@btst/stack 3.0.0-rc.1 → 3.0.0-rc.3

package/dist/plugins/comments/api/index.cjs

@@ -5,6 +5,9 @@ const getters = require('../../../packages/stack/src/plugins/comments/api/getter
 const mutations = require('../../../packages/stack/src/plugins/comments/api/mutations.cjs');
 const serializers = require('../../../packages/stack/src/plugins/comments/api/serializers.cjs');
 const queryKeyDefs = require('../../../packages/stack/src/plugins/comments/api/query-key-defs.cjs');
+const plugins_comments_permissions = require('../permissions.cjs');
+const lifecycleMigrations = require('../../../packages/stack/src/plugins/comments/api/lifecycle-migrations.cjs');
+const operations = require('../../../packages/stack/src/plugins/comments/api/operations.cjs');
 
 
 
@@ -19,3 +22,10 @@ exports.updateComment = mutations.updateComment;
 exports.updateCommentStatus = mutations.updateCommentStatus;
 exports.serializeComment = serializers.serializeComment;
 exports.COMMENTS_QUERY_KEYS = queryKeyDefs.COMMENTS_QUERY_KEYS;
+exports.commentsPermissions = plugins_comments_permissions.commentsPermissions;
+exports.COMMENTS_LIFECYCLE_HOOK_MIGRATIONS = lifecycleMigrations.COMMENTS_LIFECYCLE_HOOK_MIGRATIONS;
+exports.CreateCommentOperationInputSchema = operations.CreateCommentOperationInputSchema;
+exports.DeleteCommentOperationInputSchema = operations.DeleteCommentOperationInputSchema;
+exports.ToggleCommentLikeOperationInputSchema = operations.ToggleCommentLikeOperationInputSchema;
+exports.UpdateCommentOperationInputSchema = operations.UpdateCommentOperationInputSchema;
+exports.UpdateCommentStatusOperationInputSchema = operations.UpdateCommentStatusOperationInputSchema;

package/dist/plugins/comments/api/index.d.cts

@@ -1,10 +1,35 @@
-import { d as CommentListParamsSchema, e as CommentCountQuerySchema } from '../../../shared/stack.DKZMaVr6.cjs';
-export { i as COMMENTS_QUERY_KEYS, g as CommentsApiContext, c as CommentsApiRouter, h as CommentsBackendOptions, f as commentsBackendPlugin } from '../../../shared/stack.DKZMaVr6.cjs';
+import { d as CommentListParamsSchema, e as CommentCountQuerySchema } from '../../../shared/stack.BFP_9pRX.cjs';
+export { f as COMMENTS_QUERY_KEYS, c as CommentsApiRouter, j as CommentsBackendHooks, k as CommentsBackendOptions, l as CommentsCountOperationContext, m as CommentsCreateOperationContext, n as CommentsCreateResultContext, o as CommentsDeleteOperationContext, p as CommentsDeleteResultContext, q as CommentsEditOperationContext, r as CommentsEditResultContext, s as CommentsListOperationContext, t as CommentsModerateOperationContext, u as CommentsModerateResultContext, v as CommentsReactOperationContext, h as CreateCommentOperationInputSchema, D as DeleteCommentOperationInputSchema, S as SerializedCommentListResult, T as ToggleCommentLikeOperationInputSchema, U as UpdateCommentOperationInputSchema, i as UpdateCommentStatusOperationInputSchema, g as commentsBackendPlugin } from '../../../shared/stack.BFP_9pRX.cjs';
 import { DBAdapter } from '@btst/db';
-import { C as CommentListResult, S as SerializedComment, a as Comment } from '../../../shared/stack.C3GBG8in.cjs';
+import { C as CommentListResult, S as SerializedComment, a as Comment } from '../../../shared/stack.COrJrztD.cjs';
 import { z } from 'zod';
+export { commentsPermissions } from '../permissions.cjs';
 import '@btst/stack/plugins/api';
+import '../../../authorization/index.cjs';
+import 'zod/v4/core';
 import 'better-call';
+import '@btst/stack/authorization';
+
+/**
+ * Removed Comments lifecycle names and their canonical v3 replacements.
+ *
+ * Approval remains a meaningful moderation event rather than being flattened
+ * into a generic update callback.
+ */
+declare const COMMENTS_LIFECYCLE_HOOK_MIGRATIONS: Readonly<{
+    readonly onBeforeList: "onBeforeListComments";
+    readonly onBeforeCount: "onBeforeCountComments";
+    readonly onBeforeListByAuthor: "onBeforeListCommentsByAuthor";
+    readonly onBeforePost: "onBeforeCreateComment";
+    readonly onAfterPost: "onAfterCreateComment";
+    readonly onBeforeEdit: "onBeforeUpdateComment";
+    readonly onAfterEdit: "onAfterUpdateComment";
+    readonly onBeforeLike: "onBeforeToggleCommentReaction";
+    readonly onBeforeStatusChange: "onBeforeModerateComment";
+    readonly onAfterApprove: "onAfterApproveComment";
+    readonly onBeforeDelete: "onBeforeDeleteComment";
+    readonly onAfterDelete: "onAfterDeleteComment";
+}>;
 
 /**
  * List comments for a resource, optionally filtered by status and parentId.
@@ -55,25 +80,29 @@ interface CreateCommentInput {
 /**
  * Create a new comment.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for any access-control checks (e.g., onBeforePost) before
- * invoking this function.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for authorization and lifecycle composition before invoking
+ * this lower-level data function.
  */
 declare function createComment(adapter: DBAdapter, input: CreateCommentInput): Promise<Comment>;
 /**
  * Update the body of an existing comment and set editedAt.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for ensuring the requesting user owns the comment (onBeforeEdit).
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for authorization and lifecycle composition. Pass the complete
+ * authorized `expected` snapshot to make the edit conditional and construct
+ * the result without a racy post-write read.
  */
-declare function updateComment(adapter: DBAdapter, id: string, body: string): Promise<Comment | null>;
+declare function updateComment(adapter: DBAdapter, id: string, body: string, expected?: Comment): Promise<Comment | null>;
 /**
  * Update the status of a comment (approve, reject, spam).
  *
- * @remarks **Security:** No authorization hooks are called. Callers should
- * ensure the requesting user has moderation privileges.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. Callers should
+ * authorize moderation before calling this lower-level data function. Pass the
+ * complete authorized `expected` snapshot to make the transition conditional,
+ * fail closed on concurrent changes, and avoid a racy post-write read.
  */
-declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pending" | "approved" | "spam"): Promise<Comment | null>;
+declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pending" | "approved" | "spam", expected?: Comment): Promise<Comment | null>;
 /**
  * Delete a comment by ID, cascading to any child replies.
  *
@@ -85,10 +114,11 @@ declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pe
  * Comments are only one level deep (the UI prevents replying to replies), so a
  * single-level cascade is sufficient — no recursive walk is needed.
  *
- * @remarks **Security:** No authorization hooks are called. Callers should
- * ensure the requesting user has permission to delete this comment.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. Callers should
+ * ensure the requesting user has permission to delete this comment. Pass the
+ * authorized `expected` ownership to make deletion conditional.
  */
-declare function deleteComment(adapter: DBAdapter, id: string): Promise<boolean>;
+declare function deleteComment(adapter: DBAdapter, id: string, expected?: Pick<Comment, "authorId">): Promise<boolean>;
 /**
  * Toggle a like on a comment for a given authorId.
  * - If the user has not liked the comment: creates a commentLike row and increments the likes counter.
@@ -98,13 +128,19 @@ declare function deleteComment(adapter: DBAdapter, id: string): Promise<boolean>
  * All reads and writes are performed inside a single transaction to prevent
  * concurrent requests from causing counter drift or duplicate like rows.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for ensuring the requesting user is authenticated (authorId is valid).
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for ensuring the requesting user is authenticated (authorId is
+ * valid). Pass the authorized `expected` status to fail closed if visibility
+ * changes before the reaction is committed.
  */
 declare function toggleCommentLike(adapter: DBAdapter, commentId: string, authorId: string): Promise<{
     likes: number;
     isLiked: boolean;
 }>;
+declare function toggleCommentLike(adapter: DBAdapter, commentId: string, authorId: string, expected: Pick<Comment, "status">): Promise<{
+    likes: number;
+    isLiked: boolean;
+} | null>;
 
 /**
  * Serialize a raw Comment DB record into a SerializedComment for SSG/setQueryData.
@@ -121,5 +157,5 @@ declare function serializeComment(comment: Comment): Omit<SerializedComment, "re
     isLikedByCurrentUser: false;
 };
 
-export { createComment, deleteComment, getCommentById, getCommentCount, listComments, serializeComment, toggleCommentLike, updateComment, updateCommentStatus };
+export { COMMENTS_LIFECYCLE_HOOK_MIGRATIONS, createComment, deleteComment, getCommentById, getCommentCount, listComments, serializeComment, toggleCommentLike, updateComment, updateCommentStatus };
 export type { CreateCommentInput };

package/dist/plugins/comments/api/index.d.mts

@@ -1,10 +1,35 @@
-import { d as CommentListParamsSchema, e as CommentCountQuerySchema } from '../../../shared/stack.oBokjN_J.mjs';
-export { i as COMMENTS_QUERY_KEYS, g as CommentsApiContext, c as CommentsApiRouter, h as CommentsBackendOptions, f as commentsBackendPlugin } from '../../../shared/stack.oBokjN_J.mjs';
+import { d as CommentListParamsSchema, e as CommentCountQuerySchema } from '../../../shared/stack.BMHoxAn7.mjs';
+export { f as COMMENTS_QUERY_KEYS, c as CommentsApiRouter, j as CommentsBackendHooks, k as CommentsBackendOptions, l as CommentsCountOperationContext, m as CommentsCreateOperationContext, n as CommentsCreateResultContext, o as CommentsDeleteOperationContext, p as CommentsDeleteResultContext, q as CommentsEditOperationContext, r as CommentsEditResultContext, s as CommentsListOperationContext, t as CommentsModerateOperationContext, u as CommentsModerateResultContext, v as CommentsReactOperationContext, h as CreateCommentOperationInputSchema, D as DeleteCommentOperationInputSchema, S as SerializedCommentListResult, T as ToggleCommentLikeOperationInputSchema, U as UpdateCommentOperationInputSchema, i as UpdateCommentStatusOperationInputSchema, g as commentsBackendPlugin } from '../../../shared/stack.BMHoxAn7.mjs';
 import { DBAdapter } from '@btst/db';
-import { C as CommentListResult, S as SerializedComment, a as Comment } from '../../../shared/stack.C3GBG8in.mjs';
+import { C as CommentListResult, S as SerializedComment, a as Comment } from '../../../shared/stack.COrJrztD.mjs';
 import { z } from 'zod';
+export { commentsPermissions } from '../permissions.mjs';
 import '@btst/stack/plugins/api';
+import '../../../authorization/index.mjs';
+import 'zod/v4/core';
 import 'better-call';
+import '@btst/stack/authorization';
+
+/**
+ * Removed Comments lifecycle names and their canonical v3 replacements.
+ *
+ * Approval remains a meaningful moderation event rather than being flattened
+ * into a generic update callback.
+ */
+declare const COMMENTS_LIFECYCLE_HOOK_MIGRATIONS: Readonly<{
+    readonly onBeforeList: "onBeforeListComments";
+    readonly onBeforeCount: "onBeforeCountComments";
+    readonly onBeforeListByAuthor: "onBeforeListCommentsByAuthor";
+    readonly onBeforePost: "onBeforeCreateComment";
+    readonly onAfterPost: "onAfterCreateComment";
+    readonly onBeforeEdit: "onBeforeUpdateComment";
+    readonly onAfterEdit: "onAfterUpdateComment";
+    readonly onBeforeLike: "onBeforeToggleCommentReaction";
+    readonly onBeforeStatusChange: "onBeforeModerateComment";
+    readonly onAfterApprove: "onAfterApproveComment";
+    readonly onBeforeDelete: "onBeforeDeleteComment";
+    readonly onAfterDelete: "onAfterDeleteComment";
+}>;
 
 /**
  * List comments for a resource, optionally filtered by status and parentId.
@@ -55,25 +80,29 @@ interface CreateCommentInput {
 /**
  * Create a new comment.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for any access-control checks (e.g., onBeforePost) before
- * invoking this function.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for authorization and lifecycle composition before invoking
+ * this lower-level data function.
  */
 declare function createComment(adapter: DBAdapter, input: CreateCommentInput): Promise<Comment>;
 /**
  * Update the body of an existing comment and set editedAt.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for ensuring the requesting user owns the comment (onBeforeEdit).
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for authorization and lifecycle composition. Pass the complete
+ * authorized `expected` snapshot to make the edit conditional and construct
+ * the result without a racy post-write read.
  */
-declare function updateComment(adapter: DBAdapter, id: string, body: string): Promise<Comment | null>;
+declare function updateComment(adapter: DBAdapter, id: string, body: string, expected?: Comment): Promise<Comment | null>;
 /**
  * Update the status of a comment (approve, reject, spam).
  *
- * @remarks **Security:** No authorization hooks are called. Callers should
- * ensure the requesting user has moderation privileges.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. Callers should
+ * authorize moderation before calling this lower-level data function. Pass the
+ * complete authorized `expected` snapshot to make the transition conditional,
+ * fail closed on concurrent changes, and avoid a racy post-write read.
  */
-declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pending" | "approved" | "spam"): Promise<Comment | null>;
+declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pending" | "approved" | "spam", expected?: Comment): Promise<Comment | null>;
 /**
  * Delete a comment by ID, cascading to any child replies.
  *
@@ -85,10 +114,11 @@ declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pe
  * Comments are only one level deep (the UI prevents replying to replies), so a
  * single-level cascade is sufficient — no recursive walk is needed.
  *
- * @remarks **Security:** No authorization hooks are called. Callers should
- * ensure the requesting user has permission to delete this comment.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. Callers should
+ * ensure the requesting user has permission to delete this comment. Pass the
+ * authorized `expected` ownership to make deletion conditional.
  */
-declare function deleteComment(adapter: DBAdapter, id: string): Promise<boolean>;
+declare function deleteComment(adapter: DBAdapter, id: string, expected?: Pick<Comment, "authorId">): Promise<boolean>;
 /**
  * Toggle a like on a comment for a given authorId.
  * - If the user has not liked the comment: creates a commentLike row and increments the likes counter.
@@ -98,13 +128,19 @@ declare function deleteComment(adapter: DBAdapter, id: string): Promise<boolean>
  * All reads and writes are performed inside a single transaction to prevent
  * concurrent requests from causing counter drift or duplicate like rows.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for ensuring the requesting user is authenticated (authorId is valid).
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for ensuring the requesting user is authenticated (authorId is
+ * valid). Pass the authorized `expected` status to fail closed if visibility
+ * changes before the reaction is committed.
  */
 declare function toggleCommentLike(adapter: DBAdapter, commentId: string, authorId: string): Promise<{
     likes: number;
     isLiked: boolean;
 }>;
+declare function toggleCommentLike(adapter: DBAdapter, commentId: string, authorId: string, expected: Pick<Comment, "status">): Promise<{
+    likes: number;
+    isLiked: boolean;
+} | null>;
 
 /**
  * Serialize a raw Comment DB record into a SerializedComment for SSG/setQueryData.
@@ -121,5 +157,5 @@ declare function serializeComment(comment: Comment): Omit<SerializedComment, "re
     isLikedByCurrentUser: false;
 };
 
-export { createComment, deleteComment, getCommentById, getCommentCount, listComments, serializeComment, toggleCommentLike, updateComment, updateCommentStatus };
+export { COMMENTS_LIFECYCLE_HOOK_MIGRATIONS, createComment, deleteComment, getCommentById, getCommentCount, listComments, serializeComment, toggleCommentLike, updateComment, updateCommentStatus };
 export type { CreateCommentInput };

package/dist/plugins/comments/api/index.d.ts

@@ -1,10 +1,35 @@
-import { d as CommentListParamsSchema, e as CommentCountQuerySchema } from '../../../shared/stack.C1ATQ3pd.js';
-export { i as COMMENTS_QUERY_KEYS, g as CommentsApiContext, c as CommentsApiRouter, h as CommentsBackendOptions, f as commentsBackendPlugin } from '../../../shared/stack.C1ATQ3pd.js';
+import { d as CommentListParamsSchema, e as CommentCountQuerySchema } from '../../../shared/stack.Bt8hfw9o.js';
+export { f as COMMENTS_QUERY_KEYS, c as CommentsApiRouter, j as CommentsBackendHooks, k as CommentsBackendOptions, l as CommentsCountOperationContext, m as CommentsCreateOperationContext, n as CommentsCreateResultContext, o as CommentsDeleteOperationContext, p as CommentsDeleteResultContext, q as CommentsEditOperationContext, r as CommentsEditResultContext, s as CommentsListOperationContext, t as CommentsModerateOperationContext, u as CommentsModerateResultContext, v as CommentsReactOperationContext, h as CreateCommentOperationInputSchema, D as DeleteCommentOperationInputSchema, S as SerializedCommentListResult, T as ToggleCommentLikeOperationInputSchema, U as UpdateCommentOperationInputSchema, i as UpdateCommentStatusOperationInputSchema, g as commentsBackendPlugin } from '../../../shared/stack.Bt8hfw9o.js';
 import { DBAdapter } from '@btst/db';
-import { C as CommentListResult, S as SerializedComment, a as Comment } from '../../../shared/stack.C3GBG8in.js';
+import { C as CommentListResult, S as SerializedComment, a as Comment } from '../../../shared/stack.COrJrztD.js';
 import { z } from 'zod';
+export { commentsPermissions } from '../permissions.js';
 import '@btst/stack/plugins/api';
+import '../../../authorization/index.js';
+import 'zod/v4/core';
 import 'better-call';
+import '@btst/stack/authorization';
+
+/**
+ * Removed Comments lifecycle names and their canonical v3 replacements.
+ *
+ * Approval remains a meaningful moderation event rather than being flattened
+ * into a generic update callback.
+ */
+declare const COMMENTS_LIFECYCLE_HOOK_MIGRATIONS: Readonly<{
+    readonly onBeforeList: "onBeforeListComments";
+    readonly onBeforeCount: "onBeforeCountComments";
+    readonly onBeforeListByAuthor: "onBeforeListCommentsByAuthor";
+    readonly onBeforePost: "onBeforeCreateComment";
+    readonly onAfterPost: "onAfterCreateComment";
+    readonly onBeforeEdit: "onBeforeUpdateComment";
+    readonly onAfterEdit: "onAfterUpdateComment";
+    readonly onBeforeLike: "onBeforeToggleCommentReaction";
+    readonly onBeforeStatusChange: "onBeforeModerateComment";
+    readonly onAfterApprove: "onAfterApproveComment";
+    readonly onBeforeDelete: "onBeforeDeleteComment";
+    readonly onAfterDelete: "onAfterDeleteComment";
+}>;
 
 /**
  * List comments for a resource, optionally filtered by status and parentId.
@@ -55,25 +80,29 @@ interface CreateCommentInput {
 /**
  * Create a new comment.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for any access-control checks (e.g., onBeforePost) before
- * invoking this function.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for authorization and lifecycle composition before invoking
+ * this lower-level data function.
  */
 declare function createComment(adapter: DBAdapter, input: CreateCommentInput): Promise<Comment>;
 /**
  * Update the body of an existing comment and set editedAt.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for ensuring the requesting user owns the comment (onBeforeEdit).
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for authorization and lifecycle composition. Pass the complete
+ * authorized `expected` snapshot to make the edit conditional and construct
+ * the result without a racy post-write read.
  */
-declare function updateComment(adapter: DBAdapter, id: string, body: string): Promise<Comment | null>;
+declare function updateComment(adapter: DBAdapter, id: string, body: string, expected?: Comment): Promise<Comment | null>;
 /**
  * Update the status of a comment (approve, reject, spam).
  *
- * @remarks **Security:** No authorization hooks are called. Callers should
- * ensure the requesting user has moderation privileges.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. Callers should
+ * authorize moderation before calling this lower-level data function. Pass the
+ * complete authorized `expected` snapshot to make the transition conditional,
+ * fail closed on concurrent changes, and avoid a racy post-write read.
  */
-declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pending" | "approved" | "spam"): Promise<Comment | null>;
+declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pending" | "approved" | "spam", expected?: Comment): Promise<Comment | null>;
 /**
  * Delete a comment by ID, cascading to any child replies.
  *
@@ -85,10 +114,11 @@ declare function updateCommentStatus(adapter: DBAdapter, id: string, status: "pe
  * Comments are only one level deep (the UI prevents replying to replies), so a
  * single-level cascade is sufficient — no recursive walk is needed.
  *
- * @remarks **Security:** No authorization hooks are called. Callers should
- * ensure the requesting user has permission to delete this comment.
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. Callers should
+ * ensure the requesting user has permission to delete this comment. Pass the
+ * authorized `expected` ownership to make deletion conditional.
  */
-declare function deleteComment(adapter: DBAdapter, id: string): Promise<boolean>;
+declare function deleteComment(adapter: DBAdapter, id: string, expected?: Pick<Comment, "authorId">): Promise<boolean>;
 /**
  * Toggle a like on a comment for a given authorId.
  * - If the user has not liked the comment: creates a commentLike row and increments the likes counter.
@@ -98,13 +128,19 @@ declare function deleteComment(adapter: DBAdapter, id: string): Promise<boolean>
  * All reads and writes are performed inside a single transaction to prevent
  * concurrent requests from causing counter drift or duplicate like rows.
  *
- * @remarks **Security:** No authorization hooks are called. The caller is
- * responsible for ensuring the requesting user is authenticated (authorId is valid).
+ * @remarks **Security:** Operation authorization and lifecycle hooks are not called. The caller is
+ * responsible for ensuring the requesting user is authenticated (authorId is
+ * valid). Pass the authorized `expected` status to fail closed if visibility
+ * changes before the reaction is committed.
  */
 declare function toggleCommentLike(adapter: DBAdapter, commentId: string, authorId: string): Promise<{
     likes: number;
     isLiked: boolean;
 }>;
+declare function toggleCommentLike(adapter: DBAdapter, commentId: string, authorId: string, expected: Pick<Comment, "status">): Promise<{
+    likes: number;
+    isLiked: boolean;
+} | null>;
 
 /**
  * Serialize a raw Comment DB record into a SerializedComment for SSG/setQueryData.
@@ -121,5 +157,5 @@ declare function serializeComment(comment: Comment): Omit<SerializedComment, "re
     isLikedByCurrentUser: false;
 };
 
-export { createComment, deleteComment, getCommentById, getCommentCount, listComments, serializeComment, toggleCommentLike, updateComment, updateCommentStatus };
+export { COMMENTS_LIFECYCLE_HOOK_MIGRATIONS, createComment, deleteComment, getCommentById, getCommentCount, listComments, serializeComment, toggleCommentLike, updateComment, updateCommentStatus };
 export type { CreateCommentInput };

package/dist/plugins/comments/api/index.mjs

@@ -3,3 +3,6 @@ export { getCommentById, getCommentCount, listComments } from '../../../packages
 export { createComment, deleteComment, toggleCommentLike, updateComment, updateCommentStatus } from '../../../packages/stack/src/plugins/comments/api/mutations.mjs';
 export { serializeComment } from '../../../packages/stack/src/plugins/comments/api/serializers.mjs';
 export { COMMENTS_QUERY_KEYS } from '../../../packages/stack/src/plugins/comments/api/query-key-defs.mjs';
+export { commentsPermissions } from '../permissions.mjs';
+export { COMMENTS_LIFECYCLE_HOOK_MIGRATIONS } from '../../../packages/stack/src/plugins/comments/api/lifecycle-migrations.mjs';
+export { CreateCommentOperationInputSchema, DeleteCommentOperationInputSchema, ToggleCommentLikeOperationInputSchema, UpdateCommentOperationInputSchema, UpdateCommentStatusOperationInputSchema } from '../../../packages/stack/src/plugins/comments/api/operations.mjs';

package/dist/plugins/comments/client/components/index.d.cts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType } from 'react';
-import { C as CommentsLocalization } from '../../../../shared/stack.D7bewlgt.cjs';
-export { M as ModerationPageComponent } from '../../../../shared/stack.D7bewlgt.cjs';
+import { C as CommentsLocalization } from '../../../../shared/stack.Bu2IPOLi.cjs';
+export { M as ModerationPageComponent } from '../../../../shared/stack.Bu2IPOLi.cjs';
 
 /** Custom input component props */
 interface CommentInputProps {
@@ -30,6 +30,11 @@ interface CommentThreadProps {
     className?: string;
     /** Localization strings — defaults to English */
     localization?: Partial<CommentsLocalization>;
+    /**
+     * Sign-in URL for unauthenticated users in this thread.
+     * Overrides the `loginPath` from the nearest `StackProvider`.
+     */
+    loginHref?: string;
     /**
      * Number of top-level comments to load per page.
      * Clicking "Load more" fetches the next page. Default: 10.

package/dist/plugins/comments/client/components/index.d.mts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType } from 'react';
-import { C as CommentsLocalization } from '../../../../shared/stack.D7bewlgt.mjs';
-export { M as ModerationPageComponent } from '../../../../shared/stack.D7bewlgt.mjs';
+import { C as CommentsLocalization } from '../../../../shared/stack.Bu2IPOLi.mjs';
+export { M as ModerationPageComponent } from '../../../../shared/stack.Bu2IPOLi.mjs';
 
 /** Custom input component props */
 interface CommentInputProps {
@@ -30,6 +30,11 @@ interface CommentThreadProps {
     className?: string;
     /** Localization strings — defaults to English */
     localization?: Partial<CommentsLocalization>;
+    /**
+     * Sign-in URL for unauthenticated users in this thread.
+     * Overrides the `loginPath` from the nearest `StackProvider`.
+     */
+    loginHref?: string;
     /**
      * Number of top-level comments to load per page.
      * Clicking "Load more" fetches the next page. Default: 10.

package/dist/plugins/comments/client/components/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType } from 'react';
-import { C as CommentsLocalization } from '../../../../shared/stack.D7bewlgt.js';
-export { M as ModerationPageComponent } from '../../../../shared/stack.D7bewlgt.js';
+import { C as CommentsLocalization } from '../../../../shared/stack.Bu2IPOLi.js';
+export { M as ModerationPageComponent } from '../../../../shared/stack.Bu2IPOLi.js';
 
 /** Custom input component props */
 interface CommentInputProps {
@@ -30,6 +30,11 @@ interface CommentThreadProps {
     className?: string;
     /** Localization strings — defaults to English */
     localization?: Partial<CommentsLocalization>;
+    /**
+     * Sign-in URL for unauthenticated users in this thread.
+     * Overrides the `loginPath` from the nearest `StackProvider`.
+     */
+    loginHref?: string;
     /**
      * Number of top-level comments to load per page.
      * Clicking "Load more" fetches the next page. Default: 10.

package/dist/plugins/comments/client/hooks/index.d.cts

@@ -1,17 +1,12 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { InfiniteData } from '@tanstack/react-query';
-import { C as CommentListResult, S as SerializedComment } from '../../../../shared/stack.C3GBG8in.cjs';
+import { C as CommentListResult, S as SerializedComment } from '../../../../shared/stack.COrJrztD.cjs';
 
-interface CommentsClientConfig {
-    apiBaseURL: string;
-    apiBasePath: string;
-    headers?: HeadersInit;
-}
 /**
  * Fetch a paginated list of comments for a resource.
  * Returns approved comments by default.
  */
-declare function useComments(config: CommentsClientConfig, params: {
+declare function useComments(params: {
     resourceId?: string;
     resourceType?: string;
     parentId?: string | null;
@@ -35,7 +30,7 @@ declare function useComments(config: CommentsClientConfig, params: {
 /**
  * useSuspenseQuery version — for use in .internal.tsx files.
  */
-declare function useSuspenseComments(config: CommentsClientConfig, params: {
+declare function useSuspenseComments(params: {
     resourceId?: string;
     resourceType?: string;
     parentId?: string | null;
@@ -55,7 +50,7 @@ declare function useSuspenseComments(config: CommentsClientConfig, params: {
  * Uses useSuspenseQuery with explicit offset so the table always shows exactly
  * one page of results and navigation is handled by Prev / Next controls.
  */
-declare function useSuspenseModerationComments(config: CommentsClientConfig, params: {
+declare function useSuspenseModerationComments(params: {
     status?: "pending" | "approved" | "spam";
     limit?: number;
     page?: number;
@@ -75,7 +70,7 @@ declare function useSuspenseModerationComments(config: CommentsClientConfig, par
  * Mirrors the blog's usePosts pattern: spread the factory base query into
  * useInfiniteQuery, drive pages via pageParam, and derive hasMore from server total.
  */
-declare function useInfiniteComments(config: CommentsClientConfig, params: {
+declare function useInfiniteComments(params: {
     resourceId: string;
     resourceType: string;
     parentId?: string | null;
@@ -103,7 +98,7 @@ declare function useInfiniteComments(config: CommentsClientConfig, params: {
 /**
  * Fetch the approved comment count for a resource.
  */
-declare function useCommentCount(config: CommentsClientConfig, params: {
+declare function useCommentCount(params: {
     resourceId: string;
     resourceType: string;
     status?: "pending" | "approved" | "spam";
@@ -121,7 +116,7 @@ declare function useCommentCount(config: CommentsClientConfig, params: {
  * infinite query so the optimistic update targets InfiniteData<CommentListResult>
  * instead of a plain CommentListResult cache entry.
  */
-declare function usePostComment(config: CommentsClientConfig, params: {
+declare function usePostComment(params: {
     resourceId: string;
     resourceType: string;
     currentUserId?: string;
@@ -164,25 +159,25 @@ declare function usePostComment(config: CommentsClientConfig, params: {
 /**
  * Edit the body of an existing comment.
  */
-declare function useUpdateComment(config: CommentsClientConfig): _tanstack_react_query.UseMutationResult<SerializedComment, Error, {
+declare function useUpdateComment(): _tanstack_react_query.UseMutationResult<SerializedComment, Error, {
     id: string;
     body: string;
 }, unknown>;
 /**
  * Approve a comment (set status to "approved"). Admin use.
  */
-declare function useApproveComment(config: CommentsClientConfig): _tanstack_react_query.UseMutationResult<SerializedComment, Error, string, unknown>;
+declare function useApproveComment(): _tanstack_react_query.UseMutationResult<SerializedComment, Error, string, unknown>;
 /**
  * Update comment status (pending / approved / spam). Admin use.
  */
-declare function useUpdateCommentStatus(config: CommentsClientConfig): _tanstack_react_query.UseMutationResult<SerializedComment, Error, {
+declare function useUpdateCommentStatus(): _tanstack_react_query.UseMutationResult<SerializedComment, Error, {
     id: string;
     status: "pending" | "approved" | "spam";
 }, unknown>;
 /**
  * Delete a comment. Admin use.
  */
-declare function useDeleteComment(config: CommentsClientConfig): _tanstack_react_query.UseMutationResult<{
+declare function useDeleteComment(): _tanstack_react_query.UseMutationResult<{
     success: boolean;
 }, Error, string, unknown>;
 /**
@@ -192,7 +187,7 @@ declare function useDeleteComment(config: CommentsClientConfig): _tanstack_react
  * so the optimistic update targets InfiniteData<CommentListResult> instead of
  * a plain CommentListResult cache entry.
  */
-declare function useToggleLike(config: CommentsClientConfig, params: {
+declare function useToggleLike(params: {
     resourceId: string;
     resourceType: string;
     /** parentId of the comment being liked — must match the parentId used by
@@ -208,7 +203,6 @@ declare function useToggleLike(config: CommentsClientConfig, params: {
     isLiked: boolean;
 }, Error, {
     commentId: string;
-    authorId: string;
 }, {
     previous: CommentListResult | InfiniteData<CommentListResult, unknown> | undefined;
 }>;