hazo_blog 1.4.0 → 2.0.0

package/CHANGE_LOG.md

@@ -3,6 +3,195 @@
 All notable changes are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## 2.0.0 — 2026-10-31
+
+**⚠️ BREAKING — new posts + pages foundation for BlogSketch (Phase 1a issue 04).**
+
+Replaces `hazo_blog_posts`' v1.6 shape entirely with a content-type-agnostic
+model: `type` (free-form string, default `'post'`) instead of a fixed
+post/page split; `_rev` optimistic concurrency; `live_revision_id`/
+`draft_revision_id` pointers into a new `hazo_blog_revisions` table (every
+save is an immutable snapshot — the live/draft promotion workflow itself is
+Phase 1a issue 06); `custom_fields` JSONB; a current-value SEO/meta snapshot
+(`seo_title`/`seo_description`/`og_image`/`noindex`/`canonical_override`) on
+the post, with historical snapshots on each revision; `deleted_at` (soft
+delete — restore/auto-purge is issue 07); `publish_at` (scheduled — auto-publish
+worker is issue 07). **`scope_id` is now NOT NULL** on `hazo_blog_posts`/
+`hazo_blog_revisions` — add-on/single-site mode stamps hazo_auth's
+`DEFAULT_SYSTEM_SCOPE_ID` (`resolvePostScope()` in `src/service/posts.ts`,
+via `optional_import("hazo_auth/server-lib")` since `hazo_auth` is an
+optional peer, with a literal fallback if it's not installed).
+
+Gone from the table entirely (content/category/faq/i18n fields now live
+elsewhere or are deferred): `content`, `content_html`, `excerpt`,
+`category_id`, `author_id`, `meta_title`, `meta_description`,
+`canonical_url`, `featured_image`, `image_ref`, `faq_json`, `reading_time`,
+`status`, `publish_date`, `translation_of`, `review_notes`, `indexable`.
+`status`/transitions/trash-restore are deliberately NOT part of this issue —
+see issue 07.
+
+**This is intentionally a hard break, not a migration.** v1.6 consumers
+(GoTimer, kinstripe) stay on `~1.6.x` and are unaffected — their deployments
+bundle v1.6's own `db_setup_*.sql`. The v1.6 `BlogRepository`/`BlogService`/
+routes/components/SEO glue in this package (`src/repository/index.ts`,
+`src/service/index.ts`, `src/next/routes.ts`, `src/components/*`, `src/ui/*`,
+`src/seo/*`) are UNTOUCHED by this change and now reference a dropped shape
+— their own tests fail against the new schema until later Phase 1a issues
+(05 admin shell, 10 media pipeline, 11 SEO admin, 12 post list, 15 post
+editor) rewrite each consumer against the v2 model. `npx tsc --noEmit`
+stays green (the breakage is schema/runtime, not type-level — `BlogPost`
+etc. are plain interfaces with no DB coupling).
+
+New, additive, and NOT touching any v1.6 code path:
+
+- **`src/types/index.ts`** — `Post`, `PostRevision`, `CreatePostInput`,
+  `UpdatePostInput`, `ListPostsQuery`, `PaginatedPostsResult`.
+- **`src/repository/posts.ts`** — `createPostRepository(adapter, scope)`.
+  `updatePost()`'s optimistic-concurrency check is a single atomic
+  `UPDATE ... WHERE id = ? AND scope_id = ? AND _rev = ? RETURNING *` (via
+  `hazo_connect`'s `QueryBuilder`+`CrudService.query()`) — the WHERE clause
+  itself is what prevents a lost update between two concurrent callers, not
+  a prior read (that read only exists to tell `PostNotFoundError` apart from
+  `PostConflictError` with a clearer error). Postgres full-text search uses
+  native `tsvector`/`ts_rank` via a duck-typed `adapter.raw()` escape hatch
+  (PgAdapter-only — not part of the common `HazoConnectAdapter` interface;
+  every other adapter, including PostgREST/Supabase, degrades to a plain
+  title substring match). SQLite add-on mode gets a stub `hazo_blog_posts_fts`
+  FTS5 table, kept in sync on write but not yet wired into `searchPosts()`.
+- **`src/service/posts.ts`** — `createPostService(config)`, `resolvePostScope()`.
+  Fails CLOSED (`ScopeUnresolvedError`) when a multi-site `resolveScope` is
+  configured but returns no scope for a request — only falls back to
+  hazo_auth's `DEFAULT_SYSTEM_SCOPE_ID` when no `resolveScope` is configured
+  at all. Defaulting to the system scope on an unresolved multi-tenant
+  request would be a fail-open tenant-isolation bug, not a convenience.
+- **`src/next/post-routes.ts`** — `createPostManageRoutes`/`createPostItemRoutes`
+  (same `blog:read`/`blog:write` hazo_api scopes as v1.6's manage routes).
+- **`db_setup_sqlite.sql`/`db_setup_postgres.sql`/`migrations/*`** — new
+  `hazo_blog_posts` shape, new `hazo_blog_revisions` table, new
+  `hazo_blog_posts_fts` SQLite FTS5 stub. `hazo_blog_categories`/
+  `hazo_blog_tags`/`hazo_blog_post_tags`/`hazo_blog_settings` are unchanged
+  and not yet wired to v2 posts (categorization is deferred to a later
+  issue).
+
+## 1.6.0 — 2026-10-09
+
+**Fix — `getPostById` ignored tenant scoping (IDOR).**
+
+`repository.getPostById(id)` used `posts.findById(id)` directly, with no `scope_id`
+predicate — unlike every other read in this file (`getPostBySlug`, `getAllSlugs`, `listPosts`),
+which all go through the `scoped()` helper. One tenant could fetch (and, via the new
+translate/review flow below, read/mutate) another tenant's post by guessing or enumerating its
+id. Fixed by routing `getPostById` through `posts.list()` with the same `scoped(qb)` predicate
+the slug lookup uses.
+
+**Blog translation, Phase 4C: AI translate + AI review of translation-cluster drafts**
+
+Takes a Phase 4B draft (created via `createTranslation()`, content copied verbatim,
+untranslated) and fills it in — plus an independent quality-review pass. Both are new
+`BlogService` methods over the `hazo_llm_api` optional peer, mirroring `hazo_i18n`'s own
+`api/translate.ts`/`api/review.ts` shape and philosophy exactly (lazy `optional_import()`
+probe, local re-declared module-shape interface, per-call `HazoUnavailableError` 503,
+per-chunk graceful degradation).
+
+- **`src/lib/mdx_mask.ts`** — `maskMdx()`/`unmaskMdx()`. Sets aside leading YAML frontmatter
+  (defensive only — `BlogPost.content` is pure MDX body today, title/excerpt/meta live in
+  their own columns, so no post in this schema actually has frontmatter), masks every
+  capitalized JSX component tag (`<Callout>`, `<YouTube id="..."/>`, ANY `[A-Z]...` tag name —
+  not an enumerated list, since a host's `config.mdxComponents` can add more) into its own
+  `jN` placeholder namespace, then delegates the remainder to `hazo_i18n/html`'s
+  `maskHtml()`/`unmaskHtml()` (`xN` namespace) for plain attributed HTML tags. The JSX pass
+  exists because `maskHtml()` only masks tags that carry attributes — right for plain HTML,
+  wrong for MDX, where a bare `<Callout>` (no attrs) is exactly as fragile to translate
+  around as an attributed one. **`hazo_i18n/html` is resolved LAZILY** (`optional_import`,
+  same convention as the `hazo_llm_api` peer below) — a static import here would turn
+  `hazo_i18n` (an optional peer) into a hard dependency for every consumer of this package,
+  not just ones calling `translatePost()`. For the same reason this module is NOT re-exported
+  through the general `./lib` barrel.
+- **`src/lib/mdx_segment.ts`** — `segmentMdxForTranslation(content, maxChars = 2000)`. Splits
+  masked MDX at paragraph (blank-line) boundaries into LLM-call-sized chunks, grouping
+  consecutive paragraphs up to the budget; a single oversized paragraph still gets its own
+  chunk rather than being split mid-paragraph.
+- **`BlogService.translatePost(postId)`** — `postId` is an EXISTING translation-cluster
+  DRAFT's own id (not a new `targetLocale` parameter): its `translation_of` is read to find
+  the source post, and its own `locale` is the target — a deliberate refinement of the
+  original plan now that `createTranslation()` already owns "create the row". Masks the
+  source content, segments it, translates each segment sequentially with its own
+  `hazo_llm_text_text()` call (plain-text response — "return ONLY the translated text, no
+  commentary" — not JSON; there's nothing to extract-as-JSON for free-form prose, unlike
+  `hazo_i18n`'s key-value chunks), then the title with one more call. One segment's failure
+  never aborts the others, but if ANY segment (or the title) fails, nothing is written — a
+  partially translated MDX post going live is worse than failing the whole call. Never
+  changes `status` (stays `'draft'`).
+- **`BlogService.reviewTranslatedPost(postId)`** — one LLM call (not chunked; a blog post
+  comfortably fits one call) judging accuracy/naturalness/completeness/MDX-preservation
+  against the source, requesting structured `{ ok, notes }` JSON (parsed via
+  `try_extract_json()`, since a free-text verdict would need re-parsing anyway). Persists
+  `notes` to the post's new `review_notes` column on success; a failed review call leaves
+  `review_notes` untouched (`persisted: false`) rather than overwriting it with an error.
+  Never flips `status` — unlike `hazo_i18n`'s `reviewMessages()`, a human editor decides what
+  to do with the notes via the existing admin UI.
+- **`hazo_blog_posts.review_notes TEXT`** (nullable) — new column, both `db_setup_sqlite.sql`
+  and `db_setup_postgres.sql` (+ their `migrations/` mirrors). `excerpt` was deliberately NOT
+  repurposed — it's an actively-used teaser/meta-description field.
+- **New routes** (`src/next/routes.ts`, exported from the package root): `createBlogTranslateRoutes`
+  (`[id]/translate`, `POST` → `translatePost`) and `createBlogReviewRoutes` (`[id]/review`,
+  `POST` → `reviewTranslatedPost`) — mounted on their own resources rather than another method
+  on `[id]`, since that route's `POST`/`PUT`/`DELETE` are already spoken for (Phase 4B's
+  `createTranslation`, plus upsert/delete). Same cookie/session `config.authorize` guard, same
+  `HazoUnavailableError` → 503 convention as everywhere else in this file.
+- **`hazo_llm_api` is now a declared OPTIONAL peer** (`peerDependenciesMeta`), same convention
+  as `hazo_i18n`. **`hazo_i18n`'s declared range bumped `^0.9.0` → `^0.12.0`** — its new `./html`
+  subpath (this phase's `maskHtml`/`unmaskHtml` reuse) only exists from 0.12.0. Note: this
+  workspace's own `node_modules/hazo_i18n` held a STALE real copy (0.5.9 — not even satisfying
+  the old `^0.9.0` range) that shadowed the correctly-hoisted 0.12.0 at the monorepo root;
+  removed so resolution falls through to the hoisted copy. A fresh `npm install` anywhere this
+  stale-copy situation doesn't already exist should resolve cleanly against the declared range.
+
+## 1.5.0 — 2026-10-09
+
+**Blog translation, Phase 4B: locale-aware post URLs + static params + admin "Translate to..."**
+
+Closes three gaps left over from 1.4.0's locale infrastructure (locale columns, `translation_of`,
+locale-filtered repository reads, `getTranslations`) — URLs, static generation, and the admin UI
+never actually used any of it.
+
+- **`postUrl(config, slug, locale?)`** (`src/seo/index.ts`) gained an optional third parameter.
+  Omitted, `null`, or equal to `config.defaultLocale` (`"en"` when unset): byte-identical output
+  to before this parameter existed — no prefix, fully backward compatible. Any other locale gets
+  a `/${locale}` segment prepended **before** `basePath`: `https://site.com/de/blog/my-slug`, not
+  `/blog/de/my-slug` — matching gotimer's own `/[locale]/<slug>` convention (locale segment
+  first, default locale unprefixed) so a locale-aware host's `generateStaticParams`/routing
+  doesn't have to special-case blog URLs. `canonicalFor` now threads the post's own `locale`
+  through (a translated post's canonical was previously default-locale-shaped), and the sitemap's
+  per-post URL and hreflang `alternates` do the same.
+- **`createBlogPostPage(...).generateStaticParams`** now returns a `{ slug, locale }` entry for
+  **every** locale variant from `getAllSlugs(false)` — not just the default locale. Null-locale
+  (default) rows get `config.defaultLocale` (`"en"` fallback) filled in as their `locale` value,
+  matching `postUrl`'s own default-locale comparison. Previously only default-locale posts ever
+  got a static route; every translation 404'd until `dynamicParams` kicked in on-demand.
+- **Admin locale filter + "Translate to..."** (`BlogAdminPanel`, `PostListTable`,
+  `useBlogAdmin`, `createBlogAdminRoutes`):
+  - `collection.GET` now reads `?locale=` (same omitted-means-default-locale semantics as
+    `ListPostsOptions.locale`) and also returns a derived `locales: string[]` — every locale
+    currently in use, default locale first. No new DB query: reuses the existing
+    `getAllSlugs(true)` lookup (already built for `generateStaticParams`) rather than adding an
+    `enabledLocales` config field, since none exists today.
+  - New `BlogService.createTranslation(postId, targetLocale, req?)` + `BlogRepository.getPostById`
+    — creates a **draft** post in `targetLocale`, linked via `translation_of` to the source's
+    cluster root, with every content field (title/content/excerpt/meta/FAQ/tags/images) copied
+    **verbatim** from the source. Not a translation step — no LLM call; that's Phase 4C.
+  - New `item.POST` route (same `[id]` resource as the existing `PUT`/`DELETE`) wraps
+    `createTranslation`; body `{ locale: string }`.
+  - `BlogAdminPanel` gained a locale `<select>` filtering the post list (hidden when only one
+    locale is in use); `PostListTable` gained a Locale column and a per-row "Translate to…"
+    picker + button (hidden when `availableLocales` is empty). Both token-free Tailwind, per this
+    tree's isolation rule. New locale catalog keys (`post_list_table.col_locale`,
+    `post_list_table.translate_to`, `post_list_table.translate_failed`,
+    `blog_admin_panel.locale_filter_label`) in `en`/`de`/`sv`.
+- Out of scope (separate, later phases): gotimer's own hazo_blog 1.4.0 schema upgrade (4A) and
+  the LLM `translatePost`/`reviewTranslatedPost` pipeline (4C) — `createTranslation` deliberately
+  does a verbatim copy, not a translation.
+
 ## 1.4.0 — 2026-10-06
 
 **Locale-aware UI text and dates (`en` / `de` / `sv`)**

package/db_setup_postgres.sql

@@ -3,9 +3,11 @@
 -- Supports both PostgreSQL (this file) and SQLite (db_setup_sqlite.sql).
 -- All tables use the `hazo_blog_` prefix per workspace standards.
 --
--- Multi-tenancy: every table carries a nullable `scope_id`. Single-tenant
--- consumers leave it NULL; multi-tenant consumers populate it and pass a scope
--- resolver so the repository filters by it.
+-- Multi-tenancy: hazo_blog_posts/hazo_blog_revisions require a `scope_id`
+-- (NOT NULL, as of v2.0.0) — add-on/single-site mode stamps hazo_auth's
+-- DEFAULT_SYSTEM_SCOPE_ID. Every other table still carries a nullable
+-- `scope_id`: single-tenant consumers leave it NULL; multi-tenant consumers
+-- populate it and pass a scope resolver so the repository filters by it.
 
 CREATE TABLE IF NOT EXISTS hazo_blog_categories (
   id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -42,45 +44,81 @@ DROP INDEX IF EXISTS idx_hazo_blog_tags_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_tags_scope_slug_locale
   ON hazo_blog_tags (scope_id, slug, COALESCE(locale, ''));
 
+-- hazo_blog_posts (v2.0.0) — content-type-agnostic foundation for posts and
+-- pages. Supersedes the v1.6 shape: status/category_id/faq_json/content/etc.
+-- are gone. `type` picks post vs page vs any site-defined type; the actual
+-- MDX body + excerpt + per-save SEO snapshot live on hazo_blog_revisions, not
+-- here — this table only carries the current pointer (_rev/live/draft) plus
+-- the SEO/meta fields needed to render without a join.
+--
+-- scope_id is NOT NULL (unlike every other hazo_blog table): v2 requires a
+-- concrete tenant for every post, including add-on/single-site mode, which
+-- stamps hazo_auth's DEFAULT_SYSTEM_SCOPE_ID rather than leaving it NULL.
+--
+-- live_revision_id/draft_revision_id intentionally carry no FK constraint:
+-- hazo_blog_revisions.post_id references this table, so a FK the other way
+-- would be circular at CREATE TABLE time. The repository enforces the
+-- pointer's integrity (see src/repository/posts.ts).
+--
+-- search_vector is maintained by the repository, not a generated column —
+-- Postgres generated columns can't reach across tables, and the searchable
+-- body text lives on hazo_blog_revisions.
 CREATE TABLE IF NOT EXISTS hazo_blog_posts (
-  id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  scope_id         TEXT,
-  slug             TEXT NOT NULL,
-  title            TEXT NOT NULL,
-  content          TEXT NOT NULL DEFAULT '',          -- raw MDX
-  content_html     TEXT,                              -- cached rendered HTML (nullable)
-  excerpt          TEXT,
-  category_id      UUID REFERENCES hazo_blog_categories(id) ON DELETE SET NULL,
-  author_id        TEXT,                              -- optional; resolved via getAuthor()
-  meta_title       TEXT NOT NULL DEFAULT '',
-  meta_description TEXT NOT NULL DEFAULT '',
-  canonical_url    TEXT,                              -- per-post canonical override
-  og_image         TEXT,                              -- per-post OG image override
-  featured_image   TEXT,
-  image_ref        TEXT,                              -- generic image ref (was character_id)
-  faq_json         JSONB NOT NULL DEFAULT '[]',       -- [{question, answer}]
-  reading_time     INTEGER NOT NULL DEFAULT 0,        -- cached, minutes
-  status           TEXT NOT NULL DEFAULT 'draft',     -- draft | published | scheduled
-  publish_date     TIMESTAMPTZ,
-  locale           TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
-  translation_of   UUID REFERENCES hazo_blog_posts(id) ON DELETE SET NULL, -- root post of this translation cluster
-  indexable        BOOLEAN NOT NULL DEFAULT TRUE,     -- FALSE excludes from sitemap/robots
-  created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id            TEXT NOT NULL,
+  type                TEXT NOT NULL DEFAULT 'post',
+  slug                TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  _rev                INTEGER NOT NULL DEFAULT 1,
+  live_revision_id    UUID,
+  draft_revision_id   UUID,
+  deleted_at          TIMESTAMPTZ,
+  template            TEXT,
+  locale              TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
+  custom_fields       JSONB NOT NULL DEFAULT '{}'::jsonb,
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             BOOLEAN NOT NULL DEFAULT FALSE,
+  canonical_override  TEXT,
+  search_vector       tsvector,
+  created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  published_at        TIMESTAMPTZ,
+  publish_at          TIMESTAMPTZ
 );
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS locale TEXT DEFAULT NULL;
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS translation_of UUID REFERENCES hazo_blog_posts(id) ON DELETE SET NULL;
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS indexable BOOLEAN NOT NULL DEFAULT TRUE;
--- FR-034: locale-aware uniqueness (see categories index comment above).
-DROP INDEX IF EXISTS idx_hazo_blog_posts_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_slug_locale
   ON hazo_blog_posts (scope_id, slug, COALESCE(locale, ''));
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_status_date
-  ON hazo_blog_posts (status, publish_date);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_category
-  ON hazo_blog_posts (category_id);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_translation_of
-  ON hazo_blog_posts (translation_of);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_type
+  ON hazo_blog_posts (scope_id, type);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_deleted_at
+  ON hazo_blog_posts (deleted_at);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_publish_at
+  ON hazo_blog_posts (publish_at);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_search
+  ON hazo_blog_posts USING GIN (search_vector);
+
+-- hazo_blog_revisions: full immutable snapshot on every save (draft or
+-- publish). posts.live_revision_id/draft_revision_id point into this table.
+CREATE TABLE IF NOT EXISTS hazo_blog_revisions (
+  id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  post_id             UUID NOT NULL REFERENCES hazo_blog_posts(id) ON DELETE CASCADE,
+  scope_id            TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  slug                TEXT NOT NULL,
+  body                TEXT NOT NULL DEFAULT '',
+  excerpt             TEXT,
+  custom_fields       JSONB NOT NULL DEFAULT '{}'::jsonb,
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             BOOLEAN NOT NULL DEFAULT FALSE,
+  canonical_override  TEXT,
+  created_by          TEXT,
+  created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_revisions_post_created
+  ON hazo_blog_revisions (post_id, created_at);
 
 CREATE TABLE IF NOT EXISTS hazo_blog_post_tags (
   id      UUID PRIMARY KEY DEFAULT gen_random_uuid(),

package/db_setup_sqlite.sql

@@ -4,15 +4,20 @@
 -- All tables use the `hazo_blog_` prefix per workspace standards.
 --
 -- Tables:
---   hazo_blog_posts       — blog posts (raw MDX content + cached HTML + SEO fields)
---   hazo_blog_categories  — single category per post
---   hazo_blog_tags        — free-form tags (many-to-many with posts)
+--   hazo_blog_posts       — posts/pages (v2.0.0: type/_rev/live+draft pointers; see table comment)
+--   hazo_blog_revisions   — immutable per-save content snapshots for hazo_blog_posts
+--   hazo_blog_posts_fts   — FTS5 stub search index for hazo_blog_posts (add-on/SQLite mode)
+--   hazo_blog_categories  — single category per post (v1.6; not yet wired to v2 posts)
+--   hazo_blog_tags        — free-form tags (many-to-many with posts; v1.6, not yet wired to v2 posts)
 --   hazo_blog_post_tags   — post↔tag join
 --   hazo_blog_settings    — package-owned display/behavior settings
 --
--- Multi-tenancy: every table carries a nullable `scope_id`. Single-tenant
--- consumers (e.g. gotimer) leave it NULL; multi-tenant consumers populate it
--- and pass a scope resolver so the repository filters by it.
+-- Multi-tenancy: hazo_blog_posts/hazo_blog_revisions require a `scope_id`
+-- (NOT NULL, as of v2.0.0) — add-on/single-site mode stamps hazo_auth's
+-- DEFAULT_SYSTEM_SCOPE_ID. Every other table still carries a nullable
+-- `scope_id`: single-tenant consumers (e.g. gotimer, on v1.6) leave it NULL;
+-- multi-tenant consumers populate it and pass a scope resolver so the
+-- repository filters by it.
 
 CREATE TABLE IF NOT EXISTS hazo_blog_categories (
   id          TEXT PRIMARY KEY,
@@ -48,42 +53,84 @@ DROP INDEX IF EXISTS idx_hazo_blog_tags_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_tags_scope_slug_locale
   ON hazo_blog_tags (scope_id, slug, COALESCE(locale, ''));
 
+-- hazo_blog_posts (v2.0.0) — content-type-agnostic foundation for posts and
+-- pages. Supersedes the v1.6 shape: status/category_id/faq_json/content/etc.
+-- are gone. `type` picks post vs page vs any site-defined type; the actual
+-- MDX body + excerpt + per-save SEO snapshot live on hazo_blog_revisions, not
+-- here — this table only carries the current pointer (_rev/live/draft) plus
+-- the SEO/meta fields needed to render without a join.
+--
+-- scope_id is NOT NULL (unlike every other hazo_blog table): v2 requires a
+-- concrete tenant for every post, including add-on/single-site mode, which
+-- stamps hazo_auth's DEFAULT_SYSTEM_SCOPE_ID rather than leaving it NULL.
+--
+-- live_revision_id/draft_revision_id intentionally carry no FK constraint:
+-- hazo_blog_revisions.post_id references this table, so a FK the other way
+-- would be circular at CREATE TABLE time. The repository enforces the
+-- pointer's integrity (see src/repository/posts.ts).
 CREATE TABLE IF NOT EXISTS hazo_blog_posts (
-  id               TEXT PRIMARY KEY,
-  scope_id         TEXT,
-  slug             TEXT NOT NULL,
-  title            TEXT NOT NULL,
-  content          TEXT NOT NULL DEFAULT '',          -- raw MDX
-  content_html     TEXT,                              -- cached rendered HTML (nullable)
-  excerpt          TEXT,
-  category_id      TEXT REFERENCES hazo_blog_categories(id) ON DELETE SET NULL,
-  author_id        TEXT,                              -- optional; resolved via getAuthor()
-  meta_title       TEXT NOT NULL DEFAULT '',
-  meta_description TEXT NOT NULL DEFAULT '',
-  canonical_url    TEXT,                              -- per-post canonical override
-  og_image         TEXT,                              -- per-post OG image override
-  featured_image   TEXT,
-  image_ref        TEXT,                              -- generic image ref (was character_id)
-  faq_json         TEXT NOT NULL DEFAULT '[]',        -- [{question, answer}]
-  reading_time     INTEGER NOT NULL DEFAULT 0,        -- cached, minutes
-  status           TEXT NOT NULL DEFAULT 'draft',     -- draft | published | scheduled
-  publish_date     TEXT,
-  locale           TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
-  translation_of   TEXT REFERENCES hazo_blog_posts(id) ON DELETE SET NULL, -- root post of this translation cluster
-  indexable        INTEGER NOT NULL DEFAULT 1,        -- 0/1; FALSE excludes from sitemap/robots
-  created_at       TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+  id                  TEXT PRIMARY KEY,
+  scope_id            TEXT NOT NULL,
+  type                TEXT NOT NULL DEFAULT 'post',
+  slug                TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  _rev                INTEGER NOT NULL DEFAULT 1,
+  live_revision_id    TEXT,
+  draft_revision_id   TEXT,
+  deleted_at          TEXT,
+  template            TEXT,
+  locale              TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
+  custom_fields       TEXT NOT NULL DEFAULT '{}',         -- JSON object
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             INTEGER NOT NULL DEFAULT 0,         -- 0/1
+  canonical_override  TEXT,
+  created_at          TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at          TEXT NOT NULL DEFAULT (datetime('now')),
+  published_at        TEXT,
+  publish_at          TEXT                                -- scheduled publish time
 );
--- FR-034: locale-aware uniqueness (see categories index comment above).
-DROP INDEX IF EXISTS idx_hazo_blog_posts_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_slug_locale
   ON hazo_blog_posts (scope_id, slug, COALESCE(locale, ''));
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_status_date
-  ON hazo_blog_posts (status, publish_date);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_category
-  ON hazo_blog_posts (category_id);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_translation_of
-  ON hazo_blog_posts (translation_of);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_type
+  ON hazo_blog_posts (scope_id, type);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_deleted_at
+  ON hazo_blog_posts (deleted_at);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_publish_at
+  ON hazo_blog_posts (publish_at);
+
+-- Stub FTS5 index for add-on (SQLite) mode — see db_setup_postgres.sql's
+-- search_vector/GIN index for the real multi-tenant implementation. Kept in
+-- sync by the repository (not SQLite's external-content mechanism: that
+-- needs an INTEGER rowid content table, and this PK is TEXT).
+CREATE VIRTUAL TABLE IF NOT EXISTS hazo_blog_posts_fts USING fts5(
+  post_id UNINDEXED,
+  title,
+  body
+);
+
+-- hazo_blog_revisions: full immutable snapshot on every save (draft or
+-- publish). posts.live_revision_id/draft_revision_id point into this table.
+CREATE TABLE IF NOT EXISTS hazo_blog_revisions (
+  id                  TEXT PRIMARY KEY,
+  post_id             TEXT NOT NULL REFERENCES hazo_blog_posts(id) ON DELETE CASCADE,
+  scope_id            TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  slug                TEXT NOT NULL,
+  body                TEXT NOT NULL DEFAULT '',          -- raw MDX
+  excerpt             TEXT,
+  custom_fields       TEXT NOT NULL DEFAULT '{}',        -- JSON object
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             INTEGER NOT NULL DEFAULT 0,
+  canonical_override  TEXT,
+  created_by          TEXT,
+  created_at          TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_revisions_post_created
+  ON hazo_blog_revisions (post_id, created_at);
 
 CREATE TABLE IF NOT EXISTS hazo_blog_post_tags (
   id      TEXT PRIMARY KEY,

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export * from "./types/index.js";
 export * from "./lib/index.js";
 export { createBlogRepository, type BlogRepository, type RepositoryOptions, type ListQuery, } from "./repository/index.js";
-export { createBlogService, resolveConfig, BlogSettingsUnavailableError, type BlogService, } from "./service/index.js";
+export { createBlogService, resolveConfig, BlogSettingsUnavailableError, type BlogService, type TranslatePostResult, type TranslatePostUsage, type TranslatePostSegmentResult, type ReviewTranslatedPostResult, type ReviewTranslatedPostUsage, } from "./service/index.js";
 export * from "./seo/index.js";
-export { createBlogManageRoutes, createBlogManageSlugRoutes, createBlogAdminRoutes, createBlogSettingsRoutes, createBlogSearchRoute, createBlogFeedRoute, createBlogSitemapRoute, } from "./next/routes.js";
+export { createBlogManageRoutes, createBlogManageSlugRoutes, createBlogAdminRoutes, createBlogSettingsRoutes, createBlogTranslateRoutes, createBlogReviewRoutes, createBlogSearchRoute, createBlogFeedRoute, createBlogSitemapRoute, } from "./next/routes.js";
 export { createBlogImageUploadRoute, type CreateBlogImageUploadRouteDeps, } from "./next/image-upload.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,kBAAkB,CAAC;AAGjC,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,SAAS,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,4BAA4B,EAC5B,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAG5B,cAAc,gBAAgB,CAAC;AAI/B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,kBAAkB,CAAC;AAGjC,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,SAAS,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAG5B,cAAc,gBAAgB,CAAC;AAI/B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -12,5 +12,5 @@ export { createBlogService, resolveConfig, BlogSettingsUnavailableError, } from
 export * from "./seo/index.js";
 // Route-handler factories — React-free, so API routes can import them without
 // pulling in the React page components from `hazo_blog/next`.
-export { createBlogManageRoutes, createBlogManageSlugRoutes, createBlogAdminRoutes, createBlogSettingsRoutes, createBlogSearchRoute, createBlogFeedRoute, createBlogSitemapRoute, } from "./next/routes.js";
+export { createBlogManageRoutes, createBlogManageSlugRoutes, createBlogAdminRoutes, createBlogSettingsRoutes, createBlogTranslateRoutes, createBlogReviewRoutes, createBlogSearchRoute, createBlogFeedRoute, createBlogSitemapRoute, } from "./next/routes.js";
 export { createBlogImageUploadRoute, } from "./next/image-upload.js";

package/dist/lib/index.js

@@ -4,3 +4,9 @@ export * from "./validate.js";
 export * from "./dates.js";
 export * from "./layouts.js";
 export * from "./i18n.js";
+// `mdx_mask.ts` and `mdx_segment.ts` are deliberately NOT re-exported here —
+// `mdx_mask.ts` lazily depends on the OPTIONAL `hazo_i18n` peer (see its own
+// header), and this barrel backs the general-purpose `./lib` subpath every
+// consumer of this package's pure utilities pulls in, whether or not they
+// use `translatePost()`. Import `../lib/mdx_mask.js`/`../lib/mdx_segment.js`
+// directly (as `service/index.ts` does) instead of widening this barrel.

package/dist/lib/mdx_mask.d.ts

@@ -0,0 +1,28 @@
+/** One masked tag's original open/close text (mirrors `hazo_i18n/html`'s own `MaskedTagEntry` shape). `close` is `''` for a self-closing tag. */
+export interface MaskedTagEntry {
+    open: string;
+    close: string;
+}
+export interface MaskMdxResult {
+    masked: string;
+    frontmatter: string | null;
+    map: Record<string, MaskedTagEntry>;
+}
+/**
+ * Sets aside leading YAML frontmatter (if present — see this file's header,
+ * most posts have none), then masks every capitalized JSX component tag
+ * (`maskJsxComponents`, this file's own `jN` namespace) and finally every
+ * remaining attributed plain-HTML tag (`maskHtml()`'s `xN` namespace). The
+ * two placeholder maps are merged into one — the numeric prefixes (`j`/`x`)
+ * never collide, so a single `map` round-trips through `unmaskMdx()`.
+ */
+export declare function maskMdx(content: string): Promise<MaskMdxResult>;
+/**
+ * Exact inverse of `maskMdx()`: restores HTML tag placeholders, then JSX
+ * component placeholders, then re-prepends the frontmatter byte-for-byte.
+ * Order doesn't matter between the two unmask passes (disjoint placeholder
+ * namespaces), but running `unmaskHtml` first mirrors `maskMdx()`'s own
+ * "JSX pass, then HTML pass" order in reverse.
+ */
+export declare function unmaskMdx(masked: string, frontmatter: string | null, map: Record<string, MaskedTagEntry>): Promise<string>;
+//# sourceMappingURL=mdx_mask.d.ts.map

package/dist/lib/mdx_mask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdx_mask.d.ts","sourceRoot":"","sources":["../../src/lib/mdx_mask.ts"],"names":[],"mappings":"AAyEA,iJAAiJ;AACjJ,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAOD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACrC;AAsED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAerE;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAClC,OAAO,CAAC,MAAM,CAAC,CAKjB"}