@basaltkit/comments 1.0.0 → 1.0.2

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Machize Contributors
+Copyright (c) 2026 Basalt Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,3 +1,9 @@
+<p align="center">
+  <a href="https://basaltkit-docs.pages.dev">
+    <img src="https://basaltkit-docs.pages.dev/social-card.png" alt="Basalt" width="440">
+  </a>
+</p>
+
 # @basaltkit/comments
 
 Per-resource comments for Basalt: **threads** (nested replies), **@mentions**, and **resolve/reopen**, isolated by tenant, emitting **events** that connect to [`@basaltkit/realtime`](https://www.npmjs.com/package/@basaltkit/realtime) (live discussion) and [`@basaltkit/notifications`](https://www.npmjs.com/package/@basaltkit/notifications) (notify who was mentioned). You need this module when you want collaboration — commenting on a note, a project, a task.

package/dist/comments.d.ts

@@ -0,0 +1,54 @@
+import { BasaltError, type HookBus } from '@basaltkit/core';
+import { type Comment, type CommentStore } from './store.js';
+export declare class CommentNotFoundError extends BasaltError {
+    readonly status = 404;
+    constructor();
+}
+export declare class CommentTenantRequiredError extends BasaltError {
+    readonly status = 400;
+    constructor();
+}
+/** A comment plus its nested replies. */
+export interface CommentNode extends Comment {
+    replies: CommentNode[];
+}
+export interface CommentsOptions {
+    store?: CommentStore;
+    hooks?: HookBus;
+    /** Regex whose first capture group is a mentioned user id. Default `@([\w-]+)`. */
+    mentionPattern?: RegExp;
+    now?: () => number;
+}
+export interface AddCommentInput {
+    authorId: string;
+    body: string;
+    parentId?: string;
+}
+/** Everything scoped to one resource (`resourceType`:`resourceId`) of a tenant. */
+export interface ResourceComments {
+    add(input: AddCommentInput): Promise<Comment>;
+    list(): Promise<Comment[]>;
+    tree(): Promise<CommentNode[]>;
+}
+/**
+ * Per-resource comment threads with @mentions and resolve/reopen, scoped by
+ * tenant. Emits hooks (`comment:created`, `comment:mentioned`, …) so live
+ * updates (@basaltkit/realtime) and notifications wire up without coupling.
+ */
+export declare class Comments {
+    private readonly store;
+    private readonly hooks;
+    private readonly mentionPattern;
+    private readonly now;
+    constructor(options?: CommentsOptions);
+    on(resourceType: string, resourceId: string, tenantId?: string): ResourceComments;
+    get(id: string, tenantId?: string): Promise<Comment | null>;
+    edit(id: string, body: string, tenantId?: string): Promise<Comment>;
+    remove(id: string, tenantId?: string): Promise<void>;
+    resolve(id: string, resolvedBy: string, tenantId?: string): Promise<Comment>;
+    reopen(id: string, tenantId?: string): Promise<Comment>;
+    private add;
+    private mutate;
+    private mentions;
+    private tenant;
+}

package/dist/comments.js

@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto';
+import { BasaltError, tryCtx } from '@basaltkit/core';
+import { MemoryCommentStore } from './store.js';
+export class CommentNotFoundError extends BasaltError {
+    status = 404;
+    constructor() {
+        super('COMMENT_NOT_FOUND', 'Comment not found.');
+    }
+}
+export class CommentTenantRequiredError extends BasaltError {
+    status = 400;
+    constructor() {
+        super('COMMENT_TENANT_REQUIRED', 'A tenant is required — pass tenantId or run inside a tenant context.');
+    }
+}
+const buildTree = (comments) => {
+    const nodes = new Map(comments.map((c) => [c.id, { ...c, replies: [] }]));
+    const roots = [];
+    for (const node of nodes.values()) {
+        const parent = node.parentId ? nodes.get(node.parentId) : undefined;
+        if (parent)
+            parent.replies.push(node);
+        else
+            roots.push(node);
+    }
+    return roots;
+};
+/**
+ * Per-resource comment threads with @mentions and resolve/reopen, scoped by
+ * tenant. Emits hooks (`comment:created`, `comment:mentioned`, …) so live
+ * updates (@basaltkit/realtime) and notifications wire up without coupling.
+ */
+export class Comments {
+    store;
+    hooks;
+    mentionPattern;
+    now;
+    constructor(options = {}) {
+        this.store = options.store ?? new MemoryCommentStore();
+        this.hooks = options.hooks;
+        this.mentionPattern = options.mentionPattern ?? /@([\w-]+)/g;
+        this.now = options.now ?? Date.now;
+    }
+    on(resourceType, resourceId, tenantId) {
+        const tenant = this.tenant(tenantId);
+        return {
+            add: (input) => this.add(tenant, resourceType, resourceId, input),
+            list: () => this.store.list(tenant, resourceType, resourceId),
+            tree: async () => buildTree(await this.store.list(tenant, resourceType, resourceId)),
+        };
+    }
+    get(id, tenantId) {
+        return this.store.find(this.tenant(tenantId), id);
+    }
+    async edit(id, body, tenantId) {
+        const tenant = this.tenant(tenantId);
+        if (!(await this.store.find(tenant, id)))
+            throw new CommentNotFoundError();
+        const updated = await this.store.update(tenant, id, { body, mentions: this.mentions(body), editedAt: this.now() });
+        await this.hooks?.emit('comment:updated', { comment: updated });
+        return updated;
+    }
+    async remove(id, tenantId) {
+        const tenant = this.tenant(tenantId);
+        const comment = await this.store.find(tenant, id);
+        if (!comment)
+            return;
+        await this.store.delete(tenant, id);
+        await this.hooks?.emit('comment:deleted', {
+            tenantId: tenant,
+            id,
+            resourceType: comment.resourceType,
+            resourceId: comment.resourceId,
+        });
+    }
+    async resolve(id, resolvedBy, tenantId) {
+        const comment = await this.mutate(id, { resolvedAt: this.now(), resolvedBy }, tenantId);
+        await this.hooks?.emit('comment:resolved', { comment });
+        return comment;
+    }
+    async reopen(id, tenantId) {
+        const comment = await this.mutate(id, { resolvedAt: undefined, resolvedBy: undefined }, tenantId);
+        await this.hooks?.emit('comment:reopened', { comment });
+        return comment;
+    }
+    async add(tenantId, resourceType, resourceId, input) {
+        const mentions = this.mentions(input.body);
+        const comment = {
+            id: randomUUID(),
+            tenantId,
+            resourceType,
+            resourceId,
+            authorId: input.authorId,
+            body: input.body,
+            mentions,
+            createdAt: this.now(),
+            ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
+        };
+        await this.store.create(comment);
+        await this.hooks?.emit('comment:created', { comment });
+        for (const userId of mentions)
+            await this.hooks?.emit('comment:mentioned', { comment, userId });
+        return comment;
+    }
+    async mutate(id, patch, tenantId) {
+        const tenant = this.tenant(tenantId);
+        if (!(await this.store.find(tenant, id)))
+            throw new CommentNotFoundError();
+        return (await this.store.update(tenant, id, patch));
+    }
+    mentions(body) {
+        const ids = new Set();
+        for (const match of body.matchAll(this.mentionPattern))
+            if (match[1])
+                ids.add(match[1]);
+        return [...ids];
+    }
+    tenant(explicit) {
+        const id = explicit ?? tryCtx()?.['tenant']?.id;
+        if (!id)
+            throw new CommentTenantRequiredError();
+        return id;
+    }
+}

package/dist/index.d.ts

@@ -1,138 +1,3 @@
-import * as _basaltkit_core from '@basaltkit/core';
-import { HookBus, BasaltError } from '@basaltkit/core';
-import { BasaltRoute } from '@basaltkit/fastify';
-
-/** A comment attached to a resource (`resourceType`:`resourceId`) within a tenant. */
-interface Comment {
-    id: string;
-    tenantId: string;
-    resourceType: string;
-    resourceId: string;
-    /** Set when this comment is a reply to another. */
-    parentId?: string;
-    authorId: string;
-    body: string;
-    /** User ids extracted from @mentions in the body. */
-    mentions: string[];
-    resolvedAt?: number;
-    resolvedBy?: string;
-    editedAt?: number;
-    createdAt: number;
-}
-interface CommentPatch {
-    body?: string;
-    mentions?: string[];
-    editedAt?: number;
-    /** `undefined` clears it (reopen). */
-    resolvedAt?: number | undefined;
-    resolvedBy?: string | undefined;
-}
-interface CommentStore {
-    create(comment: Comment): Promise<void>;
-    find(tenantId: string, id: string): Promise<Comment | null>;
-    /** Every comment on a resource (the whole thread), oldest first. */
-    list(tenantId: string, resourceType: string, resourceId: string): Promise<Comment[]>;
-    update(tenantId: string, id: string, patch: CommentPatch): Promise<Comment | null>;
-    delete(tenantId: string, id: string): Promise<void>;
-}
-declare class MemoryCommentStore implements CommentStore {
-    private readonly records;
-    private key;
-    create(comment: Comment): Promise<void>;
-    find(tenantId: string, id: string): Promise<Comment | null>;
-    list(tenantId: string, resourceType: string, resourceId: string): Promise<Comment[]>;
-    update(tenantId: string, id: string, patch: CommentPatch): Promise<Comment | null>;
-    delete(tenantId: string, id: string): Promise<void>;
-}
-
-declare class CommentNotFoundError extends BasaltError {
-    readonly status = 404;
-    constructor();
-}
-declare class CommentTenantRequiredError extends BasaltError {
-    readonly status = 400;
-    constructor();
-}
-/** A comment plus its nested replies. */
-interface CommentNode extends Comment {
-    replies: CommentNode[];
-}
-interface CommentsOptions {
-    store?: CommentStore;
-    hooks?: HookBus;
-    /** Regex whose first capture group is a mentioned user id. Default `@([\w-]+)`. */
-    mentionPattern?: RegExp;
-    now?: () => number;
-}
-interface AddCommentInput {
-    authorId: string;
-    body: string;
-    parentId?: string;
-}
-/** Everything scoped to one resource (`resourceType`:`resourceId`) of a tenant. */
-interface ResourceComments {
-    add(input: AddCommentInput): Promise<Comment>;
-    list(): Promise<Comment[]>;
-    tree(): Promise<CommentNode[]>;
-}
-/**
- * Per-resource comment threads with @mentions and resolve/reopen, scoped by
- * tenant. Emits hooks (`comment:created`, `comment:mentioned`, …) so live
- * updates (@basaltkit/realtime) and notifications wire up without coupling.
- */
-declare class Comments {
-    private readonly store;
-    private readonly hooks;
-    private readonly mentionPattern;
-    private readonly now;
-    constructor(options?: CommentsOptions);
-    on(resourceType: string, resourceId: string, tenantId?: string): ResourceComments;
-    get(id: string, tenantId?: string): Promise<Comment | null>;
-    edit(id: string, body: string, tenantId?: string): Promise<Comment>;
-    remove(id: string, tenantId?: string): Promise<void>;
-    resolve(id: string, resolvedBy: string, tenantId?: string): Promise<Comment>;
-    reopen(id: string, tenantId?: string): Promise<Comment>;
-    private add;
-    private mutate;
-    private mentions;
-    private tenant;
-}
-
-declare module '@basaltkit/core' {
-    interface BasaltHooks {
-        'comment:created': {
-            comment: Comment;
-        };
-        'comment:updated': {
-            comment: Comment;
-        };
-        'comment:deleted': {
-            tenantId: string;
-            id: string;
-            resourceType: string;
-            resourceId: string;
-        };
-        'comment:resolved': {
-            comment: Comment;
-        };
-        'comment:reopened': {
-            comment: Comment;
-        };
-        /** One per mentioned user — wire to notifications. */
-        'comment:mentioned': {
-            comment: Comment;
-            userId: string;
-        };
-    }
-}
-declare const COMMENTS: _basaltkit_core.Token<Comments>;
-type CommentsPluginOptions = Omit<CommentsOptions, 'hooks'>;
-declare function commentsPlugin(options?: CommentsPluginOptions): _basaltkit_core.BasaltPlugin<unknown>;
-/**
- * REST routes for the current tenant's comments, all requiring a logged-in
- * user. The author is taken from `ctx().user`; editing and deleting are
- * restricted to the comment's author.
- */
-declare function commentRoutes(): BasaltRoute[];
-
-export { type AddCommentInput, COMMENTS, type Comment, type CommentNode, CommentNotFoundError, type CommentPatch, type CommentStore, CommentTenantRequiredError, Comments, type CommentsOptions, type CommentsPluginOptions, MemoryCommentStore, type ResourceComments, commentRoutes, commentsPlugin };
+export { Comments, CommentNotFoundError, CommentTenantRequiredError, type CommentsOptions, type AddCommentInput, type ResourceComments, type CommentNode, } from './comments.js';
+export { MemoryCommentStore, type Comment, type CommentStore, type CommentPatch } from './store.js';
+export { commentsPlugin, commentRoutes, COMMENTS, type CommentsPluginOptions } from './plugin.js';

package/dist/index.js

@@ -1,251 +1,3 @@
-// src/comments.ts
-import { randomUUID } from "crypto";
-import { BasaltError, tryCtx } from "@basaltkit/core";
-
-// src/store.ts
-var MemoryCommentStore = class {
-  records = /* @__PURE__ */ new Map();
-  key(tenantId, id) {
-    return `${tenantId} ${id}`;
-  }
-  async create(comment) {
-    this.records.set(this.key(comment.tenantId, comment.id), comment);
-  }
-  async find(tenantId, id) {
-    return this.records.get(this.key(tenantId, id)) ?? null;
-  }
-  async list(tenantId, resourceType, resourceId) {
-    const out = [];
-    for (const c of this.records.values()) {
-      if (c.tenantId === tenantId && c.resourceType === resourceType && c.resourceId === resourceId) out.push(c);
-    }
-    return out.sort((a, b) => a.createdAt - b.createdAt);
-  }
-  async update(tenantId, id, patch) {
-    const record = this.records.get(this.key(tenantId, id));
-    if (!record) return null;
-    Object.assign(record, patch);
-    return record;
-  }
-  async delete(tenantId, id) {
-    this.records.delete(this.key(tenantId, id));
-  }
-};
-
-// src/comments.ts
-var CommentNotFoundError = class extends BasaltError {
-  status = 404;
-  constructor() {
-    super("COMMENT_NOT_FOUND", "Comment not found.");
-  }
-};
-var CommentTenantRequiredError = class extends BasaltError {
-  status = 400;
-  constructor() {
-    super("COMMENT_TENANT_REQUIRED", "A tenant is required \u2014 pass tenantId or run inside a tenant context.");
-  }
-};
-var buildTree = (comments2) => {
-  const nodes = new Map(comments2.map((c) => [c.id, { ...c, replies: [] }]));
-  const roots = [];
-  for (const node of nodes.values()) {
-    const parent = node.parentId ? nodes.get(node.parentId) : void 0;
-    if (parent) parent.replies.push(node);
-    else roots.push(node);
-  }
-  return roots;
-};
-var Comments = class {
-  store;
-  hooks;
-  mentionPattern;
-  now;
-  constructor(options = {}) {
-    this.store = options.store ?? new MemoryCommentStore();
-    this.hooks = options.hooks;
-    this.mentionPattern = options.mentionPattern ?? /@([\w-]+)/g;
-    this.now = options.now ?? Date.now;
-  }
-  on(resourceType, resourceId, tenantId) {
-    const tenant = this.tenant(tenantId);
-    return {
-      add: (input) => this.add(tenant, resourceType, resourceId, input),
-      list: () => this.store.list(tenant, resourceType, resourceId),
-      tree: async () => buildTree(await this.store.list(tenant, resourceType, resourceId))
-    };
-  }
-  get(id, tenantId) {
-    return this.store.find(this.tenant(tenantId), id);
-  }
-  async edit(id, body, tenantId) {
-    const tenant = this.tenant(tenantId);
-    if (!await this.store.find(tenant, id)) throw new CommentNotFoundError();
-    const updated = await this.store.update(tenant, id, { body, mentions: this.mentions(body), editedAt: this.now() });
-    await this.hooks?.emit("comment:updated", { comment: updated });
-    return updated;
-  }
-  async remove(id, tenantId) {
-    const tenant = this.tenant(tenantId);
-    const comment = await this.store.find(tenant, id);
-    if (!comment) return;
-    await this.store.delete(tenant, id);
-    await this.hooks?.emit("comment:deleted", {
-      tenantId: tenant,
-      id,
-      resourceType: comment.resourceType,
-      resourceId: comment.resourceId
-    });
-  }
-  async resolve(id, resolvedBy, tenantId) {
-    const comment = await this.mutate(id, { resolvedAt: this.now(), resolvedBy }, tenantId);
-    await this.hooks?.emit("comment:resolved", { comment });
-    return comment;
-  }
-  async reopen(id, tenantId) {
-    const comment = await this.mutate(id, { resolvedAt: void 0, resolvedBy: void 0 }, tenantId);
-    await this.hooks?.emit("comment:reopened", { comment });
-    return comment;
-  }
-  async add(tenantId, resourceType, resourceId, input) {
-    const mentions = this.mentions(input.body);
-    const comment = {
-      id: randomUUID(),
-      tenantId,
-      resourceType,
-      resourceId,
-      authorId: input.authorId,
-      body: input.body,
-      mentions,
-      createdAt: this.now(),
-      ...input.parentId !== void 0 ? { parentId: input.parentId } : {}
-    };
-    await this.store.create(comment);
-    await this.hooks?.emit("comment:created", { comment });
-    for (const userId of mentions) await this.hooks?.emit("comment:mentioned", { comment, userId });
-    return comment;
-  }
-  async mutate(id, patch, tenantId) {
-    const tenant = this.tenant(tenantId);
-    if (!await this.store.find(tenant, id)) throw new CommentNotFoundError();
-    return await this.store.update(tenant, id, patch);
-  }
-  mentions(body) {
-    const ids = /* @__PURE__ */ new Set();
-    for (const match of body.matchAll(this.mentionPattern)) if (match[1]) ids.add(match[1]);
-    return [...ids];
-  }
-  tenant(explicit) {
-    const id = explicit ?? tryCtx()?.["tenant"]?.id;
-    if (!id) throw new CommentTenantRequiredError();
-    return id;
-  }
-};
-
-// src/plugin.ts
-import { createToken, ctx, definePlugin, BasaltError as BasaltError2 } from "@basaltkit/core";
-import { route } from "@basaltkit/fastify";
-import { z } from "zod";
-var COMMENTS = createToken("comments");
-function commentsPlugin(options = {}) {
-  return definePlugin({
-    name: "basalt:comments",
-    register({ container, hooks }) {
-      container.singleton(COMMENTS, () => new Comments({ ...options, hooks }));
-    }
-  });
-}
-var CommentForbiddenError = class extends BasaltError2 {
-  status = 403;
-  constructor() {
-    super("COMMENT_FORBIDDEN", "You can only modify your own comments.");
-  }
-};
-var UserRequiredError = class extends BasaltError2 {
-  status = 401;
-  constructor() {
-    super("AUTH_REQUIRED", "Authentication required.");
-  }
-};
-var comments = () => ctx().container.get(COMMENTS);
-var currentUser = () => {
-  const id = ctx().user?.id;
-  if (!id) throw new UserRequiredError();
-  return id;
-};
-var assertAuthor = async (id) => {
-  const comment = await comments().get(id);
-  if (!comment || comment.authorId !== currentUser()) throw new CommentForbiddenError();
-};
-function commentRoutes() {
-  const resource = z.object({ resourceType: z.string().min(1), resourceId: z.string().min(1) });
-  return [
-    route({
-      method: "GET",
-      url: "/comments",
-      meta: { auth: true },
-      query: resource,
-      async handler({ query }) {
-        return comments().on(query.resourceType, query.resourceId).tree();
-      }
-    }),
-    route({
-      method: "POST",
-      url: "/comments",
-      meta: { auth: true },
-      body: resource.extend({ body: z.string().min(1), parentId: z.string().optional() }),
-      async handler({ body, reply }) {
-        const created = await comments().on(body.resourceType, body.resourceId).add({ authorId: currentUser(), body: body.body, ...body.parentId ? { parentId: body.parentId } : {} });
-        return reply.code(201).send(created);
-      }
-    }),
-    route({
-      method: "PATCH",
-      url: "/comments/:id",
-      meta: { auth: true },
-      params: z.object({ id: z.string() }),
-      body: z.object({ body: z.string().min(1) }),
-      async handler({ params, body }) {
-        await assertAuthor(params.id);
-        return comments().edit(params.id, body.body);
-      }
-    }),
-    route({
-      method: "DELETE",
-      url: "/comments/:id",
-      meta: { auth: true },
-      params: z.object({ id: z.string() }),
-      async handler({ params, reply }) {
-        await assertAuthor(params.id);
-        await comments().remove(params.id);
-        return reply.code(204).send();
-      }
-    }),
-    route({
-      method: "POST",
-      url: "/comments/:id/resolve",
-      meta: { auth: true },
-      params: z.object({ id: z.string() }),
-      async handler({ params }) {
-        return comments().resolve(params.id, currentUser());
-      }
-    }),
-    route({
-      method: "POST",
-      url: "/comments/:id/reopen",
-      meta: { auth: true },
-      params: z.object({ id: z.string() }),
-      async handler({ params }) {
-        return comments().reopen(params.id);
-      }
-    })
-  ];
-}
-export {
-  COMMENTS,
-  CommentNotFoundError,
-  CommentTenantRequiredError,
-  Comments,
-  MemoryCommentStore,
-  commentRoutes,
-  commentsPlugin
-};
+export { Comments, CommentNotFoundError, CommentTenantRequiredError, } from './comments.js';
+export { MemoryCommentStore } from './store.js';
+export { commentsPlugin, commentRoutes, COMMENTS } from './plugin.js';

package/dist/plugin.d.ts

@@ -0,0 +1,39 @@
+import { type BasaltRoute } from '@basaltkit/http';
+import { Comments, type CommentsOptions } from './comments.js';
+import type { Comment } from './store.js';
+declare module '@basaltkit/core' {
+    interface BasaltHooks {
+        'comment:created': {
+            comment: Comment;
+        };
+        'comment:updated': {
+            comment: Comment;
+        };
+        'comment:deleted': {
+            tenantId: string;
+            id: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        'comment:resolved': {
+            comment: Comment;
+        };
+        'comment:reopened': {
+            comment: Comment;
+        };
+        /** One per mentioned user — wire to notifications. */
+        'comment:mentioned': {
+            comment: Comment;
+            userId: string;
+        };
+    }
+}
+export declare const COMMENTS: import("@basaltkit/core").Token<Comments>;
+export type CommentsPluginOptions = Omit<CommentsOptions, 'hooks'>;
+export declare function commentsPlugin(options?: CommentsPluginOptions): import("@basaltkit/core").BasaltPlugin<unknown>;
+/**
+ * REST routes for the current tenant's comments, all requiring a logged-in
+ * user. The author is taken from `ctx().user`; editing and deleting are
+ * restricted to the comment's author.
+ */
+export declare function commentRoutes(): BasaltRoute[];

package/dist/plugin.js

@@ -0,0 +1,109 @@
+import { createToken, ctx, definePlugin, BasaltError } from '@basaltkit/core';
+import { route } from '@basaltkit/http';
+import { z } from 'zod';
+import { Comments } from './comments.js';
+export const COMMENTS = createToken('comments');
+export function commentsPlugin(options = {}) {
+    return definePlugin({
+        name: 'basalt:comments',
+        register({ container, hooks }) {
+            container.singleton(COMMENTS, () => new Comments({ ...options, hooks }));
+        },
+    });
+}
+class CommentForbiddenError extends BasaltError {
+    status = 403;
+    constructor() {
+        super('COMMENT_FORBIDDEN', 'You can only modify your own comments.');
+    }
+}
+class UserRequiredError extends BasaltError {
+    status = 401;
+    constructor() {
+        super('AUTH_REQUIRED', 'Authentication required.');
+    }
+}
+const comments = () => ctx().container.get(COMMENTS);
+const currentUser = () => {
+    // `user` is set by @basaltkit/auth; read it without a hard dependency on it.
+    const id = ctx().user?.id;
+    if (!id)
+        throw new UserRequiredError();
+    return id;
+};
+const assertAuthor = async (id) => {
+    const comment = await comments().get(id);
+    if (!comment || comment.authorId !== currentUser())
+        throw new CommentForbiddenError();
+};
+/**
+ * REST routes for the current tenant's comments, all requiring a logged-in
+ * user. The author is taken from `ctx().user`; editing and deleting are
+ * restricted to the comment's author.
+ */
+export function commentRoutes() {
+    const resource = z.object({ resourceType: z.string().min(1), resourceId: z.string().min(1) });
+    return [
+        route({
+            method: 'GET',
+            url: '/comments',
+            meta: { auth: true },
+            query: resource,
+            async handler({ query }) {
+                return comments().on(query.resourceType, query.resourceId).tree();
+            },
+        }),
+        route({
+            method: 'POST',
+            url: '/comments',
+            meta: { auth: true },
+            body: resource.extend({ body: z.string().min(1), parentId: z.string().optional() }),
+            async handler({ body, reply }) {
+                const created = await comments()
+                    .on(body.resourceType, body.resourceId)
+                    .add({ authorId: currentUser(), body: body.body, ...(body.parentId ? { parentId: body.parentId } : {}) });
+                return reply.code(201).send(created);
+            },
+        }),
+        route({
+            method: 'PATCH',
+            url: '/comments/:id',
+            meta: { auth: true },
+            params: z.object({ id: z.string() }),
+            body: z.object({ body: z.string().min(1) }),
+            async handler({ params, body }) {
+                await assertAuthor(params.id);
+                return comments().edit(params.id, body.body);
+            },
+        }),
+        route({
+            method: 'DELETE',
+            url: '/comments/:id',
+            meta: { auth: true },
+            params: z.object({ id: z.string() }),
+            async handler({ params, reply }) {
+                await assertAuthor(params.id);
+                await comments().remove(params.id);
+                return reply.code(204).send();
+            },
+        }),
+        route({
+            method: 'POST',
+            url: '/comments/:id/resolve',
+            meta: { auth: true },
+            params: z.object({ id: z.string() }),
+            async handler({ params }) {
+                return comments().resolve(params.id, currentUser());
+            },
+        }),
+        route({
+            method: 'POST',
+            url: '/comments/:id/reopen',
+            meta: { auth: true },
+            params: z.object({ id: z.string() }),
+            async handler({ params }) {
+                return comments().reopen(params.id);
+            },
+        }),
+    ];
+}

package/dist/store.d.ts

@@ -0,0 +1,42 @@
+/** A comment attached to a resource (`resourceType`:`resourceId`) within a tenant. */
+export interface Comment {
+    id: string;
+    tenantId: string;
+    resourceType: string;
+    resourceId: string;
+    /** Set when this comment is a reply to another. */
+    parentId?: string;
+    authorId: string;
+    body: string;
+    /** User ids extracted from @mentions in the body. */
+    mentions: string[];
+    resolvedAt?: number;
+    resolvedBy?: string;
+    editedAt?: number;
+    createdAt: number;
+}
+export interface CommentPatch {
+    body?: string;
+    mentions?: string[];
+    editedAt?: number;
+    /** `undefined` clears it (reopen). */
+    resolvedAt?: number | undefined;
+    resolvedBy?: string | undefined;
+}
+export interface CommentStore {
+    create(comment: Comment): Promise<void>;
+    find(tenantId: string, id: string): Promise<Comment | null>;
+    /** Every comment on a resource (the whole thread), oldest first. */
+    list(tenantId: string, resourceType: string, resourceId: string): Promise<Comment[]>;
+    update(tenantId: string, id: string, patch: CommentPatch): Promise<Comment | null>;
+    delete(tenantId: string, id: string): Promise<void>;
+}
+export declare class MemoryCommentStore implements CommentStore {
+    private readonly records;
+    private key;
+    create(comment: Comment): Promise<void>;
+    find(tenantId: string, id: string): Promise<Comment | null>;
+    list(tenantId: string, resourceType: string, resourceId: string): Promise<Comment[]>;
+    update(tenantId: string, id: string, patch: CommentPatch): Promise<Comment | null>;
+    delete(tenantId: string, id: string): Promise<void>;
+}

package/dist/store.js

@@ -0,0 +1,30 @@
+export class MemoryCommentStore {
+    records = new Map();
+    key(tenantId, id) {
+        return `${tenantId} ${id}`;
+    }
+    async create(comment) {
+        this.records.set(this.key(comment.tenantId, comment.id), comment);
+    }
+    async find(tenantId, id) {
+        return this.records.get(this.key(tenantId, id)) ?? null;
+    }
+    async list(tenantId, resourceType, resourceId) {
+        const out = [];
+        for (const c of this.records.values()) {
+            if (c.tenantId === tenantId && c.resourceType === resourceType && c.resourceId === resourceId)
+                out.push(c);
+        }
+        return out.sort((a, b) => a.createdAt - b.createdAt);
+    }
+    async update(tenantId, id, patch) {
+        const record = this.records.get(this.key(tenantId, id));
+        if (!record)
+            return null;
+        Object.assign(record, patch);
+        return record;
+    }
+    async delete(tenantId, id) {
+        this.records.delete(this.key(tenantId, id));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/comments",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Comments for Basalt: per-resource threads with @mentions and resolve/reopen, tenant-scoped, emitting events that bridge to realtime and notifications.",
   "license": "MIT",
   "type": "module",
@@ -14,20 +14,20 @@
     "dist"
   ],
   "dependencies": {
-    "@basaltkit/core": "^1.0.0",
-    "@basaltkit/fastify": "^1.0.0"
+    "@basaltkit/core": "^1.1.2",
+    "@basaltkit/http": "^1.9.1"
   },
   "peerDependencies": {
     "zod": "^3.24.0 || ^4.0.0"
   },
   "devDependencies": {
-    "@types/node": "^22.15.0",
-    "tsup": "^8.4.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.1.0",
-    "zod": "^3.24.0",
-    "@basaltkit/auth": "^1.0.0",
-    "@basaltkit/tenancy": "^1.0.0",
+    "@types/node": "^26.3.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11",
+    "zod": "^3.24.0 || ^4.0.0",
+    "@basaltkit/auth": "^1.6.3",
+    "@basaltkit/tenancy": "^1.3.3",
+    "@basaltkit/fastify": "^1.6.1",
     "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {
@@ -35,11 +35,11 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Zebedeu/basalt.git",
+    "url": "git+https://github.com/basaltkit/basalt.git",
     "directory": "packages/comments"
   },
-  "homepage": "https://github.com/Zebedeu/basalt/tree/main/packages/comments#readme",
-  "bugs": "https://github.com/Zebedeu/basalt/issues",
+  "homepage": "https://github.com/basaltkit/basalt/tree/main/packages/comments#readme",
+  "bugs": "https://github.com/basaltkit/basalt/issues",
   "keywords": [
     "basalt",
     "typescript",
@@ -49,7 +49,7 @@
     "mentions"
   ],
   "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean",
+    "build": "tsc -p tsconfig.build.json",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   }