@fayz-ai/plugin-blog 0.12.6 → 0.12.8

package/dist/index.js

@@ -113,219 +113,474 @@ function createSupabaseBlogProvider(options) {
 }
 
 // src/migrations/index.ts
-var MIGRATION_001_BLOG = `-- ============================================================================
--- plugin-blog 001: blog content model + public (anon) read surface
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-blog/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
 --
--- Backs the blog backoffice (managed from the marketing plugin's "Blog" tab) and
--- the public website surface (/blog, /blog/:slug). Prefix: plg_blog_.
---   \xA71  plg_blog_categories \u2014 first-class category (name/slug/description)
---   \xA72  plg_blog_posts       \u2014 articles; category_id FK, author byline, status
---   \xA73  RLS: authenticated tenant CRUD on both tables (the backoffice)
---   \xA74  v_public_blog_posts  \u2014 anon-readable view of PUBLISHED posts (the site)
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
 --
--- Anon-access design mirrors plugin-agenda's public booking surface: the public
--- website runs with the publishable key and no session, so canonical tenant RLS
--- yields nothing. Anon read is granted ONLY through the column-whitelisted,
--- published-only view (\xA74); the front provider filters it by tenant_id.
--- Idempotent + safe to re-run.
+-- This replaced 2 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
 -- ============================================================================
 
--- \xA71 \u2014 categories
-CREATE TABLE IF NOT EXISTS public.plg_blog_categories (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  name text NOT NULL,
-  slug text NOT NULL,
-  description text,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now()
-);
-ALTER TABLE public.plg_blog_categories ENABLE ROW LEVEL SECURITY;
-CREATE INDEX IF NOT EXISTS idx_plg_blog_categories_tenant ON public.plg_blog_categories(tenant_id);
-CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_blog_categories_tenant_slug ON public.plg_blog_categories(tenant_id, slug);
-
--- \xA72 \u2014 posts
-CREATE TABLE IF NOT EXISTS public.plg_blog_posts (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  category_id uuid REFERENCES public.plg_blog_categories(id) ON DELETE SET NULL,
-  slug text NOT NULL,
-  title text NOT NULL,
-  excerpt text NOT NULL DEFAULT '',
-  body text NOT NULL DEFAULT '',
-  cover_image text,
-  author_name text,
-  author_role text,
-  author_avatar_url text,
-  author_bio text,
-  status text NOT NULL DEFAULT 'draft'
-    CHECK (status IN ('draft', 'published')),
-  read_time text,
-  published_at timestamptz,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now()
-);
-ALTER TABLE public.plg_blog_posts ENABLE ROW LEVEL SECURITY;
-CREATE INDEX IF NOT EXISTS idx_plg_blog_posts_tenant ON public.plg_blog_posts(tenant_id);
-CREATE INDEX IF NOT EXISTS idx_plg_blog_posts_category ON public.plg_blog_posts(category_id);
-CREATE INDEX IF NOT EXISTS idx_plg_blog_posts_status ON public.plg_blog_posts(tenant_id, status, published_at DESC);
-CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_blog_posts_tenant_slug ON public.plg_blog_posts(tenant_id, slug);
-
--- \xA73 \u2014 RLS: authenticated tenant CRUD (the backoffice writes here)
-DROP POLICY IF EXISTS plg_blog_categories_select ON public.plg_blog_categories;
-DROP POLICY IF EXISTS plg_blog_categories_insert ON public.plg_blog_categories;
-DROP POLICY IF EXISTS plg_blog_categories_update ON public.plg_blog_categories;
-DROP POLICY IF EXISTS plg_blog_categories_delete ON public.plg_blog_categories;
-CREATE POLICY plg_blog_categories_select ON public.plg_blog_categories FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-CREATE POLICY plg_blog_categories_insert ON public.plg_blog_categories FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-CREATE POLICY plg_blog_categories_update ON public.plg_blog_categories FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-CREATE POLICY plg_blog_categories_delete ON public.plg_blog_categories FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_blog_categories TO authenticated;
-
-DROP POLICY IF EXISTS plg_blog_posts_select ON public.plg_blog_posts;
-DROP POLICY IF EXISTS plg_blog_posts_insert ON public.plg_blog_posts;
-DROP POLICY IF EXISTS plg_blog_posts_update ON public.plg_blog_posts;
-DROP POLICY IF EXISTS plg_blog_posts_delete ON public.plg_blog_posts;
-CREATE POLICY plg_blog_posts_select ON public.plg_blog_posts FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-CREATE POLICY plg_blog_posts_insert ON public.plg_blog_posts FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-CREATE POLICY plg_blog_posts_update ON public.plg_blog_posts FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-CREATE POLICY plg_blog_posts_delete ON public.plg_blog_posts FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_blog_posts TO authenticated;
-
--- \xA74 \u2014 anon-readable public catalog (owner-rights view = deliberate, whitelisted,
--- PUBLISHED only). The front provider filters by tenant_id. Category name is
--- surfaced as \`tag\` so the website's BlogPost shape stays unchanged.
--- Dropped, not replaced: a later file widens this view and CREATE OR REPLACE
--- cannot narrow a live one back down ("cannot drop columns from view"), which is
--- what a re-run of this file is asking for. 143 carries any dependent across.
---
--- This is one of the three anon-facing views 043 deliberately left alone, so it
--- comes back WITHOUT security_invoker: flipping it would make it resolve as
--- \`anon\` and the public blog would go dark.
-SELECT app.detach_view_dependents('public.v_public_blog_posts');
-DROP VIEW IF EXISTS public.v_public_blog_posts;
-CREATE OR REPLACE VIEW public.v_public_blog_posts AS
-SELECT
-  p.id,
-  p.tenant_id,
-  p.slug,
-  p.title,
-  p.excerpt,
-  p.body,
-  COALESCE(c.name, '')  AS tag,
-  p.cover_image,
-  p.author_name,
-  p.author_role,
-  p.author_avatar_url,
-  p.author_bio,
-  p.read_time,
-  p.published_at
-FROM public.plg_blog_posts p
-LEFT JOIN public.plg_blog_categories c ON c.id = p.category_id
-WHERE p.status = 'published';
-
-GRANT SELECT ON public.v_public_blog_posts TO anon, authenticated, service_role;
-
-SELECT app.reattach_view_dependents();
-`;
-var MIGRATION_002_EXTERNAL_POSTS = `-- ============================================================================
--- plugin-blog 002: the ingest seam \u2014 per-post SEO, external identity, and the
--- single function an outside publisher passes through.
---
--- 001 gave the blog a content model written by one hand: the backoffice, behind
--- a session, through RLS. RankLayer publishes INTO the tenant instead, so the
--- write arrives from a machine we do not run, carrying HTML we did not author
--- and an identity that lives in someone else's database. Three things follow,
--- and each is a section here.
---
---   \xA71  columns    per-post SEO + the external identity (external_ref, source\u2026)
---   \xA72  identity   partial unique index on (tenant_id, external_ref)
---   \xA73  sanitiser  plg_blog_sanitize_html \u2014 a tag allowlist, in SQL
---   \xA74  ingest     blog_upsert_external_post(p_payload jsonb)
---   \xA75  agent      agent_blog_draft_post \u2014 the assistant's write, guarded
---   \xA76  facts      blog.post.{created,updated,published,deleted}
---   \xA77  view       v_public_blog_posts extended with the SEO the site renders
---
--- Additive and idempotent: no table is created, no policy is rewritten, the
--- existing tenant RLS from 001 already covers every column added here.
--- ============================================================================
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_blog_categories (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text NOT NULL,
+    slug text NOT NULL,
+    description text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE public.plg_blog_posts (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    category_id uuid,
+    slug text NOT NULL,
+    title text NOT NULL,
+    excerpt text DEFAULT ''::text NOT NULL,
+    body text DEFAULT ''::text NOT NULL,
+    cover_image text,
+    author_name text,
+    author_role text,
+    author_avatar_url text,
+    author_bio text,
+    status text DEFAULT 'draft'::text NOT NULL,
+    read_time text,
+    published_at timestamp with time zone,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    meta_title text,
+    meta_description text,
+    canonical_url text,
+    og_image text,
+    noindex boolean DEFAULT false NOT NULL,
+    external_ref text,
+    source text DEFAULT 'admin'::text NOT NULL,
+    language text,
+    tags text[],
+    author_member_id uuid,
+    CONSTRAINT plg_blog_posts_status_check CHECK ((status = ANY (ARRAY['draft'::text, 'published'::text])))
+);
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_denial jsonb;
+  v_used   int;
+  v_title  text;
+  v_base   text;
+  v_slug   text;
+  v_n      int := 1;
+  v_id     uuid;
+BEGIN
+  v_title := nullif(btrim(p_payload->>'title'), '');
+  IF v_title IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'title is required to draft a post');
+  END IF;
+
+  SELECT count(*) INTO v_used FROM public.plg_blog_posts p WHERE p.tenant_id = p_tenant_id;
+  v_denial := public.agent_guard(p_tenant_id, p_actor_user_id, 'blog', 'create', 'blog_posts', v_used, 1);
+  IF v_denial IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
+  END IF;
+
+  v_base := coalesce(nullif(public.plg_blog_slugify(v_title), ''), 'post-' || left(md5(v_title), 8));
+  v_slug := left(v_base, 120);
+  WHILE EXISTS (SELECT 1 FROM public.plg_blog_posts p
+                WHERE p.tenant_id = p_tenant_id AND p.slug = v_slug) LOOP
+    v_n := v_n + 1;
+    IF v_n > 50 THEN
+      RETURN jsonb_build_object('ok', false, 'error', format('cannot derive a free slug from %L', v_base));
+    END IF;
+    v_slug := left(v_base, 112) || '-' || v_n;
+  END LOOP;
+
+  INSERT INTO public.plg_blog_posts (
+    tenant_id, slug, title, excerpt, body, status, source, language, tags, updated_at)
+  VALUES (
+    p_tenant_id, v_slug, v_title,
+    left(btrim(regexp_replace(coalesce(p_payload->>'excerpt', ''), '<[^>]*>', '', 'g')), 500),
+    -- Same sanitiser as the external door: the model's output is not more
+    -- trustworthy than a partner's, it is just closer to home.
+    public.plg_blog_sanitize_html(p_payload->>'body_html'),
+    'draft', 'agent',
+    nullif(btrim(p_payload->>'language'), ''),
+    CASE WHEN jsonb_typeof(p_payload->'tags') = 'array'
+         THEN ARRAY(SELECT btrim(x) FROM jsonb_array_elements_text(p_payload->'tags') AS x WHERE btrim(x) <> '')
+    END,
+    now())
+  RETURNING id INTO v_id;
+
+  INSERT INTO public.audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
+  VALUES (p_tenant_id, p_actor_user_id, 'agent.draftBlogPost', 'blog_post', v_id::text,
+          jsonb_build_object('title', v_title, 'slug', v_slug));
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_id,
+    'record', jsonb_build_object(
+      'ref', jsonb_build_object('id', v_id, 'resource', 'plg_blog_posts', 'entityKey', 'blog:posts'),
+      'name', v_title,
+      'slug', v_slug,
+      'status', 'draft'));
+END;
+$$;
+
+CREATE FUNCTION public.blog_upsert_external_post(p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_tenants     uuid[];
+  v_tenant      uuid;
+  v_claimed     uuid;
+  v_ref         text;
+  v_title       text;
+  v_base        text;
+  v_slug        text;
+  v_status      text;
+  v_source      text;
+  v_lang        text;
+  v_body        text;
+  v_excerpt     text;
+  v_tags        text[];
+  v_author      uuid;
+  v_pub         timestamptz;
+  v_cover       text;
+  v_existing_id   uuid;
+  v_existing_pub  timestamptz;
+  v_existing_slug text;
+  v_n           int := 1;
+  v_id          uuid;
+  v_created     boolean := false;
+BEGIN
+  -- \u2500\u2500 tenant: from the credential, never from the payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  -- A tenant id the caller supplies is how one tenant writes into another's
+  -- blog, and the caller is a machine outside our trust boundary. The only
+  -- statement about identity we can believe is the one the credential makes.
+  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
+  IF v_tenants IS NULL OR array_length(v_tenants, 1) <> 1 THEN
+    RAISE EXCEPTION
+      'blog_upsert_external_post: the caller must present a credential scoped to exactly one tenant'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+  v_tenant := v_tenants[1];
+
+  -- Refusing beats ignoring: a publisher that believes it is writing into
+  -- another tenant must be told so, not silently redirected into this one.
+  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL THEN
+    BEGIN
+      v_claimed := (p_payload->>'tenant_id')::uuid;
+    EXCEPTION WHEN OTHERS THEN
+      v_claimed := NULL;
+    END;
+    IF v_claimed IS DISTINCT FROM v_tenant THEN
+      RAISE EXCEPTION 'blog_upsert_external_post: payload names another tenant; the tenant comes from the credential'
+        USING ERRCODE = 'insufficient_privilege';
+    END IF;
+  END IF;
+
+  -- \u2500\u2500 the article \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  v_ref   := nullif(btrim(p_payload->>'external_ref'), '');
+  v_title := nullif(btrim(p_payload->>'title'), '');
+  IF v_title IS NULL THEN
+    RAISE EXCEPTION 'blog_upsert_external_post: title is required'
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  v_status := lower(coalesce(nullif(btrim(p_payload->>'status'), ''), 'draft'));
+  IF v_status NOT IN ('draft', 'published') THEN
+    RAISE EXCEPTION 'blog_upsert_external_post: unknown status %; expected draft or published', v_status
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  -- Never taken as 'admin' by default: a post that arrived through this door is
+  -- external by definition, and mislabelling it is what makes a connector echo
+  -- it back to the system that sent it.
+  v_source  := lower(coalesce(nullif(btrim(p_payload->>'source'), ''), 'external'));
+  v_lang    := nullif(btrim(p_payload->>'language'), '');
+  v_body    := public.plg_blog_sanitize_html(p_payload->>'body_html');
+  v_excerpt := left(btrim(regexp_replace(coalesce(p_payload->>'excerpt', ''), '<[^>]*>', '', 'g')), 500);
+
+  IF jsonb_typeof(p_payload->'tags') = 'array' THEN
+    SELECT array_agg(btrim(x)) INTO v_tags
+    FROM jsonb_array_elements_text(p_payload->'tags') AS x
+    WHERE btrim(x) <> '';
+  END IF;
+
+  -- An author id is a claim about a person in THIS tenant. Unverified, it would
+  -- let an external publisher put a real employee's name on anything it writes.
+  IF nullif(btrim(p_payload->>'author_member_id'), '') IS NOT NULL THEN
+    BEGIN
+      SELECT tm.id INTO v_author
+      FROM public.tenant_members tm
+      WHERE tm.tenant_id = v_tenant AND tm.id = (p_payload->>'author_member_id')::uuid;
+    EXCEPTION WHEN OTHERS THEN
+      v_author := NULL;
+    END;
+  END IF;
+
+  v_cover := public.plg_blog_safe_url(
+    coalesce(nullif(btrim(p_payload->>'cover_image'), ''), nullif(btrim(p_payload->>'og_image'), '')));
+
+  -- \u2500\u2500 identity + slug \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  IF v_ref IS NOT NULL THEN
+    SELECT p.id, p.published_at, p.slug INTO v_existing_id, v_existing_pub, v_existing_slug
+    FROM public.plg_blog_posts p
+    WHERE p.tenant_id = v_tenant AND p.external_ref = v_ref;
+  END IF;
+
+  -- On re-delivery the existing slug WINS over one re-derived from the title.
+  -- A published post's slug is its URL: silently re-slugging it because the
+  -- publisher fixed a typo in the headline breaks every inbound link \u2014 on an
+  -- SEO product's own articles, of all things. Changing it stays possible, but
+  -- only by saying so explicitly in \`slug\`.
+  v_base := coalesce(
+    nullif(public.plg_blog_slugify(p_payload->>'slug'), ''),
+    nullif(v_existing_slug, ''),
+    nullif(public.plg_blog_slugify(v_title), ''),
+    'post-' || left(md5(coalesce(v_ref, gen_random_uuid()::text)), 8));
+  v_base := left(v_base, 120);
+
+  -- Slug is unique per tenant (001). Two different articles that slugify the
+  -- same must not make the second delivery fail \u2014 a suffixed slug is a smaller
+  -- surprise than a rejected publish.
+  v_slug := v_base;
+  WHILE EXISTS (
+    SELECT 1 FROM public.plg_blog_posts p
+    WHERE p.tenant_id = v_tenant AND p.slug = v_slug
+      AND (v_existing_id IS NULL OR p.id <> v_existing_id)
+  ) LOOP
+    v_n := v_n + 1;
+    IF v_n > 50 THEN
+      RAISE EXCEPTION 'blog_upsert_external_post: cannot derive a free slug from %', v_base
+        USING ERRCODE = 'invalid_parameter_value';
+    END IF;
+    v_slug := left(v_base, 112) || '-' || v_n;
+  END LOOP;
+
+  BEGIN
+    v_pub := nullif(btrim(p_payload->>'published_at'), '')::timestamptz;
+  EXCEPTION WHEN OTHERS THEN
+    v_pub := NULL;
+  END;
+  -- A post that goes back to draft keeps the date it first went out; the public
+  -- view filters on status, so nothing leaks, and the history stays true.
+  v_pub := coalesce(v_pub, v_existing_pub, CASE WHEN v_status = 'published' THEN now() END);
+
+  -- \u2500\u2500 write \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  IF v_existing_id IS NOT NULL THEN
+    UPDATE public.plg_blog_posts SET
+      slug             = v_slug,
+      title            = v_title,
+      excerpt          = v_excerpt,
+      body             = v_body,
+      status           = v_status,
+      published_at     = v_pub,
+      source           = v_source,
+      language         = v_lang,
+      tags             = v_tags,
+      author_member_id = coalesce(v_author, author_member_id),
+      cover_image      = coalesce(v_cover, cover_image),
+      meta_title       = nullif(btrim(p_payload->>'meta_title'), ''),
+      meta_description = nullif(btrim(p_payload->>'meta_description'), ''),
+      canonical_url    = public.plg_blog_safe_url(p_payload->>'canonical_url'),
+      og_image         = public.plg_blog_safe_url(p_payload->>'og_image'),
+      noindex          = coalesce((p_payload->>'noindex')::boolean, false),
+      updated_at       = now()
+    WHERE id = v_existing_id;
+    v_id := v_existing_id;
+  ELSE
+    -- ON CONFLICT on the partial index, not just the SELECT above: two
+    -- deliveries of the same article racing each other would both find nothing
+    -- and both insert. The index is what makes the second one an update.
+    INSERT INTO public.plg_blog_posts (
+      tenant_id, slug, title, excerpt, body, status, published_at,
+      external_ref, source, language, tags, author_member_id, cover_image,
+      meta_title, meta_description, canonical_url, og_image, noindex, updated_at)
+    VALUES (
+      v_tenant, v_slug, v_title, v_excerpt, v_body, v_status, v_pub,
+      v_ref, v_source, v_lang, v_tags, v_author, v_cover,
+      nullif(btrim(p_payload->>'meta_title'), ''),
+      nullif(btrim(p_payload->>'meta_description'), ''),
+      public.plg_blog_safe_url(p_payload->>'canonical_url'),
+      public.plg_blog_safe_url(p_payload->>'og_image'),
+      coalesce((p_payload->>'noindex')::boolean, false),
+      now())
+    ON CONFLICT (tenant_id, external_ref) WHERE external_ref IS NOT NULL
+    DO UPDATE SET
+      title            = excluded.title,
+      excerpt          = excluded.excerpt,
+      body             = excluded.body,
+      status           = excluded.status,
+      published_at     = coalesce(excluded.published_at, plg_blog_posts.published_at),
+      source           = excluded.source,
+      language         = excluded.language,
+      tags             = excluded.tags,
+      cover_image      = coalesce(excluded.cover_image, plg_blog_posts.cover_image),
+      meta_title       = excluded.meta_title,
+      meta_description = excluded.meta_description,
+      canonical_url    = excluded.canonical_url,
+      og_image         = excluded.og_image,
+      noindex          = excluded.noindex,
+      updated_at       = now()
+    RETURNING id, (xmax = 0) INTO v_id, v_created;
+  END IF;
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_id,
+    'slug', v_slug,
+    'status', v_status,
+    'source', v_source,
+    'external_ref', v_ref,
+    'created', coalesce(v_created, false));
+END;
+$$;
+
+CREATE FUNCTION public.plg_blog_emit_post_event() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_row     jsonb;
+  v_tenant  uuid;
+  v_id      text;
+  v_payload jsonb;
+BEGIN
+  -- A save that changed nothing is not a fact; without this any bulk re-save
+  -- buries the real updates.
+  IF TG_OP = 'UPDATE' AND OLD IS NOT DISTINCT FROM NEW THEN
+    RETURN NULL;
+  END IF;
+
+  IF TG_OP = 'DELETE' THEN
+    v_row := to_jsonb(OLD);
+  ELSE
+    v_row := to_jsonb(NEW);
+  END IF;
+  v_tenant := nullif(v_row->>'tenant_id', '')::uuid;
+  v_id     := v_row->>'id';
+  -- The contract every consumer reads. Not the row: a whole-row payload puts
+  -- the article body inside every webhook by default, and whoever needs it
+  -- fetches by id.
+  v_payload := jsonb_build_object(
+    'post_id',      v_id,
+    'slug',         v_row->>'slug',
+    'title',        v_row->>'title',
+    'status',       v_row->>'status',
+    'source',       coalesce(v_row->>'source', 'admin'),
+    'external_ref', v_row->>'external_ref',
+    'language',     v_row->>'language');
+
+  BEGIN
+    IF TG_OP = 'INSERT' THEN
+      PERFORM public.plg_emit_event('blog.post.created', v_payload, 'blog_post', v_id, v_tenant, NULL);
+      IF NEW.status = 'published' THEN
+        PERFORM public.plg_emit_event('blog.post.published', v_payload, 'blog_post', v_id, v_tenant, NULL);
+      END IF;
+    ELSIF TG_OP = 'UPDATE' THEN
+      PERFORM public.plg_emit_event('blog.post.updated', v_payload, 'blog_post', v_id, v_tenant, NULL);
+      IF NEW.status = 'published' AND OLD.status IS DISTINCT FROM 'published' THEN
+        PERFORM public.plg_emit_event('blog.post.published', v_payload, 'blog_post', v_id, v_tenant, NULL);
+      END IF;
+    ELSE
+      PERFORM public.plg_emit_event('blog.post.deleted', v_payload, 'blog_post', v_id, v_tenant, NULL);
+    END IF;
+  EXCEPTION WHEN OTHERS THEN
+    -- Observability must never be able to reject the write that caused it.
+    RAISE WARNING '[plg_blog_emit_post_event] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
+  END;
+
+  RETURN NULL;
+END;
+$$;
 
--- \xA71 \u2500\u2500 columns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Per-post SEO. The blog already had site-level SEO (lib/seo.ts builds the
--- descriptors), but an organic-SEO product's whole output is per-ARTICLE: the
--- title it wants in the SERP is not the title on the page, and a syndicated
--- post has a canonical that points somewhere else entirely.
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS meta_title       text;
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS meta_description text;
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS canonical_url    text;
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS og_image         text;
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS noindex          boolean NOT NULL DEFAULT false;
-
--- The external identity. \`external_ref\` is the publisher's id for the article \u2014
--- ours is a uuid it has never seen, so re-delivery can only be recognised by
--- theirs. \`source\` is the anti-loop field: it names who WROTE the post, and a
--- connector reads it to avoid echoing an article back to the system it came
--- from. Defaulting to 'admin' is not a placeholder \u2014 every row that exists
--- today was written by a person in the backoffice, and saying so is what makes
--- the field usable from the first event.
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS external_ref     text;
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS source           text NOT NULL DEFAULT 'admin';
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS language         text;
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS tags             text[];
-ALTER TABLE public.plg_blog_posts ADD COLUMN IF NOT EXISTS author_member_id uuid
-  REFERENCES public.tenant_members(id) ON DELETE SET NULL;
-
--- \xA72 \u2500\u2500 identity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- This index is the whole of idempotency. Without it the same article delivered
--- twice \u2014 a retry, a redeployed connector, a replayed queue \u2014 lands as two
--- posts with two slugs, and the tenant's blog grows duplicates nobody ordered.
--- Partial because the backoffice's own posts have no external ref and must not
--- collide with each other on NULL.
-CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_blog_posts_tenant_external_ref
-  ON public.plg_blog_posts (tenant_id, external_ref)
-  WHERE external_ref IS NOT NULL;
-
--- "What did this source publish here?" is the connector's own reconciliation
--- query, and the ledger's.
-CREATE INDEX IF NOT EXISTS idx_plg_blog_posts_source
-  ON public.plg_blog_posts (tenant_id, source, updated_at DESC);
-
--- \xA73 \u2500\u2500 sanitiser \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- The sanitising happens HERE, in the function, and not in the client that
--- renders the post. The RPC below is the only door an external publisher passes
--- through; a browser-side sanitiser protects the one reader whose browser runs
--- it and nothing else \u2014 the row is already poisoned, the RSS feed, the sitemap
--- and every server-rendered page still carry the script. A control has to sit
--- where the data enters, not where it is displayed.
-
--- Extract one attribute from a tag, tolerating the three ways HTML quotes a
--- value. \`p_name\` is always a literal this file controls, never caller input.
-CREATE OR REPLACE FUNCTION public.plg_blog_html_attr(p_tag text, p_name text)
-RETURNS text
-LANGUAGE sql
-IMMUTABLE
-AS $fn$
+CREATE FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) RETURNS text
+    LANGUAGE sql IMMUTABLE
+    AS $$
   SELECT coalesce(
     substring(p_tag from '(?i)\\s' || p_name || '\\s*=\\s*"([^"]*)"'),
     substring(p_tag from '(?i)\\s' || p_name || '\\s*=\\s*''([^'']*)'''),
     substring(p_tag from '(?i)\\s' || p_name || '\\s*=\\s*([^\\s">]+)')
   );
-$fn$;
+$$;
 
-CREATE OR REPLACE FUNCTION public.plg_blog_html_escape(p_text text)
-RETURNS text
-LANGUAGE sql
-IMMUTABLE
-AS $fn$
+CREATE FUNCTION public.plg_blog_html_escape(p_text text) RETURNS text
+    LANGUAGE sql IMMUTABLE
+    AS $$
   SELECT replace(replace(replace(coalesce(p_text, ''), '<', '&lt;'), '>', '&gt;'), '"', '&quot;');
-$fn$;
-
--- A URL we are willing to put back into the document.
-CREATE OR REPLACE FUNCTION public.plg_blog_safe_url(p_url text)
-RETURNS text
-LANGUAGE plpgsql
-IMMUTABLE
-AS $fn$
+$$;
+
+CREATE FUNCTION public.plg_blog_safe_url(p_url text) RETURNS text
+    LANGUAGE plpgsql IMMUTABLE
+    AS $$
 DECLARE
   v text;
 BEGIN
@@ -341,14 +596,12 @@ BEGIN
   END IF;
   RETURN NULL;
 END;
-$fn$;
-
-CREATE OR REPLACE FUNCTION public.plg_blog_sanitize_html(p_html text)
-RETURNS text
-LANGUAGE plpgsql
-IMMUTABLE
-SET search_path = public
-AS $fn$
+$$;
+
+CREATE FUNCTION public.plg_blog_sanitize_html(p_html text) RETURNS text
+    LANGUAGE plpgsql IMMUTABLE
+    SET search_path TO 'public'
+    AS $$
 DECLARE
   -- The allowlist is what an ARTICLE is made of. Layout tags (div, span,
   -- section, main) are deliberately out: they carry nothing a blog post needs
@@ -464,15 +717,11 @@ BEGIN
 
   RETURN v_out;
 END;
-$fn$;
-
--- Accents are transliterated rather than stripped: 'sa\xFAde-bucal' beats
--- 'sa-de-bucal', and a slug is a URL somebody will read out loud.
-CREATE OR REPLACE FUNCTION public.plg_blog_slugify(p_text text)
-RETURNS text
-LANGUAGE sql
-IMMUTABLE
-AS $fn$
+$$;
+
+CREATE FUNCTION public.plg_blog_slugify(p_text text) RETURNS text
+    LANGUAGE sql IMMUTABLE
+    AS $$
   SELECT btrim(
     regexp_replace(
       translate(lower(coalesce(p_text, '')),
@@ -480,33 +729,334 @@ AS $fn$
                 'aaaaaaeeeeiiiioooooouuuucnyy'),
       '[^a-z0-9]+', '-', 'g'),
     '-');
-$fn$;
-
-REVOKE ALL ON FUNCTION public.plg_blog_html_attr(text, text)   FROM public, anon;
-REVOKE ALL ON FUNCTION public.plg_blog_html_escape(text)       FROM public, anon;
-REVOKE ALL ON FUNCTION public.plg_blog_safe_url(text)          FROM public, anon;
-REVOKE ALL ON FUNCTION public.plg_blog_sanitize_html(text)     FROM public, anon;
-REVOKE ALL ON FUNCTION public.plg_blog_slugify(text)           FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.plg_blog_html_attr(text, text) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION public.plg_blog_html_escape(text)     TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION public.plg_blog_safe_url(text)        TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION public.plg_blog_sanitize_html(text)   TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION public.plg_blog_slugify(text)         TO authenticated, service_role;
-
--- \xA74 \u2500\u2500 ingest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- The one door. Takes a single jsonb so the caller never has to know a column
--- list, and returns what it did so a connector can reconcile without a second
--- read.
+$$;
+
+
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_blog_categories
+    ADD CONSTRAINT plg_blog_categories_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_blog_posts
+    ADD CONSTRAINT plg_blog_posts_pkey PRIMARY KEY (id);
+
+
+-- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE VIEW public.v_public_blog_posts AS
+ SELECT p.id,
+    p.tenant_id,
+    p.slug,
+    p.title,
+    p.excerpt,
+    p.body,
+    COALESCE(c.name, ''::text) AS tag,
+    p.cover_image,
+    p.author_name,
+    p.author_role,
+    p.author_avatar_url,
+    p.author_bio,
+    p.read_time,
+    p.published_at,
+    p.meta_title,
+    p.meta_description,
+    p.canonical_url,
+    p.og_image,
+    p.noindex,
+    p.language,
+    p.tags
+   FROM (public.plg_blog_posts p
+     LEFT JOIN public.plg_blog_categories c ON ((c.id = p.category_id)))
+  WHERE (p.status = 'published'::text);
+
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE INDEX idx_plg_blog_categories_tenant ON public.plg_blog_categories USING btree (tenant_id);
+
+CREATE INDEX idx_plg_blog_posts_category ON public.plg_blog_posts USING btree (category_id);
+
+CREATE INDEX idx_plg_blog_posts_source ON public.plg_blog_posts USING btree (tenant_id, source, updated_at DESC);
+
+CREATE INDEX idx_plg_blog_posts_status ON public.plg_blog_posts USING btree (tenant_id, status, published_at DESC);
+
+CREATE INDEX idx_plg_blog_posts_tenant ON public.plg_blog_posts USING btree (tenant_id);
+
+CREATE UNIQUE INDEX uq_plg_blog_categories_tenant_slug ON public.plg_blog_categories USING btree (tenant_id, slug);
+
+CREATE UNIQUE INDEX uq_plg_blog_posts_tenant_external_ref ON public.plg_blog_posts USING btree (tenant_id, external_ref) WHERE (external_ref IS NOT NULL);
+
+CREATE UNIQUE INDEX uq_plg_blog_posts_tenant_slug ON public.plg_blog_posts USING btree (tenant_id, slug);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_blog_categories
+    ADD CONSTRAINT plg_blog_categories_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_blog_posts
+    ADD CONSTRAINT plg_blog_posts_author_member_id_fkey FOREIGN KEY (author_member_id) REFERENCES public.tenant_members(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_blog_posts
+    ADD CONSTRAINT plg_blog_posts_category_id_fkey FOREIGN KEY (category_id) REFERENCES public.plg_blog_categories(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_blog_posts
+    ADD CONSTRAINT plg_blog_posts_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+
+-- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TRIGGER plg_blog_posts_emit_facts AFTER INSERT OR DELETE OR UPDATE ON public.plg_blog_posts FOR EACH ROW EXECUTE FUNCTION public.plg_blog_emit_post_event();
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_blog_categories ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_blog_posts ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_blog_categories_delete ON public.plg_blog_categories FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_categories_insert ON public.plg_blog_categories FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_categories_select ON public.plg_blog_categories FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_categories_update ON public.plg_blog_categories FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_posts_delete ON public.plg_blog_posts FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_posts_insert ON public.plg_blog_posts FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_posts_select ON public.plg_blog_posts FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_blog_posts_update ON public.plg_blog_posts FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+REVOKE ALL ON FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.agent_blog_draft_post(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.blog_upsert_external_post(p_payload jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.blog_upsert_external_post(p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.blog_upsert_external_post(p_payload jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_blog_emit_post_event() FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_blog_emit_post_event() TO authenticated;
+GRANT ALL ON FUNCTION public.plg_blog_emit_post_event() TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) TO authenticated;
+GRANT ALL ON FUNCTION public.plg_blog_html_attr(p_tag text, p_name text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_blog_html_escape(p_text text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_blog_html_escape(p_text text) TO authenticated;
+GRANT ALL ON FUNCTION public.plg_blog_html_escape(p_text text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_blog_safe_url(p_url text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_blog_safe_url(p_url text) TO authenticated;
+GRANT ALL ON FUNCTION public.plg_blog_safe_url(p_url text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_blog_sanitize_html(p_html text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_blog_sanitize_html(p_html text) TO authenticated;
+GRANT ALL ON FUNCTION public.plg_blog_sanitize_html(p_html text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_blog_slugify(p_text text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_blog_slugify(p_text text) TO authenticated;
+GRANT ALL ON FUNCTION public.plg_blog_slugify(p_text text) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_blog_categories TO anon;
+GRANT ALL ON TABLE public.plg_blog_categories TO authenticated;
+GRANT ALL ON TABLE public.plg_blog_categories TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_blog_posts TO anon;
+GRANT ALL ON TABLE public.plg_blog_posts TO authenticated;
+GRANT ALL ON TABLE public.plg_blog_posts TO service_role;
+
+GRANT SELECT,MAINTAIN ON TABLE public.v_public_blog_posts TO anon;
+GRANT ALL ON TABLE public.v_public_blog_posts TO authenticated;
+GRANT ALL ON TABLE public.v_public_blog_posts TO service_role;
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATION_001_THE_AUTHOR_IS_A_MEMBERSHIP = `-- ============================================================================
+-- 001_the_author_is_a_membership \u2014 the FK and the lookup leave the projection
+-- (#214 / #352).
+--
+-- plg_blog_posts.author_member_id pointed at public.tenant_members(id), which
+-- is a COMPAT PROJECTION of app.memberships maintained by triggers \u2014 so a real
+-- foreign key was resting on a derived table. That is the reason the projection
+-- could not be dropped, and it is a stronger reason than "a screen reads it":
+-- Postgres refuses to drop a table another table references.
 --
--- Payload: external_ref, title, slug, excerpt, body_html, status, source,
--- language, tags[], author_member_id, published_at, cover_image, meta_title,
--- meta_description, canonical_url, og_image, noindex.
-CREATE OR REPLACE FUNCTION public.blog_upsert_external_post(p_payload jsonb)
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $fn$
+-- The move is safe precisely because the projection's own comment says the ids
+-- are the same ("COMPAT PROJECTION of app.memberships (#134): same ids"), so
+-- every existing author_member_id already names an app.memberships row.
+-- ============================================================================
+
+ALTER TABLE public.plg_blog_posts DROP CONSTRAINT IF EXISTS plg_blog_posts_author_member_id_fkey;
+ALTER TABLE public.plg_blog_posts
+  ADD CONSTRAINT plg_blog_posts_author_member_id_fkey
+  FOREIGN KEY (author_member_id) REFERENCES app.memberships(id) ON DELETE SET NULL;
+
+CREATE OR REPLACE FUNCTION public.blog_upsert_external_post(p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
 DECLARE
   v_tenants     uuid[];
   v_tenant      uuid;
@@ -590,7 +1140,7 @@ BEGIN
   IF nullif(btrim(p_payload->>'author_member_id'), '') IS NOT NULL THEN
     BEGIN
       SELECT tm.id INTO v_author
-      FROM public.tenant_members tm
+      FROM app.memberships tm
       WHERE tm.tenant_id = v_tenant AND tm.id = (p_payload->>'author_member_id')::uuid;
     EXCEPTION WHEN OTHERS THEN
       v_author := NULL;
@@ -713,210 +1263,10 @@ BEGIN
     'external_ref', v_ref,
     'created', coalesce(v_created, false));
 END;
-$fn$;
-
-REVOKE ALL ON FUNCTION public.blog_upsert_external_post(jsonb) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.blog_upsert_external_post(jsonb) TO authenticated, service_role;
-
--- \xA75 \u2500\u2500 agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- The assistant's write, in the shape the broker calls (p_tenant_id,
--- p_actor_user_id, p_payload) \u2014 a different signature from \xA74 on purpose: the
--- broker injects a verified actor and agent_guard runs role \u2192 plan \u2192 the
--- blog_posts cap before anything is written. A draft, never a publish: an agent
--- that can put a page on the public site without anyone reading it first is a
--- worse product than one that cannot.
-CREATE OR REPLACE FUNCTION public.agent_blog_draft_post(
-  p_tenant_id uuid,
-  p_actor_user_id uuid,
-  p_payload jsonb
-) RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $fn$
-DECLARE
-  v_denial jsonb;
-  v_used   int;
-  v_title  text;
-  v_base   text;
-  v_slug   text;
-  v_n      int := 1;
-  v_id     uuid;
-BEGIN
-  v_title := nullif(btrim(p_payload->>'title'), '');
-  IF v_title IS NULL THEN
-    RETURN jsonb_build_object('ok', false, 'error', 'title is required to draft a post');
-  END IF;
-
-  SELECT count(*) INTO v_used FROM public.plg_blog_posts p WHERE p.tenant_id = p_tenant_id;
-  v_denial := public.agent_guard(p_tenant_id, p_actor_user_id, 'blog', 'create', 'blog_posts', v_used, 1);
-  IF v_denial IS NOT NULL THEN
-    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
-  END IF;
-
-  v_base := coalesce(nullif(public.plg_blog_slugify(v_title), ''), 'post-' || left(md5(v_title), 8));
-  v_slug := left(v_base, 120);
-  WHILE EXISTS (SELECT 1 FROM public.plg_blog_posts p
-                WHERE p.tenant_id = p_tenant_id AND p.slug = v_slug) LOOP
-    v_n := v_n + 1;
-    IF v_n > 50 THEN
-      RETURN jsonb_build_object('ok', false, 'error', format('cannot derive a free slug from %L', v_base));
-    END IF;
-    v_slug := left(v_base, 112) || '-' || v_n;
-  END LOOP;
-
-  INSERT INTO public.plg_blog_posts (
-    tenant_id, slug, title, excerpt, body, status, source, language, tags, updated_at)
-  VALUES (
-    p_tenant_id, v_slug, v_title,
-    left(btrim(regexp_replace(coalesce(p_payload->>'excerpt', ''), '<[^>]*>', '', 'g')), 500),
-    -- Same sanitiser as the external door: the model's output is not more
-    -- trustworthy than a partner's, it is just closer to home.
-    public.plg_blog_sanitize_html(p_payload->>'body_html'),
-    'draft', 'agent',
-    nullif(btrim(p_payload->>'language'), ''),
-    CASE WHEN jsonb_typeof(p_payload->'tags') = 'array'
-         THEN ARRAY(SELECT btrim(x) FROM jsonb_array_elements_text(p_payload->'tags') AS x WHERE btrim(x) <> '')
-    END,
-    now())
-  RETURNING id INTO v_id;
-
-  INSERT INTO public.audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
-  VALUES (p_tenant_id, p_actor_user_id, 'agent.draftBlogPost', 'blog_post', v_id::text,
-          jsonb_build_object('title', v_title, 'slug', v_slug));
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'id', v_id,
-    'record', jsonb_build_object(
-      'ref', jsonb_build_object('id', v_id, 'resource', 'plg_blog_posts', 'entityKey', 'blog:posts'),
-      'name', v_title,
-      'slug', v_slug,
-      'status', 'draft'));
-END;
-$fn$;
-
-REVOKE ALL ON FUNCTION public.agent_blog_draft_post(uuid, uuid, jsonb) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.agent_blog_draft_post(uuid, uuid, jsonb) TO authenticated, service_role;
-
--- \xA76 \u2500\u2500 facts \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- One trigger on the table rather than an emit call inside each writer. The
--- backoffice, this file's two RPCs and a hand-run SQL fix all end up in the
--- same place, so a connector hears the same four facts no matter who wrote \u2014
--- which is the entire reason the row-level emitter exists (packages/db/
--- migrations/027_domain_events.sql).
---
--- \`published\` is not a row action, which is why the generic
--- plg_attach_event_source trigger cannot produce it: it is a TRANSITION, and
--- only something holding OLD and NEW can see it happen.
-CREATE OR REPLACE FUNCTION public.plg_blog_emit_post_event()
-RETURNS trigger
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $fn$
-DECLARE
-  v_row     jsonb;
-  v_tenant  uuid;
-  v_id      text;
-  v_payload jsonb;
-BEGIN
-  -- A save that changed nothing is not a fact; without this any bulk re-save
-  -- buries the real updates.
-  IF TG_OP = 'UPDATE' AND OLD IS NOT DISTINCT FROM NEW THEN
-    RETURN NULL;
-  END IF;
-
-  IF TG_OP = 'DELETE' THEN
-    v_row := to_jsonb(OLD);
-  ELSE
-    v_row := to_jsonb(NEW);
-  END IF;
-  v_tenant := nullif(v_row->>'tenant_id', '')::uuid;
-  v_id     := v_row->>'id';
-  -- The contract every consumer reads. Not the row: a whole-row payload puts
-  -- the article body inside every webhook by default, and whoever needs it
-  -- fetches by id.
-  v_payload := jsonb_build_object(
-    'post_id',      v_id,
-    'slug',         v_row->>'slug',
-    'title',        v_row->>'title',
-    'status',       v_row->>'status',
-    'source',       coalesce(v_row->>'source', 'admin'),
-    'external_ref', v_row->>'external_ref',
-    'language',     v_row->>'language');
-
-  BEGIN
-    IF TG_OP = 'INSERT' THEN
-      PERFORM public.plg_emit_event('blog.post.created', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      IF NEW.status = 'published' THEN
-        PERFORM public.plg_emit_event('blog.post.published', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      END IF;
-    ELSIF TG_OP = 'UPDATE' THEN
-      PERFORM public.plg_emit_event('blog.post.updated', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      IF NEW.status = 'published' AND OLD.status IS DISTINCT FROM 'published' THEN
-        PERFORM public.plg_emit_event('blog.post.published', v_payload, 'blog_post', v_id, v_tenant, NULL);
-      END IF;
-    ELSE
-      PERFORM public.plg_emit_event('blog.post.deleted', v_payload, 'blog_post', v_id, v_tenant, NULL);
-    END IF;
-  EXCEPTION WHEN OTHERS THEN
-    -- Observability must never be able to reject the write that caused it.
-    RAISE WARNING '[plg_blog_emit_post_event] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
-  END;
-
-  RETURN NULL;
-END;
-$fn$;
-
-REVOKE ALL ON FUNCTION public.plg_blog_emit_post_event() FROM public, anon;
-
-DROP TRIGGER IF EXISTS plg_blog_posts_emit_facts ON public.plg_blog_posts;
-CREATE TRIGGER plg_blog_posts_emit_facts
-  AFTER INSERT OR UPDATE OR DELETE ON public.plg_blog_posts
-  FOR EACH ROW EXECUTE FUNCTION public.plg_blog_emit_post_event();
-
--- \xA77 \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- The public site runs anon and reads only this view, so per-post SEO that the
--- view does not carry cannot be rendered \u2014 the columns would exist and no page
--- would ever show them.
---
--- \`source\` and \`external_ref\` stay out: they are operational facts about who
--- writes this tenant's blog, and the anon surface is the open internet.
--- New columns are appended, never reordered \u2014 CREATE OR REPLACE VIEW only
--- tolerates additions at the end.
-CREATE OR REPLACE VIEW public.v_public_blog_posts AS
-SELECT
-  p.id,
-  p.tenant_id,
-  p.slug,
-  p.title,
-  p.excerpt,
-  p.body,
-  COALESCE(c.name, '')  AS tag,
-  p.cover_image,
-  p.author_name,
-  p.author_role,
-  p.author_avatar_url,
-  p.author_bio,
-  p.read_time,
-  p.published_at,
-  p.meta_title,
-  p.meta_description,
-  p.canonical_url,
-  p.og_image,
-  p.noindex,
-  p.language,
-  p.tags
-FROM public.plg_blog_posts p
-LEFT JOIN public.plg_blog_categories c ON c.id = p.category_id
-WHERE p.status = 'published';
-
-GRANT SELECT ON public.v_public_blog_posts TO anon, authenticated, service_role;
-`;
+$$;`;
 var MIGRATIONS = [
-  { id: "001_blog", sql: MIGRATION_001_BLOG },
-  { id: "002_external_posts", sql: MIGRATION_002_EXTERNAL_POSTS }
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_the_author_is_a_membership", sql: MIGRATION_001_THE_AUTHOR_IS_A_MEMBERSHIP }
 ];
 
 // src/data/runtime.ts