@unhingged/vizu-core 0.1.2 → 0.1.4

package/dist/index.d.cts

@@ -281,25 +281,6 @@ interface VizuCloudOptions {
      */
     autoSignIn?: boolean;
 }
-/**
- * Live collaboration config. Both keys are needed — the public key
- * identifies the Liveblocks project to the browser SDK; the auth
- * endpoint mints scoped tokens that gate room access against the
- * workspace's role + plan.
- *
- * Wired in Slice 1 of plans/live-collab.md; cursor + follow rendering
- * arrives in Slice 2+.
- */
-interface VizuLiveblocksOptions {
-    /** Liveblocks public key from the dashboard (pk_dev_… / pk_prod_…). */
-    publicKey: string;
-    /**
-     * URL of the auth endpoint that mints room tokens. Same-origin path
-     * (`/api/liveblocks-auth`) for dashboard usage; full URL for hosts
-     * embedding @vizu/core cross-origin.
-     */
-    authEndpoint: string;
-}
 interface VizuOptions {
     shortcut?: string;
     namespace?: string;
@@ -314,16 +295,6 @@ interface VizuOptions {
     storage?: StorageOption;
     /** Cloud workspace connection. Overrides `storage`. See {@link VizuCloudOptions}. */
     cloud?: VizuCloudOptions;
-    /**
-     * Optional live collaboration config. When set AND the workspace's
-     * plan carries the `live_collab` feature, @vizu/core opens a
-     * Liveblocks room scoped to (workspaceSlug, pageUrl) and renders
-     * presence + cursors + follow mode. Without this, all live-collab
-     * machinery stays inert — standalone usage is unaffected.
-     *
-     * See plans/live-collab.md.
-     */
-    liveblocks?: VizuLiveblocksOptions;
     ignoreSelectors?: string[];
     accent?: string;
     startEnabled?: boolean;
@@ -498,14 +469,6 @@ declare class CloudStorageAdapter implements StorageAdapter {
      * state.
      */
     preflightAuth(): Promise<void>;
-    /**
-     * Synchronous accessor for the currently cached bearer token, used
-     * by sibling modules that need to authenticate against the same
-     * backend (live-collab cross-origin polling). Returns null when no
-     * valid token is cached — callers fall back to credentials:'include'
-     * for same-origin or just disable themselves.
-     */
-    getCachedAuthToken(): string | null;
     load(_namespace: string): Promise<VizuComment[]>;
     addComment(_namespace: string, comment: VizuComment): Promise<void>;
     updateComment(_namespace: string, id: string, patch: Partial<VizuComment>): Promise<VizuComment | null>;
@@ -638,8 +601,6 @@ declare class Vizu {
     private selfHealedThisSession;
     private actions;
     private user;
-    /** Live-collab module — non-null only when `opts.liveblocks` and `opts.cloud` are both set AND the plan carries `live_collab`. Stays null otherwise. */
-    private liveCollab;
     private enabled;
     private rafScheduled;
     private bus;
@@ -655,6 +616,17 @@ declare class Vizu {
     off<E extends VizuEventName>(event: E, handler: VizuEventHandler<E>): void;
     setUser(user: VizuUser | null): void;
     getUser(): VizuUser | null;
+    /**
+     * Cloud-mode write gate. Every entry point that creates or modifies a
+     * comment first checks that we have a known user. Without one, the
+     * write would land as Anonymous (or 401 on the backend) — neither is
+     * the right UX. So we re-trigger the sign-in popup and refuse the
+     * action. The user signs in, this.user gets set via onAuthChanged,
+     * then they can retry the click themselves.
+     *
+     * Returns true when the caller may proceed.
+     */
+    private requireUserOrAuth;
     enable(): void;
     disable(): void;
     toggle(): void;

package/dist/index.d.ts

@@ -281,25 +281,6 @@ interface VizuCloudOptions {
      */
     autoSignIn?: boolean;
 }
-/**
- * Live collaboration config. Both keys are needed — the public key
- * identifies the Liveblocks project to the browser SDK; the auth
- * endpoint mints scoped tokens that gate room access against the
- * workspace's role + plan.
- *
- * Wired in Slice 1 of plans/live-collab.md; cursor + follow rendering
- * arrives in Slice 2+.
- */
-interface VizuLiveblocksOptions {
-    /** Liveblocks public key from the dashboard (pk_dev_… / pk_prod_…). */
-    publicKey: string;
-    /**
-     * URL of the auth endpoint that mints room tokens. Same-origin path
-     * (`/api/liveblocks-auth`) for dashboard usage; full URL for hosts
-     * embedding @vizu/core cross-origin.
-     */
-    authEndpoint: string;
-}
 interface VizuOptions {
     shortcut?: string;
     namespace?: string;
@@ -314,16 +295,6 @@ interface VizuOptions {
     storage?: StorageOption;
     /** Cloud workspace connection. Overrides `storage`. See {@link VizuCloudOptions}. */
     cloud?: VizuCloudOptions;
-    /**
-     * Optional live collaboration config. When set AND the workspace's
-     * plan carries the `live_collab` feature, @vizu/core opens a
-     * Liveblocks room scoped to (workspaceSlug, pageUrl) and renders
-     * presence + cursors + follow mode. Without this, all live-collab
-     * machinery stays inert — standalone usage is unaffected.
-     *
-     * See plans/live-collab.md.
-     */
-    liveblocks?: VizuLiveblocksOptions;
     ignoreSelectors?: string[];
     accent?: string;
     startEnabled?: boolean;
@@ -498,14 +469,6 @@ declare class CloudStorageAdapter implements StorageAdapter {
      * state.
      */
     preflightAuth(): Promise<void>;
-    /**
-     * Synchronous accessor for the currently cached bearer token, used
-     * by sibling modules that need to authenticate against the same
-     * backend (live-collab cross-origin polling). Returns null when no
-     * valid token is cached — callers fall back to credentials:'include'
-     * for same-origin or just disable themselves.
-     */
-    getCachedAuthToken(): string | null;
     load(_namespace: string): Promise<VizuComment[]>;
     addComment(_namespace: string, comment: VizuComment): Promise<void>;
     updateComment(_namespace: string, id: string, patch: Partial<VizuComment>): Promise<VizuComment | null>;
@@ -638,8 +601,6 @@ declare class Vizu {
     private selfHealedThisSession;
     private actions;
     private user;
-    /** Live-collab module — non-null only when `opts.liveblocks` and `opts.cloud` are both set AND the plan carries `live_collab`. Stays null otherwise. */
-    private liveCollab;
     private enabled;
     private rafScheduled;
     private bus;
@@ -655,6 +616,17 @@ declare class Vizu {
     off<E extends VizuEventName>(event: E, handler: VizuEventHandler<E>): void;
     setUser(user: VizuUser | null): void;
     getUser(): VizuUser | null;
+    /**
+     * Cloud-mode write gate. Every entry point that creates or modifies a
+     * comment first checks that we have a known user. Without one, the
+     * write would land as Anonymous (or 401 on the backend) — neither is
+     * the right UX. So we re-trigger the sign-in popup and refuse the
+     * action. The user signs in, this.user gets set via onAuthChanged,
+     * then they can retry the click themselves.
+     *
+     * Returns true when the caller may proceed.
+     */
+    private requireUserOrAuth;
     enable(): void;
     disable(): void;
     toggle(): void;

package/dist/index.js

@@ -1,11 +1,3 @@
-import {
-  findByFingerprint,
-  findElementByFingerprint,
-  fingerprint,
-  fingerprintKey,
-  fingerprintLabel
-} from "./chunk-OMIFOSQ2.js";
-
 // src/types.ts
 var SCHEMA_VERSION = 2;
 
@@ -365,18 +357,6 @@ var CloudStorageAdapter = class {
   async preflightAuth() {
     await this.resolveToken();
   }
-  /**
-   * Synchronous accessor for the currently cached bearer token, used
-   * by sibling modules that need to authenticate against the same
-   * backend (live-collab cross-origin polling). Returns null when no
-   * valid token is cached — callers fall back to credentials:'include'
-   * for same-origin or just disable themselves.
-   */
-  getCachedAuthToken() {
-    if (!this.cachedToken) return null;
-    if (this.isExpired(this.cachedToken)) return null;
-    return this.cachedToken.token;
-  }
   /* ─── StorageAdapter v2 ───────────────────────────────────────────── */
   async load(_namespace) {
     const out = [];
@@ -692,10 +672,297 @@ function apiErr(status, body) {
   return err;
 }
 
+// src/fingerprint.ts
+var TEXT_SNIPPET_MAX = 80;
+var ANCESTOR_DEPTH = 4;
+var ANCESTOR_MAX_SHIFT = 3;
+var TEXT_RATIO_THRESHOLD = 0.75;
+var CLASS_JACCARD_THRESHOLD = 0.6;
+function buildSelector(el) {
+  const parts = [];
+  let current = el;
+  let depth = 0;
+  while (current && current !== document.documentElement && depth < 8) {
+    let part = current.tagName.toLowerCase();
+    if (current.id) {
+      parts.unshift("#" + CSS.escape(current.id));
+      break;
+    }
+    const cls = Array.from(current.classList).filter((c) => !c.startsWith("vz-") && !c.startsWith("vizu-")).slice(0, 2);
+    if (cls.length) part += "." + cls.map((c) => CSS.escape(c)).join(".");
+    const parent = current.parentElement;
+    if (parent) {
+      const sameTag = Array.from(parent.children).filter((c) => c.tagName === current.tagName);
+      if (sameTag.length > 1) {
+        const idx = sameTag.indexOf(current);
+        part += ":nth-of-type(" + (idx + 1) + ")";
+      }
+    }
+    parts.unshift(part);
+    current = parent;
+    depth++;
+  }
+  return parts.join(" > ");
+}
+function fingerprint(el) {
+  const text = el.innerText || el.textContent || "";
+  const parent = el.parentElement;
+  let siblingIndex = 0;
+  if (parent) {
+    siblingIndex = Array.from(parent.children).indexOf(el);
+  }
+  return {
+    selector: buildSelector(el),
+    parentSelector: parent ? buildSelector(parent) : "",
+    tagName: el.tagName,
+    textSnippet: text.trim().slice(0, TEXT_SNIPPET_MAX),
+    siblingIndex,
+    attributes: {
+      id: el.id || void 0,
+      classList: Array.from(el.classList).filter((c) => !c.startsWith("vz-") && !c.startsWith("vizu-")),
+      role: el.getAttribute("role") || void 0,
+      ariaLabel: el.getAttribute("aria-label") || void 0,
+      dataKey: el.getAttribute("data-vizu-key") || void 0
+    },
+    ancestorChain: captureAncestorChain(el, ANCESTOR_DEPTH),
+    algorithmVersion: 2
+  };
+}
+function captureAncestorChain(el, depth) {
+  const steps = [];
+  let current = el.parentElement;
+  while (current && steps.length < depth) {
+    const parent = current.parentElement;
+    let nthOfType = 1;
+    if (parent) {
+      const sameTag = Array.from(parent.children).filter((c) => c.tagName === current.tagName);
+      nthOfType = sameTag.indexOf(current) + 1;
+    }
+    steps.push({ tag: current.tagName, nthOfType });
+    current = parent;
+  }
+  return steps.length > 0 ? { steps } : void 0;
+}
+function findByFingerprint(fp, root = document) {
+  if (fp.attributes.dataKey) {
+    try {
+      const byKey = root.querySelector(`[data-vizu-key="${CSS.escape(fp.attributes.dataKey)}"]`);
+      if (byKey) return { element: byKey, confidence: "exact" };
+    } catch {
+    }
+    return { element: null, confidence: "orphaned" };
+  }
+  if (fp.attributes.id) {
+    try {
+      const byId = root.querySelector("#" + CSS.escape(fp.attributes.id));
+      if (byId) return { element: byId, confidence: "exact" };
+    } catch {
+    }
+  }
+  const candidates = [];
+  const classes = fp.attributes.classList;
+  if (classes && classes.length > 0) {
+    const m = findByClassSignature(root, fp.tagName, classes);
+    if (m?.element) candidates.push({ el: m.element, rung: "class" });
+  }
+  try {
+    const bySelector = root.querySelector(fp.selector);
+    if (bySelector) candidates.push({ el: bySelector, rung: "selector" });
+  } catch {
+  }
+  if (fp.ancestorChain && fp.ancestorChain.steps.length > 0) {
+    const m = findByAncestorChain(root, fp.tagName, fp.ancestorChain.steps);
+    if (m?.element) candidates.push({ el: m.element, rung: "chain" });
+  } else {
+    try {
+      const parent = fp.parentSelector ? root.querySelector(fp.parentSelector) : root;
+      if (parent) {
+        const candidate = parent.children[fp.siblingIndex];
+        if (candidate && candidate.tagName === fp.tagName) {
+          candidates.push({ el: candidate, rung: "chain" });
+        }
+      }
+    } catch {
+    }
+  }
+  if (fp.textSnippet) {
+    const m = findByTextSnippet(root, fp.tagName, fp.textSnippet);
+    if (m?.element) candidates.push({ el: m.element, rung: "text" });
+  }
+  if (candidates.length === 0) {
+    return { element: null, confidence: "orphaned" };
+  }
+  const votes = /* @__PURE__ */ new Map();
+  for (const c of candidates) {
+    let s = votes.get(c.el);
+    if (!s) {
+      s = /* @__PURE__ */ new Set();
+      votes.set(c.el, s);
+    }
+    s.add(c.rung);
+  }
+  let best = null;
+  for (const [el, rungs] of votes) {
+    if (!best || rungs.size > best.rungs.size) best = { el, rungs };
+  }
+  if (!best) return { element: null, confidence: "orphaned" };
+  if (best.rungs.size >= 3) return { element: best.el, confidence: "likely" };
+  if (best.rungs.size >= 2) return { element: best.el, confidence: "drifted" };
+  if (best.rungs.has("class") || best.rungs.has("chain")) {
+    return { element: best.el, confidence: "drifted" };
+  }
+  return { element: null, confidence: "orphaned" };
+}
+function findByClassSignature(root, tagName, needle) {
+  const needleSet = new Set(needle.filter((c) => !c.startsWith("vz-") && !c.startsWith("vizu-")));
+  if (needleSet.size === 0) return null;
+  const all = root.querySelectorAll(tagName.toLowerCase());
+  let best = null;
+  let secondScore = 0;
+  for (const el of all) {
+    const haystack = new Set(
+      Array.from(el.classList).filter((c) => !c.startsWith("vz-") && !c.startsWith("vizu-"))
+    );
+    if (haystack.size === 0) continue;
+    const score = jaccardSimilarity(needleSet, haystack);
+    if (score < CLASS_JACCARD_THRESHOLD) continue;
+    if (!best || score > best.score) {
+      secondScore = best?.score ?? 0;
+      best = { el, score };
+    } else if (score > secondScore) {
+      secondScore = score;
+    }
+  }
+  if (!best) return null;
+  if (best.score - secondScore < 0.1) return null;
+  return { element: best.el, confidence: "likely" };
+}
+function findByAncestorChain(root, tagName, steps) {
+  const all = root.querySelectorAll(tagName.toLowerCase());
+  let best = null;
+  for (const el of all) {
+    const ancestors = collectAncestorSteps(el, steps.length + ANCESTOR_MAX_SHIFT);
+    const score = scoreChainAgainstAncestors(ancestors, steps, ANCESTOR_MAX_SHIFT);
+    if (score < 2) continue;
+    if (!best || score > best.score) best = { el, score };
+  }
+  if (!best) return null;
+  return {
+    element: best.el,
+    confidence: best.score === steps.length ? "likely" : "drifted"
+  };
+}
+function collectAncestorSteps(el, limit) {
+  const steps = [];
+  let current = el.parentElement;
+  while (current && steps.length < limit) {
+    const parent = current.parentElement;
+    let nth = 1;
+    if (parent) {
+      const sameTag = Array.from(parent.children).filter((c) => c.tagName === current.tagName);
+      nth = sameTag.indexOf(current) + 1;
+    }
+    steps.push({ tag: current.tagName, nthOfType: nth });
+    current = parent;
+  }
+  return steps;
+}
+function findByTextSnippet(root, tagName, snippet) {
+  const needle = normalizeText(snippet);
+  if (!needle) return null;
+  const all = root.querySelectorAll(tagName.toLowerCase());
+  let best = null;
+  for (const el of all) {
+    const raw = el.innerText || el.textContent || "";
+    const candidate = normalizeText(raw.slice(0, TEXT_SNIPPET_MAX * 2));
+    if (!candidate) continue;
+    const score = levenshteinRatio(needle, candidate);
+    if (score < TEXT_RATIO_THRESHOLD) continue;
+    if (!best || score > best.score) {
+      best = { el, score };
+    }
+  }
+  return best ? { element: best.el, confidence: "drifted" } : null;
+}
+function normalizeText(input) {
+  return input.toLowerCase().replace(/\s+/g, " ").trim();
+}
+function levenshteinRatio(a, b) {
+  if (a === b) return 1;
+  if (a.length === 0 || b.length === 0) return a.length === b.length ? 1 : 0;
+  const maxLen = Math.max(a.length, b.length);
+  const distance = levenshteinDistance(a, b);
+  return 1 - distance / maxLen;
+}
+function levenshteinDistance(a, b) {
+  if (a.length > b.length) {
+    const tmp = a;
+    a = b;
+    b = tmp;
+  }
+  const prev = new Array(a.length + 1);
+  const curr = new Array(a.length + 1);
+  for (let i = 0; i <= a.length; i++) prev[i] = i;
+  for (let j = 1; j <= b.length; j++) {
+    curr[0] = j;
+    for (let i = 1; i <= a.length; i++) {
+      const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+      curr[i] = Math.min(
+        curr[i - 1] + 1,
+        // insert
+        prev[i] + 1,
+        // delete
+        prev[i - 1] + cost
+        // substitute
+      );
+    }
+    for (let i = 0; i <= a.length; i++) prev[i] = curr[i];
+  }
+  return prev[a.length];
+}
+function scoreChainAgainstAncestors(actual, captured, maxShift) {
+  let best = 0;
+  for (let offset = 0; offset <= maxShift; offset++) {
+    let score = 0;
+    for (let i = 0; i < captured.length; i++) {
+      const a = actual[i + offset];
+      if (!a) break;
+      if (a.tag === captured[i].tag && a.nthOfType === captured[i].nthOfType) {
+        score++;
+      }
+    }
+    if (score > best) best = score;
+  }
+  return best;
+}
+function jaccardSimilarity(a, b) {
+  if (a.size === 0 && b.size === 0) return 1;
+  let intersection = 0;
+  for (const item of a) if (b.has(item)) intersection++;
+  const union = a.size + b.size - intersection;
+  return union === 0 ? 0 : intersection / union;
+}
+function findElementByFingerprint(fp, root) {
+  return findByFingerprint(fp, root).element;
+}
+function fingerprintKey(fp) {
+  return fp.selector + "|" + fp.textSnippet;
+}
+function fingerprintLabel(fp) {
+  const tag = fp.tagName.toLowerCase();
+  if (fp.textSnippet) {
+    const snippet = fp.textSnippet.length > 24 ? fp.textSnippet.slice(0, 24) + "\u2026" : fp.textSnippet;
+    return tag + ": " + snippet;
+  }
+  if (fp.attributes.id) return tag + "#" + fp.attributes.id;
+  if (fp.attributes.classList && fp.attributes.classList.length) return tag + "." + fp.attributes.classList[0];
+  return tag;
+}
+
 // src/highlighter.ts
 var IGNORE_SELECTOR = "[data-vizu-root], [data-vizu-ignore], script, style, link, meta, head";
 var Highlighter = class {
-  constructor(root, extraIgnore, onClick, onCurrentChange) {
+  constructor(root, extraIgnore, onClick) {
     this.current = null;
     this.active = false;
     this.paused = false;
@@ -730,7 +997,6 @@ var Highlighter = class {
     this.root = root;
     this.extraIgnore = extraIgnore;
     this.onClick = onClick;
-    this.onCurrentChange = onCurrentChange ?? null;
     this.overlay = document.createElement("div");
     this.overlay.className = "vz-highlight";
     this.overlay.style.display = "none";
@@ -739,7 +1005,6 @@ var Highlighter = class {
   setCurrent(el) {
     if (this.current === el) return;
     this.current = el;
-    this.onCurrentChange?.(el);
   }
   start() {
     if (this.active) return;
@@ -2784,8 +3049,6 @@ var Vizu = class {
     this.selfHealedThisSession = /* @__PURE__ */ new Set();
     this.actions = [];
     this.user = null;
-    /** Live-collab module — non-null only when `opts.liveblocks` and `opts.cloud` are both set AND the plan carries `live_collab`. Stays null otherwise. */
-    this.liveCollab = null;
     this.enabled = false;
     this.rafScheduled = false;
     this.bus = new EventBus();
@@ -2857,31 +3120,6 @@ var Vizu = class {
     if (options.actions) this.actions = [...options.actions];
     if (options.onCommentAdded) this.bus.on("comment:added", (p) => options.onCommentAdded(p.comment));
     if (options.onCommentRemoved) this.bus.on("comment:removed", (p) => options.onCommentRemoved(p.id));
-    if (options.cloud) {
-      const cloud = options.cloud;
-      const apiUrl = (cloud.apiUrl ?? "https://vizu.unhingged.com").replace(/\/$/, "");
-      void import("./live-collab-BVLNJ5QI.js").then(({ LiveCollab }) => {
-        this.liveCollab = new LiveCollab({
-          workspaceSlug: cloud.workspace,
-          apiUrl,
-          getAuthHeader: async () => {
-            if (typeof window === "undefined") return null;
-            try {
-              if (new URL(apiUrl).origin === window.location.origin) return null;
-            } catch {
-              return null;
-            }
-            const adapter = this.storage;
-            if (adapter instanceof CloudStorageAdapter) {
-              const token = adapter.getCachedAuthToken();
-              if (token) return { Authorization: `Bearer ${token}` };
-            }
-            return null;
-          }
-        });
-        void this.liveCollab.start();
-      });
-    }
     if (typeof window !== "undefined") {
       window.addEventListener("keydown", this.onKeyDown);
       void this.loadComments().then(() => this.subscribeStorage());
@@ -2905,6 +3143,23 @@ var Vizu = class {
   getUser() {
     return this.user;
   }
+  /**
+   * Cloud-mode write gate. Every entry point that creates or modifies a
+   * comment first checks that we have a known user. Without one, the
+   * write would land as Anonymous (or 401 on the backend) — neither is
+   * the right UX. So we re-trigger the sign-in popup and refuse the
+   * action. The user signs in, this.user gets set via onAuthChanged,
+   * then they can retry the click themselves.
+   *
+   * Returns true when the caller may proceed.
+   */
+  requireUserOrAuth() {
+    if (!(this.storage instanceof CloudStorageAdapter)) return true;
+    if (this.user) return true;
+    void this.storage.preflightAuth().catch(() => {
+    });
+    return false;
+  }
   /* ===== Lifecycle ===== */
   enable() {
     if (this.enabled) return;
@@ -2939,8 +3194,6 @@ var Vizu = class {
     this.unsubscribeStorage?.();
     this.unsubscribeStorage = null;
     this.selfHealedThisSession.clear();
-    this.liveCollab?.destroy();
-    this.liveCollab = null;
     this.bus.clear();
   }
   /* ===== Action API ===== */
@@ -3075,6 +3328,7 @@ var Vizu = class {
    * patch for adapters that don't implement reply ops.
    */
   async addReply(commentId, text, mentions) {
+    if (!this.requireUserOrAuth()) return null;
     const idx = this.comments.findIndex((c) => c.id === commentId);
     if (idx === -1) return null;
     const reply = {
@@ -3141,6 +3395,7 @@ var Vizu = class {
   /* ===== Multi-select API ===== */
   /** Toggle multi-select mode. When on, plain clicks accumulate into the selection. */
   toggleMultiSelectMode() {
+    if (!this.requireUserOrAuth()) return;
     this.multiSelectMode = !this.multiSelectMode;
     if (!this.multiSelectMode) this.clearSelection();
     this.pill?.setMultiSelectState(this.multiSelectMode, this.pendingFingerprints.length);
@@ -3262,11 +3517,7 @@ var Vizu = class {
     this.highlighter = new Highlighter(
       this.root,
       this.opts.ignoreSelectors ?? [],
-      (el, e) => this.onElementClick(el, e),
-      (el) => {
-        if (!this.liveCollab) return;
-        this.liveCollab.setLocalSelection(el ? fingerprint(el) : null);
-      }
+      (el, e) => this.onElementClick(el, e)
     );
     this.highlighter.start();
     this.renderAllMarkers();
@@ -3306,6 +3557,7 @@ var Vizu = class {
       p.onSelect(fp2);
       return;
     }
+    if (!this.requireUserOrAuth()) return;
     const fp = fingerprint(el);
     if (this.popover?.isOpen() && e.shiftKey) {
       this.popover.addAnchor(fp, el);
@@ -3353,6 +3605,7 @@ var Vizu = class {
     );
   }
   async addCommentFromPopover(text, fps, references, mentions, attachments) {
+    if (!this.requireUserOrAuth()) return;
     if (fps.length === 0) return;
     const pageUrl = typeof location !== "undefined" ? location.href : void 0;
     const c = {