@sonicjs-cms/core 3.0.0-beta.12 → 3.0.0-beta.14

package/dist/{chunk-KI5KMJH2.cjs → chunk-H5FB6GKR.cjs}

@@ -272,5 +272,5 @@ var MigrationService = class {
 
 exports.MigrationService = MigrationService;
 exports.ensureScalarSchema = ensureScalarSchema;
-//# sourceMappingURL=chunk-KI5KMJH2.cjs.map
-//# sourceMappingURL=chunk-KI5KMJH2.cjs.map
+//# sourceMappingURL=chunk-H5FB6GKR.cjs.map
+//# sourceMappingURL=chunk-H5FB6GKR.cjs.map

package/dist/{chunk-KI5KMJH2.cjs.map → chunk-H5FB6GKR.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/db/migrations-bundle.ts","../src/services/document-scalar-schema.ts","../src/services/migrations.ts"],"names":[],"mappings":";;;AAiBO,IAAM,iBAAA,GAAwC;AAAA,EACnD;AAAA,IACE,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,MAAA;AAAA,IACN,QAAA,EAAU,eAAA;AAAA,IACV,WAAA,EAAa,sBAAA;AAAA,IACb,GAAA,EAAK;AAAA,GACP;AAAA,EACA;AAAA,IACE,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,WAAA;AAAA,IACN,QAAA,EAAU,oBAAA;AAAA,IACV,WAAA,EAAa,2BAAA;AAAA,IACb,GAAA,EAAK;AAAA;AAET,CAAA;AAGiC,IAAI,GAAA;AAAA,EACnC,kBAAkB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,EAAA,EAAI,CAAC,CAAC;AACtC;;;AC/BA,IAAM,eAAA,GAAkB,oBAAA;AAGxB,SAAS,SAAS,IAAA,EAA4D;AAC5E,EAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAC9B,EAAA,IAAI,SAAS,SAAA,IAAa,IAAA,KAAS,SAAA,IAAa,IAAA,KAAS,QAAQ,OAAO,SAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,IAAA,GAAO,CAAC,CAAA,KAAc,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAQvF,SAAS,aAAA,CAAc,QAAgB,CAAA,EAA2B;AACvE,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,OAAO,CAAA,CAAE,MAAA;AACvB,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,CAAA,CAAE,IAAI,CAAC,CAAA,CAAA;AAC9C,EAAA,OAAO,IAAA,CAAK,UAAU,EAAA,GAAK,IAAA,GAAO,KAAK,IAAA,CAAK,MAAM,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,IAAI,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAC/F;AAaA,eAAsB,kBAAA,CACpB,EAAA,EACA,MAAA,EACA,MAAA,EACmB;AACnB,EAAA,MAAM,UAAU,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AACxD,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAGlC,EAAA,IAAI,QAAA,uBAAe,GAAA,EAAY;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,EAAA,CAAG,OAAA,CAAQ,kDAAkD,EAAE,GAAA,EAAI;AACtF,IAAA,QAAA,GAAW,IAAI,GAAA,CAAA,CAAK,IAAA,EAAM,OAAA,IAAW,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAClE,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC9B,MAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,eAAA,CAAY,CAAA;AAC7F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,IAAA,IAAQ,CAAA,EAAA,EAAK,EAAE,IAAI,CAAA,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,GAAG,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,gBAAA,CAAa,CAAA;AAC3F,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,EAAA,CACH,OAAA,CAAQ,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAA,EAAI,QAAA,CAAS,CAAA,CAAE,IAAI,CAAC,CAAA,yBAAA,EAA4B,IAAI,CAAA,WAAA,CAAa,EAChH,GAAA,EAAI;AACP,QAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,gCAAA,EAAmC,GAAG,CAAA,WAAA,EAAc,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC3E,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,MAAM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACjE,QAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,uBAAuB,CAAA,EAAG;AAC1C,UAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,wCAAA,EAA2C,GAAG,CAAA,CAAA,CAAA,EAAK,GAAG,CAAA;AACpE,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAMA,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CACH,QAAQ,CAAA,+BAAA,EAAkC,GAAG,qCAAqC,GAAG,CAAA,2BAAA,CAA6B,EAClH,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qCAAA,EAAwC,GAAG,CAAA,CAAA,CAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IACtH;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;AC5EO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAAoB,EAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrC,MAAM,yBAAA,GAA2C;AAAA,EAEjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAA,GAA+C;AACnD,IAAA,MAAM,aAA0B,EAAC;AACjC,IAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,sBAAA,EAAuB;AAC5D,IAAA,MAAM,KAAK,yBAAA,EAA0B;AAGrC,IAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,MAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAChD,MAAA,MAAM,WAAA,GAAc,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAEpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,OAAA;AAAA,QACA,SAAA,EAAW,OAAA,GAAU,WAAA,EAAa,UAAA,GAAa,MAAA;AAAA,QAC/C,IAAA,EAAM,QAAQ,GAAA,CAAI;AAAA,OACnB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAA,GAAoD;AAChE,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,QAClC;AAAA,QACA,GAAA,EAAI;AAEN,MAAA,OAAO,IAAI,GAAA;AAAA,QAAA,CACR,cAAc,OAAA,IAAW,EAAC,EACxB,GAAA,CAAI,CAAC,GAAA,KAAa;AACjB,UAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA;AACtC,UAAA,MAAM,EAAA,GAAK,QAAA,CAAS,KAAA,CAAM,QAAQ,IAAI,CAAC,CAAA;AACvC,UAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,UAAA,OAAO,CAAC,EAAA,EAAI;AAAA,YACV,EAAA;AAAA,YACA,IAAA,EAAM,QAAA;AAAA,YACN,QAAA;AAAA,YACA,YAAY,GAAA,CAAI;AAAA,WACjB,CAAA;AAAA,QACH,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,KAAA,KAAkC,UAAU,IAAI;AAAA,OAC7D;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,2BAAW,GAAA,EAAI;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,yBAAA,GAA2C;AAC/C,IAAA,IAAI,MAAM,IAAA,CAAK,gBAAA,CAAiB,CAAC,WAAW,CAAC,CAAA,EAAG;AAC9C,MAAA,MAAM,KAAK,8BAAA,EAA+B;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,8BAAA,GAAgD;AAC5D,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,iBAAiB,CAAC,gBAAgB,CAAC,CAAA,EAAI;AACxD,IAAA,MAAM,OAAO,MAAM,IAAA,CAAK,GACrB,OAAA,CAAQ,qEAAqE,EAC7E,GAAA,EAA8C;AACjD,IAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACpC,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,gBAAgB,CAAA;AAAA,MAC1C,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AACA,MAAA,MAAM,kBAAA,CAAmB,IAAA,CAAK,EAAA,EAAI,GAAA,CAAI,IAAI,MAAM,CAAA;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAiB,UAAA,EAAwC;AACrE,IAAA,IAAI;AACF,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,UAC3B,CAAA,4DAAA;AAAA,SACF,CAAE,IAAA,CAAK,SAAS,CAAA,CAAE,KAAA,EAAM;AAExB,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAA,CAAkB,SAAA,EAAmB,UAAA,EAAsC;AACvF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,QAC3B,CAAA,iDAAA;AAAA,OACF,CAAE,IAAA,CAAK,SAAA,EAAW,UAAU,EAAE,KAAA,EAAM;AAEpC,MAAA,OAAO,CAAC,CAAC,MAAA;AAAA,IACX,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,GAA+C;AACnD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,sBAAA,EAAuB;AACrD,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,OAAO,CAAA;AAC1D,IAAA,MAAM,oBAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA;AAE3D,IAAA,MAAM,WAAA,GAAc,kBAAkB,MAAA,GAAS,CAAA,GAC3C,kBAAkB,iBAAA,CAAkB,MAAA,GAAS,CAAC,CAAA,EAAG,SAAA,GACjD,MAAA;AAEJ,IAAA,OAAO;AAAA,MACL,iBAAiB,UAAA,CAAW,MAAA;AAAA,MAC5B,mBAAmB,iBAAA,CAAkB,MAAA;AAAA,MACrC,mBAAmB,iBAAA,CAAkB,MAAA;AAAA,MACrC,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CAAqB,WAAA,EAAqB,IAAA,EAAc,QAAA,EAAiC;AAGxF,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,WAAA,EAAoC;AAC1D,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,WAAA,EAAuC;AAC9D,IAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,sBAAA,EAAuB;AAC5D,IAAA,OAAO,iBAAA,CAAkB,IAAI,WAAW,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAA,GAAqD;AACzD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,sBAAA,EAAuB;AACrD,IAAA,OAAO,UAAA,CAAW,OAAO,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,CAAA,CAAE,EAAA,CAAG,EAAE,CAAA,IAAK,IAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,GAA4G;AAChH,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,OAAA,EAAS,uIAAA;AAAA,MACT,SAAS,EAAC;AAAA,MACV,QAAQ;AAAC,KACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,GAAgE;AACpE,IAAA,MAAM,SAAmB,EAAC;AAG1B,IAAA,MAAM,cAAA,GAAiB;AAAA,MACrB,OAAA;AAAA,MAAS,WAAA;AAAA,MAAa;AAAA,KACxB;AAEA,IAAA,KAAA,MAAW,SAAS,cAAA,EAAgB;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,KAAK,EAAA,CAAG,OAAA,CAAQ,wBAAwB,KAAK,CAAA,QAAA,CAAU,EAAE,KAAA,EAAM;AAAA,MACvE,SAAS,KAAA,EAAO;AACd,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAE,CAAA;AAAA,MACvC;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,OAAO,MAAA,KAAW,CAAA;AAAA,MACzB;AAAA,KACF;AAAA,EACF;AACF","file":"chunk-KI5KMJH2.cjs","sourcesContent":["/**\n * AUTO-GENERATED FILE - DO NOT EDIT\n * Generated by: scripts/generate-migrations.ts\n * Generated at: 2026-06-25T17:24:06.727Z\n *\n * This file contains all migration SQL bundled for use in Cloudflare Workers\n * where filesystem access is not available at runtime.\n */\n\nexport interface BundledMigration {\n  id: string\n  name: string\n  filename: string\n  description: string\n  sql: string\n}\n\nexport const bundledMigrations: BundledMigration[] = [\n  {\n    id: '0001',\n    name: 'Core',\n    filename: '0001_core.sql',\n    description: 'Migration 0001: Core',\n    sql: \"-- Migration 0001: Auth tables\\n-- auth_user, auth_session, auth_account, auth_verification + BA plugin tables + RBAC + auth support.\\n-- Only auth_* prefixed tables live here. All content lives in document_* tables (0002_documents.sql).\\n\\n-- ── auth_user ────────────────────────────────────────────────────────────────\\n-- BA user model + SonicJS domain columns as BA additionalFields.\\nCREATE TABLE IF NOT EXISTS auth_user (\\n  id TEXT PRIMARY KEY,\\n  name TEXT,\\n  email TEXT NOT NULL UNIQUE,\\n  email_verified INTEGER NOT NULL DEFAULT 0,\\n  image TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL,\\n  -- SonicJS additionalFields\\n  first_name TEXT NOT NULL,\\n  last_name TEXT NOT NULL,\\n  role TEXT NOT NULL DEFAULT 'viewer',\\n  -- Platform super-admin: bypasses the multi-tenant membership gate, uses global roles in every\\n  -- tenant. Opt-in (default 0); intentionally NOT derived from the 'admin' role.\\n  is_super_admin INTEGER NOT NULL DEFAULT 0,\\n  avatar TEXT,\\n  password_hash TEXT,\\n  is_active INTEGER NOT NULL DEFAULT 1,\\n  last_login_at INTEGER,\\n  phone TEXT,\\n  bio TEXT,\\n  timezone TEXT DEFAULT 'UTC',\\n  language TEXT DEFAULT 'en',\\n  email_notifications INTEGER DEFAULT 1,\\n  theme TEXT DEFAULT 'dark',\\n  invitation_token TEXT,\\n  invited_by TEXT,\\n  invited_at INTEGER,\\n  accepted_invitation_at INTEGER,\\n  failed_login_count INTEGER NOT NULL DEFAULT 0,\\n  locked_until INTEGER\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_auth_user_email ON auth_user(email);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_role ON auth_user(role);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_invitation_token ON auth_user(invitation_token);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_locked_until ON auth_user(locked_until) WHERE locked_until IS NOT NULL;\\n\\n-- ── auth_session ─────────────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_session (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  token TEXT NOT NULL UNIQUE,\\n  expires_at INTEGER NOT NULL,\\n  ip_address TEXT,\\n  user_agent TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_user_id ON auth_session(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_token ON auth_session(token);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_expires_at ON auth_session(expires_at);\\n\\n-- ── auth_account ─────────────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_account (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  account_id TEXT NOT NULL,\\n  provider_id TEXT NOT NULL,\\n  access_token TEXT,\\n  refresh_token TEXT,\\n  access_token_expires_at INTEGER,\\n  refresh_token_expires_at INTEGER,\\n  scope TEXT,\\n  id_token TEXT,\\n  password TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_account_user_id ON auth_account(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_account_provider ON auth_account(provider_id, account_id);\\n\\n-- ── auth_verification ────────────────────────────────────────────────────────\\n-- Covers email verification, password reset, magic-link tokens, OTP codes.\\nCREATE TABLE IF NOT EXISTS auth_verification (\\n  id TEXT PRIMARY KEY,\\n  identifier TEXT NOT NULL,\\n  value TEXT NOT NULL,\\n  expires_at INTEGER NOT NULL,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_verification_identifier ON auth_verification(identifier);\\n\\n-- ── BA plugin tables ──────────────────────────────────────────────────────────\\n\\nCREATE TABLE IF NOT EXISTS auth_two_factor (\\n  id           TEXT PRIMARY KEY,\\n  secret       TEXT NOT NULL,\\n  backup_codes TEXT NOT NULL,\\n  user_id      TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  verified     INTEGER NOT NULL DEFAULT 1,\\n  created_at   INTEGER NOT NULL,\\n  updated_at   INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_two_factor_user_id ON auth_two_factor(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant (\\n  id         TEXT PRIMARY KEY,\\n  name       TEXT NOT NULL,\\n  slug       TEXT NOT NULL UNIQUE,\\n  logo       TEXT,\\n  metadata   TEXT,\\n  -- SonicJS tenant-resolution fields (BA organization additionalFields):\\n  status     TEXT NOT NULL DEFAULT 'active',\\n  domain     TEXT,\\n  notes      TEXT NOT NULL DEFAULT '',\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_domain ON auth_tenant(domain);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_member (\\n  id        TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  user_id   TEXT NOT NULL REFERENCES auth_user(id)   ON DELETE CASCADE,\\n  role      TEXT NOT NULL DEFAULT 'member',\\n  email     TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL,\\n  UNIQUE(tenant_id, user_id)\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_tenant ON auth_tenant_member(tenant_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_user   ON auth_tenant_member(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_invitation (\\n  id         TEXT PRIMARY KEY,\\n  tenant_id  TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  email      TEXT NOT NULL,\\n  role       TEXT NOT NULL DEFAULT 'member',\\n  status     TEXT NOT NULL DEFAULT 'pending',\\n  expires_at INTEGER NOT NULL,\\n  inviter_id TEXT REFERENCES auth_user(id) ON DELETE SET NULL,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_tenant ON auth_tenant_invitation(tenant_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_email  ON auth_tenant_invitation(email);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_team (\\n  id        TEXT PRIMARY KEY,\\n  name      TEXT NOT NULL,\\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\n\\n-- ── RBAC ─────────────────────────────────────────────────────────────────────\\n-- RBAC roles, verbs, and user-role assignments are document-backed (is_auth doc\\n-- types rbac_role / rbac_verb / rbac_user_roles — see services/rbac.ts). The\\n-- system roles/verbs/grants are seeded at bootstrap by RbacService.ensureSystemRbacSeed().\\n-- No auth_rbac_* tables.\\n\\n-- ── Auth support tables ───────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_password_history (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  password_hash TEXT NOT NULL,\\n  created_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_password_history_user_id ON auth_password_history(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_api_tokens (\\n  id TEXT PRIMARY KEY,\\n  name TEXT NOT NULL,\\n  token TEXT NOT NULL UNIQUE,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id),\\n  permissions TEXT NOT NULL,\\n  expires_at INTEGER,\\n  last_used_at INTEGER,\\n  created_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_user ON auth_api_tokens(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_token ON auth_api_tokens(token);\\n\\n-- User profiles moved to the document model: a `user_profile` document (is_auth type),\\n-- one per user, addressed by slug = userId. See services/document-types-seed.ts and\\n-- plugins/core-plugins/user-profiles/user-profile-document.ts. No auth_user_profiles table.\\n\"\n  },\n  {\n    id: '0002',\n    name: 'Documents',\n    filename: '0002_documents.sql',\n    description: 'Migration 0002: Documents',\n    sql: \"-- Migration 0002: Document Schema (v3 greenfield)\\n-- Contains only the new document data model tables, generated columns, and indexes.\\n\\n-- Document type registry\\nCREATE TABLE IF NOT EXISTS document_types (\\n  id TEXT PRIMARY KEY,\\n  name TEXT NOT NULL UNIQUE,\\n  display_name TEXT NOT NULL,\\n  description TEXT,\\n  schema TEXT NOT NULL DEFAULT '{}',\\n  queryable_fields TEXT NOT NULL DEFAULT '[]',\\n  settings TEXT NOT NULL DEFAULT '{}',\\n  plugin_id TEXT,\\n  source TEXT NOT NULL DEFAULT 'code' CHECK (source IN ('code', 'plugin', 'system')),\\n  schema_version INTEGER NOT NULL DEFAULT 1,\\n  is_system INTEGER NOT NULL DEFAULT 0,\\n  is_active INTEGER NOT NULL DEFAULT 1,\\n  is_auth INTEGER NOT NULL DEFAULT 0,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_document_types_plugin ON document_types(plugin_id);\\nCREATE INDEX IF NOT EXISTS idx_document_types_active ON document_types(is_active);\\n\\n-- Documents: canonical document rows and historical versions.\\nCREATE TABLE IF NOT EXISTS documents (\\n  id TEXT PRIMARY KEY,\\n  root_id TEXT NOT NULL,\\n  type_id TEXT NOT NULL REFERENCES document_types(id),\\n  type_version INTEGER NOT NULL DEFAULT 1,\\n\\n  version_of_id TEXT REFERENCES documents(id),\\n  version_number INTEGER NOT NULL DEFAULT 1,\\n\\n  is_current_draft INTEGER NOT NULL DEFAULT 1,\\n  is_published INTEGER NOT NULL DEFAULT 0,\\n  status TEXT NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'published', 'archived')),\\n\\n  parent_root_id TEXT NOT NULL DEFAULT '',\\n  slug TEXT,\\n  path TEXT,\\n  title TEXT,\\n  zone TEXT,\\n  sort_order INTEGER NOT NULL DEFAULT 0,\\n  visible INTEGER NOT NULL DEFAULT 1,\\n\\n  published_at INTEGER,\\n  scheduled_at INTEGER,\\n  expires_at INTEGER,\\n  deleted_at INTEGER,\\n\\n  tenant_id TEXT NOT NULL DEFAULT 'default',\\n  locale TEXT NOT NULL DEFAULT 'default',\\n  translation_group_id TEXT NOT NULL DEFAULT '',\\n\\n  data TEXT NOT NULL DEFAULT '{}',\\n  metadata TEXT NOT NULL DEFAULT '{}',\\n\\n  owner_id TEXT,\\n  created_by TEXT,\\n  updated_by TEXT,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\n-- Queryable scalar fields (VIRTUAL generated columns) and their q_* filter indexes\\n-- are AUTO-GENERATED at runtime from each document type's queryableFields config —\\n-- see DocumentTypeRegistry.register() -> ensureScalarSchema() (document-scalar-schema.ts).\\n-- Do not hand-add q_* columns/indexes here; declare the field in the type instead.\\n\\n-- Revision chain\\nCREATE INDEX IF NOT EXISTS idx_documents_root ON documents(root_id, version_number DESC);\\n\\n-- List / lifecycle\\nCREATE INDEX IF NOT EXISTS idx_documents_published ON documents(tenant_id, type_id, locale, is_published)\\n  WHERE is_published = 1 AND deleted_at IS NULL;\\nCREATE INDEX IF NOT EXISTS idx_documents_drafts ON documents(tenant_id, type_id, status, is_current_draft)\\n  WHERE is_current_draft = 1;\\nCREATE INDEX IF NOT EXISTS idx_documents_parent ON documents(tenant_id, parent_root_id, sort_order, is_published);\\nCREATE INDEX IF NOT EXISTS idx_documents_path ON documents(tenant_id, path);\\nCREATE INDEX IF NOT EXISTS idx_documents_translation ON documents(translation_group_id, locale);\\nCREATE INDEX IF NOT EXISTS idx_documents_deleted ON documents(deleted_at);\\nCREATE INDEX IF NOT EXISTS idx_documents_scheduled ON documents(scheduled_at) WHERE scheduled_at IS NOT NULL;\\nCREATE INDEX IF NOT EXISTS idx_documents_expires ON documents(expires_at) WHERE expires_at IS NOT NULL;\\n\\n-- Stable keyset/cursor pagination for published lists\\nCREATE INDEX IF NOT EXISTS idx_documents_published_cursor\\n  ON documents(tenant_id, type_id, updated_at DESC, id DESC)\\n  WHERE is_published = 1 AND deleted_at IS NULL;\\n\\n-- (q_* generated-column filter indexes are auto-created at runtime — see note above.)\\n\\n-- Partial unique indexes: the hard concurrency guarantees for draft/publish invariants.\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_current_draft\\n  ON documents(root_id) WHERE is_current_draft = 1;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_published\\n  ON documents(root_id) WHERE is_published = 1;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_version\\n  ON documents(root_id, version_number);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_slug\\n  ON documents(tenant_id, locale, type_id, parent_root_id, slug)\\n  WHERE is_current_draft = 1 AND deleted_at IS NULL AND slug IS NOT NULL;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_translation_per_locale\\n  ON documents(tenant_id, translation_group_id, locale)\\n  WHERE is_current_draft = 1 AND translation_group_id <> '';\\n\\n-- Document references: typed document-to-document edges.\\nCREATE TABLE IF NOT EXISTS document_references (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  from_root_id TEXT NOT NULL,\\n  from_document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\\n  field_name TEXT NOT NULL,\\n  ordinal INTEGER NOT NULL DEFAULT 0,\\n  to_root_id TEXT NOT NULL,\\n  ref_strength TEXT NOT NULL DEFAULT 'weak' CHECK (ref_strength IN ('strong', 'weak')),\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_docref_to   ON document_references(tenant_id, to_root_id);\\nCREATE INDEX IF NOT EXISTS idx_docref_from ON document_references(from_document_id);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_docref_unique\\n  ON document_references(from_document_id, field_name, ordinal);\\n\\n-- Document facets: indexed rows for multi-valued scalar fields (e.g. tags arrays).\\nCREATE TABLE IF NOT EXISTS document_facets (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\\n  root_id TEXT NOT NULL,\\n  type_id TEXT NOT NULL,\\n  field_name TEXT NOT NULL,\\n  ordinal INTEGER NOT NULL DEFAULT 0,\\n  value_text TEXT,\\n  value_number REAL,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_facets_lookup ON document_facets(tenant_id, type_id, field_name, value_text);\\nCREATE INDEX IF NOT EXISTS idx_facets_doc    ON document_facets(document_id);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_facets_unique\\n  ON document_facets(document_id, field_name, ordinal);\\n\\n-- Document permissions: per-document ACL overrides.\\nCREATE TABLE IF NOT EXISTS document_permissions (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  root_id TEXT NOT NULL,\\n  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'role', 'group', 'public', 'token')),\\n  principal_id TEXT NOT NULL,\\n  permission TEXT NOT NULL CHECK (permission IN ('read', 'create', 'update', 'delete', 'publish', 'manage')),\\n  effect TEXT NOT NULL DEFAULT 'allow' CHECK (effect IN ('allow', 'deny')),\\n  inherited INTEGER NOT NULL DEFAULT 0,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  created_by TEXT\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_document_permissions_root ON document_permissions(tenant_id, root_id);\\nCREATE INDEX IF NOT EXISTS idx_document_permissions_principal\\n  ON document_permissions(tenant_id, principal_type, principal_id, permission);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_document_permissions_unique\\n  ON document_permissions(root_id, principal_type, principal_id, permission);\\n\"\n  }\n]\n\n// Map for quick lookup by ID\nexport const migrationsByIdMap = new Map<string, BundledMigration>(\n  bundledMigrations.map(m => [m.id, m])\n)\n\n// Get migration SQL by ID\nexport function getMigrationSQLById(id: string): string | null {\n  return migrationsByIdMap.get(id)?.sql ?? null\n}\n\n// Get all migration info (without SQL for lighter payloads)\nexport function getMigrationList(): Array<Omit<BundledMigration, 'sql'>> {\n  return bundledMigrations.map(({ sql, ...rest }) => rest)\n}\n","import { D1Database } from '@cloudflare/workers-types'\nimport type { QueryableField } from '../schemas/document'\n\n// Identifiers and JSON paths are interpolated into DDL (they cannot be bound), so\n// they are format-guarded here. Source is trusted code config, not user input —\n// this is defense-in-depth, mirroring document-repository.ts.\nconst SAFE_IDENTIFIER = /^[a-z_][a-z0-9_]*$/\n\n/** Map a queryable field's logical type to a SQLite column affinity. */\nfunction affinity(type?: QueryableField['type']): 'TEXT' | 'INTEGER' | 'REAL' {\n  if (type === 'number') return 'REAL'\n  if (type === 'integer' || type === 'boolean' || type === 'date') return 'INTEGER'\n  return 'TEXT'\n}\n\nconst slug = (s: string) => s.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '')\n\n/**\n * Authoritative generated-column name for a scalar field. An explicit `column`\n * always wins (back-compat with every existing type definition); otherwise it is\n * derived deterministically from the type id + field name. The repository reads\n * the same `column`/derivation when building filter SQL, so the two never drift.\n */\nexport function resolveColumn(typeId: string, f: QueryableField): string {\n  if (f.column) return f.column\n  const name = `q_${slug(typeId)}_${slug(f.name)}`\n  return name.length <= 60 ? name : `q_${slug(typeId).slice(0, 20)}_${slug(f.name).slice(0, 20)}`\n}\n\n/**\n * Idempotently ensure the `documents` table has a VIRTUAL generated column and a\n * filter/sort index for each of a type's scalar queryable fields. Safe to call on\n * every registration and every bootstrap: existing columns/indexes are skipped,\n * and a concurrent add surfaces as a swallowed \"duplicate column name\".\n *\n * Facet and reference fields need no DDL (generic document_facets /\n * document_references tables), so they are ignored here.\n *\n * Returns the columns it actually created (empty when all already existed).\n */\nexport async function ensureScalarSchema(\n  db: D1Database,\n  typeId: string,\n  fields: QueryableField[],\n): Promise<string[]> {\n  const scalars = fields.filter((f) => f.kind === 'scalar')\n  if (scalars.length === 0) return []\n\n  // pragma_table_info does NOT list VIRTUAL generated columns — use table_xinfo, which does.\n  let existing = new Set<string>()\n  try {\n    const info = await db.prepare(\"SELECT name FROM pragma_table_xinfo('documents')\").all()\n    existing = new Set((info?.results ?? []).map((r: any) => r.name))\n  } catch {\n    // table_xinfo unavailable — fall back to attempting every ALTER (duplicate errors swallowed).\n  }\n\n  const added: string[] = []\n  for (const f of scalars) {\n    const col = resolveColumn(typeId, f)\n    if (!SAFE_IDENTIFIER.test(col)) {\n      console.error(`[scalar-schema] unsafe column name '${col}' for ${typeId}.${f.name} — skipped`)\n      continue\n    }\n    const path = f.path ?? `$.${f.name}`\n    if (path.includes(\"'\")) {\n      console.error(`[scalar-schema] unsafe json path for ${col} (${typeId}.${f.name}) — skipped`)\n      continue\n    }\n\n    if (!existing.has(col)) {\n      try {\n        await db\n          .prepare(`ALTER TABLE documents ADD COLUMN ${col} ${affinity(f.type)} AS (json_extract(data, '${path}')) VIRTUAL`)\n          .run()\n        added.push(col)\n        console.log(`[scalar-schema] added documents.${col} for type '${typeId}'`)\n      } catch (error) {\n        const msg = error instanceof Error ? error.message : String(error)\n        if (!msg.includes('duplicate column name')) {\n          console.error(`[scalar-schema] failed to add documents.${col}:`, msg)\n          continue\n        }\n      }\n    }\n\n    // One general index per column: the leading (tenant_id, type_id, col) prefix\n    // serves every equality filter the repository builds; the trailing\n    // (updated_at DESC, id DESC) matches the default keyset sort/cursor. Non-partial\n    // so a single index covers both draft and published lists.\n    try {\n      await db\n        .prepare(`CREATE INDEX IF NOT EXISTS idx_${col} ON documents(tenant_id, type_id, ${col}, updated_at DESC, id DESC)`)\n        .run()\n    } catch (error) {\n      console.error(`[scalar-schema] failed to create idx_${col}:`, error instanceof Error ? error.message : String(error))\n    }\n  }\n  return added\n}\n","import { D1Database } from '@cloudflare/workers-types'\nimport { bundledMigrations } from '../db/migrations-bundle'\nimport { ensureScalarSchema } from './document-scalar-schema'\nimport type { QueryableField } from '../schemas/document'\n\nexport interface Migration {\n  id: string\n  name: string\n  filename: string\n  description?: string\n  applied: boolean\n  appliedAt?: string\n  size?: number\n}\n\nexport interface MigrationStatus {\n  totalMigrations: number\n  appliedMigrations: number\n  pendingMigrations: number\n  lastApplied?: string\n  migrations: Migration[]\n}\n\nexport class MigrationService {\n  constructor(private db: D1Database) {}\n\n  /**\n   * Cloudflare D1 owns migration bookkeeping through `d1_migrations`.\n   * SonicJS intentionally does not create its own tracking table.\n   */\n  async initializeMigrationsTable(): Promise<void> {\n    // Kept as a no-op for compatibility with older callers.\n  }\n\n  /**\n   * Get all available migrations from the bundled migrations\n   */\n  async getAvailableMigrations(): Promise<Migration[]> {\n    const migrations: Migration[] = []\n    const appliedMigrations = await this.getD1AppliedMigrations()\n    await this.ensureSchemaCompatibility()\n\n    // Use bundled migrations as the source of truth\n    for (const bundled of bundledMigrations) {\n      const applied = appliedMigrations.has(bundled.id)\n      const appliedData = appliedMigrations.get(bundled.id)\n\n      migrations.push({\n        id: bundled.id,\n        name: bundled.name,\n        filename: bundled.filename,\n        description: bundled.description,\n        applied,\n        appliedAt: applied ? appliedData?.applied_at : undefined,\n        size: bundled.sql.length\n      })\n    }\n\n    return migrations\n  }\n\n  /**\n   * Read Wrangler/D1's canonical migration table. If the table is absent, no\n   * migrations have been applied by the supported migration runner yet.\n   */\n  private async getD1AppliedMigrations(): Promise<Map<string, any>> {\n    try {\n      const appliedResult = await this.db.prepare(\n        'SELECT name, applied_at FROM d1_migrations ORDER BY applied_at ASC'\n      ).all()\n\n      return new Map(\n        (appliedResult.results ?? [])\n          .map((row: any) => {\n            const filename = String(row.name ?? '')\n            const id = filename.match(/^(\\d+)/)?.[1]\n            if (!id) return null\n            return [id, {\n              id,\n              name: filename,\n              filename,\n              applied_at: row.applied_at\n            }]\n          })\n          .filter((entry): entry is [string, any] => entry !== null)\n      )\n    } catch (error) {\n      return new Map()\n    }\n  }\n\n  /**\n   * Run idempotent compatibility repairs that are safe outside migration state.\n   */\n  async ensureSchemaCompatibility(): Promise<void> {\n    if (await this.checkTablesExist(['documents'])) {\n      await this.ensureDocumentGeneratedColumns()\n    }\n  }\n\n  /**\n   * Ensure the `documents` table exposes every queryable VIRTUAL generated column + index (D45).\n   * Data-driven repair: reconciles from each active type's `queryable_fields` rather than a hardcoded\n   * list, so it stays in sync with whatever types are registered. Generation of these columns is owned\n   * by DocumentTypeRegistry.register() (via ensureScalarSchema); this pass is a bootstrap safety net for\n   * a DB that has document_types rows but lost columns (e.g. table rebuilt). Idempotent.\n   */\n  private async ensureDocumentGeneratedColumns(): Promise<void> {\n    if (!(await this.checkTablesExist(['document_types']))) return\n    const rows = await this.db\n      .prepare('SELECT id, queryable_fields FROM document_types WHERE is_active = 1')\n      .all<{ id: string; queryable_fields: string }>()\n    for (const row of rows.results ?? []) {\n      let fields: QueryableField[]\n      try {\n        fields = JSON.parse(row.queryable_fields)\n      } catch {\n        continue\n      }\n      await ensureScalarSchema(this.db, row.id, fields)\n    }\n  }\n\n  /**\n   * Check if specific tables exist in the database\n   */\n  private async checkTablesExist(tableNames: string[]): Promise<boolean> {\n    try {\n      for (const tableName of tableNames) {\n        const result = await this.db.prepare(\n          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`\n        ).bind(tableName).first()\n\n        if (!result) {\n          return false\n        }\n      }\n      return true\n    } catch (error) {\n      return false\n    }\n  }\n\n  /**\n   * Check if a specific column exists in a table\n   */\n  private async checkColumnExists(tableName: string, columnName: string): Promise<boolean> {\n    try {\n      const result = await this.db.prepare(\n        `SELECT * FROM pragma_table_info(?) WHERE name = ?`\n      ).bind(tableName, columnName).first()\n\n      return !!result\n    } catch (error) {\n      return false\n    }\n  }\n\n  /**\n   * Get migration status summary\n   */\n  async getMigrationStatus(): Promise<MigrationStatus> {\n    const migrations = await this.getAvailableMigrations()\n    const appliedMigrations = migrations.filter(m => m.applied)\n    const pendingMigrations = migrations.filter(m => !m.applied)\n\n    const lastApplied = appliedMigrations.length > 0\n      ? appliedMigrations[appliedMigrations.length - 1]?.appliedAt\n      : undefined\n\n    return {\n      totalMigrations: migrations.length,\n      appliedMigrations: appliedMigrations.length,\n      pendingMigrations: pendingMigrations.length,\n      lastApplied,\n      migrations\n    }\n  }\n\n  /**\n   * D1 migration state is managed by Wrangler.\n   */\n  async markMigrationApplied(migrationId: string, name: string, filename: string): Promise<void> {\n    void migrationId\n    void name\n    void filename\n  }\n\n  /**\n   * D1 migration state is managed by Wrangler.\n   */\n  async removeMigrationApplied(migrationId: string): Promise<void> {\n    void migrationId\n  }\n\n  /**\n   * Check if a specific migration has been applied\n   */\n  async isMigrationApplied(migrationId: string): Promise<boolean> {\n    const appliedMigrations = await this.getD1AppliedMigrations()\n    return appliedMigrations.has(migrationId)\n  }\n\n  /**\n   * Get the last applied migration\n   */\n  async getLastAppliedMigration(): Promise<Migration | null> {\n    const migrations = await this.getAvailableMigrations()\n    return migrations.filter(m => m.applied).at(-1) ?? null\n  }\n\n  /**\n   * Run pending migrations\n   */\n  async runPendingMigrations(): Promise<{ success: boolean; message: string; applied: string[]; errors: string[] }> {\n    return {\n      success: false,\n      message: 'Migrations are managed by Cloudflare D1. Run `wrangler d1 migrations apply DB --local` or `wrangler d1 migrations apply DB --remote`.',\n      applied: [],\n      errors: []\n    }\n  }\n\n  /**\n   * Validate database schema\n   */\n  async validateSchema(): Promise<{ valid: boolean; issues: string[] }> {\n    const issues: string[] = []\n\n    // Basic table existence checks\n    const requiredTables = [\n      'users', 'documents', 'document_types'\n    ]\n\n    for (const table of requiredTables) {\n      try {\n        await this.db.prepare(`SELECT COUNT(*) FROM ${table} LIMIT 1`).first()\n      } catch (error) {\n        issues.push(`Missing table: ${table}`)\n      }\n    }\n\n    return {\n      valid: issues.length === 0,\n      issues\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/db/migrations-bundle.ts","../src/services/document-scalar-schema.ts","../src/services/migrations.ts"],"names":[],"mappings":";;;AAiBO,IAAM,iBAAA,GAAwC;AAAA,EACnD;AAAA,IACE,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,MAAA;AAAA,IACN,QAAA,EAAU,eAAA;AAAA,IACV,WAAA,EAAa,sBAAA;AAAA,IACb,GAAA,EAAK;AAAA,GACP;AAAA,EACA;AAAA,IACE,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,WAAA;AAAA,IACN,QAAA,EAAU,oBAAA;AAAA,IACV,WAAA,EAAa,2BAAA;AAAA,IACb,GAAA,EAAK;AAAA;AAET,CAAA;AAGiC,IAAI,GAAA;AAAA,EACnC,kBAAkB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,EAAA,EAAI,CAAC,CAAC;AACtC;;;AC/BA,IAAM,eAAA,GAAkB,oBAAA;AAGxB,SAAS,SAAS,IAAA,EAA4D;AAC5E,EAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAC9B,EAAA,IAAI,SAAS,SAAA,IAAa,IAAA,KAAS,SAAA,IAAa,IAAA,KAAS,QAAQ,OAAO,SAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,IAAA,GAAO,CAAC,CAAA,KAAc,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAQvF,SAAS,aAAA,CAAc,QAAgB,CAAA,EAA2B;AACvE,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,OAAO,CAAA,CAAE,MAAA;AACvB,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,CAAA,CAAE,IAAI,CAAC,CAAA,CAAA;AAC9C,EAAA,OAAO,IAAA,CAAK,UAAU,EAAA,GAAK,IAAA,GAAO,KAAK,IAAA,CAAK,MAAM,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,IAAI,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAC/F;AAaA,eAAsB,kBAAA,CACpB,EAAA,EACA,MAAA,EACA,MAAA,EACmB;AACnB,EAAA,MAAM,UAAU,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AACxD,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAGlC,EAAA,IAAI,QAAA,uBAAe,GAAA,EAAY;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,EAAA,CAAG,OAAA,CAAQ,kDAAkD,EAAE,GAAA,EAAI;AACtF,IAAA,QAAA,GAAW,IAAI,GAAA,CAAA,CAAK,IAAA,EAAM,OAAA,IAAW,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAClE,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC9B,MAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,eAAA,CAAY,CAAA;AAC7F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,IAAA,IAAQ,CAAA,EAAA,EAAK,EAAE,IAAI,CAAA,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,GAAG,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,gBAAA,CAAa,CAAA;AAC3F,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,EAAA,CACH,OAAA,CAAQ,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAA,EAAI,QAAA,CAAS,CAAA,CAAE,IAAI,CAAC,CAAA,yBAAA,EAA4B,IAAI,CAAA,WAAA,CAAa,EAChH,GAAA,EAAI;AACP,QAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,gCAAA,EAAmC,GAAG,CAAA,WAAA,EAAc,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC3E,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,MAAM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACjE,QAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,uBAAuB,CAAA,EAAG;AAC1C,UAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,wCAAA,EAA2C,GAAG,CAAA,CAAA,CAAA,EAAK,GAAG,CAAA;AACpE,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAMA,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CACH,QAAQ,CAAA,+BAAA,EAAkC,GAAG,qCAAqC,GAAG,CAAA,2BAAA,CAA6B,EAClH,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qCAAA,EAAwC,GAAG,CAAA,CAAA,CAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IACtH;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;AC5EO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAAoB,EAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrC,MAAM,yBAAA,GAA2C;AAAA,EAEjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAA,GAA+C;AACnD,IAAA,MAAM,aAA0B,EAAC;AACjC,IAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,sBAAA,EAAuB;AAC5D,IAAA,MAAM,KAAK,yBAAA,EAA0B;AAGrC,IAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,MAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAChD,MAAA,MAAM,WAAA,GAAc,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAEpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,OAAA;AAAA,QACA,SAAA,EAAW,OAAA,GAAU,WAAA,EAAa,UAAA,GAAa,MAAA;AAAA,QAC/C,IAAA,EAAM,QAAQ,GAAA,CAAI;AAAA,OACnB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAA,GAAoD;AAChE,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,QAClC;AAAA,QACA,GAAA,EAAI;AAEN,MAAA,OAAO,IAAI,GAAA;AAAA,QAAA,CACR,cAAc,OAAA,IAAW,EAAC,EACxB,GAAA,CAAI,CAAC,GAAA,KAAa;AACjB,UAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA;AACtC,UAAA,MAAM,EAAA,GAAK,QAAA,CAAS,KAAA,CAAM,QAAQ,IAAI,CAAC,CAAA;AACvC,UAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,UAAA,OAAO,CAAC,EAAA,EAAI;AAAA,YACV,EAAA;AAAA,YACA,IAAA,EAAM,QAAA;AAAA,YACN,QAAA;AAAA,YACA,YAAY,GAAA,CAAI;AAAA,WACjB,CAAA;AAAA,QACH,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,KAAA,KAAkC,UAAU,IAAI;AAAA,OAC7D;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,2BAAW,GAAA,EAAI;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,yBAAA,GAA2C;AAC/C,IAAA,IAAI,MAAM,IAAA,CAAK,gBAAA,CAAiB,CAAC,WAAW,CAAC,CAAA,EAAG;AAC9C,MAAA,MAAM,KAAK,8BAAA,EAA+B;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,8BAAA,GAAgD;AAC5D,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,iBAAiB,CAAC,gBAAgB,CAAC,CAAA,EAAI;AACxD,IAAA,MAAM,OAAO,MAAM,IAAA,CAAK,GACrB,OAAA,CAAQ,qEAAqE,EAC7E,GAAA,EAA8C;AACjD,IAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACpC,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,gBAAgB,CAAA;AAAA,MAC1C,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AACA,MAAA,MAAM,kBAAA,CAAmB,IAAA,CAAK,EAAA,EAAI,GAAA,CAAI,IAAI,MAAM,CAAA;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAiB,UAAA,EAAwC;AACrE,IAAA,IAAI;AACF,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,UAC3B,CAAA,4DAAA;AAAA,SACF,CAAE,IAAA,CAAK,SAAS,CAAA,CAAE,KAAA,EAAM;AAExB,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAA,CAAkB,SAAA,EAAmB,UAAA,EAAsC;AACvF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,QAC3B,CAAA,iDAAA;AAAA,OACF,CAAE,IAAA,CAAK,SAAA,EAAW,UAAU,EAAE,KAAA,EAAM;AAEpC,MAAA,OAAO,CAAC,CAAC,MAAA;AAAA,IACX,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,GAA+C;AACnD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,sBAAA,EAAuB;AACrD,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,OAAO,CAAA;AAC1D,IAAA,MAAM,oBAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA;AAE3D,IAAA,MAAM,WAAA,GAAc,kBAAkB,MAAA,GAAS,CAAA,GAC3C,kBAAkB,iBAAA,CAAkB,MAAA,GAAS,CAAC,CAAA,EAAG,SAAA,GACjD,MAAA;AAEJ,IAAA,OAAO;AAAA,MACL,iBAAiB,UAAA,CAAW,MAAA;AAAA,MAC5B,mBAAmB,iBAAA,CAAkB,MAAA;AAAA,MACrC,mBAAmB,iBAAA,CAAkB,MAAA;AAAA,MACrC,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CAAqB,WAAA,EAAqB,IAAA,EAAc,QAAA,EAAiC;AAGxF,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,WAAA,EAAoC;AAC1D,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,WAAA,EAAuC;AAC9D,IAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,sBAAA,EAAuB;AAC5D,IAAA,OAAO,iBAAA,CAAkB,IAAI,WAAW,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAA,GAAqD;AACzD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,sBAAA,EAAuB;AACrD,IAAA,OAAO,UAAA,CAAW,OAAO,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,CAAA,CAAE,EAAA,CAAG,EAAE,CAAA,IAAK,IAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,GAA4G;AAChH,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,OAAA,EAAS,uIAAA;AAAA,MACT,SAAS,EAAC;AAAA,MACV,QAAQ;AAAC,KACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,GAAgE;AACpE,IAAA,MAAM,SAAmB,EAAC;AAG1B,IAAA,MAAM,cAAA,GAAiB;AAAA,MACrB,OAAA;AAAA,MAAS,WAAA;AAAA,MAAa;AAAA,KACxB;AAEA,IAAA,KAAA,MAAW,SAAS,cAAA,EAAgB;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,KAAK,EAAA,CAAG,OAAA,CAAQ,wBAAwB,KAAK,CAAA,QAAA,CAAU,EAAE,KAAA,EAAM;AAAA,MACvE,SAAS,KAAA,EAAO;AACd,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAE,CAAA;AAAA,MACvC;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,OAAO,MAAA,KAAW,CAAA;AAAA,MACzB;AAAA,KACF;AAAA,EACF;AACF","file":"chunk-H5FB6GKR.cjs","sourcesContent":["/**\n * AUTO-GENERATED FILE - DO NOT EDIT\n * Generated by: scripts/generate-migrations.ts\n * Generated at: 2026-06-25T21:00:56.028Z\n *\n * This file contains all migration SQL bundled for use in Cloudflare Workers\n * where filesystem access is not available at runtime.\n */\n\nexport interface BundledMigration {\n  id: string\n  name: string\n  filename: string\n  description: string\n  sql: string\n}\n\nexport const bundledMigrations: BundledMigration[] = [\n  {\n    id: '0001',\n    name: 'Core',\n    filename: '0001_core.sql',\n    description: 'Migration 0001: Core',\n    sql: \"-- Migration 0001: Auth tables\\n-- auth_user, auth_session, auth_account, auth_verification + BA plugin tables + RBAC + auth support.\\n-- Only auth_* prefixed tables live here. All content lives in document_* tables (0002_documents.sql).\\n\\n-- ── auth_user ────────────────────────────────────────────────────────────────\\n-- BA user model + SonicJS domain columns as BA additionalFields.\\nCREATE TABLE IF NOT EXISTS auth_user (\\n  id TEXT PRIMARY KEY,\\n  name TEXT,\\n  email TEXT NOT NULL UNIQUE,\\n  email_verified INTEGER NOT NULL DEFAULT 0,\\n  image TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL,\\n  -- SonicJS additionalFields\\n  first_name TEXT NOT NULL,\\n  last_name TEXT NOT NULL,\\n  role TEXT NOT NULL DEFAULT 'viewer',\\n  -- Platform super-admin: bypasses the multi-tenant membership gate, uses global roles in every\\n  -- tenant. Opt-in (default 0); intentionally NOT derived from the 'admin' role.\\n  is_super_admin INTEGER NOT NULL DEFAULT 0,\\n  avatar TEXT,\\n  password_hash TEXT,\\n  is_active INTEGER NOT NULL DEFAULT 1,\\n  last_login_at INTEGER,\\n  phone TEXT,\\n  bio TEXT,\\n  timezone TEXT DEFAULT 'UTC',\\n  language TEXT DEFAULT 'en',\\n  email_notifications INTEGER DEFAULT 1,\\n  theme TEXT DEFAULT 'dark',\\n  invitation_token TEXT,\\n  invited_by TEXT,\\n  invited_at INTEGER,\\n  accepted_invitation_at INTEGER,\\n  failed_login_count INTEGER NOT NULL DEFAULT 0,\\n  locked_until INTEGER\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_auth_user_email ON auth_user(email);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_role ON auth_user(role);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_invitation_token ON auth_user(invitation_token);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_locked_until ON auth_user(locked_until) WHERE locked_until IS NOT NULL;\\n\\n-- ── auth_session ─────────────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_session (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  token TEXT NOT NULL UNIQUE,\\n  expires_at INTEGER NOT NULL,\\n  ip_address TEXT,\\n  user_agent TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_user_id ON auth_session(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_token ON auth_session(token);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_expires_at ON auth_session(expires_at);\\n\\n-- ── auth_account ─────────────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_account (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  account_id TEXT NOT NULL,\\n  provider_id TEXT NOT NULL,\\n  access_token TEXT,\\n  refresh_token TEXT,\\n  access_token_expires_at INTEGER,\\n  refresh_token_expires_at INTEGER,\\n  scope TEXT,\\n  id_token TEXT,\\n  password TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_account_user_id ON auth_account(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_account_provider ON auth_account(provider_id, account_id);\\n\\n-- ── auth_verification ────────────────────────────────────────────────────────\\n-- Covers email verification, password reset, magic-link tokens, OTP codes.\\nCREATE TABLE IF NOT EXISTS auth_verification (\\n  id TEXT PRIMARY KEY,\\n  identifier TEXT NOT NULL,\\n  value TEXT NOT NULL,\\n  expires_at INTEGER NOT NULL,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_verification_identifier ON auth_verification(identifier);\\n\\n-- ── BA plugin tables ──────────────────────────────────────────────────────────\\n\\nCREATE TABLE IF NOT EXISTS auth_two_factor (\\n  id           TEXT PRIMARY KEY,\\n  secret       TEXT NOT NULL,\\n  backup_codes TEXT NOT NULL,\\n  user_id      TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  verified     INTEGER NOT NULL DEFAULT 1,\\n  created_at   INTEGER NOT NULL,\\n  updated_at   INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_two_factor_user_id ON auth_two_factor(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant (\\n  id         TEXT PRIMARY KEY,\\n  name       TEXT NOT NULL,\\n  slug       TEXT NOT NULL UNIQUE,\\n  logo       TEXT,\\n  metadata   TEXT,\\n  -- SonicJS tenant-resolution fields (BA organization additionalFields):\\n  status     TEXT NOT NULL DEFAULT 'active',\\n  domain     TEXT,\\n  notes      TEXT NOT NULL DEFAULT '',\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_domain ON auth_tenant(domain);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_member (\\n  id        TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  user_id   TEXT NOT NULL REFERENCES auth_user(id)   ON DELETE CASCADE,\\n  role      TEXT NOT NULL DEFAULT 'member',\\n  email     TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL,\\n  UNIQUE(tenant_id, user_id)\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_tenant ON auth_tenant_member(tenant_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_user   ON auth_tenant_member(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_invitation (\\n  id         TEXT PRIMARY KEY,\\n  tenant_id  TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  email      TEXT NOT NULL,\\n  role       TEXT NOT NULL DEFAULT 'member',\\n  status     TEXT NOT NULL DEFAULT 'pending',\\n  expires_at INTEGER NOT NULL,\\n  inviter_id TEXT REFERENCES auth_user(id) ON DELETE SET NULL,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_tenant ON auth_tenant_invitation(tenant_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_email  ON auth_tenant_invitation(email);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_team (\\n  id        TEXT PRIMARY KEY,\\n  name      TEXT NOT NULL,\\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\n\\n-- ── RBAC ─────────────────────────────────────────────────────────────────────\\n-- RBAC roles, verbs, and user-role assignments are document-backed (is_auth doc\\n-- types rbac_role / rbac_verb / rbac_user_roles — see services/rbac.ts). The\\n-- system roles/verbs/grants are seeded at bootstrap by RbacService.ensureSystemRbacSeed().\\n-- No auth_rbac_* tables.\\n\\n-- ── Auth support tables ───────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_password_history (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  password_hash TEXT NOT NULL,\\n  created_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_password_history_user_id ON auth_password_history(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_api_tokens (\\n  id TEXT PRIMARY KEY,\\n  name TEXT NOT NULL,\\n  token TEXT NOT NULL UNIQUE,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id),\\n  permissions TEXT NOT NULL,\\n  expires_at INTEGER,\\n  last_used_at INTEGER,\\n  created_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_user ON auth_api_tokens(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_token ON auth_api_tokens(token);\\n\\n-- User profiles moved to the document model: a `user_profile` document (is_auth type),\\n-- one per user, addressed by slug = userId. See services/document-types-seed.ts and\\n-- plugins/core-plugins/user-profiles/user-profile-document.ts. No auth_user_profiles table.\\n\"\n  },\n  {\n    id: '0002',\n    name: 'Documents',\n    filename: '0002_documents.sql',\n    description: 'Migration 0002: Documents',\n    sql: \"-- Migration 0002: Document Schema (v3 greenfield)\\n-- Contains only the new document data model tables, generated columns, and indexes.\\n\\n-- Document type registry\\nCREATE TABLE IF NOT EXISTS document_types (\\n  id TEXT PRIMARY KEY,\\n  name TEXT NOT NULL UNIQUE,\\n  display_name TEXT NOT NULL,\\n  description TEXT,\\n  schema TEXT NOT NULL DEFAULT '{}',\\n  queryable_fields TEXT NOT NULL DEFAULT '[]',\\n  settings TEXT NOT NULL DEFAULT '{}',\\n  plugin_id TEXT,\\n  source TEXT NOT NULL DEFAULT 'code' CHECK (source IN ('code', 'plugin', 'system')),\\n  schema_version INTEGER NOT NULL DEFAULT 1,\\n  is_system INTEGER NOT NULL DEFAULT 0,\\n  is_active INTEGER NOT NULL DEFAULT 1,\\n  is_auth INTEGER NOT NULL DEFAULT 0,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_document_types_plugin ON document_types(plugin_id);\\nCREATE INDEX IF NOT EXISTS idx_document_types_active ON document_types(is_active);\\n\\n-- Documents: canonical document rows and historical versions.\\nCREATE TABLE IF NOT EXISTS documents (\\n  id TEXT PRIMARY KEY,\\n  root_id TEXT NOT NULL,\\n  type_id TEXT NOT NULL REFERENCES document_types(id),\\n  type_version INTEGER NOT NULL DEFAULT 1,\\n\\n  version_of_id TEXT REFERENCES documents(id),\\n  version_number INTEGER NOT NULL DEFAULT 1,\\n\\n  is_current_draft INTEGER NOT NULL DEFAULT 1,\\n  is_published INTEGER NOT NULL DEFAULT 0,\\n  status TEXT NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'published', 'archived')),\\n\\n  parent_root_id TEXT NOT NULL DEFAULT '',\\n  slug TEXT,\\n  path TEXT,\\n  title TEXT,\\n  zone TEXT,\\n  sort_order INTEGER NOT NULL DEFAULT 0,\\n  visible INTEGER NOT NULL DEFAULT 1,\\n\\n  published_at INTEGER,\\n  scheduled_at INTEGER,\\n  expires_at INTEGER,\\n  deleted_at INTEGER,\\n\\n  tenant_id TEXT NOT NULL DEFAULT 'default',\\n  locale TEXT NOT NULL DEFAULT 'default',\\n  translation_group_id TEXT NOT NULL DEFAULT '',\\n\\n  data TEXT NOT NULL DEFAULT '{}',\\n  metadata TEXT NOT NULL DEFAULT '{}',\\n\\n  owner_id TEXT,\\n  created_by TEXT,\\n  updated_by TEXT,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\n-- Queryable scalar fields (VIRTUAL generated columns) and their q_* filter indexes\\n-- are AUTO-GENERATED at runtime from each document type's queryableFields config —\\n-- see DocumentTypeRegistry.register() -> ensureScalarSchema() (document-scalar-schema.ts).\\n-- Do not hand-add q_* columns/indexes here; declare the field in the type instead.\\n\\n-- Revision chain\\nCREATE INDEX IF NOT EXISTS idx_documents_root ON documents(root_id, version_number DESC);\\n\\n-- List / lifecycle\\nCREATE INDEX IF NOT EXISTS idx_documents_published ON documents(tenant_id, type_id, locale, is_published)\\n  WHERE is_published = 1 AND deleted_at IS NULL;\\nCREATE INDEX IF NOT EXISTS idx_documents_drafts ON documents(tenant_id, type_id, status, is_current_draft)\\n  WHERE is_current_draft = 1;\\nCREATE INDEX IF NOT EXISTS idx_documents_parent ON documents(tenant_id, parent_root_id, sort_order, is_published);\\nCREATE INDEX IF NOT EXISTS idx_documents_path ON documents(tenant_id, path);\\nCREATE INDEX IF NOT EXISTS idx_documents_translation ON documents(translation_group_id, locale);\\nCREATE INDEX IF NOT EXISTS idx_documents_deleted ON documents(deleted_at);\\nCREATE INDEX IF NOT EXISTS idx_documents_scheduled ON documents(scheduled_at) WHERE scheduled_at IS NOT NULL;\\nCREATE INDEX IF NOT EXISTS idx_documents_expires ON documents(expires_at) WHERE expires_at IS NOT NULL;\\n\\n-- Stable keyset/cursor pagination for published lists\\nCREATE INDEX IF NOT EXISTS idx_documents_published_cursor\\n  ON documents(tenant_id, type_id, updated_at DESC, id DESC)\\n  WHERE is_published = 1 AND deleted_at IS NULL;\\n\\n-- (q_* generated-column filter indexes are auto-created at runtime — see note above.)\\n\\n-- Partial unique indexes: the hard concurrency guarantees for draft/publish invariants.\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_current_draft\\n  ON documents(root_id) WHERE is_current_draft = 1;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_published\\n  ON documents(root_id) WHERE is_published = 1;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_version\\n  ON documents(root_id, version_number);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_slug\\n  ON documents(tenant_id, locale, type_id, parent_root_id, slug)\\n  WHERE is_current_draft = 1 AND deleted_at IS NULL AND slug IS NOT NULL;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_translation_per_locale\\n  ON documents(tenant_id, translation_group_id, locale)\\n  WHERE is_current_draft = 1 AND translation_group_id <> '';\\n\\n-- Document references: typed document-to-document edges.\\nCREATE TABLE IF NOT EXISTS document_references (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  from_root_id TEXT NOT NULL,\\n  from_document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\\n  field_name TEXT NOT NULL,\\n  ordinal INTEGER NOT NULL DEFAULT 0,\\n  to_root_id TEXT NOT NULL,\\n  ref_strength TEXT NOT NULL DEFAULT 'weak' CHECK (ref_strength IN ('strong', 'weak')),\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_docref_to   ON document_references(tenant_id, to_root_id);\\nCREATE INDEX IF NOT EXISTS idx_docref_from ON document_references(from_document_id);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_docref_unique\\n  ON document_references(from_document_id, field_name, ordinal);\\n\\n-- Document facets: indexed rows for multi-valued scalar fields (e.g. tags arrays).\\nCREATE TABLE IF NOT EXISTS document_facets (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\\n  root_id TEXT NOT NULL,\\n  type_id TEXT NOT NULL,\\n  field_name TEXT NOT NULL,\\n  ordinal INTEGER NOT NULL DEFAULT 0,\\n  value_text TEXT,\\n  value_number REAL,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_facets_lookup ON document_facets(tenant_id, type_id, field_name, value_text);\\nCREATE INDEX IF NOT EXISTS idx_facets_doc    ON document_facets(document_id);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_facets_unique\\n  ON document_facets(document_id, field_name, ordinal);\\n\\n-- Document permissions: per-document ACL overrides.\\nCREATE TABLE IF NOT EXISTS document_permissions (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  root_id TEXT NOT NULL,\\n  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'role', 'group', 'public', 'token')),\\n  principal_id TEXT NOT NULL,\\n  permission TEXT NOT NULL CHECK (permission IN ('read', 'create', 'update', 'delete', 'publish', 'manage')),\\n  effect TEXT NOT NULL DEFAULT 'allow' CHECK (effect IN ('allow', 'deny')),\\n  inherited INTEGER NOT NULL DEFAULT 0,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  created_by TEXT\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_document_permissions_root ON document_permissions(tenant_id, root_id);\\nCREATE INDEX IF NOT EXISTS idx_document_permissions_principal\\n  ON document_permissions(tenant_id, principal_type, principal_id, permission);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_document_permissions_unique\\n  ON document_permissions(root_id, principal_type, principal_id, permission);\\n\"\n  }\n]\n\n// Map for quick lookup by ID\nexport const migrationsByIdMap = new Map<string, BundledMigration>(\n  bundledMigrations.map(m => [m.id, m])\n)\n\n// Get migration SQL by ID\nexport function getMigrationSQLById(id: string): string | null {\n  return migrationsByIdMap.get(id)?.sql ?? null\n}\n\n// Get all migration info (without SQL for lighter payloads)\nexport function getMigrationList(): Array<Omit<BundledMigration, 'sql'>> {\n  return bundledMigrations.map(({ sql, ...rest }) => rest)\n}\n","import { D1Database } from '@cloudflare/workers-types'\nimport type { QueryableField } from '../schemas/document'\n\n// Identifiers and JSON paths are interpolated into DDL (they cannot be bound), so\n// they are format-guarded here. Source is trusted code config, not user input —\n// this is defense-in-depth, mirroring document-repository.ts.\nconst SAFE_IDENTIFIER = /^[a-z_][a-z0-9_]*$/\n\n/** Map a queryable field's logical type to a SQLite column affinity. */\nfunction affinity(type?: QueryableField['type']): 'TEXT' | 'INTEGER' | 'REAL' {\n  if (type === 'number') return 'REAL'\n  if (type === 'integer' || type === 'boolean' || type === 'date') return 'INTEGER'\n  return 'TEXT'\n}\n\nconst slug = (s: string) => s.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '')\n\n/**\n * Authoritative generated-column name for a scalar field. An explicit `column`\n * always wins (back-compat with every existing type definition); otherwise it is\n * derived deterministically from the type id + field name. The repository reads\n * the same `column`/derivation when building filter SQL, so the two never drift.\n */\nexport function resolveColumn(typeId: string, f: QueryableField): string {\n  if (f.column) return f.column\n  const name = `q_${slug(typeId)}_${slug(f.name)}`\n  return name.length <= 60 ? name : `q_${slug(typeId).slice(0, 20)}_${slug(f.name).slice(0, 20)}`\n}\n\n/**\n * Idempotently ensure the `documents` table has a VIRTUAL generated column and a\n * filter/sort index for each of a type's scalar queryable fields. Safe to call on\n * every registration and every bootstrap: existing columns/indexes are skipped,\n * and a concurrent add surfaces as a swallowed \"duplicate column name\".\n *\n * Facet and reference fields need no DDL (generic document_facets /\n * document_references tables), so they are ignored here.\n *\n * Returns the columns it actually created (empty when all already existed).\n */\nexport async function ensureScalarSchema(\n  db: D1Database,\n  typeId: string,\n  fields: QueryableField[],\n): Promise<string[]> {\n  const scalars = fields.filter((f) => f.kind === 'scalar')\n  if (scalars.length === 0) return []\n\n  // pragma_table_info does NOT list VIRTUAL generated columns — use table_xinfo, which does.\n  let existing = new Set<string>()\n  try {\n    const info = await db.prepare(\"SELECT name FROM pragma_table_xinfo('documents')\").all()\n    existing = new Set((info?.results ?? []).map((r: any) => r.name))\n  } catch {\n    // table_xinfo unavailable — fall back to attempting every ALTER (duplicate errors swallowed).\n  }\n\n  const added: string[] = []\n  for (const f of scalars) {\n    const col = resolveColumn(typeId, f)\n    if (!SAFE_IDENTIFIER.test(col)) {\n      console.error(`[scalar-schema] unsafe column name '${col}' for ${typeId}.${f.name} — skipped`)\n      continue\n    }\n    const path = f.path ?? `$.${f.name}`\n    if (path.includes(\"'\")) {\n      console.error(`[scalar-schema] unsafe json path for ${col} (${typeId}.${f.name}) — skipped`)\n      continue\n    }\n\n    if (!existing.has(col)) {\n      try {\n        await db\n          .prepare(`ALTER TABLE documents ADD COLUMN ${col} ${affinity(f.type)} AS (json_extract(data, '${path}')) VIRTUAL`)\n          .run()\n        added.push(col)\n        console.log(`[scalar-schema] added documents.${col} for type '${typeId}'`)\n      } catch (error) {\n        const msg = error instanceof Error ? error.message : String(error)\n        if (!msg.includes('duplicate column name')) {\n          console.error(`[scalar-schema] failed to add documents.${col}:`, msg)\n          continue\n        }\n      }\n    }\n\n    // One general index per column: the leading (tenant_id, type_id, col) prefix\n    // serves every equality filter the repository builds; the trailing\n    // (updated_at DESC, id DESC) matches the default keyset sort/cursor. Non-partial\n    // so a single index covers both draft and published lists.\n    try {\n      await db\n        .prepare(`CREATE INDEX IF NOT EXISTS idx_${col} ON documents(tenant_id, type_id, ${col}, updated_at DESC, id DESC)`)\n        .run()\n    } catch (error) {\n      console.error(`[scalar-schema] failed to create idx_${col}:`, error instanceof Error ? error.message : String(error))\n    }\n  }\n  return added\n}\n","import { D1Database } from '@cloudflare/workers-types'\nimport { bundledMigrations } from '../db/migrations-bundle'\nimport { ensureScalarSchema } from './document-scalar-schema'\nimport type { QueryableField } from '../schemas/document'\n\nexport interface Migration {\n  id: string\n  name: string\n  filename: string\n  description?: string\n  applied: boolean\n  appliedAt?: string\n  size?: number\n}\n\nexport interface MigrationStatus {\n  totalMigrations: number\n  appliedMigrations: number\n  pendingMigrations: number\n  lastApplied?: string\n  migrations: Migration[]\n}\n\nexport class MigrationService {\n  constructor(private db: D1Database) {}\n\n  /**\n   * Cloudflare D1 owns migration bookkeeping through `d1_migrations`.\n   * SonicJS intentionally does not create its own tracking table.\n   */\n  async initializeMigrationsTable(): Promise<void> {\n    // Kept as a no-op for compatibility with older callers.\n  }\n\n  /**\n   * Get all available migrations from the bundled migrations\n   */\n  async getAvailableMigrations(): Promise<Migration[]> {\n    const migrations: Migration[] = []\n    const appliedMigrations = await this.getD1AppliedMigrations()\n    await this.ensureSchemaCompatibility()\n\n    // Use bundled migrations as the source of truth\n    for (const bundled of bundledMigrations) {\n      const applied = appliedMigrations.has(bundled.id)\n      const appliedData = appliedMigrations.get(bundled.id)\n\n      migrations.push({\n        id: bundled.id,\n        name: bundled.name,\n        filename: bundled.filename,\n        description: bundled.description,\n        applied,\n        appliedAt: applied ? appliedData?.applied_at : undefined,\n        size: bundled.sql.length\n      })\n    }\n\n    return migrations\n  }\n\n  /**\n   * Read Wrangler/D1's canonical migration table. If the table is absent, no\n   * migrations have been applied by the supported migration runner yet.\n   */\n  private async getD1AppliedMigrations(): Promise<Map<string, any>> {\n    try {\n      const appliedResult = await this.db.prepare(\n        'SELECT name, applied_at FROM d1_migrations ORDER BY applied_at ASC'\n      ).all()\n\n      return new Map(\n        (appliedResult.results ?? [])\n          .map((row: any) => {\n            const filename = String(row.name ?? '')\n            const id = filename.match(/^(\\d+)/)?.[1]\n            if (!id) return null\n            return [id, {\n              id,\n              name: filename,\n              filename,\n              applied_at: row.applied_at\n            }]\n          })\n          .filter((entry): entry is [string, any] => entry !== null)\n      )\n    } catch (error) {\n      return new Map()\n    }\n  }\n\n  /**\n   * Run idempotent compatibility repairs that are safe outside migration state.\n   */\n  async ensureSchemaCompatibility(): Promise<void> {\n    if (await this.checkTablesExist(['documents'])) {\n      await this.ensureDocumentGeneratedColumns()\n    }\n  }\n\n  /**\n   * Ensure the `documents` table exposes every queryable VIRTUAL generated column + index (D45).\n   * Data-driven repair: reconciles from each active type's `queryable_fields` rather than a hardcoded\n   * list, so it stays in sync with whatever types are registered. Generation of these columns is owned\n   * by DocumentTypeRegistry.register() (via ensureScalarSchema); this pass is a bootstrap safety net for\n   * a DB that has document_types rows but lost columns (e.g. table rebuilt). Idempotent.\n   */\n  private async ensureDocumentGeneratedColumns(): Promise<void> {\n    if (!(await this.checkTablesExist(['document_types']))) return\n    const rows = await this.db\n      .prepare('SELECT id, queryable_fields FROM document_types WHERE is_active = 1')\n      .all<{ id: string; queryable_fields: string }>()\n    for (const row of rows.results ?? []) {\n      let fields: QueryableField[]\n      try {\n        fields = JSON.parse(row.queryable_fields)\n      } catch {\n        continue\n      }\n      await ensureScalarSchema(this.db, row.id, fields)\n    }\n  }\n\n  /**\n   * Check if specific tables exist in the database\n   */\n  private async checkTablesExist(tableNames: string[]): Promise<boolean> {\n    try {\n      for (const tableName of tableNames) {\n        const result = await this.db.prepare(\n          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`\n        ).bind(tableName).first()\n\n        if (!result) {\n          return false\n        }\n      }\n      return true\n    } catch (error) {\n      return false\n    }\n  }\n\n  /**\n   * Check if a specific column exists in a table\n   */\n  private async checkColumnExists(tableName: string, columnName: string): Promise<boolean> {\n    try {\n      const result = await this.db.prepare(\n        `SELECT * FROM pragma_table_info(?) WHERE name = ?`\n      ).bind(tableName, columnName).first()\n\n      return !!result\n    } catch (error) {\n      return false\n    }\n  }\n\n  /**\n   * Get migration status summary\n   */\n  async getMigrationStatus(): Promise<MigrationStatus> {\n    const migrations = await this.getAvailableMigrations()\n    const appliedMigrations = migrations.filter(m => m.applied)\n    const pendingMigrations = migrations.filter(m => !m.applied)\n\n    const lastApplied = appliedMigrations.length > 0\n      ? appliedMigrations[appliedMigrations.length - 1]?.appliedAt\n      : undefined\n\n    return {\n      totalMigrations: migrations.length,\n      appliedMigrations: appliedMigrations.length,\n      pendingMigrations: pendingMigrations.length,\n      lastApplied,\n      migrations\n    }\n  }\n\n  /**\n   * D1 migration state is managed by Wrangler.\n   */\n  async markMigrationApplied(migrationId: string, name: string, filename: string): Promise<void> {\n    void migrationId\n    void name\n    void filename\n  }\n\n  /**\n   * D1 migration state is managed by Wrangler.\n   */\n  async removeMigrationApplied(migrationId: string): Promise<void> {\n    void migrationId\n  }\n\n  /**\n   * Check if a specific migration has been applied\n   */\n  async isMigrationApplied(migrationId: string): Promise<boolean> {\n    const appliedMigrations = await this.getD1AppliedMigrations()\n    return appliedMigrations.has(migrationId)\n  }\n\n  /**\n   * Get the last applied migration\n   */\n  async getLastAppliedMigration(): Promise<Migration | null> {\n    const migrations = await this.getAvailableMigrations()\n    return migrations.filter(m => m.applied).at(-1) ?? null\n  }\n\n  /**\n   * Run pending migrations\n   */\n  async runPendingMigrations(): Promise<{ success: boolean; message: string; applied: string[]; errors: string[] }> {\n    return {\n      success: false,\n      message: 'Migrations are managed by Cloudflare D1. Run `wrangler d1 migrations apply DB --local` or `wrangler d1 migrations apply DB --remote`.',\n      applied: [],\n      errors: []\n    }\n  }\n\n  /**\n   * Validate database schema\n   */\n  async validateSchema(): Promise<{ valid: boolean; issues: string[] }> {\n    const issues: string[] = []\n\n    // Basic table existence checks\n    const requiredTables = [\n      'users', 'documents', 'document_types'\n    ]\n\n    for (const table of requiredTables) {\n      try {\n        await this.db.prepare(`SELECT COUNT(*) FROM ${table} LIMIT 1`).first()\n      } catch (error) {\n        issues.push(`Missing table: ${table}`)\n      }\n    }\n\n    return {\n      valid: issues.length === 0,\n      issues\n    }\n  }\n}\n"]}

package/dist/{chunk-R2O6TTQS.js → chunk-HNUGMALL.js}

@@ -1,18 +1,18 @@
 import { isFirstUserRegistration, isRegistrationEnabled, authValidationService } from './chunk-IESEVHXL.js';
 import { renderDocumentFormPage, renderAlert } from './chunk-RMRJGMDE.js';
 import { getCacheService, CACHE_CONFIGS, SettingsService, getLogger, getAppInstance, buildRouteList, CATEGORY_INFO } from './chunk-RQ6N3FTV.js';
-import { DocumentTypeRegistry, requireAuth, requireRole, optionalAuth, isPluginActive, rateLimit, AuthManager, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, logActivity, generateCsrfToken } from './chunk-DMXDQ5YI.js';
-import { DocumentsService, documentSecondsToMs, RbacService } from './chunk-BLMTL57B.js';
+import { DocumentTypeRegistry, requireAuth, requireRole, optionalAuth, isPluginActive, rateLimit, AuthManager, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, logActivity, generateCsrfToken } from './chunk-O32IZ6JS.js';
+import { DocumentsService, documentSecondsToMs, RbacService } from './chunk-PDC7DLOV.js';
 import { nanoid } from './chunk-GCDZZNIN.js';
-import { getCollectionRegistry, collectionRecordToRow, loadCollectionConfigs, getVisibleCollections, PluginService, PLUGIN_REGISTRY, findPluginByCodeName, isCodeCollectionInternal, isDbDocTypeInternal, invalidateTenantCache } from './chunk-SUHGXAII.js';
-import { MigrationService } from './chunk-INKP2WNU.js';
+import { getCollectionRegistry, collectionRecordToRow, loadCollectionConfigs, getVisibleCollections, PluginService, PLUGIN_REGISTRY, findPluginByCodeName, isCodeCollectionInternal, isDbDocTypeInternal, invalidateTenantCache } from './chunk-INE5E3SL.js';
+import { MigrationService } from './chunk-32SDMKZ7.js';
 import { renderCheckboxPage, renderAlert as renderAlert$1, renderTable, renderPagination, renderConfirmationDialog, getConfirmationDialogScript, renderAdminLayout, adminLayoutV2, renderForm } from './chunk-OBA2RYZN.js';
 import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-5V62WT6M.js';
-import { createServiceSingleton, definePlugin, getPluginDefinition, applySchemaDefaults, renderSchemaFields, parseFormDataToSettings } from './chunk-XHBEFQJ3.js';
+import { createServiceSingleton, definePlugin, getPluginDefinition, applySchemaDefaults, renderSchemaFields, parseFormDataToSettings } from './chunk-QNPT6BQP.js';
 import { hasHookSystem, getTypedHooks } from './chunk-RNZFGN4R.js';
 import { QueryFilterBuilder, getBlocksFieldConfig, parseBlocksValue } from './chunk-QZGABF2M.js';
 import { metricsTracker } from './chunk-FICTAGD4.js';
-import { getCoreVersion } from './chunk-ALNODOY4.js';
+import { getCoreVersion } from './chunk-U7T5EOHJ.js';
 import { escapeHtml, sanitizeRichText, sanitizeInput } from './chunk-TQABQWOP.js';
 import { Hono } from 'hono';
 import { z } from 'zod';
@@ -3389,7 +3389,7 @@ adminApiRoutes.patch("/collections/:id", collectionsReadOnly);
 adminApiRoutes.delete("/collections/:id", collectionsReadOnly);
 adminApiRoutes.get("/migrations/status", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-MLBACCPF.js');
+    const { MigrationService: MigrationService2 } = await import('./migrations-DOPZXFK3.js');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const status = await migrationService.getMigrationStatus();
@@ -3432,7 +3432,7 @@ adminApiRoutes.post("/migrations/run", async (c) => {
 });
 adminApiRoutes.get("/migrations/validate", async (c) => {
   try {
-    const { MigrationService: MigrationService2 } = await import('./migrations-MLBACCPF.js');
+    const { MigrationService: MigrationService2 } = await import('./migrations-DOPZXFK3.js');
     const db = c.env.DB;
     const migrationService = new MigrationService2(db);
     const validation = await migrationService.validateSchema();
@@ -3591,7 +3591,7 @@ function renderLoginPage(data, demoLoginActive = false) {
             <!-- Form -->
             <form
               id="login-form"
-              hx-post="/auth/login/form"
+              hx-post="/auth/login/form${data.redirect ? `?redirect=${encodeURIComponent(data.redirect)}` : ""}"
               hx-target="#form-response"
               hx-swap="innerHTML"
               class="space-y-6"
@@ -5579,6 +5579,79 @@ function renderDynamicField(field, options = {}) {
       `;
       break;
     }
+    case "json": {
+      const jsonParsedValue = value !== null && value !== void 0 && typeof value !== "string" ? value : typeof value === "string" && value !== "" ? (() => {
+        try {
+          return JSON.parse(value);
+        } catch {
+          return value;
+        }
+      })() : null;
+      const jsonDisplayValue = jsonParsedValue !== null && typeof jsonParsedValue !== "string" ? JSON.stringify(jsonParsedValue, null, 2) : typeof jsonParsedValue === "string" ? jsonParsedValue : "";
+      const viewerId = `${fieldId}-viewer`;
+      const textareaId = `${fieldId}-textarea`;
+      const jsonDataAttr = escapeHtml2(JSON.stringify(jsonParsedValue ?? null));
+      const isEmpty = jsonParsedValue === null || jsonDisplayValue === "";
+      if (disabled) {
+        fieldHTML = `
+          <div
+            id="${viewerId}"
+            class="json-viewer-host rounded-lg px-3 py-2 text-xs bg-white dark:bg-zinc-800 shadow-sm ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 min-h-[2.5rem] overflow-auto"
+            data-json-viewer
+            data-json="${jsonDataAttr}"
+            data-open="${opts.open ?? 2}"
+          >${isEmpty ? '<span class="text-zinc-400 dark:text-zinc-500 italic">empty</span>' : ""}</div>
+          ${getJsonViewerScript()}
+        `;
+      } else {
+        fieldHTML = `
+          <div class="json-field-wrapper space-y-2">
+            <div class="flex items-center justify-end">
+              <button
+                type="button"
+                id="${fieldId}-toggle"
+                class="text-xs text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 underline transition-colors"
+                data-json-toggle
+                data-viewer="${viewerId}"
+                data-textarea="${textareaId}"
+                data-hidden-input="${fieldId}"
+              >Edit JSON</button>
+            </div>
+
+            <div
+              id="${viewerId}"
+              class="json-viewer-host rounded-lg px-3 py-2 text-xs bg-white dark:bg-zinc-800 shadow-sm ring-1 ring-inset ring-zinc-950/10 dark:ring-white/10 min-h-[2.5rem] overflow-auto"
+              data-json-viewer
+              data-json="${jsonDataAttr}"
+              data-open="${opts.open ?? 2}"
+            >${isEmpty ? '<span class="text-zinc-400 dark:text-zinc-500 italic">empty \u2014 click &quot;Edit JSON&quot; to add data</span>' : ""}</div>
+
+            <textarea
+              id="${textareaId}"
+              rows="${opts.rows || 8}"
+              placeholder="${opts.placeholder || "{}"}"
+              class="${baseClasses} ${errorClasses} resize-y font-mono text-xs hidden"
+              aria-label="${escapeHtml2(field.field_label)}"
+              data-json-edit-area
+              data-viewer="${viewerId}"
+              data-hidden-input="${fieldId}"
+            >${escapeHtml2(jsonDisplayValue)}</textarea>
+
+            <input
+              type="hidden"
+              id="${fieldId}"
+              name="${fieldName}"
+              value="${escapeHtml2(jsonDisplayValue)}"
+              ${required}
+            >
+
+            <div id="${fieldId}-json-error" class="text-xs text-pink-500 dark:text-pink-400 hidden"></div>
+          </div>
+          ${getJsonViewerScript()}
+        `;
+      }
+      break;
+    }
     default:
       fieldHTML = `
         <input
@@ -6075,6 +6148,120 @@ function normalizeBlockField(fieldConfig, fieldName) {
     options
   };
 }
+function getJsonViewerScript() {
+  return `
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/json-formatter-js@2.5.23/dist/json-formatter.min.css" id="json-formatter-css" onload="this.removeAttribute('onload')" onerror="">
+    <script>
+      (function() {
+        var JS_URL = 'https://cdn.jsdelivr.net/npm/json-formatter-js@2.5.23/dist/json-formatter.umd.min.js';
+
+        function isDark() {
+          return document.documentElement.classList.contains('dark') ||
+                 document.documentElement.dataset.theme === 'dark' ||
+                 window.matchMedia('(prefers-color-scheme: dark)').matches;
+        }
+
+        function initViewer(el) {
+          var raw = el.dataset.json;
+          var open = parseInt(el.dataset.open || '2', 10);
+          if (!raw || raw === 'null') return;
+          var data;
+          try { data = JSON.parse(raw); } catch(e) { el.textContent = raw; return; }
+          var fmt = new JSONFormatter(data, open, {
+            hoverPreviewEnabled: true,
+            hoverPreviewArrayCount: 5,
+            hoverPreviewFieldCount: 5,
+            theme: isDark() ? 'dark' : '',
+            animateOpen: true,
+            animateClose: true,
+          });
+          el.innerHTML = '';
+          el.appendChild(fmt.render());
+        }
+
+        function initAllViewers() {
+          document.querySelectorAll('[data-json-viewer]').forEach(function(el) { initViewer(el); });
+        }
+
+        function ensureLoaded(cb) {
+          if (window.JSONFormatter) { cb(); return; }
+          if (window.__jsonFormatterCallbacks) { window.__jsonFormatterCallbacks.push(cb); return; }
+          window.__jsonFormatterCallbacks = [cb];
+          var s = document.createElement('script');
+          s.src = JS_URL;
+          s.onload = function() {
+            (window.__jsonFormatterCallbacks || []).forEach(function(fn) { fn(); });
+            window.__jsonFormatterCallbacks = null;
+          };
+          document.head.appendChild(s);
+        }
+
+        if (!window.__sonicJsonViewerInit) {
+          window.__sonicJsonViewerInit = true;
+
+          // Toggle between viewer and edit textarea
+          document.addEventListener('click', function(e) {
+            var btn = e.target.closest('[data-json-toggle]');
+            if (!btn) return;
+            var viewerId = btn.dataset.viewer;
+            var textareaId = btn.dataset.textarea;
+            var hiddenId = btn.dataset.hiddenInput;
+            var viewer = document.getElementById(viewerId);
+            var textarea = document.getElementById(textareaId);
+            var hidden = document.getElementById(hiddenId);
+            var errorEl = hidden ? document.getElementById(hiddenId + '-json-error') : null;
+            if (!viewer || !textarea) return;
+            var isEditing = !textarea.classList.contains('hidden');
+            if (isEditing) {
+              // Switching back to viewer \u2014 validate + refresh
+              var raw = textarea.value.trim();
+              if (raw) {
+                try {
+                  var parsed = JSON.parse(raw);
+                  if (hidden) hidden.value = raw;
+                  viewer.dataset.json = JSON.stringify(parsed);
+                  ensureLoaded(function() { initViewer(viewer); });
+                  if (errorEl) { errorEl.textContent = ''; errorEl.classList.add('hidden'); }
+                } catch(ex) {
+                  if (errorEl) { errorEl.textContent = 'Invalid JSON: ' + ex.message; errorEl.classList.remove('hidden'); }
+                  return;
+                }
+              } else {
+                if (hidden) hidden.value = '';
+                viewer.innerHTML = '<span class="text-zinc-400 dark:text-zinc-500 italic">empty</span>';
+              }
+              textarea.classList.add('hidden');
+              viewer.classList.remove('hidden');
+              btn.textContent = 'Edit JSON';
+            } else {
+              // Switching to edit \u2014 populate textarea from hidden input
+              if (hidden && hidden.value) {
+                try {
+                  textarea.value = JSON.stringify(JSON.parse(hidden.value), null, 2);
+                } catch(e) {
+                  textarea.value = hidden.value;
+                }
+              }
+              viewer.classList.add('hidden');
+              textarea.classList.remove('hidden');
+              btn.textContent = 'Preview';
+            }
+          });
+        }
+
+        function run() {
+          ensureLoaded(initAllViewers);
+        }
+
+        if (document.readyState === 'loading') {
+          document.addEventListener('DOMContentLoaded', run);
+        } else {
+          run();
+        }
+      })();
+    </script>
+  `;
+}
 function getStructuredFieldScript() {
   return `
     ${getReadFieldValueScript()}
@@ -6935,10 +7122,12 @@ var authRoutes = new Hono();
 authRoutes.get("/login", async (c) => {
   const error = c.req.query("error");
   const message = c.req.query("message");
+  const redirect = c.req.query("redirect");
   const pageData = {
     error: error || void 0,
     message: message || void 0,
-    version: c.get("appVersion")
+    version: c.get("appVersion"),
+    redirect: redirect && redirect.startsWith("/") ? redirect : void 0
   };
   const db = c.env.DB;
   let demoLoginActive = false;
@@ -7082,7 +7271,7 @@ authRoutes.post(
       }
       const { email, password } = validation.data;
       const normalizedEmail = email.toLowerCase();
-      const { createAuth } = await import('./config-HFXANXCC.js');
+      const { createAuth } = await import('./config-PLJTDINX.js');
       const auth = createAuth(c.env);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
@@ -7104,6 +7293,20 @@ authRoutes.post(
       await setCsrfCookie(c);
       const baBody = await baRes.json();
       const user = baBody.user ?? {};
+      const tokenTtl = await getJwtExpirySecondsFromDb(c.env.DB, c.env);
+      const token = await AuthManager.generateToken(
+        user.id,
+        user.email,
+        user.role ?? "viewer",
+        c.env.JWT_SECRET,
+        tokenTtl
+      );
+      setCookie(c, "auth_token", token, {
+        httpOnly: true,
+        secure: true,
+        sameSite: "Strict",
+        maxAge: tokenTtl
+      });
       return c.json({
         user: {
           id: user.id,
@@ -7111,7 +7314,8 @@ authRoutes.post(
           firstName: user.name?.split(" ")[0] ?? "",
           lastName: user.name?.split(" ").slice(1).join(" ") ?? "",
           role: user.role ?? "viewer"
-        }
+        },
+        token
       });
     } catch (error) {
       console.error("Login error:", error);
@@ -7121,7 +7325,7 @@ authRoutes.post(
 );
 authRoutes.post("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-HFXANXCC.js');
+    const { createAuth } = await import('./config-PLJTDINX.js');
     const auth = createAuth(c.env);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
@@ -7137,7 +7341,7 @@ authRoutes.post("/logout", async (c) => {
 });
 authRoutes.get("/logout", async (c) => {
   try {
-    const { createAuth } = await import('./config-HFXANXCC.js');
+    const { createAuth } = await import('./config-PLJTDINX.js');
     const auth = createAuth(c.env);
     const baReq = new Request(new URL("/auth/sign-out", c.req.url).href, {
       method: "POST",
@@ -7344,7 +7548,7 @@ authRoutes.post(
         </div>
       `);
       }
-      const { createAuth } = await import('./config-HFXANXCC.js');
+      const { createAuth } = await import('./config-PLJTDINX.js');
       const auth = createAuth(c.env);
       const baReq = new Request(new URL("/auth/sign-in/email", c.req.url).href, {
         method: "POST",
@@ -7368,6 +7572,8 @@ authRoutes.post(
         }
       }
       await setCsrfCookie(c);
+      const rawRedirect = c.req.query("redirect");
+      const redirectUrl = rawRedirect && rawRedirect.startsWith("/") ? rawRedirect : "/admin/content";
       return c.html(html`
       <div id="form-response">
         <div class="rounded-lg bg-green-100 dark:bg-lime-500/10 p-4 ring-1 ring-green-400 dark:ring-lime-500/20">
@@ -7380,7 +7586,7 @@ authRoutes.post(
             </div>
           </div>
           <script>
-            setTimeout(() => { window.location.href = '/admin/content'; }, 500);
+            setTimeout(() => { window.location.href = '${redirectUrl}'; }, 500);
           </script>
         </div>
       </div>
@@ -26628,5 +26834,5 @@ var ROUTES_INFO = {
 };
 
 export { DocumentRepository, ROUTES_INFO, TenantService, VALID_MEMBER_ROLES, adminCheckboxRoutes, adminCollectionsRoutes, adminDocumentsRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, admin_api_default, admin_content_default, apiDocumentsRoutes, api_content_crud_default, api_default, api_media_default, api_system_default, auth_default, createUserProfilesPlugin, defineUserProfile, denyIfNotAllowed, dispatchHookEvent, getConfirmationDialogScript2 as getConfirmationDialogScript, getCustomData, getEmailService, getUserProfileConfig, getVariablesCached, hasEmailService, invalidateVariablesCache, isValidMemberRole, lexicalEditorPlugin, renderConfirmationDialog2 as renderConfirmationDialog, renderTable2 as renderTable, resolveDocScope, resolveVariablesInObject, router, router2, setEmailService, setVariablesCache, test_cleanup_default, userProfilesPlugin, userRoutes };
-//# sourceMappingURL=chunk-R2O6TTQS.js.map
-//# sourceMappingURL=chunk-R2O6TTQS.js.map
+//# sourceMappingURL=chunk-HNUGMALL.js.map
+//# sourceMappingURL=chunk-HNUGMALL.js.map