CREATE TABLE `app_logs` (
	`id` text PRIMARY KEY NOT NULL,
	`level` text NOT NULL,
	`source` text NOT NULL,
	`message` text NOT NULL,
	`context` text,
	`http_status` integer,
	`path` text,
	`stack` text,
	`user_id` text,
	`user_agent` text,
	`created_at` text DEFAULT (current_timestamp) NOT NULL
);
--> statement-breakpoint
CREATE INDEX `app_logs_created_at_idx` ON `app_logs` (`created_at`);--> statement-breakpoint
CREATE INDEX `app_logs_level_idx` ON `app_logs` (`level`);--> statement-breakpoint
-- Grant the new log:read permission to the built-in admin role (enforcement is
-- runtime-special-cased to ALL permissions, but the Roles UI lists the grid from these
-- rows — keep it in sync). INSERT OR IGNORE: harmless if the row already exists.
INSERT OR IGNORE INTO `role_permissions` (`role_id`, `permission`) VALUES ('admin','log:read');