@fayz-ai/plugin-blog 0.12.34 → 0.12.36

package/dist/index.js

@@ -4,6 +4,7 @@ import { BlogProvider } from './chunk-TYSSR2VZ.js';
 export { BlogProvider, articleJsonLd, blogJsonLd, blogListSeo, blogUrl, postSeo, postUrl, useBlogContext } from './chunk-TYSSR2VZ.js';
 import { lazy, createElement, Suspense } from 'react';
 import { hasLoader, defineLoader, createSafeDataProvider, getActiveTenantId, getSupabaseClientOptional } from '@fayz-ai/core';
+import { MIGRATIONS } from '#migrations/main';
 
 // src/config.ts
 function resolveConfig(options) {
@@ -112,1163 +113,6 @@ function createSupabaseBlogProvider(options) {
   };
 }
 
-// src/migrations/index.ts
-var MIGRATION_000_BASELINE = `-- ============================================================================
--- plugins/plugin-blog/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
---
--- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
--- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
--- prove the result still matches.
---
--- This replaced 2 migration files. They are kept, unapplied, in
--- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
--- longer worth replaying.
---
--- Object order is fixed rather than dependency-sorted: schemas, types,
--- sequences, tables, defaults, functions, constraints, views, indexes, foreign
--- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
--- are carried by the order packages/db/chain.json declares.
--- ============================================================================
-
--- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
--- sorted by name are not sorted by who calls whom. This is what lets them load
--- in any order; every body is still compiled on first call, so a genuinely
--- broken reference surfaces then rather than never. Session-scoped.
-SET check_function_bodies = false;
-
-
-
--- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Cleared BEFORE anything is created, so every object below gets the ACL the
--- dump describes rather than the image's defaults on top of it. Restored at
--- the end of this file.
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-
--- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE TABLE public.plg_blog_categories (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    name text NOT NULL,
-    slug text NOT NULL,
-    description text,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL
-);
-
-CREATE TABLE public.plg_blog_posts (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    tenant_id uuid NOT NULL,
-    category_id uuid,
-    slug text NOT NULL,
-    title text NOT NULL,
-    excerpt text DEFAULT ''::text NOT NULL,
-    body text DEFAULT ''::text NOT NULL,
-    cover_image text,
-    author_name text,
-    author_role text,
-    author_avatar_url text,
-    author_bio text,
-    status text DEFAULT 'draft'::text NOT NULL,
-    read_time text,
-    published_at timestamp with time zone,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    meta_title text,
-    meta_description text,
-    canonical_url text,
-    og_image text,
-    noindex boolean DEFAULT false NOT NULL,
-    external_ref text,
-    source text DEFAULT 'admin'::text NOT NULL,
-    language text,
-    tags text[],
-    author_member_id uuid,
-    CONSTRAINT plg_blog_posts_status_check CHECK ((status = ANY (ARRAY['draft'::text, 'published'::text])))
-);
-
-
--- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) RETURNS jsonb
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_denial jsonb;
-  v_used   int;
-  v_title  text;
-  v_base   text;
-  v_slug   text;
-  v_n      int := 1;
-  v_id     uuid;
-BEGIN
-  v_title := nullif(btrim(p_payload->>'title'), '');
-  IF v_title IS NULL THEN
-    RETURN jsonb_build_object('ok', false, 'error', 'title is required to draft a post');
-  END IF;
-
-  SELECT count(*) INTO v_used FROM public.plg_blog_posts p WHERE p.tenant_id = p_tenant_id;
-  v_denial := public.agent_guard(p_tenant_id, p_actor_user_id, 'blog', 'create', 'blog_posts', v_used, 1);
-  IF v_denial IS NOT NULL THEN
-    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
-  END IF;
-
-  v_base := coalesce(nullif(public.plg_blog_slugify(v_title), ''), 'post-' || left(md5(v_title), 8));
-  v_slug := left(v_base, 120);
-  WHILE EXISTS (SELECT 1 FROM public.plg_blog_posts p
-                WHERE p.tenant_id = p_tenant_id AND p.slug = v_slug) LOOP
-    v_n := v_n + 1;
-    IF v_n > 50 THEN
-      RETURN jsonb_build_object('ok', false, 'error', format('cannot derive a free slug from %L', v_base));
-    END IF;
-    v_slug := left(v_base, 112) || '-' || v_n;
-  END LOOP;
-
-  INSERT INTO public.plg_blog_posts (
-    tenant_id, slug, title, excerpt, body, status, source, language, tags, updated_at)
-  VALUES (
-    p_tenant_id, v_slug, v_title,
-    left(btrim(regexp_replace(coalesce(p_payload->>'excerpt', ''), '<[^>]*>', '', 'g')), 500),
-    -- Same sanitiser as the external door: the model's output is not more
-    -- trustworthy than a partner's, it is just closer to home.
-    public.plg_blog_sanitize_html(p_payload->>'body_html'),
-    'draft', 'agent',
-    nullif(btrim(p_payload->>'language'), ''),
-    CASE WHEN jsonb_typeof(p_payload->'tags') = 'array'
-         THEN ARRAY(SELECT btrim(x) FROM jsonb_array_elements_text(p_payload->'tags') AS x WHERE btrim(x) <> '')
-    END,
-    now())
-  RETURNING id INTO v_id;
-
-  INSERT INTO public.audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
-  VALUES (p_tenant_id, p_actor_user_id, 'agent.draftBlogPost', 'blog_post', v_id::text,
-          jsonb_build_object('title', v_title, 'slug', v_slug));
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'id', v_id,
-    'record', jsonb_build_object(
-      'ref', jsonb_build_object('id', v_id, 'resource', 'plg_blog_posts', 'entityKey', 'blog:posts'),
-      'name', v_title,
-      'slug', v_slug,
-      'status', 'draft'));
-END;
-$$;
-
-CREATE FUNCTION public.blog_upsert_external_post(p_payload jsonb) RETURNS jsonb
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_tenants     uuid[];
-  v_tenant      uuid;
-  v_claimed     uuid;
-  v_ref         text;
-  v_title       text;
-  v_base        text;
-  v_slug        text;
-  v_status      text;
-  v_source      text;
-  v_lang        text;
-  v_body        text;
-  v_excerpt     text;
-  v_tags        text[];
-  v_author      uuid;
-  v_pub         timestamptz;
-  v_cover       text;
-  v_existing_id   uuid;
-  v_existing_pub  timestamptz;
-  v_existing_slug text;
-  v_n           int := 1;
-  v_id          uuid;
-  v_created     boolean := false;
-BEGIN
-  -- \u2500\u2500 tenant: from the credential, never from the payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  -- A tenant id the caller supplies is how one tenant writes into another's
-  -- blog, and the caller is a machine outside our trust boundary. The only
-  -- statement about identity we can believe is the one the credential makes.
-  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
-  IF v_tenants IS NULL OR array_length(v_tenants, 1) <> 1 THEN
-    RAISE EXCEPTION
-      'blog_upsert_external_post: the caller must present a credential scoped to exactly one tenant'
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-  v_tenant := v_tenants[1];
-
-  -- Refusing beats ignoring: a publisher that believes it is writing into
-  -- another tenant must be told so, not silently redirected into this one.
-  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL THEN
-    BEGIN
-      v_claimed := (p_payload->>'tenant_id')::uuid;
-    EXCEPTION WHEN OTHERS THEN
-      v_claimed := NULL;
-    END;
-    IF v_claimed IS DISTINCT FROM v_tenant THEN
-      RAISE EXCEPTION 'blog_upsert_external_post: payload names another tenant; the tenant comes from the credential'
-        USING ERRCODE = 'insufficient_privilege';
-    END IF;
-  END IF;
-
-  -- \u2500\u2500 the article \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  v_ref   := nullif(btrim(p_payload->>'external_ref'), '');
-  v_title := nullif(btrim(p_payload->>'title'), '');
-  IF v_title IS NULL THEN
-    RAISE EXCEPTION 'blog_upsert_external_post: title is required'
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  v_status := lower(coalesce(nullif(btrim(p_payload->>'status'), ''), 'draft'));
-  IF v_status NOT IN ('draft', 'published') THEN
-    RAISE EXCEPTION 'blog_upsert_external_post: unknown status %; expected draft or published', v_status
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  -- Never taken as 'admin' by default: a post that arrived through this door is
-  -- external by definition, and mislabelling it is what makes a connector echo
-  -- it back to the system that sent it.
-  v_source  := lower(coalesce(nullif(btrim(p_payload->>'source'), ''), 'external'));
-  v_lang    := nullif(btrim(p_payload->>'language'), '');
-  v_body    := public.plg_blog_sanitize_html(p_payload->>'body_html');
-  v_excerpt := left(btrim(regexp_replace(coalesce(p_payload->>'excerpt', ''), '<[^>]*>', '', 'g')), 500);
-
-  IF jsonb_typeof(p_payload->'tags') = 'array' THEN
-    SELECT array_agg(btrim(x)) INTO v_tags
-    FROM jsonb_array_elements_text(p_payload->'tags') AS x
-    WHERE btrim(x) <> '';
-  END IF;
-
-  -- An author id is a claim about a person in THIS tenant. Unverified, it would
-  -- let an external publisher put a real employee's name on anything it writes.
-  IF nullif(btrim(p_payload->>'author_member_id'), '') IS NOT NULL THEN
-    BEGIN
-      SELECT tm.id INTO v_author
-      FROM public.tenant_members tm
-      WHERE tm.tenant_id = v_tenant AND tm.id = (p_payload->>'author_member_id')::uuid;
-    EXCEPTION WHEN OTHERS THEN
-      v_author := NULL;
-    END;
-  END IF;
-
-  v_cover := public.plg_blog_safe_url(
-    coalesce(nullif(btrim(p_payload->>'cover_image'), ''), nullif(btrim(p_payload->>'og_image'), '')));
-
-  -- \u2500\u2500 identity + slug \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  IF v_ref IS NOT NULL THEN
-    SELECT p.id, p.published_at, p.slug INTO v_existing_id, v_existing_pub, v_existing_slug
-    FROM public.plg_blog_posts p
-    WHERE p.tenant_id = v_tenant AND p.external_ref = v_ref;
-  END IF;
-
-  -- On re-delivery the existing slug WINS over one re-derived from the title.
-  -- A published post's slug is its URL: silently re-slugging it because the
-  -- publisher fixed a typo in the headline breaks every inbound link \u2014 on an
-  -- SEO product's own articles, of all things. Changing it stays possible, but
-  -- only by saying so explicitly in \`slug\`.
-  v_base := coalesce(
-    nullif(public.plg_blog_slugify(p_payload->>'slug'), ''),
-    nullif(v_existing_slug, ''),
-    nullif(public.plg_blog_slugify(v_title), ''),
-    'post-' || left(md5(coalesce(v_ref, gen_random_uuid()::text)), 8));
-  v_base := left(v_base, 120);
-
-  -- Slug is unique per tenant (001). Two different articles that slugify the
-  -- same must not make the second delivery fail \u2014 a suffixed slug is a smaller
-  -- surprise than a rejected publish.
-  v_slug := v_base;
-  WHILE EXISTS (
-    SELECT 1 FROM public.plg_blog_posts p
-    WHERE p.tenant_id = v_tenant AND p.slug = v_slug
-      AND (v_existing_id IS NULL OR p.id <> v_existing_id)
-  ) LOOP
-    v_n := v_n + 1;
-    IF v_n > 50 THEN
-      RAISE EXCEPTION 'blog_upsert_external_post: cannot derive a free slug from %', v_base
-        USING ERRCODE = 'invalid_parameter_value';
-    END IF;
-    v_slug := left(v_base, 112) || '-' || v_n;
-  END LOOP;
-
-  BEGIN
-    v_pub := nullif(btrim(p_payload->>'published_at'), '')::timestamptz;
-  EXCEPTION WHEN OTHERS THEN
-    v_pub := NULL;
-  END;
-  -- A post that goes back to draft keeps the date it first went out; the public
-  -- view filters on status, so nothing leaks, and the history stays true.
-  v_pub := coalesce(v_pub, v_existing_pub, CASE WHEN v_status = 'published' THEN now() END);
-
-  -- \u2500\u2500 write \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  IF v_existing_id IS NOT NULL THEN
-    UPDATE public.plg_blog_posts SET
-      slug             = v_slug,
-      title            = v_title,
-      excerpt          = v_excerpt,
-      body             = v_body,
-      status           = v_status,
-      published_at     = v_pub,
-      source           = v_source,
-      language         = v_lang,
-      tags             = v_tags,
-      author_member_id = coalesce(v_author, author_member_id),
-      cover_image      = coalesce(v_cover, cover_image),
-      meta_title       = nullif(btrim(p_payload->>'meta_title'), ''),
-      meta_description = nullif(btrim(p_payload->>'meta_description'), ''),
-      canonical_url    = public.plg_blog_safe_url(p_payload->>'canonical_url'),
-      og_image         = public.plg_blog_safe_url(p_payload->>'og_image'),
-      noindex          = coalesce((p_payload->>'noindex')::boolean, false),
-      updated_at       = now()
-    WHERE id = v_existing_id;
-    v_id := v_existing_id;
-  ELSE
-    -- ON CONFLICT on the partial index, not just the SELECT above: two
-    -- deliveries of the same article racing each other would both find nothing
-    -- and both insert. The index is what makes the second one an update.
-    INSERT INTO public.plg_blog_posts (
-      tenant_id, slug, title, excerpt, body, status, published_at,
-      external_ref, source, language, tags, author_member_id, cover_image,
-      meta_title, meta_description, canonical_url, og_image, noindex, updated_at)
-    VALUES (
-      v_tenant, v_slug, v_title, v_excerpt, v_body, v_status, v_pub,
-      v_ref, v_source, v_lang, v_tags, v_author, v_cover,
-      nullif(btrim(p_payload->>'meta_title'), ''),
-      nullif(btrim(p_payload->>'meta_description'), ''),
-      public.plg_blog_safe_url(p_payload->>'canonical_url'),
-      public.plg_blog_safe_url(p_payload->>'og_image'),
-      coalesce((p_payload->>'noindex')::boolean, false),
-      now())
-    ON CONFLICT (tenant_id, external_ref) WHERE external_ref IS NOT NULL
-    DO UPDATE SET
-      title            = excluded.title,
-      excerpt          = excluded.excerpt,
-      body             = excluded.body,
-      status           = excluded.status,
-      published_at     = coalesce(excluded.published_at, plg_blog_posts.published_at),
-      source           = excluded.source,
-      language         = excluded.language,
-      tags             = excluded.tags,
-      cover_image      = coalesce(excluded.cover_image, plg_blog_posts.cover_image),
-      meta_title       = excluded.meta_title,
-      meta_description = excluded.meta_description,
-      canonical_url    = excluded.canonical_url,
-      og_image         = excluded.og_image,
-      noindex          = excluded.noindex,
-      updated_at       = now()
-    RETURNING id, (xmax = 0) INTO v_id, v_created;
-  END IF;
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'id', v_id,
-    'slug', v_slug,
-    'status', v_status,
-    'source', v_source,
-    'external_ref', v_ref,
-    'created', coalesce(v_created, false));
-END;
-$$;
-
-CREATE FUNCTION public.plg_blog_emit_post_event() RETURNS trigger
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_row     jsonb;
-  v_tenant  uuid;
-  v_id      text;
-  v_payload jsonb;
-BEGIN
-  -- A save that changed nothing is not a fact; without this any bulk re-save
-  -- buries the real updates.
-  IF TG_OP = 'UPDATE' AND OLD IS NOT DISTINCT FROM NEW THEN
-    RETURN NULL;
-  END IF;
-
-  IF TG_OP = 'DELETE' THEN
-    v_row := to_jsonb(OLD);
-  ELSE
-    v_row := to_jsonb(NEW);
-  END IF;
-  v_tenant := nullif(v_row->>'tenant_id', '')::uuid;
-  v_id     := v_row->>'id';
-  -- The contract every consumer reads. Not the row: a whole-row payload puts
-  -- the article body inside every webhook by default, and whoever needs it
-  -- fetches by id.
-  v_payload := jsonb_build_object(
-    'post_id',      v_id,
-    'slug',         v_row->>'slug',
-    'title',        v_row->>'title',
-    'status',       v_row->>'status',
-    'source',       coalesce(v_row->>'source', 'admin'),
-    'external_ref', v_row->>'external_ref',
-    'language',     v_row->>'language');
-
-  BEGIN
-    IF TG_OP = 'INSERT' THEN
-      PERFORM public.plg_emit_event('blog.post.created', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      IF NEW.status = 'published' THEN
-        PERFORM public.plg_emit_event('blog.post.published', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      END IF;
-    ELSIF TG_OP = 'UPDATE' THEN
-      PERFORM public.plg_emit_event('blog.post.updated', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      IF NEW.status = 'published' AND OLD.status IS DISTINCT FROM 'published' THEN
-        PERFORM public.plg_emit_event('blog.post.published', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      END IF;
-    ELSE
-      PERFORM public.plg_emit_event('blog.post.deleted', v_payload, 'blog_post', v_id, v_tenant, NULL);
-    END IF;
-  EXCEPTION WHEN OTHERS THEN
-    -- Observability must never be able to reject the write that caused it.
-    RAISE WARNING '[plg_blog_emit_post_event] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
-  END;
-
-  RETURN NULL;
-END;
-$$;
-
-CREATE FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) RETURNS text
-    LANGUAGE sql IMMUTABLE
-    AS $$
-  SELECT coalesce(
-    substring(p_tag from '(?i)\\s' || p_name || '\\s*=\\s*"([^"]*)"'),
-    substring(p_tag from '(?i)\\s' || p_name || '\\s*=\\s*''([^'']*)'''),
-    substring(p_tag from '(?i)\\s' || p_name || '\\s*=\\s*([^\\s">]+)')
-  );
-$$;
-
-CREATE FUNCTION public.plg_blog_html_escape(p_text text) RETURNS text
-    LANGUAGE sql IMMUTABLE
-    AS $$
-  SELECT replace(replace(replace(coalesce(p_text, ''), '<', '&lt;'), '>', '&gt;'), '"', '&quot;');
-$$;
-
-CREATE FUNCTION public.plg_blog_safe_url(p_url text) RETURNS text
-    LANGUAGE plpgsql IMMUTABLE
-    AS $$
-DECLARE
-  v text;
-BEGIN
-  IF p_url IS NULL THEN RETURN NULL; END IF;
-  -- Whitespace and control characters go BEFORE the scheme test: \`java\\tscript:\`
-  -- is a working URL in every browser and would pass a naive prefix check.
-  v := regexp_replace(btrim(p_url), '[[:space:][:cntrl:]]', '', 'g');
-  IF v = '' THEN RETURN NULL; END IF;
-  -- Allowlist of schemes. \`data:\` is absent on purpose: a data URL is a way to
-  -- ship a whole document \u2014 including an SVG that scripts \u2014 inside an href.
-  IF v ~* '^(https?://|mailto:|/|#)' THEN
-    RETURN public.plg_blog_html_escape(v);
-  END IF;
-  RETURN NULL;
-END;
-$$;
-
-CREATE FUNCTION public.plg_blog_sanitize_html(p_html text) RETURNS text
-    LANGUAGE plpgsql IMMUTABLE
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  -- The allowlist is what an ARTICLE is made of. Layout tags (div, span,
-  -- section, main) are deliberately out: they carry nothing a blog post needs
-  -- and every one of them is a place to hang an attribute. Anything not listed
-  -- loses its tag and keeps its text, so a stripped wrapper degrades to prose
-  -- rather than to a hole in the article.
-  c_allowed constant text[] := ARRAY[
-    'p','br','hr','h1','h2','h3','h4','h5','h6',
-    'strong','b','em','i','u','s','sup','sub','code','pre','blockquote','q','cite',
-    'ul','ol','li','dl','dt','dd',
-    'a','img','figure','figcaption',
-    'table','thead','tbody','tfoot','tr','th','td','caption'
-  ];
-  c_void constant text[] := ARRAY['br','hr','img'];
-  -- Elements whose CONTENT is code rather than text.
-  c_active constant text :=
-    'script|style|iframe|object|embed|applet|form|noscript|svg|math|template|frameset|frame';
-  v       text;
-  v_rest  text;
-  v_out   text := '';
-  v_lt    int;
-  v_gt    int;
-  v_tag   text;
-  v_name  text;
-  v_val   text;
-  v_attrs text;
-BEGIN
-  IF p_html IS NULL OR btrim(p_html) = '' THEN RETURN ''; END IF;
-  v := p_html;
-
-  -- Comments first: a conditional comment is executable markup in older
-  -- engines, and \`<!-- <script>\u2026 -->\` would otherwise reach the pass below
-  -- already commented out and survive it.
-  v := regexp_replace(v, '<!--.*?-->', '', 'g');
-  v := regexp_replace(v, '<!\\[CDATA\\[.*?\\]\\]>', '', 'g');
-  v := regexp_replace(v, '<\\?.*?\\?>', '', 'g');
-
-  -- Active elements go whole. Dropping only the tag would leave the script body
-  -- standing as visible page text \u2014 the article would read as vandalised even
-  -- though nothing executed.
-  -- Two Postgres regex traps, both of which fail OPEN and were caught by
-  -- running this against a container rather than by reading it:
-  --   \`\\y\`, not \`\\b\` \u2014 in a Postgres RE \`\\b\` is the BACKSPACE character, so
-  --   \`<script\\b\` matches nothing and the script body survives as page text.
-  --   Every quantifier non-greedy \u2014 a Postgres RE takes its greediness from its
-  --   FIRST quantifier, so one greedy \`\\s*\` at the front makes the trailing
-  --   \`.*?\` greedy too, and the first <script> swallows the article down to the
-  --   last closing tag in the document.
-  v := regexp_replace(v, '<\\s*?(' || c_active || ')\\y[^>]*?>.*?<\\s*?/\\s*?\\1\\s*?>', '', 'gi');
-  -- \u2026and the unbalanced halves of the same set, plus the document-level tags
-  -- that have no business inside an article body.
-  v := regexp_replace(
-    v,
-    '<\\s*/?\\s*(' || c_active || '|link|meta|base|title|head|body|html)\\y[^>]*>',
-    '', 'gi');
-
-  -- Walk the remaining tags. A rewrite rather than a filter: every tag that
-  -- comes out the other side was BUILT here from a name and an allowlisted
-  -- attribute, so nothing an attacker wrote is copied through by accident.
-  v_rest := v;
-  LOOP
-    v_lt := position('<' in v_rest);
-    IF v_lt = 0 THEN
-      v_out := v_out || v_rest;
-      EXIT;
-    END IF;
-    v_out  := v_out || substr(v_rest, 1, v_lt - 1);
-    v_rest := substr(v_rest, v_lt);
-
-    v_gt := position('>' in v_rest);
-    IF v_gt = 0 THEN
-      -- An unterminated '<' is text. It is escaped so it cannot open a tag when
-      -- something is concatenated after this body.
-      v_out := v_out || replace(v_rest, '<', '&lt;');
-      EXIT;
-    END IF;
-    v_tag  := substr(v_rest, 1, v_gt);
-    v_rest := substr(v_rest, v_gt + 1);
-
-    v_name := lower(coalesce(substring(v_tag from '^<\\s*/?\\s*([a-zA-Z][a-zA-Z0-9]*)'), ''));
-    IF v_name = '' OR NOT (v_name = ANY (c_allowed)) THEN
-      CONTINUE; -- tag dropped, its text kept
-    END IF;
-
-    IF v_tag ~ '^<\\s*/' THEN
-      IF NOT (v_name = ANY (c_void)) THEN v_out := v_out || '</' || v_name || '>'; END IF;
-      CONTINUE;
-    END IF;
-
-    -- Attributes are an allowlist too, and a per-tag one: \`href\` on <a>,
-    -- \`src\`/\`alt\` on <img>. Everything else \u2014 style, on*, srcset, class,
-    -- data-* \u2014 is dropped rather than inspected, because inspecting means
-    -- maintaining a list of what is dangerous, and that list is never finished.
-    v_attrs := '';
-    IF v_name = 'a' THEN
-      v_val := public.plg_blog_safe_url(public.plg_blog_html_attr(v_tag, 'href'));
-      IF v_val IS NOT NULL THEN
-        -- An external publisher's outbound links are not the tenant's
-        -- endorsement, and an unmarked link farm is precisely the SEO damage
-        -- this seam could otherwise cause on the tenant's own domain.
-        v_attrs := ' href="' || v_val || '" rel="nofollow noopener"';
-      END IF;
-    ELSIF v_name = 'img' THEN
-      v_val := public.plg_blog_safe_url(public.plg_blog_html_attr(v_tag, 'src'));
-      IF v_val IS NULL THEN CONTINUE; END IF; -- an <img> with no safe src is nothing
-      v_attrs := ' src="' || v_val || '" alt="'
-                 || public.plg_blog_html_escape(public.plg_blog_html_attr(v_tag, 'alt')) || '"';
-    END IF;
-
-    v_out := v_out || '<' || v_name || v_attrs
-             || CASE WHEN v_name = ANY (c_void) THEN ' />' ELSE '>' END;
-  END LOOP;
-
-  RETURN v_out;
-END;
-$$;
-
-CREATE FUNCTION public.plg_blog_slugify(p_text text) RETURNS text
-    LANGUAGE sql IMMUTABLE
-    AS $$
-  SELECT btrim(
-    regexp_replace(
-      translate(lower(coalesce(p_text, '')),
-                '\xE1\xE0\xE2\xE3\xE4\xE5\xE9\xE8\xEA\xEB\xED\xEC\xEE\xEF\xF3\xF2\xF4\xF5\xF6\xF8\xFA\xF9\xFB\xFC\xE7\xF1\xFD\xFF',
-                'aaaaaaeeeeiiiioooooouuuucnyy'),
-      '[^a-z0-9]+', '-', 'g'),
-    '-');
-$$;
-
-
--- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-ALTER TABLE ONLY public.plg_blog_categories
-    ADD CONSTRAINT plg_blog_categories_pkey PRIMARY KEY (id);
-
-ALTER TABLE ONLY public.plg_blog_posts
-    ADD CONSTRAINT plg_blog_posts_pkey PRIMARY KEY (id);
-
-
--- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE VIEW public.v_public_blog_posts AS
- SELECT p.id,
-    p.tenant_id,
-    p.slug,
-    p.title,
-    p.excerpt,
-    p.body,
-    COALESCE(c.name, ''::text) AS tag,
-    p.cover_image,
-    p.author_name,
-    p.author_role,
-    p.author_avatar_url,
-    p.author_bio,
-    p.read_time,
-    p.published_at,
-    p.meta_title,
-    p.meta_description,
-    p.canonical_url,
-    p.og_image,
-    p.noindex,
-    p.language,
-    p.tags
-   FROM (public.plg_blog_posts p
-     LEFT JOIN public.plg_blog_categories c ON ((c.id = p.category_id)))
-  WHERE (p.status = 'published'::text);
-
-
--- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE INDEX idx_plg_blog_categories_tenant ON public.plg_blog_categories USING btree (tenant_id);
-
-CREATE INDEX idx_plg_blog_posts_category ON public.plg_blog_posts USING btree (category_id);
-
-CREATE INDEX idx_plg_blog_posts_source ON public.plg_blog_posts USING btree (tenant_id, source, updated_at DESC);
-
-CREATE INDEX idx_plg_blog_posts_status ON public.plg_blog_posts USING btree (tenant_id, status, published_at DESC);
-
-CREATE INDEX idx_plg_blog_posts_tenant ON public.plg_blog_posts USING btree (tenant_id);
-
-CREATE UNIQUE INDEX uq_plg_blog_categories_tenant_slug ON public.plg_blog_categories USING btree (tenant_id, slug);
-
-CREATE UNIQUE INDEX uq_plg_blog_posts_tenant_external_ref ON public.plg_blog_posts USING btree (tenant_id, external_ref) WHERE (external_ref IS NOT NULL);
-
-CREATE UNIQUE INDEX uq_plg_blog_posts_tenant_slug ON public.plg_blog_posts USING btree (tenant_id, slug);
-
-
--- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-ALTER TABLE ONLY public.plg_blog_categories
-    ADD CONSTRAINT plg_blog_categories_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
-
-ALTER TABLE ONLY public.plg_blog_posts
-    ADD CONSTRAINT plg_blog_posts_author_member_id_fkey FOREIGN KEY (author_member_id) REFERENCES public.tenant_members(id) ON DELETE SET NULL;
-
-ALTER TABLE ONLY public.plg_blog_posts
-    ADD CONSTRAINT plg_blog_posts_category_id_fkey FOREIGN KEY (category_id) REFERENCES public.plg_blog_categories(id) ON DELETE SET NULL;
-
-ALTER TABLE ONLY public.plg_blog_posts
-    ADD CONSTRAINT plg_blog_posts_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
-
-
--- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE TRIGGER plg_blog_posts_emit_facts AFTER INSERT OR DELETE OR UPDATE ON public.plg_blog_posts FOR EACH ROW EXECUTE FUNCTION public.plg_blog_emit_post_event();
-
-
--- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-ALTER TABLE public.plg_blog_categories ENABLE ROW LEVEL SECURITY;
-
-ALTER TABLE public.plg_blog_posts ENABLE ROW LEVEL SECURITY;
-
-
--- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE POLICY plg_blog_categories_delete ON public.plg_blog_categories FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_categories_insert ON public.plg_blog_categories FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_categories_select ON public.plg_blog_categories FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_categories_update ON public.plg_blog_categories FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_posts_delete ON public.plg_blog_posts FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_posts_insert ON public.plg_blog_posts FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_posts_select ON public.plg_blog_posts FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-CREATE POLICY plg_blog_posts_update ON public.plg_blog_posts FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
-
-
--- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-REVOKE ALL ON FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO authenticated;
-GRANT ALL ON FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO service_role;
-
-REVOKE ALL ON FUNCTION public.blog_upsert_external_post(p_payload jsonb) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.blog_upsert_external_post(p_payload jsonb) TO authenticated;
-GRANT ALL ON FUNCTION public.blog_upsert_external_post(p_payload jsonb) TO service_role;
-
-REVOKE ALL ON FUNCTION public.plg_blog_emit_post_event() FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_blog_emit_post_event() TO authenticated;
-GRANT ALL ON FUNCTION public.plg_blog_emit_post_event() TO service_role;
-
-REVOKE ALL ON FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) TO authenticated;
-GRANT ALL ON FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) TO service_role;
-
-REVOKE ALL ON FUNCTION public.plg_blog_html_escape(p_text text) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_blog_html_escape(p_text text) TO authenticated;
-GRANT ALL ON FUNCTION public.plg_blog_html_escape(p_text text) TO service_role;
-
-REVOKE ALL ON FUNCTION public.plg_blog_safe_url(p_url text) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_blog_safe_url(p_url text) TO authenticated;
-GRANT ALL ON FUNCTION public.plg_blog_safe_url(p_url text) TO service_role;
-
-REVOKE ALL ON FUNCTION public.plg_blog_sanitize_html(p_html text) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_blog_sanitize_html(p_html text) TO authenticated;
-GRANT ALL ON FUNCTION public.plg_blog_sanitize_html(p_html text) TO service_role;
-
-REVOKE ALL ON FUNCTION public.plg_blog_slugify(p_text text) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_blog_slugify(p_text text) TO authenticated;
-GRANT ALL ON FUNCTION public.plg_blog_slugify(p_text text) TO service_role;
-
-GRANT MAINTAIN ON TABLE public.plg_blog_categories TO anon;
-GRANT ALL ON TABLE public.plg_blog_categories TO authenticated;
-GRANT ALL ON TABLE public.plg_blog_categories TO service_role;
-
-GRANT MAINTAIN ON TABLE public.plg_blog_posts TO anon;
-GRANT ALL ON TABLE public.plg_blog_posts TO authenticated;
-GRANT ALL ON TABLE public.plg_blog_posts TO service_role;
-
-GRANT SELECT,MAINTAIN ON TABLE public.v_public_blog_posts TO anon;
-GRANT ALL ON TABLE public.v_public_blog_posts TO authenticated;
-GRANT ALL ON TABLE public.v_public_blog_posts TO service_role;
-
-
--- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Put back, so the NEXT thing installed inherits what the chain had.
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$--
--- PostgreSQL database dump complete
---$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
--- PostgreSQL database dump complete
---$stmt$;
-END $dp$;
-`;
-var MIGRATION_001_THE_AUTHOR_IS_A_MEMBERSHIP = `-- ============================================================================
--- 001_the_author_is_a_membership \u2014 the FK and the lookup leave the projection
--- (#214 / #352).
---
--- plg_blog_posts.author_member_id pointed at public.tenant_members(id), which
--- is a COMPAT PROJECTION of app.memberships maintained by triggers \u2014 so a real
--- foreign key was resting on a derived table. That is the reason the projection
--- could not be dropped, and it is a stronger reason than "a screen reads it":
--- Postgres refuses to drop a table another table references.
---
--- The move is safe precisely because the projection's own comment says the ids
--- are the same ("COMPAT PROJECTION of app.memberships (#134): same ids"), so
--- every existing author_member_id already names an app.memberships row.
--- ============================================================================
-
-ALTER TABLE public.plg_blog_posts DROP CONSTRAINT IF EXISTS plg_blog_posts_author_member_id_fkey;
-ALTER TABLE public.plg_blog_posts
-  ADD CONSTRAINT plg_blog_posts_author_member_id_fkey
-  FOREIGN KEY (author_member_id) REFERENCES app.memberships(id) ON DELETE SET NULL;
-
-CREATE OR REPLACE FUNCTION public.blog_upsert_external_post(p_payload jsonb) RETURNS jsonb
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_tenants     uuid[];
-  v_tenant      uuid;
-  v_claimed     uuid;
-  v_ref         text;
-  v_title       text;
-  v_base        text;
-  v_slug        text;
-  v_status      text;
-  v_source      text;
-  v_lang        text;
-  v_body        text;
-  v_excerpt     text;
-  v_tags        text[];
-  v_author      uuid;
-  v_pub         timestamptz;
-  v_cover       text;
-  v_existing_id   uuid;
-  v_existing_pub  timestamptz;
-  v_existing_slug text;
-  v_n           int := 1;
-  v_id          uuid;
-  v_created     boolean := false;
-BEGIN
-  -- \u2500\u2500 tenant: from the credential, never from the payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  -- A tenant id the caller supplies is how one tenant writes into another's
-  -- blog, and the caller is a machine outside our trust boundary. The only
-  -- statement about identity we can believe is the one the credential makes.
-  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
-  IF v_tenants IS NULL OR array_length(v_tenants, 1) <> 1 THEN
-    RAISE EXCEPTION
-      'blog_upsert_external_post: the caller must present a credential scoped to exactly one tenant'
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-  v_tenant := v_tenants[1];
-
-  -- Refusing beats ignoring: a publisher that believes it is writing into
-  -- another tenant must be told so, not silently redirected into this one.
-  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL THEN
-    BEGIN
-      v_claimed := (p_payload->>'tenant_id')::uuid;
-    EXCEPTION WHEN OTHERS THEN
-      v_claimed := NULL;
-    END;
-    IF v_claimed IS DISTINCT FROM v_tenant THEN
-      RAISE EXCEPTION 'blog_upsert_external_post: payload names another tenant; the tenant comes from the credential'
-        USING ERRCODE = 'insufficient_privilege';
-    END IF;
-  END IF;
-
-  -- \u2500\u2500 the article \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  v_ref   := nullif(btrim(p_payload->>'external_ref'), '');
-  v_title := nullif(btrim(p_payload->>'title'), '');
-  IF v_title IS NULL THEN
-    RAISE EXCEPTION 'blog_upsert_external_post: title is required'
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  v_status := lower(coalesce(nullif(btrim(p_payload->>'status'), ''), 'draft'));
-  IF v_status NOT IN ('draft', 'published') THEN
-    RAISE EXCEPTION 'blog_upsert_external_post: unknown status %; expected draft or published', v_status
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  -- Never taken as 'admin' by default: a post that arrived through this door is
-  -- external by definition, and mislabelling it is what makes a connector echo
-  -- it back to the system that sent it.
-  v_source  := lower(coalesce(nullif(btrim(p_payload->>'source'), ''), 'external'));
-  v_lang    := nullif(btrim(p_payload->>'language'), '');
-  v_body    := public.plg_blog_sanitize_html(p_payload->>'body_html');
-  v_excerpt := left(btrim(regexp_replace(coalesce(p_payload->>'excerpt', ''), '<[^>]*>', '', 'g')), 500);
-
-  IF jsonb_typeof(p_payload->'tags') = 'array' THEN
-    SELECT array_agg(btrim(x)) INTO v_tags
-    FROM jsonb_array_elements_text(p_payload->'tags') AS x
-    WHERE btrim(x) <> '';
-  END IF;
-
-  -- An author id is a claim about a person in THIS tenant. Unverified, it would
-  -- let an external publisher put a real employee's name on anything it writes.
-  IF nullif(btrim(p_payload->>'author_member_id'), '') IS NOT NULL THEN
-    BEGIN
-      SELECT tm.id INTO v_author
-      FROM app.memberships tm
-      WHERE tm.tenant_id = v_tenant AND tm.id = (p_payload->>'author_member_id')::uuid;
-    EXCEPTION WHEN OTHERS THEN
-      v_author := NULL;
-    END;
-  END IF;
-
-  v_cover := public.plg_blog_safe_url(
-    coalesce(nullif(btrim(p_payload->>'cover_image'), ''), nullif(btrim(p_payload->>'og_image'), '')));
-
-  -- \u2500\u2500 identity + slug \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  IF v_ref IS NOT NULL THEN
-    SELECT p.id, p.published_at, p.slug INTO v_existing_id, v_existing_pub, v_existing_slug
-    FROM public.plg_blog_posts p
-    WHERE p.tenant_id = v_tenant AND p.external_ref = v_ref;
-  END IF;
-
-  -- On re-delivery the existing slug WINS over one re-derived from the title.
-  -- A published post's slug is its URL: silently re-slugging it because the
-  -- publisher fixed a typo in the headline breaks every inbound link \u2014 on an
-  -- SEO product's own articles, of all things. Changing it stays possible, but
-  -- only by saying so explicitly in \`slug\`.
-  v_base := coalesce(
-    nullif(public.plg_blog_slugify(p_payload->>'slug'), ''),
-    nullif(v_existing_slug, ''),
-    nullif(public.plg_blog_slugify(v_title), ''),
-    'post-' || left(md5(coalesce(v_ref, gen_random_uuid()::text)), 8));
-  v_base := left(v_base, 120);
-
-  -- Slug is unique per tenant (001). Two different articles that slugify the
-  -- same must not make the second delivery fail \u2014 a suffixed slug is a smaller
-  -- surprise than a rejected publish.
-  v_slug := v_base;
-  WHILE EXISTS (
-    SELECT 1 FROM public.plg_blog_posts p
-    WHERE p.tenant_id = v_tenant AND p.slug = v_slug
-      AND (v_existing_id IS NULL OR p.id <> v_existing_id)
-  ) LOOP
-    v_n := v_n + 1;
-    IF v_n > 50 THEN
-      RAISE EXCEPTION 'blog_upsert_external_post: cannot derive a free slug from %', v_base
-        USING ERRCODE = 'invalid_parameter_value';
-    END IF;
-    v_slug := left(v_base, 112) || '-' || v_n;
-  END LOOP;
-
-  BEGIN
-    v_pub := nullif(btrim(p_payload->>'published_at'), '')::timestamptz;
-  EXCEPTION WHEN OTHERS THEN
-    v_pub := NULL;
-  END;
-  -- A post that goes back to draft keeps the date it first went out; the public
-  -- view filters on status, so nothing leaks, and the history stays true.
-  v_pub := coalesce(v_pub, v_existing_pub, CASE WHEN v_status = 'published' THEN now() END);
-
-  -- \u2500\u2500 write \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  IF v_existing_id IS NOT NULL THEN
-    UPDATE public.plg_blog_posts SET
-      slug             = v_slug,
-      title            = v_title,
-      excerpt          = v_excerpt,
-      body             = v_body,
-      status           = v_status,
-      published_at     = v_pub,
-      source           = v_source,
-      language         = v_lang,
-      tags             = v_tags,
-      author_member_id = coalesce(v_author, author_member_id),
-      cover_image      = coalesce(v_cover, cover_image),
-      meta_title       = nullif(btrim(p_payload->>'meta_title'), ''),
-      meta_description = nullif(btrim(p_payload->>'meta_description'), ''),
-      canonical_url    = public.plg_blog_safe_url(p_payload->>'canonical_url'),
-      og_image         = public.plg_blog_safe_url(p_payload->>'og_image'),
-      noindex          = coalesce((p_payload->>'noindex')::boolean, false),
-      updated_at       = now()
-    WHERE id = v_existing_id;
-    v_id := v_existing_id;
-  ELSE
-    -- ON CONFLICT on the partial index, not just the SELECT above: two
-    -- deliveries of the same article racing each other would both find nothing
-    -- and both insert. The index is what makes the second one an update.
-    INSERT INTO public.plg_blog_posts (
-      tenant_id, slug, title, excerpt, body, status, published_at,
-      external_ref, source, language, tags, author_member_id, cover_image,
-      meta_title, meta_description, canonical_url, og_image, noindex, updated_at)
-    VALUES (
-      v_tenant, v_slug, v_title, v_excerpt, v_body, v_status, v_pub,
-      v_ref, v_source, v_lang, v_tags, v_author, v_cover,
-      nullif(btrim(p_payload->>'meta_title'), ''),
-      nullif(btrim(p_payload->>'meta_description'), ''),
-      public.plg_blog_safe_url(p_payload->>'canonical_url'),
-      public.plg_blog_safe_url(p_payload->>'og_image'),
-      coalesce((p_payload->>'noindex')::boolean, false),
-      now())
-    ON CONFLICT (tenant_id, external_ref) WHERE external_ref IS NOT NULL
-    DO UPDATE SET
-      title            = excluded.title,
-      excerpt          = excluded.excerpt,
-      body             = excluded.body,
-      status           = excluded.status,
-      published_at     = coalesce(excluded.published_at, plg_blog_posts.published_at),
-      source           = excluded.source,
-      language         = excluded.language,
-      tags             = excluded.tags,
-      cover_image      = coalesce(excluded.cover_image, plg_blog_posts.cover_image),
-      meta_title       = excluded.meta_title,
-      meta_description = excluded.meta_description,
-      canonical_url    = excluded.canonical_url,
-      og_image         = excluded.og_image,
-      noindex          = excluded.noindex,
-      updated_at       = now()
-    RETURNING id, (xmax = 0) INTO v_id, v_created;
-  END IF;
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'id', v_id,
-    'slug', v_slug,
-    'status', v_status,
-    'source', v_source,
-    'external_ref', v_ref,
-    'created', coalesce(v_created, false));
-END;
-$$;`;
-var MIGRATIONS = [
-  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
-  { id: "001_the_author_is_a_membership", sql: MIGRATION_001_THE_AUTHOR_IS_A_MEMBERSHIP }
-];
-
 // src/data/runtime.ts
 var _provider = null;
 function setBlogProvider(provider) {