@kywi-software/core 0.2.0 → 0.3.0

package/dist/hooks/webhook-retry.js

@@ -1,5 +1,5 @@
 import { createHmac } from 'node:crypto';
-import { updateDeliveryStatus } from '../db/webhook-queries.js';
+import { updateDeliveryStatus, listPendingRetries, getEndpointById } from '../db/webhook-queries.js';
 // Exponential backoff: 1min, 5min, 15min, 60min, ...
 function computeNextRetryDelay(attempts) {
     const base = 60_000; // 1 minute
@@ -22,6 +22,43 @@ export function createWebhookRetryWorker(db, deps) {
         },
     };
 }
+/**
+ * Start an in-process interval runner that re-dispatches due webhook retries
+ * every `intervalSeconds`, wiring the real DB deps (`listPendingRetries` /
+ * `getEndpointById`) into {@link createWebhookRetryWorker}. Mirrors
+ * `startScheduler`: overlapping ticks are skipped (a slow sweep never piles up),
+ * the timer is `unref()`d so it never keeps the process alive on its own, and
+ * one failed sweep routes to `onError` instead of crashing the host. Returns a
+ * handle whose `stop()` clears the interval.
+ *
+ * This is the missing runtime call site for the retry model (#57): before this,
+ * `createWebhookRetryWorker` was dead code and failed deliveries never retried.
+ */
+export function startWebhookRetryWorker(db, opts) {
+    const worker = createWebhookRetryWorker(db, {
+        listPendingRetries: (d) => listPendingRetries(d, opts.maxAttempts !== undefined ? { maxAttempts: opts.maxAttempts } : {}),
+        getEndpointById: (d, id) => getEndpointById(d, id),
+    });
+    const ms = Math.max(1, opts.intervalSeconds) * 1000;
+    const onError = opts.onError ?? ((err) => console.warn('[kywi:webhooks] retry sweep failed:', err));
+    let running = false;
+    const timer = setInterval(() => {
+        if (running)
+            return;
+        running = true;
+        void worker.tick()
+            .catch(onError)
+            .finally(() => {
+            running = false;
+        });
+    }, ms);
+    // Do not hold the event loop open for the retry worker alone.
+    if (typeof timer.unref === 'function') {
+        ;
+        timer.unref();
+    }
+    return { stop: () => clearInterval(timer) };
+}
 async function retryDeliver(url, secret, event, payload, deliveryId, previousAttempts, db) {
     const body = JSON.stringify({ event, data: payload, timestamp: Date.now() });
     const signature = createHmac('sha256', secret).update(body).digest('hex');

package/dist/hooks/webhook-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-retry.js","sourceRoot":"","sources":["../../src/hooks/webhook-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AA4B/D,qDAAqD;AACrD,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAA,CAAC,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACpC,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAU,EACV,IAAe;IAEf,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACjD,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;gBACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ;oBAAE,SAAQ;gBAE7C,qCAAqC;gBACrC,YAAY,CACV,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,QAAQ,EACjB,EAAE,CACH,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAEjB,uDAAuD;gBACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,MAAc,EACd,KAAa,EACb,OAAgB,EAChB,UAAkB,EAClB,gBAAwB,EACxB,EAAU;IAEV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzE,MAAM,WAAW,GAAG,gBAAgB,GAAG,CAAC,CAAA;IAExC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,SAAS;gBAC7B,cAAc,EAAE,KAAK;aACtB;YACD,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE;gBACzC,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE;gBACzC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;aACvE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE;YACzC,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;SACvE,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhook-retry.js","sourceRoot":"","sources":["../../src/hooks/webhook-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AA6BpG,qDAAqD;AACrD,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAA,CAAC,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACpC,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAU,EACV,IAAe;IAEf,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACjD,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;gBACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ;oBAAE,SAAQ;gBAE7C,qCAAqC;gBACrC,YAAY,CACV,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,QAAQ,EACjB,EAAE,CACH,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAEjB,uDAAuD;gBACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAU,EACV,IAAyF;IAEzF,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,EAAE;QAC1C,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,CAAC;KACnD,CAAC,CAAA;IACF,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5G,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,OAAO;YAAE,OAAM;QACnB,OAAO,GAAG,IAAI,CAAA;QACd,KAAK,MAAM,CAAC,IAAI,EAAE;aACf,KAAK,CAAC,OAAO,CAAC;aACd,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,KAAK,CAAA;QACjB,CAAC,CAAC,CAAA;IACN,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,8DAA8D;IAC9D,IAAI,OAAQ,KAAgC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAClE,CAAC;QAAC,KAA+B,CAAC,KAAK,EAAE,CAAA;IAC3C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAA;AAC7C,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,MAAc,EACd,KAAa,EACb,OAAgB,EAChB,UAAkB,EAClB,gBAAwB,EACxB,EAAU;IAEV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzE,MAAM,WAAW,GAAG,gBAAgB,GAAG,CAAC,CAAA;IAExC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,SAAS;gBAC7B,cAAc,EAAE,KAAK;aACtB;YACD,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE;gBACzC,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE;gBACzC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;aACvE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE;YACzC,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;SACvE,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/host/index.d.ts

@@ -1,4 +1,5 @@
 export { assertProductionAuthSecret, isDevFallbackSecret, DEV_FALLBACK_SECRETS, } from '../auth/auth-secret.js';
+export { canAccessContent, hasMinRole, type ContentAction, type KywiRole, } from '../auth/roles.js';
 /** httpOnly cookie holding the short-lived access JWT (type=access). */
 export declare const ACCESS_COOKIE = "kywi_access_token";
 /** httpOnly cookie holding the long-lived refresh JWT (type=refresh). */
@@ -31,6 +32,33 @@ export type AccessTokenStatus =
  * because it expired is still refreshable ('stale'); anything else is 'invalid'.
  */
 export declare function classifyAccessToken(token: string | undefined, secret: string): Promise<AccessTokenStatus>;
+/** The non-sensitive claims carried by a signature-verified access token. */
+export interface SessionClaims {
+    /** The authenticated user's id (token `sub`). */
+    sub: string;
+    /** The user's role — feeds the content-permission gates (see canAccessContent). */
+    role: string;
+    /** The user's group ids (empty when the token carries none). */
+    groups: string[];
+}
+/**
+ * Verify an access-token cookie against the host's auth secret and return its
+ * non-sensitive claims (sub / role / groups), or null when the token is missing,
+ * malformed, the wrong type, or its signature does not match `secret`.
+ *
+ * A token whose signature verified but has merely EXPIRED still yields its
+ * claims: a public (site) route is NOT in the middleware's refresh matcher, so
+ * an actively-signed-in admin's short-lived access cookie may have lapsed by the
+ * time they open a page with `?kywi-edit=1`. These claims only gate a client-side
+ * edit AFFORDANCE (the front-of-site overlay); every real mutation still flows
+ * through /api/v1, which the middleware refreshes and which re-checks auth. So
+ * surfacing the overlay for a signature-valid-but-stale admin is safe and correct
+ * UX. Anything whose signature does not verify returns null.
+ *
+ * Intended for a host's public render to decide whether to mount the overlay for
+ * the current visitor — pair it with the re-exported `canAccessContent`.
+ */
+export declare function readSessionClaims(token: string | undefined, secret: string): Promise<SessionClaims | null>;
 /**
  * Pull the access/refresh tokens out of a token-issuing endpoint's JSON body
  * (`{ data: { accessToken, refreshToken } }`). Missing/non-string fields and

package/dist/host/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAE/B,wEAAwE;AACxE,eAAO,MAAM,aAAa,sBAAsB,CAAA;AAChD,yEAAyE;AACzE,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAGlD,eAAO,MAAM,kBAAkB,QAAU,CAAA;AACzC,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAMlD,CAAA;AAEF,MAAM,MAAM,iBAAiB;AAC3B,wEAAwE;AACtE,OAAO;AACT,2EAA2E;GACzE,OAAO;AACT,yEAAyE;GACvE,SAAS,CAAA;AAcb;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG;IACpD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAUA;AAED;oCACoC;AACpC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,KAAK,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAA;KAAE,CAAA;CACvF;AAkBD,+DAA+D;AAC/D,wBAAgB,mBAAmB,CAAC,MAAM,SAAqB,GAAG,oBAAoB,CAErF;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,MAAM,SAAsB,GAAG,oBAAoB,CAEvF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAExE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAG7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAM/B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,kBAAkB,CAAA;AAEzB,wEAAwE;AACxE,eAAO,MAAM,aAAa,sBAAsB,CAAA;AAChD,yEAAyE;AACzE,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAGlD,eAAO,MAAM,kBAAkB,QAAU,CAAA;AACzC,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAMlD,CAAA;AAEF,MAAM,MAAM,iBAAiB;AAC3B,wEAAwE;AACtE,OAAO;AACT,2EAA2E;GACzE,OAAO;AACT,yEAAyE;GACvE,SAAS,CAAA;AAcb;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAA;IACZ,gEAAgE;IAChE,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAiB/B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG;IACpD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAUA;AAED;oCACoC;AACpC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,KAAK,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAA;KAAE,CAAA;CACvF;AAkBD,+DAA+D;AAC/D,wBAAgB,mBAAmB,CAAC,MAAM,SAAqB,GAAG,oBAAoB,CAErF;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,MAAM,SAAsB,GAAG,oBAAoB,CAEvF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAExE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAG7D"}

package/dist/host/index.js

@@ -22,12 +22,17 @@
  * them. The security-critical crypto (JWT verify, token classification, cookie
  * options) lives here once; the two host files carry only framework wiring.
  */
-import { jwtVerify } from 'jose';
+import { jwtVerify, decodeJwt } from 'jose';
 // Re-export the AUTH_SECRET production guard so a generated app can call it at
 // module scope (in middleware.ts / kywi.config.ts) and refuse to build/start in
 // production with a missing or dev-fallback secret. Shares its policy with the
 // CLI/app env-guard, so both agree on what an insecure secret is.
 export { assertProductionAuthSecret, isDevFallbackSecret, DEV_FALLBACK_SECRETS, } from '../auth/auth-secret.js';
+// Re-export the pure role → content-permission helpers so a host's public (site)
+// render can decide, from a verified token's role, whether to surface the
+// front-of-site edit overlay (see readSessionClaims). Both are dependency-free,
+// so this adds nothing to the edge bundle beyond the constants they close over.
+export { canAccessContent, hasMinRole, } from '../auth/roles.js';
 /** httpOnly cookie holding the short-lived access JWT (type=access). */
 export const ACCESS_COOKIE = 'kywi_access_token';
 /** httpOnly cookie holding the long-lived refresh JWT (type=refresh). */
@@ -88,6 +93,56 @@ export async function classifyAccessToken(token, secret) {
         return 'invalid';
     }
 }
+function claimsFromPayload(payload) {
+    if (payload['type'] !== 'access')
+        return null;
+    const sub = typeof payload['sub'] === 'string' ? payload['sub'] : null;
+    const role = typeof payload['role'] === 'string' ? payload['role'] : null;
+    if (!sub || !role)
+        return null;
+    const groups = Array.isArray(payload['groups'])
+        ? payload['groups'].filter((g) => typeof g === 'string')
+        : [];
+    return { sub, role, groups };
+}
+/**
+ * Verify an access-token cookie against the host's auth secret and return its
+ * non-sensitive claims (sub / role / groups), or null when the token is missing,
+ * malformed, the wrong type, or its signature does not match `secret`.
+ *
+ * A token whose signature verified but has merely EXPIRED still yields its
+ * claims: a public (site) route is NOT in the middleware's refresh matcher, so
+ * an actively-signed-in admin's short-lived access cookie may have lapsed by the
+ * time they open a page with `?kywi-edit=1`. These claims only gate a client-side
+ * edit AFFORDANCE (the front-of-site overlay); every real mutation still flows
+ * through /api/v1, which the middleware refreshes and which re-checks auth. So
+ * surfacing the overlay for a signature-valid-but-stale admin is safe and correct
+ * UX. Anything whose signature does not verify returns null.
+ *
+ * Intended for a host's public render to decide whether to mount the overlay for
+ * the current visitor — pair it with the re-exported `canAccessContent`.
+ */
+export async function readSessionClaims(token, secret) {
+    if (!token)
+        return null;
+    try {
+        const { payload } = await jwtVerify(token, keyFor(secret), { algorithms: ['HS256'] });
+        return claimsFromPayload(payload);
+    }
+    catch (err) {
+        // jose verifies the signature BEFORE the exp claim, so ERR_JWT_EXPIRED means
+        // the signature was valid — decode the (unverified) claims to read the role.
+        if (err.code === 'ERR_JWT_EXPIRED') {
+            try {
+                return claimsFromPayload(decodeJwt(token));
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
+    }
+}
 /**
  * Pull the access/refresh tokens out of a token-issuing endpoint's JSON body
  * (`{ data: { accessToken, refreshToken } }`). Missing/non-string fields and

package/dist/host/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEhC,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAE/B,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAChD,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAElD,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAA;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,YAAY;IACZ,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,wBAAwB;CACzB,CAAC,CAAA;AAUF,iFAAiF;AACjF,oBAAoB;AACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAA;AAC9C,SAAS,MAAM,CAAC,MAAc;IAC5B,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAyB,EACzB,MAAc;IAEd,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACrF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAClD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACvD,OAAO,WAAW,IAAI,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,IAAK,GAAyB,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,OAAO,CAAA;QACzE,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAIjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+C,EAAE,IAAI,CAAA;QACtF,MAAM,GAAG,GAAoD,EAAE,CAAA;QAC/D,IAAI,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACjG,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrG,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAiBD,SAAS,iBAAiB;IACxB,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAc;QACxB,2EAA2E;QAC3E,6EAA6E;QAC7E,kEAAkE;QAClE,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,EAAE,GAAG;QACT,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;KACjD,CAAA;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAG,kBAAkB;IAC7D,OAAO,EAAE,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,mBAAmB;IAC/D,OAAO,EAAE,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAmB,EAAE,KAAa;IAChE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IACjE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAE3C,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAE/B,iFAAiF;AACjF,0EAA0E;AAC1E,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,kBAAkB,CAAA;AAEzB,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAChD,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAElD,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAA;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,YAAY;IACZ,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,wBAAwB;CACzB,CAAC,CAAA;AAUF,iFAAiF;AACjF,oBAAoB;AACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAA;AAC9C,SAAS,MAAM,CAAC,MAAc;IAC5B,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAyB,EACzB,MAAc;IAEd,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACrF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAClD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACvD,OAAO,WAAW,IAAI,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,IAAK,GAAyB,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,OAAO,CAAA;QACzE,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAYD,SAAS,iBAAiB,CAAC,OAAgC;IACzD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC,CAAE,OAAO,CAAC,QAAQ,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACpF,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAyB,EACzB,MAAc;IAEd,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACrF,OAAO,iBAAiB,CAAC,OAAkC,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAK,GAAyB,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,OAAO,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAA4B,CAAC,CAAA;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAIjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+C,EAAE,IAAI,CAAA;QACtF,MAAM,GAAG,GAAoD,EAAE,CAAA;QAC/D,IAAI,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACjG,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrG,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAiBD,SAAS,iBAAiB;IACxB,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAc;QACxB,2EAA2E;QAC3E,6EAA6E;QAC7E,kEAAkE;QAClE,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,EAAE,GAAG;QACT,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;KACjD,CAAA;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAG,kBAAkB;IAC7D,OAAO,EAAE,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,mBAAmB;IAC/D,OAAO,EAAE,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAmB,EAAE,KAAa;IAChE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IACjE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC"}

package/dist/layout/comments-module.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Comments layout module (#29). Renders the approved-comment list for the
+ * current content plus a public submission form. New comments POST to the
+ * collection endpoint `POST /api/v1/comments` and always land in the moderation
+ * queue as `pending`; they only appear here once an editor approves them (the
+ * list reads `GET /api/v1/comments?contentId=…&status=approved`, which the API
+ * only ever returns approved rows for).
+ *
+ * Inside the layout-editor canvas it renders a non-interactive preview (no live
+ * `<form>`), matching the Form module's editor behaviour (kywi-cms#36).
+ */
+interface ModuleProps {
+    props: Record<string, unknown>;
+    style?: Record<string, string>;
+}
+export declare function CommentsModule({ props }: ModuleProps): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=comments-module.d.ts.map

package/dist/layout/comments-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments-module.d.ts","sourceRoot":"","sources":["../../src/layout/comments-module.tsx"],"names":[],"mappings":"AAKA;;;;;;;;;;GAUG;AAEH,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AA2OD,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,2CAmBpD"}

package/dist/layout/comments-module.js

@@ -0,0 +1,130 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useContext, useEffect, useRef, useState } from 'react';
+import { ModuleEditorContext } from './module-render-context.js';
+const COMMENTS_ENDPOINT = '/api/v1/comments';
+const HONEYPOT_FIELD = '_kywi_hp';
+/**
+ * Resolve the content id this module is attached to, in priority order:
+ *  1. an explicit `contentId` prop (advanced binding / preview),
+ *  2. a `<meta name="kywi:content-id">` emitted on the public content page,
+ *  3. the nearest `[data-kywi-content-id]` ancestor (shared with inline editing).
+ * Resolution beyond the explicit prop happens client-side only, so SSR stays
+ * deterministic.
+ */
+function useResolvedContentId(explicit, ref) {
+    const [resolved, setResolved] = useState(explicit ?? null);
+    useEffect(() => {
+        if (explicit) {
+            setResolved(explicit);
+            return;
+        }
+        if (typeof document === 'undefined')
+            return;
+        const meta = document
+            .querySelector('meta[name="kywi:content-id"]')
+            ?.getAttribute('content');
+        if (meta) {
+            setResolved(meta);
+            return;
+        }
+        const el = ref.current?.closest('[data-kywi-content-id]');
+        const attr = el?.getAttribute('data-kywi-content-id');
+        if (attr)
+            setResolved(attr);
+    }, [explicit, ref]);
+    return resolved;
+}
+function authorLabel(c) {
+    return c.authorName && c.authorName.trim() ? c.authorName : 'Anonymous';
+}
+// ─── Editor preview (non-interactive) ────────────────────────────────────────
+function CommentsModulePreview({ title, submitLabel }) {
+    return (_jsxs("div", { className: "kywi-module kywi-module-comments kywi-module-comments-preview", "aria-hidden": "true", children: [_jsx("h2", { className: "kywi-comments-title", children: title }), _jsx("p", { className: "kywi-comments-preview-note", children: "Approved comments for this content appear here; visitors can post new ones (held for moderation)." }), _jsxs("div", { className: "kywi-comments-form kywi-comments-form-preview", children: [_jsx("input", { className: "kywi-form-input", disabled: true, placeholder: "Name (optional)" }), _jsx("textarea", { className: "kywi-form-textarea", disabled: true, placeholder: "Add a comment\u2026" }), _jsx("button", { type: "button", className: "kywi-form-submit", disabled: true, children: submitLabel })] })] }));
+}
+// ─── Public view (interactive) ───────────────────────────────────────────────
+function CommentsModuleView({ title, submitLabel, allowAnonymous, explicitId, }) {
+    const wrapperRef = useRef(null);
+    const contentId = useResolvedContentId(explicitId, wrapperRef);
+    const [comments, setComments] = useState([]);
+    const [loaded, setLoaded] = useState(false);
+    const [authorName, setAuthorName] = useState('');
+    const [authorEmail, setAuthorEmail] = useState('');
+    const [body, setBody] = useState('');
+    const [honeypot, setHoneypot] = useState('');
+    const [submitting, setSubmitting] = useState(false);
+    const [submitted, setSubmitted] = useState(false);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        if (!contentId)
+            return;
+        let cancelled = false;
+        fetch(`${COMMENTS_ENDPOINT}?contentId=${encodeURIComponent(contentId)}&status=approved`, {
+            credentials: 'include',
+        })
+            .then(r => (r.ok ? r.json() : null))
+            .then((payload) => {
+            if (!cancelled && Array.isArray(payload?.data)) {
+                // API returns newest-first; show oldest-first for readable threads.
+                setComments([...payload.data].reverse());
+            }
+        })
+            .catch(() => { })
+            .finally(() => { if (!cancelled)
+            setLoaded(true); });
+        return () => { cancelled = true; };
+    }, [contentId]);
+    const handleSubmit = async (e) => {
+        e.preventDefault();
+        setError(null);
+        if (!contentId) {
+            setError('This comments block is not connected to any content yet.');
+            return;
+        }
+        setSubmitting(true);
+        try {
+            const payload = { contentId, body };
+            if (authorName)
+                payload.authorName = authorName;
+            if (authorEmail)
+                payload.authorEmail = authorEmail;
+            if (honeypot)
+                payload[HONEYPOT_FIELD] = honeypot;
+            const res = await fetch(COMMENTS_ENDPOINT, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify(payload),
+            });
+            const result = (await res.json().catch(() => null));
+            if (!res.ok) {
+                setError(result?.error?.message ?? 'Could not submit your comment. Please try again.');
+            }
+            else {
+                setSubmitted(true);
+                setAuthorName('');
+                setAuthorEmail('');
+                setBody('');
+            }
+        }
+        catch {
+            setError('Network error. Please try again.');
+        }
+        finally {
+            setSubmitting(false);
+        }
+    };
+    return (_jsxs("div", { ref: wrapperRef, className: "kywi-module kywi-module-comments", "data-content-id": contentId ?? '', children: [_jsx("h2", { className: "kywi-comments-title", children: title }), _jsx("ul", { className: "kywi-comments-list", children: comments.map(c => (_jsxs("li", { className: "kywi-comment", children: [_jsxs("div", { className: "kywi-comment-meta", children: [_jsx("span", { className: "kywi-comment-author", children: authorLabel(c) }), c.createdAt && (_jsx("time", { className: "kywi-comment-date", dateTime: c.createdAt, children: new Date(c.createdAt).toLocaleDateString() }))] }), _jsx("p", { className: "kywi-comment-body", children: c.body })] }, c.id))) }), loaded && comments.length === 0 && (_jsx("p", { className: "kywi-comments-empty", children: "Be the first to comment." })), submitted ? (_jsx("div", { className: "kywi-comments-success", role: "status", children: _jsx("p", { children: "Thanks \u2014 your comment has been submitted and is awaiting moderation." }) })) : (_jsxs("form", { className: "kywi-comments-form", onSubmit: handleSubmit, children: [_jsx("div", { style: { position: 'absolute', left: '-9999px' }, "aria-hidden": "true", children: _jsx("input", { type: "text", name: HONEYPOT_FIELD, tabIndex: -1, autoComplete: "off", value: honeypot, onChange: e => setHoneypot(e.target.value) }) }), allowAnonymous && (_jsxs("div", { className: "kywi-comments-fields", children: [_jsx("label", { className: "kywi-form-label", htmlFor: "kywi-comment-name", children: "Name" }), _jsx("input", { id: "kywi-comment-name", className: "kywi-form-input", type: "text", value: authorName, placeholder: "Your name (optional)", onChange: e => setAuthorName(e.target.value) }), _jsx("label", { className: "kywi-form-label", htmlFor: "kywi-comment-email", children: "Email" }), _jsx("input", { id: "kywi-comment-email", className: "kywi-form-input", type: "email", value: authorEmail, placeholder: "Your email (optional, not published)", onChange: e => setAuthorEmail(e.target.value) })] })), _jsx("label", { className: "kywi-form-label", htmlFor: "kywi-comment-body", children: "Comment" }), _jsx("textarea", { id: "kywi-comment-body", className: "kywi-form-textarea", required: true, value: body, placeholder: "Add a comment\u2026", onChange: e => setBody(e.target.value) }), error && _jsx("div", { className: "kywi-form-error", role: "alert", children: error }), _jsx("div", { className: "kywi-form-actions", children: _jsx("button", { type: "submit", className: "kywi-form-submit", disabled: submitting || !body.trim(), children: submitting ? 'Submitting…' : submitLabel }) })] }))] }));
+}
+export function CommentsModule({ props }) {
+    const inEditor = useContext(ModuleEditorContext);
+    const title = String(props.title ?? 'Comments');
+    const submitLabel = String(props.submitLabel ?? 'Post Comment');
+    const allowAnonymous = props.allowAnonymous !== false;
+    const explicitId = props.contentId ? String(props.contentId) : undefined;
+    if (inEditor) {
+        return _jsx(CommentsModulePreview, { title: title, submitLabel: submitLabel });
+    }
+    return (_jsx(CommentsModuleView, { title: title, submitLabel: submitLabel, allowAnonymous: allowAnonymous, explicitId: explicitId }));
+}
+//# sourceMappingURL=comments-module.js.map

package/dist/layout/comments-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments-module.js","sourceRoot":"","sources":["../../src/layout/comments-module.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AA0BhE,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AAC5C,MAAM,cAAc,GAAG,UAAU,CAAA;AAEjC;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,QAA4B,EAC5B,GAAwC;IAExC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,QAAQ,IAAI,IAAI,CAAC,CAAA;IACzE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,CAAC,QAAQ,CAAC,CAAA;YACrB,OAAM;QACR,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,OAAM;QAC3C,MAAM,IAAI,GAAG,QAAQ;aAClB,aAAa,CAAC,8BAA8B,CAAC;YAC9C,EAAE,YAAY,CAAC,SAAS,CAAC,CAAA;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAA;QACzD,MAAM,IAAI,GAAG,EAAE,EAAE,YAAY,CAAC,sBAAsB,CAAC,CAAA;QACrD,IAAI,IAAI;YAAE,WAAW,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;IACnB,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,CAAgB;IACnC,OAAO,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAA;AACzE,CAAC;AAED,gFAAgF;AAEhF,SAAS,qBAAqB,CAAC,EAAE,KAAK,EAAE,WAAW,EAA0C;IAC3F,OAAO,CACL,eAAK,SAAS,EAAC,+DAA+D,iBAAa,MAAM,aAC/F,aAAI,SAAS,EAAC,qBAAqB,YAAE,KAAK,GAAM,EAChD,YAAG,SAAS,EAAC,4BAA4B,kHAErC,EACJ,eAAK,SAAS,EAAC,+CAA+C,aAC5D,gBAAO,SAAS,EAAC,iBAAiB,EAAC,QAAQ,QAAC,WAAW,EAAC,iBAAiB,GAAG,EAC5E,mBAAU,SAAS,EAAC,oBAAoB,EAAC,QAAQ,QAAC,WAAW,EAAC,qBAAgB,GAAG,EACjF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,kBAAkB,EAAC,QAAQ,kBAAE,WAAW,GAAU,IAC9E,IACF,CACP,CAAA;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,EAC1B,KAAK,EACL,WAAW,EACX,cAAc,EACd,UAAU,GAMX;IACC,MAAM,UAAU,GAAG,MAAM,CAAwB,IAAI,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAE9D,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAkB,EAAE,CAAC,CAAA;IAC7D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAChD,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACpC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS;YAAE,OAAM;QACtB,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,KAAK,CAAC,GAAG,iBAAiB,cAAc,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,EAAE;YACvF,WAAW,EAAE,SAAS;SACvB,CAAC;aACC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,OAA0C,EAAE,EAAE;YACnD,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/C,oEAAoE;gBACpE,WAAW,CAAC,CAAC,GAAG,OAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAqC,CAAC,CAAC;aAClD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,SAAS,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACrD,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAA,CAAC,CAAC,CAAA;IACnC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,YAAY,GAAG,KAAK,EAAE,CAAkB,EAAE,EAAE;QAChD,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,0DAA0D,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAA4B,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YAC5D,IAAI,UAAU;gBAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;YAC/C,IAAI,WAAW;gBAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAA;YAClD,IAAI,QAAQ;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;YAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE1C,CAAA;YACR,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,kDAAkD,CAAC,CAAA;YACxF,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,CAAA;gBAClB,aAAa,CAAC,EAAE,CAAC,CAAA;gBACjB,cAAc,CAAC,EAAE,CAAC,CAAA;gBAClB,OAAO,CAAC,EAAE,CAAC,CAAA;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,kCAAkC,CAAC,CAAA;QAC9C,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,CAAA;IAED,OAAO,CACL,eAAK,GAAG,EAAE,UAAU,EAAE,SAAS,EAAC,kCAAkC,qBAAkB,SAAS,IAAI,EAAE,aACjG,aAAI,SAAS,EAAC,qBAAqB,YAAE,KAAK,GAAM,EAEhD,aAAI,SAAS,EAAC,oBAAoB,YAC/B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACjB,cAAe,SAAS,EAAC,cAAc,aACrC,eAAK,SAAS,EAAC,mBAAmB,aAChC,eAAM,SAAS,EAAC,qBAAqB,YAAE,WAAW,CAAC,CAAC,CAAC,GAAQ,EAC5D,CAAC,CAAC,SAAS,IAAI,CACd,eAAM,SAAS,EAAC,mBAAmB,EAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,YACtD,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,GACtC,CACR,IACG,EACN,YAAG,SAAS,EAAC,mBAAmB,YAAE,CAAC,CAAC,IAAI,GAAK,KATtC,CAAC,CAAC,EAAE,CAUR,CACN,CAAC,GACC,EACJ,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAClC,YAAG,SAAS,EAAC,qBAAqB,yCAA6B,CAChE,EAEA,SAAS,CAAC,CAAC,CAAC,CACX,cAAK,SAAS,EAAC,uBAAuB,EAAC,IAAI,EAAC,QAAQ,YAClD,oGAA2E,GACvE,CACP,CAAC,CAAC,CAAC,CACF,gBAAM,SAAS,EAAC,oBAAoB,EAAC,QAAQ,EAAE,YAAY,aAEzD,cAAK,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAc,MAAM,YACvE,gBACE,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,EAClB,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAC1C,GACE,EAEL,cAAc,IAAI,CACjB,eAAK,SAAS,EAAC,sBAAsB,aACnC,gBAAO,SAAS,EAAC,iBAAiB,EAAC,OAAO,EAAC,mBAAmB,qBAAa,EAC3E,gBACE,EAAE,EAAC,mBAAmB,EACtB,SAAS,EAAC,iBAAiB,EAC3B,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,UAAU,EACjB,WAAW,EAAC,sBAAsB,EAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAC5C,EACF,gBAAO,SAAS,EAAC,iBAAiB,EAAC,OAAO,EAAC,oBAAoB,sBAAc,EAC7E,gBACE,EAAE,EAAC,oBAAoB,EACvB,SAAS,EAAC,iBAAiB,EAC3B,IAAI,EAAC,OAAO,EACZ,KAAK,EAAE,WAAW,EAClB,WAAW,EAAC,sCAAsC,EAClD,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAC7C,IACE,CACP,EAED,gBAAO,SAAS,EAAC,iBAAiB,EAAC,OAAO,EAAC,mBAAmB,wBAAgB,EAC9E,mBACE,EAAE,EAAC,mBAAmB,EACtB,SAAS,EAAC,oBAAoB,EAC9B,QAAQ,QACR,KAAK,EAAE,IAAI,EACX,WAAW,EAAC,qBAAgB,EAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GACtC,EAED,KAAK,IAAI,cAAK,SAAS,EAAC,iBAAiB,EAAC,IAAI,EAAC,OAAO,YAAE,KAAK,GAAO,EAErE,cAAK,SAAS,EAAC,mBAAmB,YAChC,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,kBAAkB,EAAC,QAAQ,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YACpF,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,GAClC,GACL,IACD,CACR,IACG,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAE,KAAK,EAAe;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,KAAK,KAAK,CAAA;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAExE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,KAAC,qBAAqB,IAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,GAAI,CAAA;IAC1E,CAAC;IAED,OAAO,CACL,KAAC,kBAAkB,IACjB,KAAK,EAAE,KAAK,EACZ,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,GACtB,CACH,CAAA;AACH,CAAC"}

package/dist/layout/feed-hydration.d.ts

@@ -0,0 +1,75 @@
+/**
+ * feed-hydration.ts
+ *
+ * Server-side data resolution for the public layout render path.
+ *
+ * The `feedDisplay` module (see modules.tsx) is a `'use client'` component: it can
+ * only render items it is *given* via `props.items` — it cannot run a database
+ * query itself. On the public site, nothing ran that query, so every Feed Display
+ * module rendered an empty `<div class="kywi-feed-items">` (kywi-cms#28).
+ *
+ * This module closes that gap without coupling the renderer to a database: the
+ * host supplies a {@link FeedItemsResolver} (it has DB + feed-engine access), and
+ * {@link hydrateLayoutFeeds} walks a {@link LayoutDocument}, runs each feed once,
+ * maps rows to the display shape the module expects, and injects `props.items`
+ * before the document is handed to `<KywiRegion>`. This mirrors the existing
+ * `ComponentResolver` seam in renderer.tsx: core owns the walk + shape, the host
+ * owns the data access.
+ */
+import type { LayoutDocument } from './types.js';
+/**
+ * The display-ready item shape `FeedDisplayModule` renders. Every field is a
+ * plain serializable value so the hydrated document can cross the
+ * server → client boundary as props.
+ */
+export interface FeedDisplayItem {
+    id: string;
+    title: string;
+    /** Absolute-or-root-relative link to the item, or null to render an unlinked title. */
+    href: string | null;
+    /** ISO-8601 timestamp string, or null when the row has no publish/created date. */
+    date: string | null;
+    summary: string | null;
+    /** Resolved image URL, or null. Media-id → URL resolution is a host concern. */
+    image: string | null;
+}
+/**
+ * Resolve a feed slug to its raw content rows, server-side. The host implements
+ * this over the feed engine, e.g.
+ *
+ * ```ts
+ * const resolveFeedItems: FeedItemsResolver = async (slug, { limit }) => {
+ *   const feed = await getFeedBySlug(db, slug, siteId)
+ *   if (!feed) return []
+ *   const result = await executeFeedQuery(
+ *     db,
+ *     { ...feed.query, siteId, status: 'published', limit },
+ *     contentTypeMap,
+ *     customTableMap,
+ *   )
+ *   return result.items
+ * }
+ * ```
+ *
+ * Rows are mapped to {@link FeedDisplayItem} by {@link contentRowsToFeedItems}.
+ */
+export type FeedItemsResolver = (feedSlug: string, opts: {
+    limit: number;
+}) => Promise<Array<Record<string, unknown>>>;
+/**
+ * Map raw feed-engine content rows to the {@link FeedDisplayItem} shape the
+ * Feed Display module renders. Unknown/missing fields degrade to null (the
+ * module hides those pieces) rather than throwing. `image` is only populated
+ * when the row already carries a URL string — resolving a media id to a URL is
+ * left to the host (it can pre-map rows before returning them from the resolver).
+ */
+export declare function contentRowsToFeedItems(rows: Array<Record<string, unknown>>): FeedDisplayItem[];
+/**
+ * Resolve every `feedDisplay` module in `layout` and inject its items, returning
+ * a new document (the input is not mutated). Each distinct (slug, limit) pair is
+ * queried once and shared. Modules that already carry inline items are left
+ * untouched; a resolver error or an empty result yields an empty list (the module
+ * renders no items rather than crashing the page).
+ */
+export declare function hydrateLayoutFeeds(layout: LayoutDocument, resolveFeedItems: FeedItemsResolver): Promise<LayoutDocument>;
+//# sourceMappingURL=feed-hydration.d.ts.map

package/dist/layout/feed-hydration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-hydration.d.ts","sourceRoot":"","sources":["../../src/layout/feed-hydration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,YAAY,CAAA;AAKvF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,mFAAmF;IACnF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,KACpB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;AAqC5C;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACnC,eAAe,EAAE,CASnB;AA8CD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,iBAAiB,GAClC,OAAO,CAAC,cAAc,CAAC,CAmCzB"}

package/dist/layout/feed-hydration.js

@@ -0,0 +1,158 @@
+/**
+ * feed-hydration.ts
+ *
+ * Server-side data resolution for the public layout render path.
+ *
+ * The `feedDisplay` module (see modules.tsx) is a `'use client'` component: it can
+ * only render items it is *given* via `props.items` — it cannot run a database
+ * query itself. On the public site, nothing ran that query, so every Feed Display
+ * module rendered an empty `<div class="kywi-feed-items">` (kywi-cms#28).
+ *
+ * This module closes that gap without coupling the renderer to a database: the
+ * host supplies a {@link FeedItemsResolver} (it has DB + feed-engine access), and
+ * {@link hydrateLayoutFeeds} walks a {@link LayoutDocument}, runs each feed once,
+ * maps rows to the display shape the module expects, and injects `props.items`
+ * before the document is handed to `<KywiRegion>`. This mirrors the existing
+ * `ComponentResolver` seam in renderer.tsx: core owns the walk + shape, the host
+ * owns the data access.
+ */
+import { isLayoutSection } from './types.js';
+// ── Row → display-item mapping ────────────────────────────────────────────────
+const DEFAULT_LIMIT = 10;
+function toLimit(raw) {
+    const n = Number(raw);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_LIMIT;
+}
+function firstString(...values) {
+    for (const value of values) {
+        if (typeof value === 'string' && value.trim() !== '')
+            return value;
+    }
+    return null;
+}
+/** Derive a root-relative link from a content row's `path`/`slug`, or null. */
+function rowHref(row) {
+    const explicit = firstString(row.href, row.url);
+    if (explicit)
+        return explicit;
+    const path = row.path;
+    if (typeof path === 'string' && path !== '' && path !== '/')
+        return path;
+    const slug = row.slug;
+    if (typeof slug === 'string' && slug.trim() !== '')
+        return `/${slug.replace(/^\/+/, '')}`;
+    return null;
+}
+/** Derive an ISO date string from a content row's publish/created columns, or null. */
+function rowDate(row) {
+    const raw = row.publishedAt ?? row.date ?? row.createdAt;
+    if (raw == null)
+        return null;
+    const d = raw instanceof Date ? raw : new Date(String(raw));
+    return Number.isNaN(d.getTime()) ? null : d.toISOString();
+}
+/**
+ * Map raw feed-engine content rows to the {@link FeedDisplayItem} shape the
+ * Feed Display module renders. Unknown/missing fields degrade to null (the
+ * module hides those pieces) rather than throwing. `image` is only populated
+ * when the row already carries a URL string — resolving a media id to a URL is
+ * left to the host (it can pre-map rows before returning them from the resolver).
+ */
+export function contentRowsToFeedItems(rows) {
+    return rows.map((row, i) => ({
+        id: firstString(row.id) ?? String(i),
+        title: firstString(row.title, row.name, row.menuTitle) ?? '',
+        href: rowHref(row),
+        date: rowDate(row),
+        summary: firstString(row.summary, row.metaDescription, row.excerpt),
+        image: firstString(row.image),
+    }));
+}
+// ── Layout walk + injection ───────────────────────────────────────────────────
+function* modulesInSection(section) {
+    for (const column of section.columns) {
+        for (const node of column.nodes)
+            yield node;
+    }
+}
+/**
+ * Yield every ModuleNode reachable from a layout document — across the default
+ * regions, every page variant, every A/B experiment arm, and the sections nested
+ * inside variantContainers — so no feed module is missed regardless of where the
+ * author placed it.
+ */
+function* iterateModuleNodes(layout) {
+    const regionMaps = [layout.regions];
+    for (const pv of layout.pageVariants ?? [])
+        regionMaps.push(pv.regions);
+    for (const exp of layout.abExperiments ?? []) {
+        for (const variant of exp.variants)
+            regionMaps.push(variant.regions);
+    }
+    for (const regions of regionMaps) {
+        for (const nodes of Object.values(regions)) {
+            for (const node of nodes) {
+                if (isLayoutSection(node)) {
+                    yield* modulesInSection(node);
+                }
+                else {
+                    for (const section of node.defaultSections)
+                        yield* modulesInSection(section);
+                    for (const variant of node.variants) {
+                        for (const section of variant.sections)
+                            yield* modulesInSection(section);
+                    }
+                }
+            }
+        }
+    }
+}
+function hasResolvedItems(node) {
+    const items = node.props.items;
+    if (Array.isArray(items))
+        return items.length > 0;
+    // A non-empty JSON string of items counts as author-provided too.
+    return typeof items === 'string' && items.trim() !== '' && items.trim() !== '[]';
+}
+/**
+ * Resolve every `feedDisplay` module in `layout` and inject its items, returning
+ * a new document (the input is not mutated). Each distinct (slug, limit) pair is
+ * queried once and shared. Modules that already carry inline items are left
+ * untouched; a resolver error or an empty result yields an empty list (the module
+ * renders no items rather than crashing the page).
+ */
+export async function hydrateLayoutFeeds(layout, resolveFeedItems) {
+    const cloned = structuredClone(layout);
+    const feedNodes = [];
+    for (const node of iterateModuleNodes(cloned)) {
+        if (node.type === 'feedDisplay')
+            feedNodes.push(node);
+    }
+    if (feedNodes.length === 0)
+        return cloned;
+    const cache = new Map();
+    for (const node of feedNodes) {
+        if (hasResolvedItems(node))
+            continue;
+        const feedSlug = typeof node.props.feedSlug === 'string' ? node.props.feedSlug.trim() : '';
+        if (feedSlug === '')
+            continue;
+        const limit = toLimit(node.props.limit);
+        const key = `${feedSlug}\u0000${limit}`;
+        let items = cache.get(key);
+        if (!items) {
+            let rows = [];
+            try {
+                rows = await resolveFeedItems(feedSlug, { limit });
+            }
+            catch {
+                rows = [];
+            }
+            items = contentRowsToFeedItems(Array.isArray(rows) ? rows : []);
+            cache.set(key, items);
+        }
+        node.props.items = items;
+    }
+    return cloned;
+}
+//# sourceMappingURL=feed-hydration.js.map

package/dist/layout/feed-hydration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-hydration.js","sourceRoot":"","sources":["../../src/layout/feed-hydration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA8C5C,iFAAiF;AAEjF,MAAM,aAAa,GAAG,EAAE,CAAA;AAExB,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,MAAiB;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CAAC,GAA4B;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAA;IACzF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,GAA4B;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAA;IACxD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,CAAC,GAAG,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAoC;IAEpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;QACpC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QAC5D,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;QAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;QAClB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC;QACnE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;KAC9B,CAAC,CAAC,CAAA;AACL,CAAC;AAED,iFAAiF;AAEjF,QAAQ,CAAC,CAAC,gBAAgB,CAAC,OAAsB;IAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,CAAA;IAC7C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,QAAQ,CAAC,CAAC,kBAAkB,CAAC,MAAsB;IACjD,MAAM,UAAU,GAAwC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;IACvE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe;wBAAE,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;oBAC5E,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACpC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;4BAAE,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAA;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IACjD,kEAAkE;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAA;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,gBAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAiB,EAAE,CAAA;IAClC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAA;IAElD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,SAAQ;QACpC,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3E,IAAI,QAAQ,KAAK,EAAE;YAAE,SAAQ;QAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,GAAG,GAAG,GAAG,QAAQ,SAAS,KAAK,EAAE,CAAA;QAEvC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,GAAmC,EAAE,CAAA;YAC7C,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,CAAA;YACX,CAAC;YACD,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC/D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}