hazo_blog 1.6.0 → 2.0.0

package/CHANGE_LOG.md

@@ -3,8 +3,87 @@
 All notable changes are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## 2.0.0 — 2026-10-31
+
+**⚠️ BREAKING — new posts + pages foundation for BlogSketch (Phase 1a issue 04).**
+
+Replaces `hazo_blog_posts`' v1.6 shape entirely with a content-type-agnostic
+model: `type` (free-form string, default `'post'`) instead of a fixed
+post/page split; `_rev` optimistic concurrency; `live_revision_id`/
+`draft_revision_id` pointers into a new `hazo_blog_revisions` table (every
+save is an immutable snapshot — the live/draft promotion workflow itself is
+Phase 1a issue 06); `custom_fields` JSONB; a current-value SEO/meta snapshot
+(`seo_title`/`seo_description`/`og_image`/`noindex`/`canonical_override`) on
+the post, with historical snapshots on each revision; `deleted_at` (soft
+delete — restore/auto-purge is issue 07); `publish_at` (scheduled — auto-publish
+worker is issue 07). **`scope_id` is now NOT NULL** on `hazo_blog_posts`/
+`hazo_blog_revisions` — add-on/single-site mode stamps hazo_auth's
+`DEFAULT_SYSTEM_SCOPE_ID` (`resolvePostScope()` in `src/service/posts.ts`,
+via `optional_import("hazo_auth/server-lib")` since `hazo_auth` is an
+optional peer, with a literal fallback if it's not installed).
+
+Gone from the table entirely (content/category/faq/i18n fields now live
+elsewhere or are deferred): `content`, `content_html`, `excerpt`,
+`category_id`, `author_id`, `meta_title`, `meta_description`,
+`canonical_url`, `featured_image`, `image_ref`, `faq_json`, `reading_time`,
+`status`, `publish_date`, `translation_of`, `review_notes`, `indexable`.
+`status`/transitions/trash-restore are deliberately NOT part of this issue —
+see issue 07.
+
+**This is intentionally a hard break, not a migration.** v1.6 consumers
+(GoTimer, kinstripe) stay on `~1.6.x` and are unaffected — their deployments
+bundle v1.6's own `db_setup_*.sql`. The v1.6 `BlogRepository`/`BlogService`/
+routes/components/SEO glue in this package (`src/repository/index.ts`,
+`src/service/index.ts`, `src/next/routes.ts`, `src/components/*`, `src/ui/*`,
+`src/seo/*`) are UNTOUCHED by this change and now reference a dropped shape
+— their own tests fail against the new schema until later Phase 1a issues
+(05 admin shell, 10 media pipeline, 11 SEO admin, 12 post list, 15 post
+editor) rewrite each consumer against the v2 model. `npx tsc --noEmit`
+stays green (the breakage is schema/runtime, not type-level — `BlogPost`
+etc. are plain interfaces with no DB coupling).
+
+New, additive, and NOT touching any v1.6 code path:
+
+- **`src/types/index.ts`** — `Post`, `PostRevision`, `CreatePostInput`,
+  `UpdatePostInput`, `ListPostsQuery`, `PaginatedPostsResult`.
+- **`src/repository/posts.ts`** — `createPostRepository(adapter, scope)`.
+  `updatePost()`'s optimistic-concurrency check is a single atomic
+  `UPDATE ... WHERE id = ? AND scope_id = ? AND _rev = ? RETURNING *` (via
+  `hazo_connect`'s `QueryBuilder`+`CrudService.query()`) — the WHERE clause
+  itself is what prevents a lost update between two concurrent callers, not
+  a prior read (that read only exists to tell `PostNotFoundError` apart from
+  `PostConflictError` with a clearer error). Postgres full-text search uses
+  native `tsvector`/`ts_rank` via a duck-typed `adapter.raw()` escape hatch
+  (PgAdapter-only — not part of the common `HazoConnectAdapter` interface;
+  every other adapter, including PostgREST/Supabase, degrades to a plain
+  title substring match). SQLite add-on mode gets a stub `hazo_blog_posts_fts`
+  FTS5 table, kept in sync on write but not yet wired into `searchPosts()`.
+- **`src/service/posts.ts`** — `createPostService(config)`, `resolvePostScope()`.
+  Fails CLOSED (`ScopeUnresolvedError`) when a multi-site `resolveScope` is
+  configured but returns no scope for a request — only falls back to
+  hazo_auth's `DEFAULT_SYSTEM_SCOPE_ID` when no `resolveScope` is configured
+  at all. Defaulting to the system scope on an unresolved multi-tenant
+  request would be a fail-open tenant-isolation bug, not a convenience.
+- **`src/next/post-routes.ts`** — `createPostManageRoutes`/`createPostItemRoutes`
+  (same `blog:read`/`blog:write` hazo_api scopes as v1.6's manage routes).
+- **`db_setup_sqlite.sql`/`db_setup_postgres.sql`/`migrations/*`** — new
+  `hazo_blog_posts` shape, new `hazo_blog_revisions` table, new
+  `hazo_blog_posts_fts` SQLite FTS5 stub. `hazo_blog_categories`/
+  `hazo_blog_tags`/`hazo_blog_post_tags`/`hazo_blog_settings` are unchanged
+  and not yet wired to v2 posts (categorization is deferred to a later
+  issue).
+
 ## 1.6.0 — 2026-10-09
 
+**Fix — `getPostById` ignored tenant scoping (IDOR).**
+
+`repository.getPostById(id)` used `posts.findById(id)` directly, with no `scope_id`
+predicate — unlike every other read in this file (`getPostBySlug`, `getAllSlugs`, `listPosts`),
+which all go through the `scoped()` helper. One tenant could fetch (and, via the new
+translate/review flow below, read/mutate) another tenant's post by guessing or enumerating its
+id. Fixed by routing `getPostById` through `posts.list()` with the same `scoped(qb)` predicate
+the slug lookup uses.
+
 **Blog translation, Phase 4C: AI translate + AI review of translation-cluster drafts**
 
 Takes a Phase 4B draft (created via `createTranslation()`, content copied verbatim,

package/db_setup_postgres.sql

@@ -3,9 +3,11 @@
 -- Supports both PostgreSQL (this file) and SQLite (db_setup_sqlite.sql).
 -- All tables use the `hazo_blog_` prefix per workspace standards.
 --
--- Multi-tenancy: every table carries a nullable `scope_id`. Single-tenant
--- consumers leave it NULL; multi-tenant consumers populate it and pass a scope
--- resolver so the repository filters by it.
+-- Multi-tenancy: hazo_blog_posts/hazo_blog_revisions require a `scope_id`
+-- (NOT NULL, as of v2.0.0) — add-on/single-site mode stamps hazo_auth's
+-- DEFAULT_SYSTEM_SCOPE_ID. Every other table still carries a nullable
+-- `scope_id`: single-tenant consumers leave it NULL; multi-tenant consumers
+-- populate it and pass a scope resolver so the repository filters by it.
 
 CREATE TABLE IF NOT EXISTS hazo_blog_categories (
   id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -42,47 +44,81 @@ DROP INDEX IF EXISTS idx_hazo_blog_tags_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_tags_scope_slug_locale
   ON hazo_blog_tags (scope_id, slug, COALESCE(locale, ''));
 
+-- hazo_blog_posts (v2.0.0) — content-type-agnostic foundation for posts and
+-- pages. Supersedes the v1.6 shape: status/category_id/faq_json/content/etc.
+-- are gone. `type` picks post vs page vs any site-defined type; the actual
+-- MDX body + excerpt + per-save SEO snapshot live on hazo_blog_revisions, not
+-- here — this table only carries the current pointer (_rev/live/draft) plus
+-- the SEO/meta fields needed to render without a join.
+--
+-- scope_id is NOT NULL (unlike every other hazo_blog table): v2 requires a
+-- concrete tenant for every post, including add-on/single-site mode, which
+-- stamps hazo_auth's DEFAULT_SYSTEM_SCOPE_ID rather than leaving it NULL.
+--
+-- live_revision_id/draft_revision_id intentionally carry no FK constraint:
+-- hazo_blog_revisions.post_id references this table, so a FK the other way
+-- would be circular at CREATE TABLE time. The repository enforces the
+-- pointer's integrity (see src/repository/posts.ts).
+--
+-- search_vector is maintained by the repository, not a generated column —
+-- Postgres generated columns can't reach across tables, and the searchable
+-- body text lives on hazo_blog_revisions.
 CREATE TABLE IF NOT EXISTS hazo_blog_posts (
-  id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  scope_id         TEXT,
-  slug             TEXT NOT NULL,
-  title            TEXT NOT NULL,
-  content          TEXT NOT NULL DEFAULT '',          -- raw MDX
-  content_html     TEXT,                              -- cached rendered HTML (nullable)
-  excerpt          TEXT,
-  category_id      UUID REFERENCES hazo_blog_categories(id) ON DELETE SET NULL,
-  author_id        TEXT,                              -- optional; resolved via getAuthor()
-  meta_title       TEXT NOT NULL DEFAULT '',
-  meta_description TEXT NOT NULL DEFAULT '',
-  canonical_url    TEXT,                              -- per-post canonical override
-  og_image         TEXT,                              -- per-post OG image override
-  featured_image   TEXT,
-  image_ref        TEXT,                              -- generic image ref (was character_id)
-  faq_json         JSONB NOT NULL DEFAULT '[]',       -- [{question, answer}]
-  reading_time     INTEGER NOT NULL DEFAULT 0,        -- cached, minutes
-  status           TEXT NOT NULL DEFAULT 'draft',     -- draft | published | scheduled
-  publish_date     TIMESTAMPTZ,
-  locale           TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
-  translation_of   UUID REFERENCES hazo_blog_posts(id) ON DELETE SET NULL, -- root post of this translation cluster
-  review_notes     TEXT,                              -- BlogService#reviewTranslatedPost()'s LLM notes (nullable; never flips status)
-  indexable        BOOLEAN NOT NULL DEFAULT TRUE,     -- FALSE excludes from sitemap/robots
-  created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id            TEXT NOT NULL,
+  type                TEXT NOT NULL DEFAULT 'post',
+  slug                TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  _rev                INTEGER NOT NULL DEFAULT 1,
+  live_revision_id    UUID,
+  draft_revision_id   UUID,
+  deleted_at          TIMESTAMPTZ,
+  template            TEXT,
+  locale              TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
+  custom_fields       JSONB NOT NULL DEFAULT '{}'::jsonb,
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             BOOLEAN NOT NULL DEFAULT FALSE,
+  canonical_override  TEXT,
+  search_vector       tsvector,
+  created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  published_at        TIMESTAMPTZ,
+  publish_at          TIMESTAMPTZ
 );
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS locale TEXT DEFAULT NULL;
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS translation_of UUID REFERENCES hazo_blog_posts(id) ON DELETE SET NULL;
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS indexable BOOLEAN NOT NULL DEFAULT TRUE;
-ALTER TABLE hazo_blog_posts ADD COLUMN IF NOT EXISTS review_notes TEXT;
--- FR-034: locale-aware uniqueness (see categories index comment above).
-DROP INDEX IF EXISTS idx_hazo_blog_posts_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_slug_locale
   ON hazo_blog_posts (scope_id, slug, COALESCE(locale, ''));
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_status_date
-  ON hazo_blog_posts (status, publish_date);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_category
-  ON hazo_blog_posts (category_id);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_translation_of
-  ON hazo_blog_posts (translation_of);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_type
+  ON hazo_blog_posts (scope_id, type);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_deleted_at
+  ON hazo_blog_posts (deleted_at);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_publish_at
+  ON hazo_blog_posts (publish_at);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_search
+  ON hazo_blog_posts USING GIN (search_vector);
+
+-- hazo_blog_revisions: full immutable snapshot on every save (draft or
+-- publish). posts.live_revision_id/draft_revision_id point into this table.
+CREATE TABLE IF NOT EXISTS hazo_blog_revisions (
+  id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  post_id             UUID NOT NULL REFERENCES hazo_blog_posts(id) ON DELETE CASCADE,
+  scope_id            TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  slug                TEXT NOT NULL,
+  body                TEXT NOT NULL DEFAULT '',
+  excerpt             TEXT,
+  custom_fields       JSONB NOT NULL DEFAULT '{}'::jsonb,
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             BOOLEAN NOT NULL DEFAULT FALSE,
+  canonical_override  TEXT,
+  created_by          TEXT,
+  created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_revisions_post_created
+  ON hazo_blog_revisions (post_id, created_at);
 
 CREATE TABLE IF NOT EXISTS hazo_blog_post_tags (
   id      UUID PRIMARY KEY DEFAULT gen_random_uuid(),

package/db_setup_sqlite.sql

@@ -4,15 +4,20 @@
 -- All tables use the `hazo_blog_` prefix per workspace standards.
 --
 -- Tables:
---   hazo_blog_posts       — blog posts (raw MDX content + cached HTML + SEO fields)
---   hazo_blog_categories  — single category per post
---   hazo_blog_tags        — free-form tags (many-to-many with posts)
+--   hazo_blog_posts       — posts/pages (v2.0.0: type/_rev/live+draft pointers; see table comment)
+--   hazo_blog_revisions   — immutable per-save content snapshots for hazo_blog_posts
+--   hazo_blog_posts_fts   — FTS5 stub search index for hazo_blog_posts (add-on/SQLite mode)
+--   hazo_blog_categories  — single category per post (v1.6; not yet wired to v2 posts)
+--   hazo_blog_tags        — free-form tags (many-to-many with posts; v1.6, not yet wired to v2 posts)
 --   hazo_blog_post_tags   — post↔tag join
 --   hazo_blog_settings    — package-owned display/behavior settings
 --
--- Multi-tenancy: every table carries a nullable `scope_id`. Single-tenant
--- consumers (e.g. gotimer) leave it NULL; multi-tenant consumers populate it
--- and pass a scope resolver so the repository filters by it.
+-- Multi-tenancy: hazo_blog_posts/hazo_blog_revisions require a `scope_id`
+-- (NOT NULL, as of v2.0.0) — add-on/single-site mode stamps hazo_auth's
+-- DEFAULT_SYSTEM_SCOPE_ID. Every other table still carries a nullable
+-- `scope_id`: single-tenant consumers (e.g. gotimer, on v1.6) leave it NULL;
+-- multi-tenant consumers populate it and pass a scope resolver so the
+-- repository filters by it.
 
 CREATE TABLE IF NOT EXISTS hazo_blog_categories (
   id          TEXT PRIMARY KEY,
@@ -48,43 +53,84 @@ DROP INDEX IF EXISTS idx_hazo_blog_tags_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_tags_scope_slug_locale
   ON hazo_blog_tags (scope_id, slug, COALESCE(locale, ''));
 
+-- hazo_blog_posts (v2.0.0) — content-type-agnostic foundation for posts and
+-- pages. Supersedes the v1.6 shape: status/category_id/faq_json/content/etc.
+-- are gone. `type` picks post vs page vs any site-defined type; the actual
+-- MDX body + excerpt + per-save SEO snapshot live on hazo_blog_revisions, not
+-- here — this table only carries the current pointer (_rev/live/draft) plus
+-- the SEO/meta fields needed to render without a join.
+--
+-- scope_id is NOT NULL (unlike every other hazo_blog table): v2 requires a
+-- concrete tenant for every post, including add-on/single-site mode, which
+-- stamps hazo_auth's DEFAULT_SYSTEM_SCOPE_ID rather than leaving it NULL.
+--
+-- live_revision_id/draft_revision_id intentionally carry no FK constraint:
+-- hazo_blog_revisions.post_id references this table, so a FK the other way
+-- would be circular at CREATE TABLE time. The repository enforces the
+-- pointer's integrity (see src/repository/posts.ts).
 CREATE TABLE IF NOT EXISTS hazo_blog_posts (
-  id               TEXT PRIMARY KEY,
-  scope_id         TEXT,
-  slug             TEXT NOT NULL,
-  title            TEXT NOT NULL,
-  content          TEXT NOT NULL DEFAULT '',          -- raw MDX
-  content_html     TEXT,                              -- cached rendered HTML (nullable)
-  excerpt          TEXT,
-  category_id      TEXT REFERENCES hazo_blog_categories(id) ON DELETE SET NULL,
-  author_id        TEXT,                              -- optional; resolved via getAuthor()
-  meta_title       TEXT NOT NULL DEFAULT '',
-  meta_description TEXT NOT NULL DEFAULT '',
-  canonical_url    TEXT,                              -- per-post canonical override
-  og_image         TEXT,                              -- per-post OG image override
-  featured_image   TEXT,
-  image_ref        TEXT,                              -- generic image ref (was character_id)
-  faq_json         TEXT NOT NULL DEFAULT '[]',        -- [{question, answer}]
-  reading_time     INTEGER NOT NULL DEFAULT 0,        -- cached, minutes
-  status           TEXT NOT NULL DEFAULT 'draft',     -- draft | published | scheduled
-  publish_date     TEXT,
-  locale           TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
-  translation_of   TEXT REFERENCES hazo_blog_posts(id) ON DELETE SET NULL, -- root post of this translation cluster
-  review_notes     TEXT,                              -- BlogService#reviewTranslatedPost()'s LLM notes (nullable; never flips status)
-  indexable        INTEGER NOT NULL DEFAULT 1,        -- 0/1; FALSE excludes from sitemap/robots
-  created_at       TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+  id                  TEXT PRIMARY KEY,
+  scope_id            TEXT NOT NULL,
+  type                TEXT NOT NULL DEFAULT 'post',
+  slug                TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  _rev                INTEGER NOT NULL DEFAULT 1,
+  live_revision_id    TEXT,
+  draft_revision_id   TEXT,
+  deleted_at          TEXT,
+  template            TEXT,
+  locale              TEXT DEFAULT NULL,                 -- BCP-47 locale; NULL = default locale
+  custom_fields       TEXT NOT NULL DEFAULT '{}',         -- JSON object
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             INTEGER NOT NULL DEFAULT 0,         -- 0/1
+  canonical_override  TEXT,
+  created_at          TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at          TEXT NOT NULL DEFAULT (datetime('now')),
+  published_at        TEXT,
+  publish_at          TEXT                                -- scheduled publish time
 );
--- FR-034: locale-aware uniqueness (see categories index comment above).
-DROP INDEX IF EXISTS idx_hazo_blog_posts_scope_slug;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_slug_locale
   ON hazo_blog_posts (scope_id, slug, COALESCE(locale, ''));
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_status_date
-  ON hazo_blog_posts (status, publish_date);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_category
-  ON hazo_blog_posts (category_id);
-CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_translation_of
-  ON hazo_blog_posts (translation_of);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_scope_type
+  ON hazo_blog_posts (scope_id, type);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_deleted_at
+  ON hazo_blog_posts (deleted_at);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_posts_publish_at
+  ON hazo_blog_posts (publish_at);
+
+-- Stub FTS5 index for add-on (SQLite) mode — see db_setup_postgres.sql's
+-- search_vector/GIN index for the real multi-tenant implementation. Kept in
+-- sync by the repository (not SQLite's external-content mechanism: that
+-- needs an INTEGER rowid content table, and this PK is TEXT).
+CREATE VIRTUAL TABLE IF NOT EXISTS hazo_blog_posts_fts USING fts5(
+  post_id UNINDEXED,
+  title,
+  body
+);
+
+-- hazo_blog_revisions: full immutable snapshot on every save (draft or
+-- publish). posts.live_revision_id/draft_revision_id point into this table.
+CREATE TABLE IF NOT EXISTS hazo_blog_revisions (
+  id                  TEXT PRIMARY KEY,
+  post_id             TEXT NOT NULL REFERENCES hazo_blog_posts(id) ON DELETE CASCADE,
+  scope_id            TEXT NOT NULL,
+  title               TEXT NOT NULL,
+  slug                TEXT NOT NULL,
+  body                TEXT NOT NULL DEFAULT '',          -- raw MDX
+  excerpt             TEXT,
+  custom_fields       TEXT NOT NULL DEFAULT '{}',        -- JSON object
+  seo_title           TEXT,
+  seo_description     TEXT,
+  og_image            TEXT,
+  noindex             INTEGER NOT NULL DEFAULT 0,
+  canonical_override  TEXT,
+  created_by          TEXT,
+  created_at          TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_hazo_blog_revisions_post_created
+  ON hazo_blog_revisions (post_id, created_at);
 
 CREATE TABLE IF NOT EXISTS hazo_blog_post_tags (
   id      TEXT PRIMARY KEY,

package/dist/repository/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repository/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EACR,qBAAqB,EACrB,OAAO,EAEP,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAmB3B,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF;;;OAGG;IACH,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAC9D,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC,iFAAiF;IACjF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC/D,gFAAgF;IAChF,WAAW,CAAC,kBAAkB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IACnG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,mBAAmB,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpG,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,eAAe,CAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5D,oGAAoG;IACpG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,kGAAkG;IAClG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,wFAAwF;IACxF,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AA0BD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,iBAAsB,GAC9B,cAAc,CA+ahB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repository/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EACR,qBAAqB,EACrB,OAAO,EAEP,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAmB3B,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF;;;OAGG;IACH,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAC9D,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC,iFAAiF;IACjF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC/D,gFAAgF;IAChF,WAAW,CAAC,kBAAkB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IACnG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,mBAAmB,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpG,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,eAAe,CAAC,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5D,oGAAoG;IACpG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,kGAAkG;IAClG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,wFAAwF;IACxF,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AA0BD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,iBAAsB,GAC9B,cAAc,CAsbhB"}

package/dist/repository/index.js

@@ -172,7 +172,13 @@ export function createBlogRepository(adapter, options = {}) {
             return hydrated ?? null;
         },
         async getPostById(id) {
-            const row = await posts.findById(id);
+            // Not findById: findById has no scope predicate, which would let one
+            // tenant fetch (and, via the translate/review flow, mutate) another
+            // tenant's post by guessing its id.
+            const rows = await posts.list(
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (qb) => scoped(qb).where("id", "eq", id).limit(1));
+            const row = rows[0] ?? null;
             if (!row)
                 return null;
             const [hydrated] = await hydrate([row]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_blog",
-  "version": "1.6.0",
+  "version": "2.0.0",
   "description": "SEO-optimized blogging package: posts, categories, tags, MDX content, and GA4/GSC/Bing-ready SEO.",
   "type": "module",
   "module": "./dist/index.js",
@@ -52,17 +52,17 @@
     "build:test-app": "npm run build && cd test-app && npm run build"
   },
   "peerDependencies": {
-    "hazo_core": "^2.4.0",
-    "hazo_connect": "^4.3.2",
-    "hazo_api": "^2.8.0",
+    "hazo_core": "^2.5.0",
+    "hazo_connect": "^4.3.5",
+    "hazo_api": "^2.9.0",
     "hazo_files": "^3.4.0",
-    "hazo_theme": "^1.4.0",
-    "hazo_ui": "^6.14.0",
-    "hazo_images": "^1.11.0",
-    "hazo_jobs": "^0.19.0",
-    "hazo_auth": "^10.23.3",
-    "hazo_i18n": "^0.12.0",
-    "hazo_llm_api": "^2.6.0",
+    "hazo_theme": "^1.4.2",
+    "hazo_ui": "^6.19.0",
+    "hazo_images": "^1.13.0",
+    "hazo_jobs": "^0.20.0",
+    "hazo_auth": "^10.27.0",
+    "hazo_i18n": "^0.15.4",
+    "hazo_llm_api": "^2.7.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "next": "^14.0.0 || ^16.0.0"
@@ -103,11 +103,11 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "next": "^16.0.10",
-    "hazo_core": "^2.4.0",
-    "hazo_connect": "^4.3.2",
-    "hazo_api": "^2.8.0",
+    "hazo_core": "^2.5.0",
+    "hazo_connect": "^4.3.5",
+    "hazo_api": "^2.9.0",
     "hazo_files": "^3.4.0",
-    "hazo_ui": "^6.14.0",
+    "hazo_ui": "^6.19.0",
     "tailwindcss": "^4.2.4",
     "@tailwindcss/postcss": "^4.2.4",
     "postcss": "^8.4.49"