@unhingged/vizu-core 0.1.3 → 0.1.4

package/dist/index.d.cts

@@ -616,6 +616,17 @@ declare class Vizu {
     off<E extends VizuEventName>(event: E, handler: VizuEventHandler<E>): void;
     setUser(user: VizuUser | null): void;
     getUser(): VizuUser | null;
+    /**
+     * Cloud-mode write gate. Every entry point that creates or modifies a
+     * comment first checks that we have a known user. Without one, the
+     * write would land as Anonymous (or 401 on the backend) — neither is
+     * the right UX. So we re-trigger the sign-in popup and refuse the
+     * action. The user signs in, this.user gets set via onAuthChanged,
+     * then they can retry the click themselves.
+     *
+     * Returns true when the caller may proceed.
+     */
+    private requireUserOrAuth;
     enable(): void;
     disable(): void;
     toggle(): void;

package/dist/index.d.ts

@@ -616,6 +616,17 @@ declare class Vizu {
     off<E extends VizuEventName>(event: E, handler: VizuEventHandler<E>): void;
     setUser(user: VizuUser | null): void;
     getUser(): VizuUser | null;
+    /**
+     * Cloud-mode write gate. Every entry point that creates or modifies a
+     * comment first checks that we have a known user. Without one, the
+     * write would land as Anonymous (or 401 on the backend) — neither is
+     * the right UX. So we re-trigger the sign-in popup and refuse the
+     * action. The user signs in, this.user gets set via onAuthChanged,
+     * then they can retry the click themselves.
+     *
+     * Returns true when the caller may proceed.
+     */
+    private requireUserOrAuth;
     enable(): void;
     disable(): void;
     toggle(): void;

package/dist/index.js

@@ -3143,6 +3143,23 @@ var Vizu = class {
   getUser() {
     return this.user;
   }
+  /**
+   * Cloud-mode write gate. Every entry point that creates or modifies a
+   * comment first checks that we have a known user. Without one, the
+   * write would land as Anonymous (or 401 on the backend) — neither is
+   * the right UX. So we re-trigger the sign-in popup and refuse the
+   * action. The user signs in, this.user gets set via onAuthChanged,
+   * then they can retry the click themselves.
+   *
+   * Returns true when the caller may proceed.
+   */
+  requireUserOrAuth() {
+    if (!(this.storage instanceof CloudStorageAdapter)) return true;
+    if (this.user) return true;
+    void this.storage.preflightAuth().catch(() => {
+    });
+    return false;
+  }
   /* ===== Lifecycle ===== */
   enable() {
     if (this.enabled) return;
@@ -3311,6 +3328,7 @@ var Vizu = class {
    * patch for adapters that don't implement reply ops.
    */
   async addReply(commentId, text, mentions) {
+    if (!this.requireUserOrAuth()) return null;
     const idx = this.comments.findIndex((c) => c.id === commentId);
     if (idx === -1) return null;
     const reply = {
@@ -3377,6 +3395,7 @@ var Vizu = class {
   /* ===== Multi-select API ===== */
   /** Toggle multi-select mode. When on, plain clicks accumulate into the selection. */
   toggleMultiSelectMode() {
+    if (!this.requireUserOrAuth()) return;
     this.multiSelectMode = !this.multiSelectMode;
     if (!this.multiSelectMode) this.clearSelection();
     this.pill?.setMultiSelectState(this.multiSelectMode, this.pendingFingerprints.length);
@@ -3538,6 +3557,7 @@ var Vizu = class {
       p.onSelect(fp2);
       return;
     }
+    if (!this.requireUserOrAuth()) return;
     const fp = fingerprint(el);
     if (this.popover?.isOpen() && e.shiftKey) {
       this.popover.addAnchor(fp, el);
@@ -3585,6 +3605,7 @@ var Vizu = class {
     );
   }
   async addCommentFromPopover(text, fps, references, mentions, attachments) {
+    if (!this.requireUserOrAuth()) return;
     if (fps.length === 0) return;
     const pageUrl = typeof location !== "undefined" ? location.href : void 0;
     const c = {