@jini-ai/cms 0.5.2 → 0.5.4

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.5.4 — 2026-10-08
+
+- Ships `dist/forms/**`: 0.5.3's `files` negation `!forms/**` also stripped `dist/forms`, so `@jini-ai/cms/forms` (and `/html`, `/sql`, `/express`) failed to resolve. The negation is removed: `files` already ships only `dist`, and the nested `forms/` package is never packed.
+
+## 0.5.3 — 2026-10-08
+
+- `./widgets*`: Add isolated widgets, import-free markers, HTML embeds, resolver ports and StorageKernel region-binding SQL entries; preserve stored formats, permission gates and rendering contracts.
+- Fold forms into ./forms with isolated HTML, SQL and Express adapters and host-supplied authoring, validation, attempts and dispatch ports.
+- Add isolated comments, SQL and Express entries with injected settings, rate limits, table names and IP salt; preserve ingress, moderation and audit contracts.
+- Add isolated redirects, SQL, SPA, host-config and Express entries with required verified-origin/path-policy ports and explicit adapter refusal reporting.
+- Add isolated universal SEO and browser DOM head entries, host settings/post/media/routing/liveness ports, and per-instance sitemap hooks/cache; retain output and write contracts.
+- Move generic settings to `@jini-ai/core/settings` and the Express adapter to `@jini-ai/core/settings/express`; retain both former CMS subpaths as identity-preserving compatibility re-exports for one release.
+
+- Move filesystem, sharp and ffmpeg media adapters to `@jini-ai/cms/media/node`; share `TransactionalRepoPort` through core while retaining the taxonomy type export; rename the settings HTTP entry to `@jini-ai/cms/settings/express`.
+
 ## 0.5.2 — 2026-10-06
 
 - Video previews (`@jini-ai/cms/media`): `planVideoFrames` / `planVideoContactSheets` / `getVideoFrameEdge` / `parseVideoProbe` plus the `VideoFrameExtractor` port and an ffmpeg adapter (`createFfmpegVideoFrameExtractor`, `findVideoBinaries`, `runLowPriorityVideoProcess`). Default 16 frames, up to 64 (frames past 16 shrink to bound image tokens), `every`/`start` spacing, explicit `at` times, or up to 4 contact sheets of ≤16 tiles with a timestamp map.

package/README.md

@@ -13,25 +13,30 @@ See [API integration](API-INTEGRATION.md) for current signatures and migration e
 | subpath | runtime | contents |
 |---|---|---|
 | `.` / `./core` | universal | Content contracts and types, ports, pure domain services, kernel registries. No Express, no `node:*`, no DOM. |
-| `./media` | node | Media services, filesystem blob stores and image transformers. |
-| `./http/settings` | node | Settings HTTP routes, host policy contracts, CMS adapters and resumable change feed. |
+| `./media` | node | Media services, transform ports and preview policies. |
+| `./media/node` | node | Filesystem blob stores, sharp image transforms and ffmpeg adapters. |
+| `./settings` | universal | One-release compatibility re-export of `@jini-ai/core/settings`. |
+| `./settings/express` | node | One-release compatibility re-export of `@jini-ai/core/settings/express`. |
 
 Node-bound domain adapters depend on `/core`. The reverse is a boundary violation — if a core module wants
 something from a Node adapter, the dependency is backwards and the fix is a port (interface) in core,
 not a widened export.
 
-Domain HTTP adapters live under `./http/*`, using the generic transport and host
-composition supplied by `@jini-ai/http-kit` and `@jini-ai/server`.
+Domain HTTP adapters live under their domain subpaths. Hosts can compose them
+using `@jini-ai/http-kit` and `@jini-ai/server`.
 Identity tool registration composition belongs to `@jini-ai/user-management/server`.
 
-`@jini-ai/cms/http/settings` exports `registerSettingsRoutes`, the settings HTTP
+Generic settings now belong to `@jini-ai/core/settings`; the former CMS settings subpaths
+remain thin compatibility re-exports for one release.
+
+`@jini-ai/core/settings/express` exports `registerSettingsRoutes`, the settings HTTP
 contracts and the CMS service/change-feed factories. Hosts provide route paths,
 permissions, workspace, readiness, principal resolution, authorization, scheduler,
 service and feed ports. Registration returns a disposer that closes active feeds.
 CMS adapters pass named request objects to settings dispatch and change-feed services;
 queryable index-name helpers return promises that callers must await.
-Install the optional peers `express` and `@jini-ai/http-kit` when using HTTP subpaths;
-the framework-free root and domain entries do not import them.
+Install the optional peer `express` when using `./settings/express`.
+The HTTP toolkit is a host composition choice and is not a CMS dependency.
 Readiness or principal-resolution failures return `401 UNAUTHENTICATED`.
 Stream diagnostics are best-effort: a throwing reporter cannot prevent retries,
 cancellation of other schedules or ending the response.
@@ -70,7 +75,8 @@ coordination.
 
 **Landed** (directories under `src/`, each with its own subpath export):
 `core`, `content-types`, `entries`, `media`, `navigation`, `presentation`, `settings`,
-`taxonomy`, `workspace`, and `trash`. `./core/tools` exports CMS permission helpers; `./media/import` exports bounded image fetching with injected policies and ports.
+`taxonomy`, `workspace`, and `trash`. `settings` is now a compatibility shim, with implementation
+in `@jini-ai/core/settings`. `./core/tools` re-exports the shared core permission helpers; `./media/import` exports bounded image fetching with injected policies and ports.
 
 **Still to move:** `post`, `seo`, `comments`, `redirects`, `widgets`, `newsletter`,
 `members`. The unimplemented `./widgets` export has been removed.

package/dist/comments/errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @file Typed domain errors for `comments` (ADR-031, SPEC-035).
+ *
+ * One class per error this module originates, mirroring `src/seo/errors.ts`'s one-class-per-code
+ * convention. Route handlers (`src/server/routes/admin/comments/*.ts`) map these 1:1 to HTTP codes.
+ */
+export declare class CommentsSettingsValidationError extends Error {
+}
+/** A comment id the caller named does not exist in this workspace (tool + route not-found arm). */
+export declare class CommentNotFoundError extends Error {
+    constructor(required: {
+        commentId: string;
+    }, _optional?: Record<string, never>);
+}
+/** The caller's `expectedVersion` is stale; `currentVersion` is what a retry should send. */
+export declare class CommentVersionConflictError extends Error {
+    readonly currentVersion: number | undefined;
+    constructor(required: {
+        commentId: string;
+        currentVersion?: number;
+    }, _optional?: Record<string, never>);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/comments/errors.js

@@ -0,0 +1,25 @@
+/**
+ * @file Typed domain errors for `comments` (ADR-031, SPEC-035).
+ *
+ * One class per error this module originates, mirroring `src/seo/errors.ts`'s one-class-per-code
+ * convention. Route handlers (`src/server/routes/admin/comments/*.ts`) map these 1:1 to HTTP codes.
+ */
+export class CommentsSettingsValidationError extends Error {
+}
+/** A comment id the caller named does not exist in this workspace (tool + route not-found arm). */
+export class CommentNotFoundError extends Error {
+    constructor(required, _optional = {}) {
+        super(`comment '${required.commentId}' was not found`);
+        this.name = "CommentNotFoundError";
+    }
+}
+/** The caller's `expectedVersion` is stale; `currentVersion` is what a retry should send. */
+export class CommentVersionConflictError extends Error {
+    currentVersion;
+    constructor(required, _optional = {}) {
+        super(`comment '${required.commentId}' was modified concurrently (current version is ${required.currentVersion ?? "unknown"})`);
+        this.name = "CommentVersionConflictError";
+        this.currentVersion = required.currentVersion;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/comments/express/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./submit-handler.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/comments/express/index.js

@@ -0,0 +1,2 @@
+export * from "./submit-handler.js";
+//# sourceMappingURL=index.js.map

package/dist/comments/express/submit-handler.d.ts

@@ -0,0 +1,30 @@
+import type { Request, RequestHandler } from "express";
+import type { CommentIngressPolicy } from "../ports.js";
+import type { CommentRateLimiter } from "../ingress.js";
+/**
+ * @file ADR-031 §4 (SPEC-033) — the public, unauthenticated comment submission route. The ONLY
+ * route a hostile visitor can reach into the Comments plugin; everything downstream of this file
+ * is `CommentIngressPolicy` (rate-limit, honeypot, sanitize, spam-classify — see `comments/ingress.ts`).
+ *
+ * `authorIpHash` is computed HERE, at the HTTP boundary, from the raw request IP — the raw IP
+ * itself is never passed into `ingressContext` or stored (mirrors `analytics/ingest.ts`'s
+ * discard-raw-IP-at-the-boundary discipline). The host provides the salt at construction.
+ */
+export interface CommentSubmitRequired {
+    ingressPolicy: CommentIngressPolicy;
+    workspaceId: string;
+    ipHashSalt: string;
+    /** Host-owned HTTP request budget, separate from the ingress policy's submission budget. */
+    rateLimiter: CommentRateLimiter;
+    /** Host-selected trusted proxy policy; the raw address is hashed only at this boundary. */
+    clientIp: (required: {
+        request: Request;
+    }, optional?: Record<string, never>) => string;
+}
+/** Builds the anonymous submission handler; the host owns route mounting and salt policy.
+ * @throws {TypeError} When ingressPolicy, workspaceId, ipHashSalt, rateLimiter or clientIp is missing or invalid.
+ * @returns An Express handler preserving the source route's normalization and HTTP responses.
+ * @complexity O(body length) normalization and hashing plus the ingress port's work.
+ */
+export declare function createCommentSubmitHandler(deps: CommentSubmitRequired, _optional?: Record<string, never>): RequestHandler;
+//# sourceMappingURL=submit-handler.d.ts.map

package/dist/comments/express/submit-handler.js

@@ -0,0 +1,85 @@
+import { createHash } from "node:crypto";
+/** Resolve with the host's trust policy and hash before the address leaves HTTP. @complexity O(IP length). */
+function hashClientIp(req, deps) {
+    const ip = deps.clientIp({ request: req }, {});
+    return createHash("sha256").update(`${ip}:${deps.ipHashSalt}`).digest("hex");
+}
+/** The per-request signal bag (honeypot value, IP hash) — split out of `buildCommentSubmission` so
+ * that function's own field count stays clear of the complexity ceiling. @complexity O(1). */
+function buildIngressContext(req, deps, body) {
+    return {
+        authorIpHash: hashClientIp(req, deps),
+        honeypotValue: typeof body.website === "string" ? body.website : "", // conventional honeypot field name
+    };
+}
+/**
+ * Normalizes the untyped request body into a `CommentSubmission`. Every field below defaults or
+ * clamps independently (undefined-means-empty for required strings, falsy-means-null for optional
+ * ones) — same behavior as before this was a named function, just no longer inline in the handler.
+ *
+ * @complexity O(1).
+ */
+function buildCommentSubmission(req, body, deps) {
+    return {
+        workspaceId: deps.workspaceId,
+        entryId: String(body.entryId ?? ""),
+        parentId: body.parentId ? String(body.parentId) : null,
+        authorName: String(body.authorName ?? "").slice(0, 200),
+        authorEmail: body.authorEmail ? String(body.authorEmail).slice(0, 320) : null,
+        authorUrl: body.authorUrl ? String(body.authorUrl).slice(0, 2000) : null,
+        bodyRaw: String(body.body ?? ""),
+        authorPrincipalId: null, // v1: anonymous-only public route; member-attributed submission is a named deferral
+        ingressContext: buildIngressContext(req, deps, body),
+    };
+}
+/** Builds the anonymous submission handler; the host owns route mounting and salt policy.
+ * @throws {TypeError} When ingressPolicy, workspaceId, ipHashSalt, rateLimiter or clientIp is missing or invalid.
+ * @returns An Express handler preserving the source route's normalization and HTTP responses.
+ * @complexity O(body length) normalization and hashing plus the ingress port's work.
+ */
+export function createCommentSubmitHandler(deps, _optional = {}) {
+    if (!deps?.ingressPolicy || typeof deps.ingressPolicy.submit !== "function") {
+        throw new TypeError("comments submit handler requires ingressPolicy");
+    }
+    if (typeof deps.workspaceId !== "string" || deps.workspaceId.length === 0) {
+        throw new TypeError("comments submit handler requires workspaceId");
+    }
+    if (typeof deps.ipHashSalt !== "string" || deps.ipHashSalt.length === 0) {
+        throw new TypeError("comments submit handler requires ipHashSalt");
+    }
+    if (!deps.rateLimiter || typeof deps.rateLimiter.check !== "function") {
+        throw new TypeError("comments submit handler requires rateLimiter");
+    }
+    if (typeof deps.clientIp !== "function") {
+        throw new TypeError("comments submit handler requires clientIp");
+    }
+    return async (req, res) => {
+        try {
+            const body = req.body;
+            const submission = buildCommentSubmission(req, body, deps);
+            const rateLimit = await deps.rateLimiter.check({ key: String(submission.ingressContext.authorIpHash) });
+            let result;
+            if (rateLimit.allowed) {
+                result = await deps.ingressPolicy.submit(submission);
+            }
+            else {
+                result = { ok: false, reason: "rate-limited" };
+            }
+            if (!result.ok) {
+                // No oracle: every rejection reason maps to the SAME generic 422, distinguishable only in
+                // the response body's `reason` for legitimate client-side form UX, never a status-code tell.
+                res.status(422).json({ error: "comment was not accepted", reason: result.reason });
+                return;
+            }
+            res.status(201).json({ id: result.comment.id, status: result.comment.status });
+        }
+        catch (err) {
+            // Public, unauthenticated route (this file's own header) — any visitor's malformed or
+            // hostile submission must still get a fast, honest response, never a hang; an unguarded
+            // failure here is reachable by anyone, not just an authenticated admin.
+            console.error("[site/comments-submit] unexpected error", err);
+            res.status(500).json({ error: "internal error", code: "INTERNAL_ERROR" });
+        }
+    };
+}
+//# sourceMappingURL=submit-handler.js.map

package/dist/comments/hooks.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @file `hooks.ts` — fixed-order, fail-closed hook dispatch for the two typed hook points
+ * `ports.ts#CommentHookPoints` declares (ADR-009 §3, ADR-024 §7). Mirrors
+ * `newsletter/hooks.ts`'s factory-not-singleton shape (`createHookRegistry`) — avoids a hidden
+ * cross-test/cross-instance module-level singleton.
+ *
+ * `comments.beforeSubmit` handlers run in registration order; the first `reject` short-circuits
+ * (fail-closed on veto, same as a throw). A THROWING handler is also fail-closed rejection, never
+ * "keep by default" — the spam-check adapter is expected to attach here as one such handler.
+ */
+import type { CommentHookPoints, CommentIngressRejection } from "./ports.js";
+import type { CommentSubmission } from "./types.js";
+export type BeforeSubmitHook = CommentHookPoints["comments.beforeSubmit"];
+export type StatusChangedHook = CommentHookPoints["comments.statusChanged"];
+export type BeforeSubmitChainResult = {
+    submission: CommentSubmission;
+} | {
+    reject: CommentIngressRejection;
+};
+export interface CommentHookRegistry {
+    /** Adds a filter in registration order; throws during dispatch reject the submission.
+     * @complexity Amortized O(1) registration time and space.
+     * @example registry.registerBeforeSubmitHook({ hook: async ({ submission }) => ({ submission }) }, {})
+     */
+    registerBeforeSubmitHook(required: {
+        hook: BeforeSubmitHook;
+    }, optional?: Record<string, never>): void;
+    /** Adds a post-commit notification; errors during dispatch never undo committed writes.
+     * @complexity Amortized O(1) registration time and space.
+     * @example registry.registerStatusChangedHook({ hook: async () => {} }, {})
+     */
+    registerStatusChangedHook(required: {
+        hook: StatusChangedHook;
+    }, optional?: Record<string, never>): void;
+    runBeforeSubmitChain(submission: CommentSubmission, optional?: Record<string, never>): Promise<BeforeSubmitChainResult>;
+    runStatusChangedHooks(payload: Parameters<StatusChangedHook>[0], optional?: Record<string, never>): Promise<void>;
+}
+export declare function createCommentHookRegistry(_required?: Record<string, never>, _optional?: Record<string, never>): CommentHookRegistry;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/comments/hooks.js

@@ -0,0 +1,41 @@
+export function createCommentHookRegistry(_required = {}, _optional = {}) {
+    const beforeSubmitHooks = [];
+    const statusChangedHooks = [];
+    return {
+        registerBeforeSubmitHook({ hook }, _optional = {}) {
+            beforeSubmitHooks.push(hook);
+        },
+        registerStatusChangedHook({ hook }, _optional = {}) {
+            statusChangedHooks.push(hook);
+        },
+        async runBeforeSubmitChain(initial) {
+            let submission = initial;
+            for (const hook of beforeSubmitHooks) {
+                let result;
+                try {
+                    result = await hook({ submission });
+                }
+                catch {
+                    // A throwing filter is fail-closed rejection, never "keep by default".
+                    return { reject: "invalid" };
+                }
+                if ("reject" in result)
+                    return result;
+                submission = result.submission;
+            }
+            return { submission };
+        },
+        async runStatusChangedHooks(payload) {
+            for (const hook of statusChangedHooks) {
+                try {
+                    await hook(payload);
+                }
+                catch {
+                    // Action hooks are post-commit notifications — a throwing one must not undo the
+                    // already-committed status change; it is swallowed, not fail-closed like beforeSubmit.
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=hooks.js.map

package/dist/comments/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./types.js";
+export * from "./ports.js";
+export * from "./hooks.js";
+export * from "./ingress.js";
+export * from "./write-service.js";
+export * from "./spam.heuristic.js";
+export * from "./sanitize.js";
+export * from "./errors.js";
+export * from "./repo.memory.js";
+export * from "./module.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/comments/index.js

@@ -0,0 +1,11 @@
+export * from "./types.js";
+export * from "./ports.js";
+export * from "./hooks.js";
+export * from "./ingress.js";
+export * from "./write-service.js";
+export * from "./spam.heuristic.js";
+export * from "./sanitize.js";
+export * from "./errors.js";
+export * from "./repo.memory.js";
+export * from "./module.js";
+//# sourceMappingURL=index.js.map

package/dist/comments/ingress.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @file ADR-031 §4 — `CommentIngressPolicy`, the single core-mediated public-submission
+ * boundary (mirrors ADR-027's one `MediaIngressPolicy`). Enforces, in order:
+ * comments-enabled → entry-open → parent-exists → depth-cap → rate-limit → honeypot/size/link
+ * caps → sanitize → hook chain (veto/transform) → spam classification → write.
+ *
+ * Spam is stored silently (`status: "spam"`), never rejected at the boundary — a rejection is an
+ * oracle a spammer tunes against (ADR-031 §4's own explicit instruction).
+ *
+ * `entryLookup` is a narrow, caller-injected dependency (ADR-046 Phase 3's "narrow typed
+ * dependencies" convention) rather than a direct import of the entries feature module — its
+ * `commentsClosed` field is where `CommentsSettings.closeAfterDays` math against the entry's own
+ * publish date belongs; this file does not duplicate that logic.
+ *
+ * `authorIpHash`/honeypot are read from `submission.ingressContext` (already computed/salted by
+ * the HTTP route layer, per `CommentSubmission`'s own doc: "the raw IP is never stored" — this
+ * file never sees it) under the fixed keys `authorIpHash` and `honeypotValue`.
+ *
+ * `getSettings` (SPEC-035, ADR-028 Settings Layered Ledger wiring) is a per-call RESOLVER, not a
+ * boot-captured snapshot — `submit()` reads it fresh at the top of every call, so an operator's
+ * settings change via the admin `PUT .../comments/settings` route (`settings.ts`) takes effect on
+ * the very next submission, not only after a restart. `index.ts` builds this resolver from
+ * `settingsRepo` when the composition root supplies one, falling back to a fixed snapshot
+ * otherwise (hermetic tests that don't wire the ledger).
+ */
+import type { Clock as ClockPort, IdGenerator as IdGeneratorPort, UUID } from "@jini-ai/core/primitives";
+import type { OutboxPort } from "../core/index.js";
+import type { RateLimiter as HttpRateLimiter } from "@jini-ai/http-kit/rate-limit";
+/** Only the request check belongs to ingress; limiter construction and diagnostics are host policy. */
+export type CommentRateLimiter = Pick<HttpRateLimiter, "check">;
+import type { CommentHookRegistry } from "./hooks.js";
+import type { CommentIngressPolicy, CommentRepoPort, SpamCheckPort } from "./ports.js";
+import type { CommentsSettings } from "./types.js";
+export interface EntryLookupResult {
+    id: UUID;
+    /** True when the entry itself is closed to new comments (per-entry override or `closeAfterDays`). */
+    commentsClosed: boolean;
+}
+export interface CommentIngressDeps {
+    repo: CommentRepoPort;
+    spamCheck: SpamCheckPort;
+    hooks: CommentHookRegistry;
+    clock: ClockPort;
+    idGen: IdGeneratorPort;
+    getSettings: (workspaceId: UUID) => Promise<CommentsSettings>;
+    entryLookup: (required: {
+        workspaceId: UUID;
+        entryId: UUID;
+    }) => Promise<EntryLookupResult | null>;
+    rateLimiter: CommentRateLimiter;
+    /** ADR-031 §8 — every successful submission emits `comments.submitted` (whatever status
+     * resulted, including an auto-classified `spam`); a moderator's LATER explicit action is what
+     * emits `comments.marked_spam` (see `write-service.ts`) — the two are deliberately distinct. */
+    outbox: OutboxPort;
+}
+export declare function createCommentIngressPolicy(deps: CommentIngressDeps, _optional?: Record<string, never>): CommentIngressPolicy;
+//# sourceMappingURL=ingress.d.ts.map

package/dist/comments/ingress.js

@@ -0,0 +1,173 @@
+import { nowIso } from "@jini-ai/core/primitives";
+import { countLinks, sanitizeCommentBody } from "./sanitize.js";
+import { COMMENTS_INGRESS_SYSTEM_PRINCIPAL_ID } from "./types.js";
+const MAX_BODY_LENGTH = 10_000;
+const MAX_LINKS = 5;
+function readIngressString(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+/** entry-exists + entry-open gate (comments-enabled → entry-open, per this file's header). */
+async function checkEntryGate(deps, submission) {
+    const entry = await deps.entryLookup({ workspaceId: submission.workspaceId, entryId: submission.entryId });
+    if (!entry)
+        return { ok: false, reason: "entry-not-found" };
+    if (entry.commentsClosed)
+        return { ok: false, reason: "entry-closed" };
+    return { ok: true };
+}
+/**
+ * Resolves the depth + thread-root a submission's optional `parentId` implies (parent-exists →
+ * depth-cap, per this file's header). A top-level submission (`parentId: null`) trivially passes
+ * at depth 0 with no thread root yet (the comment being created becomes its own root — see
+ * `submit()`'s own `threadRootId: parentThreadRootId ?? id`).
+ *
+ * BUG FIX (this pass — found auditing this exact function for the complexity refactor, not
+ * introduced by it): the parent lookup never checked that the found parent actually belongs to
+ * the SAME entry as this submission — `CommentRepoPort.findById` is keyed only on
+ * `(workspaceId, id)`, not `entryId`. A submission could supply an `entryId` for one (open,
+ * comments-enabled) entry and a `parentId` that is really a comment on a completely different
+ * entry, silently grafting the new comment onto that other entry's thread (wrong `threadRootId`,
+ * a `depth` computed against an unrelated thread). `types.ts`'s own header says this referential
+ * integrity is "validated at the write chokepoint, NOT by a DB foreign key" (i.e. here) — this was
+ * the gap. Treated as `parent-not-found`, not a new rejection reason: from the submitter's point
+ * of view, the parent they asked for does not exist ON THIS ENTRY. Regression:
+ * `ingress.test.ts` ("a parentId belonging to a different entry...").
+ */
+async function resolveParentContext(deps, submission, settings) {
+    if (!submission.parentId)
+        return { ok: true, depth: 0, parentThreadRootId: null };
+    const parent = await deps.repo.findById({ workspaceId: submission.workspaceId, id: submission.parentId });
+    if (!parent || parent.entryId !== submission.entryId)
+        return { ok: false, reason: "parent-not-found" };
+    const depth = parent.depth + 1;
+    if (depth > settings.maxDepth)
+        return { ok: false, reason: "max-depth-exceeded" };
+    return { ok: true, depth, parentThreadRootId: parent.threadRootId };
+}
+/** rate-limit → honeypot gate (per this file's header). */
+async function checkRateLimitAndHoneypot(deps, submission) {
+    const authorIpHash = readIngressString(submission.ingressContext.authorIpHash);
+    if (!(await deps.rateLimiter.check({ key: authorIpHash ?? "unknown" })).allowed)
+        return { ok: false, reason: "rate-limited" };
+    if (readIngressString(submission.ingressContext.honeypotValue))
+        return { ok: false, reason: "honeypot-tripped" };
+    return { ok: true, authorIpHash };
+}
+/** size/link caps, applied to the ALREADY-sanitized body (sanitize → size/link caps is this
+ *  function's own order — see this file's header — so the caps see what will actually be stored). */
+function sanitizeAndCapBody(bodyRaw) {
+    const sanitizedBody = sanitizeCommentBody({ raw: bodyRaw }, {});
+    if (sanitizedBody.length > MAX_BODY_LENGTH)
+        return { ok: false, reason: "body-too-large" };
+    if (countLinks({ text: sanitizedBody }, {}) > MAX_LINKS)
+        return { ok: false, reason: "too-many-links" };
+    return { ok: true, sanitizedBody };
+}
+/** spam-classification decision (score → status), isolated so `submit()` reads as one line instead
+ *  of a nested ternary (also clears the `sonarjs/no-nested-conditional` finding this line used to
+ *  trip). Spam is never a rejection at this boundary — see this file's header. */
+function classifyCommentStatus(verdict, settings) {
+    if (verdict.score >= settings.spamAutoRejectScore)
+        return "spam";
+    return settings.requireModeration ? "pending" : "approved";
+}
+function buildCommentRecord(params) {
+    const { submission, hookSubmission, authorIpHash, depth, parentThreadRootId, status, verdict, id, now } = params;
+    return {
+        id,
+        workspaceId: submission.workspaceId,
+        entryId: submission.entryId,
+        parentId: submission.parentId,
+        threadRootId: parentThreadRootId ?? id,
+        depth,
+        status,
+        authorPrincipalId: hookSubmission.authorPrincipalId,
+        authorName: hookSubmission.authorName,
+        authorEmail: hookSubmission.authorEmail,
+        authorUrl: hookSubmission.authorUrl,
+        authorIpHash,
+        bodyText: hookSubmission.bodyRaw,
+        spamScore: verdict.score,
+        spamProvider: verdict.provider,
+        createdAt: now,
+        updatedAt: now,
+        version: 0,
+    };
+}
+// OQ-3 resolution (ADR-031 round-2 fold, SPEC-035): every ingress-created comment gets a `submit`
+// moderation_log row, attributed to the seeded system principal — the ingress has no real operator
+// principal to attribute this to (the visitor is anonymous by definition), and the
+// auto-classification (pending/approved/spam) IS itself a moderation decision, just one core made
+// instead of a human. `fromStatus: null` (nothing existed before this write).
+function buildSubmitLogEntry(deps, record, now) {
+    return {
+        id: deps.idGen.newId(),
+        workspaceId: record.workspaceId,
+        commentId: record.id,
+        actorPrincipalId: COMMENTS_INGRESS_SYSTEM_PRINCIPAL_ID,
+        action: "submit",
+        fromStatus: null,
+        toStatus: record.status,
+        at: now,
+        note: null,
+    };
+}
+async function enqueueSubmittedEvent(deps, record, now) {
+    // Inline object literal (not a `CommentDomainEvent`-typed intermediate) — matches this
+    // codebase's established `outbox.enqueue()` call-site convention (e.g.
+    // `features/entries/write-service.ts`): TS only infers a `Record<string, unknown>`-
+    // compatible index signature for a FRESH object literal argument, not for a value already
+    // typed against a concrete interface without one.
+    await deps.outbox.enqueue({
+        id: deps.idGen.newId(),
+        name: "comments.submitted",
+        occurredAt: now,
+        aggregateId: record.id,
+        workspaceId: record.workspaceId,
+        payload: { commentId: record.id, entryId: record.entryId, status: record.status },
+    });
+}
+export function createCommentIngressPolicy(deps, _optional = {}) {
+    return {
+        async submit(submission) {
+            const settings = await deps.getSettings(submission.workspaceId);
+            if (!settings.enabled)
+                return { ok: false, reason: "comments-disabled" };
+            const entryGate = await checkEntryGate(deps, submission);
+            if (!entryGate.ok)
+                return entryGate;
+            const parentContext = await resolveParentContext(deps, submission, settings);
+            if (!parentContext.ok)
+                return parentContext;
+            const rateGate = await checkRateLimitAndHoneypot(deps, submission);
+            if (!rateGate.ok)
+                return rateGate;
+            const bodyResult = sanitizeAndCapBody(submission.bodyRaw);
+            if (!bodyResult.ok)
+                return bodyResult;
+            const sanitizedSubmission = { ...submission, bodyRaw: bodyResult.sanitizedBody };
+            const hookResult = await deps.hooks.runBeforeSubmitChain(sanitizedSubmission);
+            if ("reject" in hookResult)
+                return { ok: false, reason: hookResult.reject };
+            const verdict = await deps.spamCheck.check(hookResult.submission);
+            const status = classifyCommentStatus(verdict, settings);
+            const id = deps.idGen.newId();
+            const now = nowIso({ clock: deps.clock });
+            const record = buildCommentRecord({
+                submission,
+                hookSubmission: hookResult.submission,
+                authorIpHash: rateGate.authorIpHash,
+                depth: parentContext.depth,
+                parentThreadRootId: parentContext.parentThreadRootId,
+                status,
+                verdict,
+                id,
+                now,
+            });
+            await deps.repo.create({ record }, { submitLog: buildSubmitLogEntry(deps, record, now) });
+            await enqueueSubmittedEvent(deps, record, now);
+            return { ok: true, comment: record, autoClassified: status };
+        },
+    };
+}
+//# sourceMappingURL=ingress.js.map