@blamejs/blamejs-shop 0.3.17 → 0.3.18

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.18 (2026-05-30) — **Write and publish blog posts from the admin console.** The storefront already served a blog — the index at /blog, individual posts at /blog/:slug, an RSS feed, and sitemap entries — but there was no way to write a post, so it rendered empty. The admin console now has a Blog screen with the full lifecycle: create a draft, edit its title, body (Markdown), tags, hero image, and meta fields, publish it, unpublish it, and archive or restore it. A post is created as a draft and stays off the storefront until it is explicitly published, so work in progress is never visible to shoppers. **Added:** *Blog authoring in the admin console* — A new Blog screen lists posts by status and lets an operator create, edit, publish, unpublish, archive, and restore them. New posts start as drafts and do not appear on the storefront /blog, its RSS feed, or the sitemap until published; archiving removes a published post from the storefront and is reversible. This wires the admin over the blog backend that was already serving the customer-facing pages.
+
 - v0.3.17 (2026-05-30) — **Search results paginate with an accurate count, and collection pages get canonical URLs.** Two customer-facing storefront fixes. Search no longer stops at the first 24 products: the result count now reports the true number of matches instead of the page size, and numbered page links (with prev/next) make every matching product reachable while preserving the active query and filters. Separately, collection pages now emit a correct canonical and og:url so search engines and shared links resolve to one address, while the cart and account pages — which should not be indexed — are explicitly marked noindex. **Fixed:** *Search shows the real match count and paginates* — The search results page previously capped at 24 products, discarded the real total, and reported the page size as the match count — so anything past the first 24 was unreachable and the count was wrong. It now computes the true total, shows it in the "Showing N matches" summary, and adds no-JavaScript numbered page links (with prev/next) that carry the active query and facet filters, so every matching product can be reached. · *Collection pages have canonical URLs; cart and account are noindex* — Collection pages now emit an absolute canonical and og:url derived from the request host, so indexers and shared links resolve to a single address instead of an empty tag. The cart and account pages, which are not meant to be indexed, now carry a noindex robots tag in their markup, consistent on both the edge and container render paths.
 
 - v0.3.16 (2026-05-30) — **Uploaded SVGs are sanitized, and product images can be reordered with a chosen primary.** Two things for product media in the admin console. First, when an SVG image is uploaded it now passes through a strict sanitizer: an SVG that carries script or other active content is repaired, or refused outright when it can't be made safe, so a stored image can't become a script-execution vector. Second, a product's images can now be reordered and any image promoted to the primary (hero) slot directly from the console — previously the order was fixed at attach time and the first-attached image was always the hero. The primary image is the one shown first on the product page. **Added:** *Reorder product images and set the primary from the console* — Each image on a product now has a "Make primary" control that moves it to the hero slot shown first on the product page, and a reorder control sets the full order. Both are no-JavaScript form actions. The product page renders images in this order, so changing it here changes what shoppers see first. **Changed:** *Vendored runtime updated to v0.14.8* — The vendored blamejs runtime is updated to v0.14.8, an internal source-comment and lint-hygiene release with no API, wire-format, or behavior changes. No operator action is required. **Security:** *Uploaded SVG images are sanitized or refused* — An uploaded SVG is now checked by a strict sanitizer before it is stored: active content (scripts, event handlers, external references) is stripped, and an SVG that cannot be made safe is rejected with a clear error and never written. This closes the path where a crafted SVG, once stored and served, could execute script. Raster image uploads (PNG, JPEG, WebP, GIF) are unaffected.

package/lib/admin.js

@@ -510,7 +510,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4026,6 +4026,245 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- blog -----------------------------------------------------------
+  // Author the operator's editorial blog. The edge Worker serves the
+  // customer-facing /blog index + /blog/:slug posts + the RSS feed,
+  // reading ONLY published rows; this console writes them. A post is
+  // created as a draft and stays invisible to the storefront until it's
+  // published — publish / unpublish / archive / restore move it through
+  // the lifecycle (draft → published → archived, with restore back to
+  // draft). Content-negotiated like the other screens: bearer → the JSON
+  // contract; signed-in browser → the HTML list + author forms.
+  if (deps.blog) {
+    var blog = deps.blog;
+
+    // The list pulls each lifecycle state separately (the primitive has
+    // listDrafts / listArchived + listPublished) and merges them for the
+    // console table. The published set is the first page of the cursor-
+    // paginated feed — an editorial corpus that the console doesn't page
+    // (operators have tens of posts); the storefront's /blog is the
+    // paginated reader.
+    async function _blogRows(filter) {
+      var drafts    = await blog.listDrafts();
+      var archived  = await blog.listArchived();
+      var published = (await blog.listPublished({ limit: blog.MAX_LIST_LIMIT })).rows;
+      if (filter === "draft")     return drafts;
+      if (filter === "published") return published;
+      if (filter === "archived")  return archived;
+      // All: published first (newest-live), then drafts, then archived.
+      return published.concat(drafts).concat(archived);
+    }
+
+    router.get("/admin/blog", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var status = (url && url.searchParams.get("status")) || null;
+        _json(res, 200, { rows: await _blogRows(status) });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var status = (url && url.searchParams.get("status")) || null;
+        var rows = await _blogRows(status);
+        _sendHtml(res, 200, renderAdminBlog({
+          shop_name: deps.shop_name, nav_available: navAvailable, articles: rows,
+          status_filter: status,
+          created:   url && url.searchParams.get("created"),
+          updated:   url && url.searchParams.get("updated"),
+          published: url && url.searchParams.get("published"),
+          archived:  url && url.searchParams.get("archived"),
+          notice:    (url && url.searchParams.get("err")) ? "That action couldn't be completed for the post." : null,
+        }));
+      },
+    ));
+
+    // The new-post form. A standalone GET so the "New post" button on the
+    // list has a target; the create POST lives at /admin/blog.
+    router.get("/admin/blog/new", _pageOrApi(true,
+      R(async function (_req, res) {
+        return _problem(res, 405, "use-canonical-endpoint", "POST /admin/blog with a JSON body to create a post");
+      }),
+      async function (_req, res) {
+        _sendHtml(res, 200, renderAdminBlogDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable, article: null,
+        }));
+      },
+    ));
+
+    // Create content-negotiates: bearer → JSON 201 (a draft row); browser
+    // form → createDraft, then PRG to the post's detail screen to keep
+    // authoring. Every post is born a DRAFT — never published on create —
+    // so it can't reach the storefront before the operator publishes it.
+    router.post("/admin/blog", _pageOrApi(false,
+      W("blog.create", async function (req, res) {
+        var row = await blog.createDraft(req.body || {});
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var made;
+        try {
+          made = await blog.createDraft(_blogFromForm(req.body || {}));
+        } catch (e) {
+          var n = _safeNotice(e, "blog.create");
+          return _sendHtml(res, n.status, renderAdminBlogDetail({
+            shop_name: deps.shop_name, nav_available: navAvailable, article: null,
+            form_values: req.body || {},
+            notice: n.message.replace(/^blogArticles[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".blog.create", outcome: "success", metadata: { slug: made.slug } });
+        _redirect(res, "/admin/blog/" + encodeURIComponent(made.slug) + "?created=1");
+      },
+    ));
+
+    // Detail content-negotiates: bearer → JSON (the row, any status);
+    // browser → the edit form + the lifecycle action buttons. A bad /
+    // unknown slug is a 404 page, never a 500.
+    router.get("/admin/blog/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var row;
+        try { row = await blog.get(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 404, "blog-post-not-found", e.message); throw e; }
+        if (!row) return _problem(res, 404, "blog-post-not-found");
+        _json(res, 200, row);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var row;
+        try { row = await blog.get(req.params.slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; row = null; }
+        if (!row) return _sendHtml(res, 404, renderAdminBlog({
+          shop_name: deps.shop_name, nav_available: navAvailable, articles: [], notice: "Post not found.",
+        }));
+        _sendHtml(res, 200, renderAdminBlogDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable, article: row,
+          updated:   url && url.searchParams.get("updated"),
+          published: url && url.searchParams.get("published"),
+          notice:    (url && url.searchParams.get("err")) ? "That action couldn't be completed for the post." : null,
+        }));
+      },
+    ));
+
+    // Edit content-negotiates: bearer PATCH (the JSON contract) + browser
+    // POST /edit (HTML forms can't PATCH). Both patch the editable columns
+    // (title / body / author / tags / meta / hero image). Status is NOT
+    // editable here — it moves via the lifecycle routes below.
+    router.patch("/admin/blog/:slug", W("blog.update", async function (req, res) {
+      var row;
+      try { row = await blog.update(req.params.slug, req.body || {}); }
+      catch (e) {
+        if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+        if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _problem(res, 404, "blog-post-not-found");
+        throw e;
+      }
+      _json(res, 200, row);
+      return { id: row.slug };
+    }));
+
+    router.post("/admin/blog/:slug/edit", _pageOrApi(false,
+      W("blog.update", async function (req, res) {
+        var row;
+        try { row = await blog.update(req.params.slug, req.body || {}); }
+        catch (e) {
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _problem(res, 404, "blog-post-not-found");
+          throw e;
+        }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc  = encodeURIComponent(slug);
+        try {
+          await blog.update(slug, _blogPatchFromForm(req.body || {}));
+        } catch (e) {
+          if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _redirect(res, "/admin/blog?err=1");
+          var n = _safeNotice(e, "blog.update");
+          var current = null;
+          try { current = await blog.get(slug); } catch (_e) { current = null; }
+          if (!current) return _redirect(res, "/admin/blog?err=1");
+          return _sendHtml(res, n.status, renderAdminBlogDetail({
+            shop_name: deps.shop_name, nav_available: navAvailable, article: current,
+            notice: n.message.replace(/^blogArticles[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".blog.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/blog/" + enc + "?updated=1");
+      },
+    ));
+
+    // Lifecycle transitions — each PRGs back to the detail. publish takes
+    // a draft live (now visible on the storefront); unpublish pulls it
+    // back to draft (gone from the storefront); restore returns an
+    // archived post to draft. An illegal transition (wrong from-state) or
+    // a missing slug is a ?err=1 notice, never a 500.
+    function _blogTransition(action, fn) {
+      router.post("/admin/blog/:slug/" + action, _pageOrApi(false,
+        W("blog." + action, async function (req, res) {
+          var row;
+          try { row = await fn(req.params.slug); }
+          catch (e) {
+            if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+            if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _problem(res, 404, "blog-post-not-found");
+            if (e && e.code === "BLOG_ARTICLE_BAD_STATE") return _problem(res, 409, "conflict", e.message);
+            throw e;
+          }
+          _json(res, 200, row);
+          return { id: row.slug };
+        }),
+        async function (req, res) {
+          var slug = req.params.slug;
+          var enc  = encodeURIComponent(slug);
+          try {
+            await fn(slug);
+          } catch (e) {
+            if (e instanceof TypeError || (e && (e.code === "BLOG_ARTICLE_NOT_FOUND" || e.code === "BLOG_ARTICLE_BAD_STATE"))) {
+              return _redirect(res, "/admin/blog/" + enc + "?err=1");
+            }
+            throw e;
+          }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".blog." + action, outcome: "success", metadata: { slug: slug } });
+          // archive lands back on the list (the post left the editable
+          // set); the others stay on the detail with a status banner.
+          if (action === "archive") return _redirect(res, "/admin/blog?archived=1");
+          _redirect(res, "/admin/blog/" + enc + (action === "publish" ? "?published=1" : "?updated=1"));
+        },
+      ));
+    }
+    _blogTransition("publish",   function (s) { return blog.publish(s); });
+    _blogTransition("unpublish", function (s) { return blog.unpublish(s); });
+    _blogTransition("restore",   function (s) { return blog.restore(s); });
+
+    // Archive is destructive-ish (the post leaves the live storefront and
+    // the editable set), so the browser path confirms first — the CSP
+    // forbids a client confirm() dialog. Reached by a GET link from the
+    // detail screen; bearer clients POST /archive directly.
+    router.get("/admin/blog/:slug/archive/confirm-page", _pageOrApi(true,
+      R(async function (_req, res) {
+        return _problem(res, 405, "use-canonical-endpoint", "POST /admin/blog/:slug/archive directly for the JSON API");
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc  = encodeURIComponent(slug);
+        var row = null;
+        try { row = await blog.get(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!row) return _redirect(res, "/admin/blog?err=1");
+        _sendHtml(res, 200, renderAdminConfirm({
+          shop_name: deps.shop_name, nav_available: navAvailable, active: "blog",
+          heading: "Archive this post?",
+          consequence: "Archiving removes the post from the live storefront blog. You can restore it to a draft later.",
+          detail: "Post: " + (row.title || slug) + ".",
+          action: "/admin/blog/" + _htmlEscape(enc) + "/archive",
+          confirm_label: "Archive post",
+          cancel_href: "/admin/blog/" + enc,
+        }));
+      },
+    ));
+    _blogTransition("archive", function (s) { return blog.archive(s); });
+  }
+
   // ---- customer surveys -----------------------------------------------
   // Define NPS/CSAT/CES/custom surveys, issue token invitations (the
   // plaintext link is shown once on issue), and read the rollup. The
@@ -6393,6 +6632,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "shipping-labels", href: "/admin/shipping-labels", label: "Shipping labels", requires: "shippingLabels" },
   { key: "pick-lists",   href: "/admin/pick-lists",   label: "Pick lists",   requires: "pickLists" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
+  { key: "blog",         href: "/admin/blog",         label: "Blog",         requires: "blog" },
   { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
   { key: "hours",        href: "/admin/hours",        label: "Hours",        requires: "businessHours" },
   { key: "giftcards",    href: "/admin/gift-cards",    label: "Gift cards",   requires: "giftcards" },
@@ -9071,6 +9311,209 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// ---- blog form coercion + render --------------------------------------
+
+// A comma- or newline-separated tag field → the normalized string array
+// the blog primitive validates. Empty entries are dropped; the primitive
+// enforces the per-tag shape + the dedupe + the count cap, so this only
+// splits and trims.
+function _csvTags(v) {
+  if (typeof v !== "string" || !v.trim()) return [];
+  return v.split(/[,\n]/).map(function (s) { return s.trim(); }).filter(Boolean);
+}
+
+// Coerce the create form into blogArticles.createDraft's shape: trimmed
+// slug, the required title/body/author, the optional tags array, and the
+// optional hero-image + meta fields (a blank optional field is omitted so
+// the primitive's null default applies). The primitive validates every
+// field — this only shapes the form strings.
+function _blogFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:      typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    title:     body.title,
+    body:      body.body,
+    author_id: typeof body.author_id === "string" ? body.author_id.trim() : body.author_id,
+  };
+  var tags = _csvTags(body.tags);
+  if (tags.length) out.tags = tags;
+  var hero = typeof body.hero_image_url === "string" ? body.hero_image_url.trim() : "";
+  if (hero) out.hero_image_url = hero;
+  var md = typeof body.meta_description === "string" ? body.meta_description.trim() : "";
+  if (md) out.meta_description = md;
+  var mk = typeof body.meta_keywords === "string" ? body.meta_keywords.trim() : "";
+  if (mk) out.meta_keywords = mk;
+  return out;
+}
+
+// Coerce the edit form into a blogArticles.update patch. Only the columns
+// the form actually carries are included; an empty optional field is sent
+// as "" so the operator can clear a previously-set meta line / hero image
+// (the primitive accepts an empty string for the nullable meta columns).
+// Tags always ride (an empty list clears them). Status is NOT here — it
+// moves via the lifecycle routes.
+function _blogPatchFromForm(body) {
+  body = body || {};
+  var patch = { tags: _csvTags(body.tags) };
+  if (typeof body.title === "string")           patch.title = body.title;
+  if (typeof body.body === "string")            patch.body = body.body;
+  if (typeof body.author_id === "string")       patch.author_id = body.author_id.trim();
+  if (typeof body.hero_image_url === "string")  patch.hero_image_url = body.hero_image_url.trim() || null;
+  if (typeof body.meta_description === "string") patch.meta_description = body.meta_description.trim();
+  if (typeof body.meta_keywords === "string")   patch.meta_keywords = body.meta_keywords.trim();
+  return patch;
+}
+
+// One status pill class per lifecycle state, reusing the order-status pill
+// palette: published = paid (green), draft = pending (amber), archived =
+// cancelled (grey).
+function _blogStatusPill(status) {
+  var cls = status === "published" ? "paid" : status === "archived" ? "cancelled" : "pending";
+  return "<span class=\"status-pill " + cls + "\">" + _htmlEscape(status) + "</span>";
+}
+
+function renderAdminBlog(opts) {
+  opts = opts || {};
+  var rows = opts.articles || [];
+  var created   = opts.created   ? "<div class=\"banner banner--ok\">Post created as a draft.</div>" : "";
+  var updated   = opts.updated   ? "<div class=\"banner banner--ok\">Post saved.</div>" : "";
+  var published = opts.published ? "<div class=\"banner banner--ok\">Post published — it's live on the storefront blog.</div>" : "";
+  var archived  = opts.archived  ? "<div class=\"banner banner--ok\">Post archived.</div>" : "";
+  var notice    = opts.notice    ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var sf = opts.status_filter;
+  var chips = "<div class=\"order-filters\">" +
+    "<a class=\"chip" + (sf == null ? " chip--on" : "") + "\" href=\"/admin/blog\">All</a>" +
+    "<a class=\"chip" + (sf === "published" ? " chip--on" : "") + "\" href=\"/admin/blog?status=published\">Published</a>" +
+    "<a class=\"chip" + (sf === "draft" ? " chip--on" : "") + "\" href=\"/admin/blog?status=draft\">Drafts</a>" +
+    "<a class=\"chip" + (sf === "archived" ? " chip--on" : "") + "\" href=\"/admin/blog?status=archived\">Archived</a>" +
+    "</div>";
+
+  var bodyRows = rows.map(function (a) {
+    var enc = encodeURIComponent(a.slug);
+    var date = a.published_at != null ? _fmtDate(a.published_at) : "—";
+    // Per-row lifecycle actions match the post's current state: a draft
+    // can publish; a published post can unpublish or archive; an archived
+    // post can restore. Edit + the storefront link are always offered.
+    var actions = "<a class=\"btn btn--ghost\" href=\"/admin/blog/" + _htmlEscape(enc) + "\">Edit</a>";
+    if (a.status === "draft") {
+      actions += "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/publish\" class=\"form-inline\">" +
+        "<button class=\"btn\" type=\"submit\">Publish</button></form>";
+    } else if (a.status === "published") {
+      actions += "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/unpublish\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Unpublish</button></form>" +
+        "<a class=\"btn btn--danger\" href=\"/admin/blog/" + _htmlEscape(enc) + "/archive/confirm-page\">Archive</a>";
+    } else if (a.status === "archived") {
+      actions += "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/restore\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Restore</button></form>";
+    }
+    return "<tr>" +
+      "<td><a href=\"/admin/blog/" + _htmlEscape(enc) + "\"><strong>" + _htmlEscape(a.title) + "</strong></a></td>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(a.slug) + "</code></td>" +
+      "<td>" + _blogStatusPill(a.status) + "</td>" +
+      "<td>" + _htmlEscape(date) + "</td>" +
+      "<td><div class=\"actions-row\">" + actions + "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Status</th><th scope=\"col\">Published</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No posts" + (sf ? " " + _htmlEscape(sf) : " yet") + ". Write your first one.</p>";
+
+  var newBtn = "<div class=\"actions-row\"><a class=\"btn\" href=\"/admin/blog/new\">New post</a></div>";
+
+  var bodyHtml = "<section><h2>Blog</h2>" +
+    created + updated + published + archived + notice +
+    "<p class=\"meta\">Editorial posts shown on the storefront blog (/blog). A post is created as a draft and stays hidden until you publish it.</p>" +
+    newBtn + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Blog", bodyHtml, "blog", opts.nav_available);
+}
+
+// New-post form (article: null) or edit form (article set) for a single
+// blog post, plus the lifecycle action row when editing an existing post.
+// `form_values` re-fills a failed create so the operator doesn't retype.
+function renderAdminBlogDetail(opts) {
+  opts = opts || {};
+  var a = opts.article || null;
+  var isNew = !a;
+  var fv = opts.form_values || {};
+  var updated   = opts.updated   ? "<div class=\"banner banner--ok\">Post saved.</div>" : "";
+  var published = opts.published ? "<div class=\"banner banner--ok\">Post published — it's live on the storefront blog.</div>" : "";
+  var notice    = opts.notice    ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // Field values: the existing row when editing, else the failed-create
+  // form values, else blank.
+  function _val(col) {
+    if (a && a[col] != null) return a[col];
+    if (fv[col] != null) return fv[col];
+    return "";
+  }
+  var tagsVal = a && Array.isArray(a.tags) ? a.tags.join(", ")
+              : (typeof fv.tags === "string" ? fv.tags : "");
+
+  var action = isNew ? "/admin/blog" : "/admin/blog/" + encodeURIComponent(a.slug) + "/edit";
+  // Slug is the PK — editable only on create (the primitive keys update on
+  // it). On edit it shows read-only so the operator sees the storefront URL.
+  var slugField = isNew
+    ? _setupField("Slug", "slug", _val("slug"), "text", "Lowercase letters, digits, and hyphens — appears in /blog/<slug>.", " maxlength=\"120\" required")
+    : "<label class=\"form-field\"><span>Slug</span><input type=\"text\" value=\"" + _htmlEscape(a.slug) + "\" readonly>" +
+        "<small>The storefront URL: <code>/blog/" + _htmlEscape(a.slug) + "</code></small></label>";
+
+  var form =
+    "<div class=\"panel mw-40\">" +
+      "<h3 class=\"subhead\">" + (isNew ? "New post" : "Post details") + "</h3>" +
+      "<form method=\"post\" action=\"" + _htmlEscape(action) + "\">" +
+        slugField +
+        _setupField("Title", "title", _val("title"), "text", "", " maxlength=\"200\" required") +
+        _setupField("Author", "author_id", _val("author_id"), "text", "An author id (your editorial team's handle).", " maxlength=\"80\" required") +
+        "<label class=\"form-field\"><span>Body (Markdown)</span>" +
+          "<textarea name=\"body\" rows=\"16\" maxlength=\"200000\" required>" + _htmlEscape(_val("body")) + "</textarea>" +
+          "<small>Headings, lists, links, bold/italic. Raw HTML is escaped — links are https-only.</small></label>" +
+        _setupField("Tags (optional)", "tags", tagsVal, "text", "Comma-separated, e.g. guides, buying-tips.", " maxlength=\"1000\"") +
+        _setupField("Hero image URL (optional)", "hero_image_url", _val("hero_image_url"), "text", "https:// or a /-rooted path.", " maxlength=\"2048\"") +
+        _setupField("Meta description (optional)", "meta_description", _val("meta_description"), "text", "Shown in search results + the post's <head>.", " maxlength=\"320\"") +
+        _setupField("Meta keywords (optional)", "meta_keywords", _val("meta_keywords"), "text", "", " maxlength=\"320\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">" + (isNew ? "Create draft" : "Save") + "</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/blog\">Back</a></div>" +
+      "</form>" +
+    "</div>";
+
+  var lifecycle = "";
+  if (!isNew) {
+    var enc = encodeURIComponent(a.slug);
+    var btns = "";
+    if (a.status === "draft") {
+      btns = "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/publish\" class=\"form-inline\">" +
+        "<button class=\"btn\" type=\"submit\">Publish</button></form>" +
+        "<span class=\"meta\">Publishing makes the post live on the storefront blog.</span>";
+    } else if (a.status === "published") {
+      btns = "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/unpublish\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Unpublish</button></form>" +
+        "<a class=\"btn btn--danger\" href=\"/admin/blog/" + _htmlEscape(enc) + "/archive/confirm-page\">Archive</a>" +
+        "<span class=\"meta\">Unpublish pulls it back to a draft; archive removes it from the storefront.</span>";
+    } else if (a.status === "archived") {
+      btns = "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/restore\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Restore to draft</button></form>";
+    }
+    lifecycle = "<div class=\"panel mt-1 mw-40\"><h3 class=\"subhead\">Status</h3>" +
+      "<p class=\"meta\">Current state: " + _blogStatusPill(a.status) + "</p>" +
+      "<div class=\"actions-row\">" + btns + "</div></div>";
+  }
+
+  var head = isNew
+    ? "<p class=\"meta\"><a href=\"/admin/blog\">&larr; Blog</a></p>"
+    : "<p class=\"meta\"><a href=\"/admin/blog\">&larr; Blog</a> · " +
+        _blogStatusPill(a.status) +
+        (a.status === "published"
+          ? " · <a href=\"/blog/" + _htmlEscape(encodeURIComponent(a.slug)) + "\" target=\"_blank\" rel=\"noreferrer\">View on storefront &rarr;</a>"
+          : "") +
+      "</p>";
+
+  var title = isNew ? "New post" : (a.title || a.slug);
+  var body = "<section><h2>" + _htmlEscape(title) + "</h2>" + updated + published + notice + head + form + "</section>" + lifecycle;
+  return _renderAdminShell(opts.shop_name, isNew ? "New post" : "Post " + a.slug, body, "blog", opts.nav_available);
+}
+
 // Standard question set per survey kind, so the console can create the
 // common surveys without a dynamic question builder (fully custom question
 // lists go through the JSON defineSurvey API). Each question carries a
@@ -9889,6 +10332,8 @@ module.exports = {
   renderAdminQuestion:     renderAdminQuestion,
   renderAdminCollections:  renderAdminCollections,
   renderAdminCollection:   renderAdminCollection,
+  renderAdminBlog:         renderAdminBlog,
+  renderAdminBlogDetail:   renderAdminBlogDetail,
   renderAdminGiftCards:    renderAdminGiftCards,
   renderAdminGiftCard:     renderAdminGiftCard,
   renderAdminTaxRates:     renderAdminTaxRates,

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.17",
+  "version": "0.3.18",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {