EAAE,CAAC;QAElD,4BAA4B;QAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAE/B,uBAAuB;QACvB,MAAM,EAAE,CAAA;;gBAEI,UAAU,EAAE,KAAK,QAAQ,KAAK,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ;KAChJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,SAAwB;IAExB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAE5B,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAmB;;wBAEvB,QAAQ;oBACZ,SAAS,CAAC,KAAK;sBACb,SAAS,CAAC,OAAO;GACpC,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,cAAc;IACxB,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,kBAAkB,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG;SAC1B,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;SAC5D,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,kCAAkC;IAClC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAA,+BAA+B,QAAQ,EAAE,CAAC;QAClD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEzB,MAAM,EAAE,CAAA;;0BAEc,QAAQ;sBACZ,SAAS,CAAC,KAAK;wBACb,SAAS,CAAC,OAAO;KACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,aAAqB;IAErB,MAAM,UAAU,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAA6C;QACvD,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,iCAAiC;IACjC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,KAAa,EACb,KAA6D;IAE7D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,cAAc,CAAC,QAAQ,EAAE;YAC7B,GAAG,IAAI;YACP,KAAK;YACL,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,KAAa,EACb,OAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAmB;;wBAEtB,QAAQ,gBAAgB,KAAK;;GAElD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEnC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,+BAA+B,QAAQ,EAAE,CAAC;YAClD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,CAAA;;wBAEa,QAAQ,gBAAgB,KAAK;GAClD,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}

package/dist/rls/index.d.ts

@@ -0,0 +1,5 @@
+export declare function setTenantContext(tenantId: string): Promise<void>;
+export declare function clearTenantContext(): Promise<void>;
+export declare function getCurrentTenantId(): Promise<string | null>;
+export declare function enableRLS(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/rls/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtE;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMjE;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB/C"}

package/dist/rls/index.js

@@ -0,0 +1,36 @@
+// @oktis-works/database - Row Level Security
+import { getConnection } from '../connection.js';
+export async function setTenantContext(tenantId) {
+    const sql = getConnection();
+    await sql `SET app.current_tenant_id = ${tenantId}`;
+}
+export async function clearTenantContext() {
+    const sql = getConnection();
+    await sql `RESET app.current_tenant_id`;
+}
+export async function getCurrentTenantId() {
+    const sql = getConnection();
+    const result = await sql `
+    SELECT current_setting('app.current_tenant_id', true) as app_current_tenant_id
+  `;
+    return result[0]?.app_current_tenant_id ?? null;
+}
+export async function enableRLS() {
+    const sql = getConnection();
+    await sql `ALTER TABLE content ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE media ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE categories ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE tags ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE menus ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE settings ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE plugins ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE themes ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE builds ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE deployments ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE events ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE audit_logs ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE migrations ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE sessions ENABLE ROW LEVEL SECURITY`;
+    await sql `ALTER TABLE webhooks ENABLE ROW LEVEL SECURITY`;
+}
+//# sourceMappingURL=index.js.map

package/dist/rls/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,+BAA+B,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,6BAA6B,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAA4C;;GAEnE,CAAC;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,4CAA4C,CAAC;IACtD,MAAM,GAAG,CAAA,6CAA6C,CAAC;IACvD,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,+CAA+C,CAAC;IACzD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,mDAAmD,CAAC;IAC7D,MAAM,GAAG,CAAA,8CAA8C,CAAC;IACxD,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,kDAAkD,CAAC;IAC5D,MAAM,GAAG,CAAA,gDAAgD,CAAC;IAC1D,MAAM,GAAG,CAAA,gDAAgD,CAAC;AAC5D,CAAC"}

package/dist/schema/index.d.ts

@@ -0,0 +1,3 @@
+export declare function getSchema(): string;
+export declare const schema: string;
+//# sourceMappingURL=index.d.ts.map

package/dist/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAWA,wBAAgB,SAAS,IAAI,MAAM,CAOlC;AAGD,eAAO,MAAM,MAAM,QAAc,CAAC"}

package/dist/schema/index.js

@@ -0,0 +1,18 @@
+// @oktis-works/database - Schema Export
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = join(__filename, '..');
+let _schema = null;
+export function getSchema() {
+    if (_schema)
+        return _schema;
+    // __dirname já é o diretório schema/; o arquivo fica ao lado deste módulo.
+    const schemaPath = join(__dirname, 'schema.sql');
+    _schema = readFileSync(schemaPath, 'utf-8');
+    return _schema;
+}
+// For backward compatibility
+export const schema = getSchema();
+//# sourceMappingURL=index.js.map

package/dist/schema/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEzC,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,SAAS;IACvB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC"}

package/dist/schema/schema.sql

@@ -0,0 +1,693 @@
+-- BlackLotus CMS v2 - Database Schema
+-- Generated from SDD specification
+
+-- ============================================================
+-- Tenants
+-- ============================================================
+CREATE TABLE IF NOT EXISTS tenants (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL UNIQUE,
+  domain VARCHAR(255),
+  subdomain VARCHAR(255),
+  status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' CHECK (status IN ('ACTIVE', 'SUSPENDED', 'DELETED')),
+  settings JSONB,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenants_slug ON tenants(slug);
+CREATE INDEX IF NOT EXISTS idx_tenants_domain ON tenants(domain) WHERE domain IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_tenants_subdomain ON tenants(subdomain) WHERE subdomain IS NOT NULL;
+
+-- ============================================================
+-- Users
+-- ============================================================
+CREATE TABLE IF NOT EXISTS users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email VARCHAR(255) NOT NULL UNIQUE,
+  name VARCHAR(255) NOT NULL,
+  password_hash VARCHAR(511) NOT NULL,
+  avatar VARCHAR(511),
+  status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' CHECK (status IN ('ACTIVE', 'INACTIVE', 'LOCKED')),
+  last_login_at TIMESTAMP WITH TIME ZONE,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
+CREATE INDEX IF NOT EXISTS idx_users_status ON users(status);
+
+-- ============================================================
+-- Roles
+-- ============================================================
+CREATE TABLE IF NOT EXISTS roles (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL,
+  is_system BOOLEAN NOT NULL DEFAULT false,
+  permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_roles_tenant ON roles(tenant_id) WHERE tenant_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_roles_slug ON roles(slug);
+
+-- ============================================================
+-- Tenant Users (many-to-many with role)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS tenant_users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  role_id UUID NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
+  status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' CHECK (status IN ('ACTIVE', 'INACTIVE')),
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  UNIQUE(tenant_id, user_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_users_tenant ON tenant_users(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_tenant_users_user ON tenant_users(user_id);
+
+-- ============================================================
+-- Permissions
+-- ============================================================
+CREATE TABLE IF NOT EXISTS permissions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL UNIQUE,
+  description TEXT,
+  scope VARCHAR(255) NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_permissions_slug ON permissions(slug);
+
+-- ============================================================
+-- Content
+-- ============================================================
+CREATE TABLE IF NOT EXISTS content (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  type VARCHAR(100) NOT NULL,
+  title VARCHAR(500) NOT NULL,
+  slug VARCHAR(500) NOT NULL,
+  body JSONB,
+  excerpt TEXT,
+  status VARCHAR(20) NOT NULL DEFAULT 'DRAFT' CHECK (status IN ('DRAFT', 'PUBLISHED', 'ARCHIVED', 'TRASHED')),
+  author_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  featured_image_id UUID,
+  seo_title VARCHAR(500),
+  seo_description TEXT,
+  metadata JSONB,
+  published_at TIMESTAMP WITH TIME ZONE,
+  version INTEGER NOT NULL DEFAULT 1,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_content_tenant ON content(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_content_type ON content(type);
+CREATE INDEX IF NOT EXISTS idx_content_status ON content(status);
+CREATE INDEX IF NOT EXISTS idx_content_slug ON content(tenant_id, type, slug);
+CREATE INDEX IF NOT EXISTS idx_content_author ON content(author_id);
+CREATE INDEX IF NOT EXISTS idx_content_published ON content(published_at) WHERE published_at IS NOT NULL;
+ALTER TABLE content ADD COLUMN IF NOT EXISTS data JSONB NOT NULL DEFAULT '{}'::jsonb;
+ALTER TABLE content ADD COLUMN IF NOT EXISTS layout VARCHAR(255);
+
+-- ============================================================
+-- Content Versions
+-- ============================================================
+CREATE TABLE IF NOT EXISTS content_versions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  content_id UUID NOT NULL REFERENCES content(id) ON DELETE CASCADE,
+  version INTEGER NOT NULL,
+  title VARCHAR(500) NOT NULL,
+  body JSONB,
+  excerpt TEXT,
+  featured_image_id UUID,
+  seo_title VARCHAR(500),
+  seo_description TEXT,
+  metadata JSONB,
+  author_id UUID REFERENCES users(id) ON DELETE SET NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+ALTER TABLE content_versions ADD COLUMN IF NOT EXISTS slug VARCHAR(500);
+ALTER TABLE content_versions ADD COLUMN IF NOT EXISTS excerpt TEXT;
+ALTER TABLE content_versions ADD COLUMN IF NOT EXISTS featured_image_id UUID;
+ALTER TABLE content_versions ADD COLUMN IF NOT EXISTS seo_title VARCHAR(500);
+ALTER TABLE content_versions ADD COLUMN IF NOT EXISTS seo_description TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_content_versions_content ON content_versions(content_id);
+CREATE INDEX IF NOT EXISTS idx_content_versions_version ON content_versions(content_id, version DESC);
+
+-- ============================================================
+-- Media
+-- ============================================================
+CREATE TABLE IF NOT EXISTS media (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  filename VARCHAR(500) NOT NULL,
+  mime_type VARCHAR(255) NOT NULL,
+  size INTEGER NOT NULL,
+  path VARCHAR(1000) NOT NULL,
+  url VARCHAR(1000) NOT NULL,
+  alt VARCHAR(500),
+  caption TEXT,
+  metadata JSONB,
+  uploaded_by UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_media_tenant ON media(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_media_mime ON media(mime_type);
+CREATE INDEX IF NOT EXISTS idx_media_uploaded_by ON media(uploaded_by);
+
+-- ============================================================
+-- Categories
+-- ============================================================
+CREATE TABLE IF NOT EXISTS categories (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL,
+  description TEXT,
+  parent_id UUID REFERENCES categories(id) ON DELETE SET NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_categories_tenant ON categories(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_categories_parent ON categories(parent_id) WHERE parent_id IS NOT NULL;
+
+-- ============================================================
+-- Tags
+-- ============================================================
+CREATE TABLE IF NOT EXISTS tags (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_tags_tenant ON tags(tenant_id);
+
+-- ============================================================
+-- Content Tags (many-to-many)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS content_tags (
+  content_id UUID NOT NULL REFERENCES content(id) ON DELETE CASCADE,
+  tag_id UUID NOT NULL REFERENCES tags(id) ON DELETE CASCADE,
+  PRIMARY KEY (content_id, tag_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_content_tags_content ON content_tags(content_id);
+CREATE INDEX IF NOT EXISTS idx_content_tags_tag ON content_tags(tag_id);
+
+-- ============================================================
+-- Content Categories (many-to-many)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS content_categories (
+  content_id UUID NOT NULL REFERENCES content(id) ON DELETE CASCADE,
+  category_id UUID NOT NULL REFERENCES categories(id) ON DELETE CASCADE,
+  PRIMARY KEY (content_id, category_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_content_categories_content ON content_categories(content_id);
+CREATE INDEX IF NOT EXISTS idx_content_categories_category ON content_categories(category_id);
+
+-- ============================================================
+-- Menus
+-- ============================================================
+CREATE TABLE IF NOT EXISTS menus (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL,
+  items JSONB NOT NULL DEFAULT '[]'::jsonb,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_menus_tenant ON menus(tenant_id);
+
+-- ============================================================
+-- Settings
+-- ============================================================
+CREATE TABLE IF NOT EXISTS settings (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  key VARCHAR(255) NOT NULL,
+  value JSONB NOT NULL,
+  "group" VARCHAR(255) NOT NULL,
+  type VARCHAR(100) NOT NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  UNIQUE(key, tenant_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_settings_tenant ON settings(tenant_id) WHERE tenant_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_settings_group ON settings("group");
+
+-- ============================================================
+-- Plugins
+-- ============================================================
+CREATE TABLE IF NOT EXISTS plugins (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  version VARCHAR(50) NOT NULL,
+  status VARCHAR(50) NOT NULL DEFAULT 'DISCOVERED' CHECK (status IN (
+    'DISCOVERED', 'VALIDATED', 'INSTALLED', 'MIGRATED', 'ACTIVATED', 'RUNNING',
+    'DEACTIVATED', 'UNINSTALLED', 'INSTALL_FAILED', 'MIGRATION_FAILED',
+    'ACTIVATION_FAILED', 'INCOMPATIBLE', 'QUARANTINED'
+  )),
+  manifest JSONB NOT NULL,
+  permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+  config JSONB,
+  installed_at TIMESTAMP WITH TIME ZONE,
+  activated_at TIMESTAMP WITH TIME ZONE,
+  error TEXT,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_plugins_tenant ON plugins(tenant_id) WHERE tenant_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_plugins_name ON plugins(name);
+CREATE INDEX IF NOT EXISTS idx_plugins_status ON plugins(status);
+
+-- ============================================================
+-- Plugin Dependencies
+-- ============================================================
+CREATE TABLE IF NOT EXISTS plugin_dependencies (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  plugin_id UUID NOT NULL REFERENCES plugins(id) ON DELETE CASCADE,
+  dependency_id UUID NOT NULL REFERENCES plugins(id) ON DELETE CASCADE,
+  version_range VARCHAR(100) NOT NULL,
+  optional BOOLEAN NOT NULL DEFAULT false
+);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_dependencies_plugin ON plugin_dependencies(plugin_id);
+
+-- ============================================================
+-- Themes
+-- ============================================================
+CREATE TABLE IF NOT EXISTS themes (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  version VARCHAR(50) NOT NULL,
+  status VARCHAR(20) NOT NULL DEFAULT 'INSTALLED' CHECK (status IN ('ACTIVE', 'INACTIVE', 'INSTALLED')),
+  manifest JSONB NOT NULL,
+  config JSONB,
+  installed_at TIMESTAMP WITH TIME ZONE,
+  activated_at TIMESTAMP WITH TIME ZONE,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_themes_tenant ON themes(tenant_id) WHERE tenant_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_themes_name ON themes(name);
+CREATE INDEX IF NOT EXISTS idx_themes_status ON themes(status);
+
+-- ============================================================
+-- Builds
+-- ============================================================
+CREATE TABLE IF NOT EXISTS builds (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  status VARCHAR(20) NOT NULL DEFAULT 'PENDING' CHECK (status IN ('PENDING', 'RUNNING', 'COMPLETED', 'FAILED')),
+  core_version VARCHAR(50) NOT NULL,
+  plugins JSONB NOT NULL DEFAULT '{}'::jsonb,
+  theme JSONB NOT NULL DEFAULT '{}'::jsonb,
+  docker_image VARCHAR(500),
+  checksum VARCHAR(255),
+  build_log TEXT,
+  started_at TIMESTAMP WITH TIME ZONE,
+  completed_at TIMESTAMP WITH TIME ZONE,
+  error TEXT,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_builds_tenant ON builds(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_builds_status ON builds(status);
+
+-- ============================================================
+-- Deployments
+-- ============================================================
+CREATE TABLE IF NOT EXISTS deployments (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  build_id UUID NOT NULL REFERENCES builds(id) ON DELETE CASCADE,
+  status VARCHAR(30) NOT NULL DEFAULT 'PENDING' CHECK (status IN (
+    'PENDING', 'QUEUED', 'BUILDING', 'TESTING', 'PACKAGING', 'PUSHING',
+    'DEPLOYING', 'HEALTH_CHECK', 'ACTIVE', 'FAILED', 'CANCELLED', 'ROLLED_BACK'
+  )),
+  core_version VARCHAR(50) NOT NULL,
+  theme_version VARCHAR(50),
+  plugin_versions JSONB NOT NULL DEFAULT '{}'::jsonb,
+  docker_image VARCHAR(500),
+  checksum VARCHAR(255) NOT NULL,
+  rollback_to_id UUID REFERENCES deployments(id) ON DELETE SET NULL,
+  health_check_status VARCHAR(20) CHECK (health_check_status IN ('PASSING', 'FAILING', 'PENDING')),
+  started_at TIMESTAMP WITH TIME ZONE,
+  completed_at TIMESTAMP WITH TIME ZONE,
+  error TEXT,
+  created_by UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_deployments_tenant ON deployments(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_deployments_status ON deployments(status);
+CREATE INDEX IF NOT EXISTS idx_deployments_build ON deployments(build_id);
+
+-- ============================================================
+-- Events
+-- ============================================================
+CREATE TABLE IF NOT EXISTS events (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  type VARCHAR(255) NOT NULL,
+  aggregate_type VARCHAR(255) NOT NULL,
+  aggregate_id UUID NOT NULL,
+  payload JSONB NOT NULL,
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  processed BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+-- RULE-event-idempotency: eventos que esgotam retries vão para DLQ durável
+CREATE TABLE IF NOT EXISTS dead_letter_events (
+  id UUID PRIMARY KEY,
+  type VARCHAR(255) NOT NULL,
+  aggregate_type VARCHAR(255) NOT NULL,
+  aggregate_id UUID NOT NULL,
+  payload JSONB NOT NULL,
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  error TEXT,
+  attempts INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_dle_type ON dead_letter_events(type);
+CREATE INDEX IF NOT EXISTS idx_dle_created ON dead_letter_events(created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_events_type ON events(type);
+CREATE INDEX IF NOT EXISTS idx_events_tenant ON events(tenant_id) WHERE tenant_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_events_aggregate ON events(aggregate_type, aggregate_id);
+CREATE INDEX IF NOT EXISTS idx_events_processed ON events(processed);
+CREATE INDEX IF NOT EXISTS idx_events_created ON events(created_at DESC);
+
+-- ============================================================
+-- Audit Logs
+-- ============================================================
+CREATE TABLE IF NOT EXISTS audit_logs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  user_id UUID REFERENCES users(id) ON DELETE SET NULL,
+  action VARCHAR(255) NOT NULL,
+  resource_type VARCHAR(255) NOT NULL,
+  resource_id UUID,
+  changes JSONB,
+  ip_address VARCHAR(45),
+  user_agent TEXT,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_logs_tenant ON audit_logs(tenant_id) WHERE tenant_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_audit_logs_user ON audit_logs(user_id) WHERE user_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_audit_logs_resource ON audit_logs(resource_type, resource_id);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_created ON audit_logs(created_at DESC);
+
+-- ============================================================
+-- Migrations
+-- ============================================================
+CREATE TABLE IF NOT EXISTS migrations (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  owner VARCHAR(255) NOT NULL,
+  owner_type VARCHAR(20) NOT NULL CHECK (owner_type IN ('CORE', 'PLUGIN')),
+  version VARCHAR(50) NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  applied_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  checksum VARCHAR(255) NOT NULL,
+  UNIQUE(tenant_id, owner, version)
+);
+
+CREATE INDEX IF NOT EXISTS idx_migrations_tenant ON migrations(tenant_id);
+
+-- ============================================================
+-- Components
+-- ============================================================
+CREATE TABLE IF NOT EXISTS components (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name VARCHAR(255) NOT NULL,
+  source VARCHAR(20) NOT NULL CHECK (source IN ('CORE', 'THEME', 'PLUGIN')),
+  source_id UUID,
+  version VARCHAR(50) NOT NULL,
+  schema JSONB NOT NULL,
+  priority INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_components_name ON components(name);
+CREATE INDEX IF NOT EXISTS idx_components_source ON components(source);
+
+-- ============================================================
+-- Content Types
+-- ============================================================
+CREATE TABLE IF NOT EXISTS content_types (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL UNIQUE,
+  source VARCHAR(20) NOT NULL CHECK (source IN ('CORE', 'PLUGIN')),
+  source_id UUID,
+  schema JSONB NOT NULL,
+  plural_label VARCHAR(255) NOT NULL,
+  singular_label VARCHAR(255) NOT NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_content_types_slug ON content_types(slug);
+
+-- ============================================================
+-- Webhooks
+-- ============================================================
+CREATE TABLE IF NOT EXISTS webhooks (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  url VARCHAR(1000) NOT NULL,
+  events JSONB NOT NULL DEFAULT '[]'::jsonb,
+  secret VARCHAR(255) NOT NULL,
+  active BOOLEAN NOT NULL DEFAULT true,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhooks_tenant ON webhooks(tenant_id);
+
+-- ============================================================
+-- Sessions
+-- ============================================================
+CREATE TABLE IF NOT EXISTS sessions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  token VARCHAR(255) NOT NULL,
+  ip_address VARCHAR(45),
+  user_agent TEXT,
+  expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_tenant ON sessions(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
+
+-- ============================================================
+-- Custom Taxonomies (SDD ENTI-025)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS taxonomies (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL,
+  hierarchical BOOLEAN NOT NULL DEFAULT false,
+  attach_to JSONB NOT NULL DEFAULT '[]'::jsonb,
+  labels JSONB NOT NULL DEFAULT '{}'::jsonb,
+  meta JSONB NOT NULL DEFAULT '{}'::jsonb,
+  source VARCHAR(20) NOT NULL DEFAULT 'ADMIN' CHECK (source IN ('CORE', 'PLUGIN', 'ADMIN')),
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  UNIQUE(tenant_id, slug)
+);
+
+CREATE INDEX IF NOT EXISTS idx_taxonomies_tenant ON taxonomies(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_taxonomies_slug ON taxonomies(slug);
+ALTER TABLE taxonomies ENABLE ROW LEVEL SECURITY;
+CREATE POLICY tenant_isolation_taxonomies ON taxonomies
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+
+-- ============================================================
+-- Field Groups (SDD ENTI-026)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS field_groups (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  title VARCHAR(255) NOT NULL,
+  key VARCHAR(255) NOT NULL UNIQUE,
+  location_rules JSONB NOT NULL DEFAULT '[]'::jsonb,
+  position VARCHAR(20) NOT NULL DEFAULT 'normal' CHECK (position IN ('normal', 'side', 'acf_after_title')),
+  display_style VARCHAR(20) NOT NULL DEFAULT 'standard' CHECK (display_style IN ('standard', 'seamless', 'grouped')),
+  active BOOLEAN NOT NULL DEFAULT true,
+  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_field_groups_tenant ON field_groups(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_field_groups_active ON field_groups(active);
+ALTER TABLE field_groups ENABLE ROW LEVEL SECURITY;
+CREATE POLICY tenant_isolation_field_groups ON field_groups
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+
+-- ============================================================
+-- Field Definitions (SDD ENTI-027)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS field_definitions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  group_id UUID NOT NULL REFERENCES field_groups(id) ON DELETE CASCADE,
+  parent_field_id UUID REFERENCES field_definitions(id) ON DELETE CASCADE,
+  layout_id UUID,
+  type VARCHAR(100) NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  key VARCHAR(255) NOT NULL UNIQUE,
+  label VARCHAR(500) NOT NULL,
+  instructions TEXT,
+  required BOOLEAN NOT NULL DEFAULT false,
+  config JSONB NOT NULL DEFAULT '{}'::jsonb,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_field_definitions_group ON field_definitions(group_id);
+CREATE INDEX IF NOT EXISTS idx_field_definitions_parent ON field_definitions(parent_field_id) WHERE parent_field_id IS NOT NULL;
+ALTER TABLE field_definitions ENABLE ROW LEVEL SECURITY;
+CREATE POLICY tenant_isolation_field_definitions ON field_definitions
+  USING (EXISTS (
+    SELECT 1 FROM field_groups fg
+    WHERE fg.id = field_definitions.group_id
+      AND (fg.tenant_id = current_setting('app.current_tenant_id', true)::uuid OR fg.tenant_id IS NULL)
+  ));
+
+-- ============================================================
+-- Flexible Layouts (SDD ENTI-028)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS flexible_layouts (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  field_id UUID NOT NULL REFERENCES field_definitions(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  label VARCHAR(500) NOT NULL,
+  display VARCHAR(20) NOT NULL DEFAULT 'block' CHECK (display IN ('block', 'table', 'row')),
+  min INTEGER,
+  max INTEGER,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  UNIQUE(field_id, name)
+);
+
+CREATE INDEX IF NOT EXISTS idx_flexible_layouts_field ON flexible_layouts(field_id);
+
+-- ============================================================
+-- Taxonomy Terms & Content Terms (DECI-022 binding por referência)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS taxonomy_terms (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  taxonomy_id UUID NOT NULL REFERENCES taxonomies(id) ON DELETE CASCADE,
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  name VARCHAR(255) NOT NULL,
+  slug VARCHAR(255) NOT NULL,
+  description TEXT,
+  parent_id UUID REFERENCES taxonomy_terms(id) ON DELETE SET NULL,
+  meta JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  UNIQUE(taxonomy_id, slug)
+);
+
+CREATE INDEX IF NOT EXISTS idx_taxonomy_terms_taxonomy ON taxonomy_terms(taxonomy_id);
+CREATE INDEX IF NOT EXISTS idx_taxonomy_terms_parent ON taxonomy_terms(parent_id) WHERE parent_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS content_taxonomy_terms (
+  content_id UUID NOT NULL REFERENCES content(id) ON DELETE CASCADE,
+  term_id UUID NOT NULL REFERENCES taxonomy_terms(id) ON DELETE CASCADE,
+  PRIMARY KEY (content_id, term_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_content_terms_content ON content_taxonomy_terms(content_id);
+CREATE INDEX IF NOT EXISTS idx_content_terms_term ON content_taxonomy_terms(term_id);
+
+-- ============================================================
+-- Row Level Security Policies
+-- ============================================================
+
+-- Enable RLS on all tenant-scoped tables
+ALTER TABLE content ENABLE ROW LEVEL SECURITY;
+ALTER TABLE media ENABLE ROW LEVEL SECURITY;
+ALTER TABLE categories ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tags ENABLE ROW LEVEL SECURITY;
+ALTER TABLE menus ENABLE ROW LEVEL SECURITY;
+ALTER TABLE settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE plugins ENABLE ROW LEVEL SECURITY;
+ALTER TABLE themes ENABLE ROW LEVEL SECURITY;
+ALTER TABLE builds ENABLE ROW LEVEL SECURITY;
+ALTER TABLE deployments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_logs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE sessions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE webhooks ENABLE ROW LEVEL SECURITY;
+
+-- RLS Policies using app.current_tenant_id session variable
+CREATE POLICY tenant_isolation_content ON content
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_media ON media
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_categories ON categories
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_tags ON tags
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_menus ON menus
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_settings ON settings
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+
+CREATE POLICY tenant_isolation_plugins ON plugins
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+
+CREATE POLICY tenant_isolation_themes ON themes
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+
+CREATE POLICY tenant_isolation_builds ON builds
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_deployments ON deployments
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_events ON events
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_audit_logs ON audit_logs
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_sessions ON sessions
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
+
+CREATE POLICY tenant_isolation_webhooks ON webhooks
+  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@oktis-works/database",
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc && cp src/schema/schema.sql dist/schema/schema.sql",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "db:migrate": "node --loader ts-node/esm src/migrations/runner.ts",
+    "db:rollback": "node --loader ts-node/esm src/migrations/runner.ts rollback"
+  },
+  "dependencies": {
+    "@oktis-works/types": "0.1.0",
+    "@oktis-works/config": "0.1.0",
+    "postgres": "3.4.0"
+  },
+  "devDependencies": {
+    "typescript": "5.7.3",
+    "ts-node": "10.9.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/blacklotus/blacklotus-cms",
+    "directory": "packages/database"
+  }
+}