dineway 0.2.34 → 0.2.35

package/dist/astro/routes/api/auth/passkey/register/verify.mjs

@@ -1,16 +1,16 @@
 import { t as OptionsRepository } from "../../../../../../options-BcqHWpc-.mjs";
-import "../../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../../public-discovery-BAbOvKiR.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse--7nG62_h.mjs";
-import "../../../../../../redirects-UCXyL0lP.mjs";
-import { b as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-BscLr3p2.mjs";
+import "../../../../../../redirects-DpRiuRWn.mjs";
+import { b as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../../status-DBSB6tdS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../../public-url-D5Wjq0sy.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-DV3LWuWW.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-D-_-VavY.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-BG4GO4OO.mjs";
+import { n as getPublicOrigin } from "../../../../../../public-url-4sMO36Gw.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-Cp7BI3L9.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-sUQoLEj_.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@dineway-ai/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,16 +1,16 @@
 import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
-import "../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../public-discovery-BAbOvKiR.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-Dd8LtpG5.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse--7nG62_h.mjs";
-import "../../../../../redirects-UCXyL0lP.mjs";
-import { S as passkeyVerifyBody } from "../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { S as passkeyVerifyBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-D5Wjq0sy.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-DV3LWuWW.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-D-_-VavY.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-BG4GO4OO.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-Cp7BI3L9.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-sUQoLEj_.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@dineway-ai/auth/passkey";
 

package/dist/astro/routes/api/auth/setup-token/index.mjs

@@ -3,9 +3,9 @@ import { AtomicWriteConflict, atomicBatch } from "../../../../../database/batch.
 import "../../../../../base64-Cz-aU0X1.mjs";
 import "../../../../../types-BqxIv8Il.mjs";
 import { t as AuditRepository } from "../../../../../audit-F5iWkbcJ.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-Dd8LtpG5.mjs";
-import { i as hasScope$1, n as TOKEN_PREFIXES, r as generatePrefixedToken } from "../../../../../api-tokens-D5K_Csub.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-D5Wjq0sy.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { i as hasScope$1, n as TOKEN_PREFIXES, r as generatePrefixedToken } from "../../../../../api-tokens-DA18zxza.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { Role } from "@dineway-ai/auth";

package/dist/astro/routes/api/auth/setup-token/verify.mjs

@@ -1,8 +1,8 @@
 import "../../../../../d1-binding-D6HZa3ks.mjs";
 import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "../../../../../database/batch.mjs";
 import { r as currentIsoTimestampValue } from "../../../../../dialect-helpers-C6xtO-Ui.mjs";
-import { o as hashPrefixedToken } from "../../../../../api-tokens-D5K_Csub.mjs";
-import { t as escapeHtml } from "../../../../../escape-BWC4s5bV.mjs";
+import { o as hashPrefixedToken } from "../../../../../api-tokens-DA18zxza.mjs";
+import { t as escapeHtml } from "../../../../../escape-B1GM0yJU.mjs";
 import { sql } from "kysely";
 
 //#region src/astro/routes/api/auth/setup-token/verify.ts

package/dist/astro/routes/api/auth/signup/complete.mjs

@@ -1,16 +1,16 @@
 import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
-import "../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../public-discovery-BAbOvKiR.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-Dd8LtpG5.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse--7nG62_h.mjs";
-import "../../../../../redirects-UCXyL0lP.mjs";
-import { C as signupCompleteBody } from "../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { C as signupCompleteBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-D5Wjq0sy.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-DV3LWuWW.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-D-_-VavY.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-BG4GO4OO.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-Cp7BI3L9.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-sUQoLEj_.mjs";
 import { SignupError, completeSignup } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@dineway-ai/auth/passkey";

package/dist/astro/routes/api/auth/signup/request.mjs

@@ -1,16 +1,16 @@
 import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
-import "../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../runtime-env-CQVAWHzH.mjs";
-import "../../../../../public-discovery-BAbOvKiR.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-Dd8LtpG5.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse--7nG62_h.mjs";
-import "../../../../../redirects-UCXyL0lP.mjs";
-import { w as signupRequestBody } from "../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../runtime-env-v-1UXPAH.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { w as signupRequestBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CAW9o4Dw.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-Dd1TnzZP.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-wXFqbm9c.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CvDP0g0F.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-RaBJEgyt.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-DoTPKRND.mjs";
 import { requestSignup } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/signup/verify.mjs

@@ -1,4 +1,4 @@
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-Dd8LtpG5.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
 import { SignupError, roleFromLevel, validateSignupToken } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/comments/_collection_/_contentId_/index.d.mts

@@ -1,5 +1,66 @@
-import { APIRoute } from "astro";
+import { Hs as Comment, a as CommentAfterModerateEvent, j as ModerationDecision, l as CommentModerateEvent, n as CollectionCommentSettings, r as CommentAfterCreateEvent, s as CommentBeforeCreateEvent } from "../../../../../../types-Tt_IGMno.mjs";
+import { t as Database } from "../../../../../../types-CVRNRAA5.mjs";
+import "../../../../../../runner-Cxl-vyk2.mjs";
+import { AtomicBatch } from "../../../../../../database/batch.mjs";
+import "../../../../../../index-mlJSqFkG.mjs";
+import "../../../../../../types-SddyDti7.mjs";
+import "../../../../../../public-url-zoO-QbN6.mjs";
+import "../../../../../../validate-CCOsvPg2.mjs";
+import "../../../../../../byline-fields-BO96fXLv.mjs";
+import "../../../../../../types-CAD4OvmF.mjs";
+import { Kysely } from "kysely";
+import { APIContext, APIRoute } from "astro";
 
+//#region src/comments/service.d.ts
+interface CommentCreateInput {
+  collection: string;
+  contentId: string;
+  parentId?: string | null;
+  authorName: string;
+  authorEmail: string;
+  authorUserId?: string | null;
+  body: string;
+  ipHash?: string | null;
+  userAgent?: string | null;
+}
+interface CommentCreateResult {
+  comment: Comment;
+  decision: ModerationDecision;
+}
+/**
+ * Hook runner interface — injected from the runtime so the service
+ * doesn't need to know about the hook pipeline internals.
+ */
+interface CommentHookRunner {
+  /** Run comment:beforeCreate pipeline. Returns modified event or false. */
+  runBeforeCreate(event: CommentBeforeCreateEvent): Promise<CommentBeforeCreateEvent | false>;
+  /** Run comment:moderate exclusive hook. Returns moderation decision. */
+  runModerate(event: CommentModerateEvent): Promise<ModerationDecision>;
+  /** Run comment:afterCreate after the comment's batch has committed. */
+  fireAfterCreate(event: CommentAfterCreateEvent): void | Promise<void>;
+  /** Fire comment:afterModerate (fire-and-forget). */
+  fireAfterModerate(event: CommentAfterModerateEvent): void;
+}
+/**
+ * Create a comment through the full hook pipeline.
+ *
+ * Returns null if the comment was rejected by a beforeCreate handler.
+ */
+declare function prepareComment(db: Kysely<Database>, input: CommentCreateInput, collectionSettings: CollectionCommentSettings, hooks: CommentHookRunner, contentInfo?: {
+  id: string;
+  collection: string;
+  slug: string;
+  title?: string;
+  author?: {
+    id: string;
+    name: string | null;
+    email: string;
+  };
+}): Promise<(CommentCreateResult & {
+  batch: AtomicBatch;
+  afterCommit: () => Promise<void>;
+}) | null>;
+//#endregion
 //#region src/astro/routes/api/comments/[collection]/[contentId]/index.d.ts
 declare const prerender = false;
 /**
@@ -9,6 +70,16 @@ declare const GET: APIRoute;
 /**
  * Submit a comment (public, gated by anti-spam checks)
  */
+interface PreparedCommentRequest {
+  comment: NonNullable<Awaited<ReturnType<typeof prepareComment>>>["comment"];
+  batch: AtomicBatch;
+  afterCommit: () => Promise<Response>;
+}
+declare function prepareCommentRequest({
+  params,
+  request,
+  locals
+}: APIContext): Promise<Response | PreparedCommentRequest>;
 declare const POST: APIRoute;
 //#endregion
-export { GET, POST, prerender };
+export { GET, POST, PreparedCommentRequest, prepareCommentRequest, prerender };

package/dist/astro/routes/api/comments/_collection_/_contentId_/index.mjs

@@ -1,25 +1,29 @@
+import "../../../../../../d1-binding-D6HZa3ks.mjs";
+import { atomicBatch, rowUnchanged } from "../../../../../../database/batch.mjs";
 import { t as validateIdentifier } from "../../../../../../validate-Co3j6T_K.mjs";
+import { r as currentIsoTimestampValue } from "../../../../../../dialect-helpers-C6xtO-Ui.mjs";
 import "../../../../../../base64-Cz-aU0X1.mjs";
 import "../../../../../../types-BqxIv8Il.mjs";
 import "../../../../../../after-BVaUn7bK.mjs";
 import "../../../../../../object-cache-BGjIlY9s.mjs";
-import { t as CommentRepository } from "../../../../../../comment-Bi7cJ9SS.mjs";
+import "../../../../../../comment-kgLTdtQD.mjs";
 import "../../../../../../options-BcqHWpc-.mjs";
-import "../../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../../runtime-env-CQVAWHzH.mjs";
-import { a as resolveSecretsCached } from "../../../../../../secrets-Cg0D2gQW.mjs";
-import "../../../../../../public-discovery-BAbOvKiR.mjs";
-import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse--7nG62_h.mjs";
-import { _t as createCommentBody } from "../../../../../../redirects-UCXyL0lP.mjs";
-import "../../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../../runtime-env-v-1UXPAH.mjs";
+import { a as resolveSecretsCached } from "../../../../../../secrets-BP2YTPWn.mjs";
+import "../../../../../../public-discovery-CTql6jdZ.mjs";
+import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-BscLr3p2.mjs";
+import { _t as createCommentBody } from "../../../../../../redirects-DpRiuRWn.mjs";
+import "../../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../../status-DBSB6tdS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import "../../../../../../trusted-proxy-CAW9o4Dw.mjs";
-import { t as extractRequestMeta } from "../../../../../../request-meta-BOcuHAXD.mjs";
-import { c as hashIp, s as handleCommentList, t as checkRateLimit } from "../../../../../../comments-Dg_gWBEB.mjs";
-import { t as getSiteBaseUrl } from "../../../../../../site-url-wXFqbm9c.mjs";
-import { i as sendCommentNotification, t as createComment } from "../../../../../../service-DilVsWGD.mjs";
+import "../../../../../../trusted-proxy-CvDP0g0F.mjs";
+import { t as extractRequestMeta } from "../../../../../../request-meta-C6yGqnGD.mjs";
+import { c as hashIp, s as handleCommentList, t as checkRateLimit } from "../../../../../../comments-ZYK_cZvx.mjs";
+import { t as getSiteBaseUrl } from "../../../../../../site-url-DoTPKRND.mjs";
+import { i as sendCommentNotification, n as prepareComment } from "../../../../../../service-DOFqfUVv.mjs";
+import { sql } from "kysely";
 
 //#region src/astro/routes/api/comments/[collection]/[contentId]/index.ts
 const prerender = false;
@@ -48,10 +52,7 @@ const GET = async ({ params, url, locals }) => {
 		return handleError(error, "Failed to list comments", "COMMENT_LIST_ERROR");
 	}
 };
-/**
-* Submit a comment (public, gated by anti-spam checks)
-*/
-const POST = async ({ params, request, locals }) => {
+async function prepareCommentRequest({ params, request, locals }) {
 	const { dineway, user } = locals;
 	const { collection, contentId } = params;
 	if (!collection || !contentId) return apiError("VALIDATION_ERROR", "Collection and content ID required", 400);
@@ -76,11 +77,20 @@ const POST = async ({ params, request, locals }) => {
 			"published_at"
 		]).where("id", "=", contentId).where("status", "=", "published").where("deleted_at", "is", null).executeTakeFirst();
 		if (!contentRow) return apiError("NOT_FOUND", "Content not found", 404);
+		const checks = [rowUnchanged("_dineway_collections", {
+			slug: collection,
+			...collectionRow
+		}), rowUnchanged(`ec_${collection}`, {
+			...contentRow,
+			status: "published",
+			deleted_at: null
+		})];
 		if (collectionRow.comments_closed_after_days > 0) {
 			const publishedAt = contentRow.published_at;
 			if (publishedAt) {
 				const closedDate = new Date(publishedAt);
 				closedDate.setDate(closedDate.getDate() + collectionRow.comments_closed_after_days);
+				checks.push(sql`${currentIsoTimestampValue(dineway.db)} <= ${closedDate.toISOString()}`);
 				if (/* @__PURE__ */ new Date() > closedDate) return apiError("COMMENTS_CLOSED", "Comments are closed for this content", 403);
 			}
 		}
@@ -95,6 +105,8 @@ const POST = async ({ params, request, locals }) => {
 		else ipHash = "unknown";
 		const unknownBucketLimit = ipHash === "unknown" ? 20 : void 0;
 		if (await checkRateLimit(dineway.db, ipHash, unknownBucketLimit)) return apiError("RATE_LIMITED", "Too many comments. Please try again later.", 429);
+		checks.push(sql`(SELECT COUNT(*) FROM _dineway_comments WHERE ip_hash = ${ipHash}
+			AND created_at > ${(/* @__PURE__ */ new Date(Date.now() - 6e5)).toISOString()}) < ${unknownBucketLimit ?? 5}`);
 		const collectionSettings = {
 			commentsEnabled: collectionRow.comments_enabled === 1,
 			commentsModeration: collectionRow.comments_moderation,
@@ -111,10 +123,11 @@ const POST = async ({ params, request, locals }) => {
 		}
 		let resolvedParentId = body.parentId ?? null;
 		if (body.parentId) {
-			const parent = await new CommentRepository(dineway.db).findById(body.parentId);
+			const parent = await dineway.db.selectFrom("_dineway_comments").selectAll().where("id", "=", body.parentId).executeTakeFirst();
 			if (!parent) return apiError("VALIDATION_ERROR", "Parent comment not found", 400);
-			if (parent.collection !== collection || parent.contentId !== contentId) return apiError("VALIDATION_ERROR", "Parent comment belongs to different content", 400);
-			resolvedParentId = parent.parentId ?? parent.id;
+			if (parent.collection !== collection || parent.content_id !== contentId) return apiError("VALIDATION_ERROR", "Parent comment belongs to different content", 400);
+			checks.push(rowUnchanged("_dineway_comments", parent));
+			resolvedParentId = parent.parent_id ?? parent.id;
 		}
 		const hookRunner = {
 			async runBeforeCreate(event) {
@@ -136,7 +149,7 @@ const POST = async ({ params, request, locals }) => {
 				return result.result;
 			},
 			fireAfterCreate(event) {
-				dineway.hooks.runCommentAfterCreate(event).catch((err) => console.error("[comments] afterCreate error:", err instanceof Error ? err.message : err));
+				return dineway.hooks.runCommentAfterCreate(event).catch((err) => console.error("[comments] afterCreate error:", err instanceof Error ? err.message : err));
 			},
 			fireAfterModerate(event) {
 				dineway.hooks.runCommentAfterModerate(event).catch((err) => console.error("[comments] afterModerate error:", err instanceof Error ? err.message : err));
@@ -151,13 +164,16 @@ const POST = async ({ params, request, locals }) => {
 				"email",
 				"email_verified"
 			]).where("id", "=", typedContent.author_id).executeTakeFirst();
-			if (authorRow && authorRow.email_verified) contentAuthor = {
-				id: authorRow.id,
-				name: authorRow.name,
-				email: authorRow.email
-			};
+			if (authorRow && authorRow.email_verified) {
+				checks.push(rowUnchanged("users", authorRow));
+				contentAuthor = {
+					id: authorRow.id,
+					name: authorRow.name,
+					email: authorRow.email
+				};
+			}
 		}
-		const result = await createComment(dineway.db, {
+		const result = await prepareComment(dineway.db, {
 			collection,
 			contentId,
 			parentId: resolvedParentId,
@@ -174,26 +190,49 @@ const POST = async ({ params, request, locals }) => {
 			author: contentAuthor
 		});
 		if (!result) return apiError("COMMENT_REJECTED", "Comment was rejected", 403);
-		if (result.comment.status === "approved" && dineway.email && contentAuthor) try {
-			const adminBaseUrl = await getSiteBaseUrl(dineway.db, request);
-			await sendCommentNotification({
-				email: dineway.email,
-				comment: result.comment,
-				contentAuthor,
-				adminBaseUrl
-			});
-		} catch (err) {
-			console.error("[comments] notification error:", err instanceof Error ? err.message : err);
-		}
-		return apiSuccess({
-			id: result.comment.id,
-			status: result.comment.status,
-			message: result.comment.status === "approved" ? "Comment published" : "Comment submitted for review"
-		}, 201);
+		if (result.comment.collection !== collection || result.comment.contentId !== contentId || result.comment.parentId !== resolvedParentId) return apiError("COMMENT_REJECTED", "Comment hooks cannot change its target", 403);
+		let completed;
+		const afterCommit = () => completed ??= (async () => {
+			await result.afterCommit();
+			if (result.comment.status === "approved" && dineway.email && contentAuthor) try {
+				const adminBaseUrl = await getSiteBaseUrl(dineway.db, request);
+				await sendCommentNotification({
+					email: dineway.email,
+					comment: result.comment,
+					contentAuthor,
+					adminBaseUrl
+				});
+			} catch (err) {
+				console.error("[comments] notification error:", err instanceof Error ? err.message : err);
+			}
+			return apiSuccess({
+				id: result.comment.id,
+				status: result.comment.status,
+				message: result.comment.status === "approved" ? "Comment published" : "Comment submitted for review"
+			}, 201);
+		})();
+		return {
+			comment: result.comment,
+			batch: {
+				checks: [...checks, ...result.batch.checks ?? []],
+				statements: result.batch.statements
+			},
+			afterCommit
+		};
+	} catch (error) {
+		return handleError(error, "Failed to submit comment", "COMMENT_CREATE_ERROR");
+	}
+}
+const POST = async (context) => {
+	const prepared = await prepareCommentRequest(context);
+	if (prepared instanceof Response) return prepared;
+	try {
+		await atomicBatch(context.locals.dineway.db, prepared.batch);
+		return await prepared.afterCommit();
 	} catch (error) {
 		return handleError(error, "Failed to submit comment", "COMMENT_CREATE_ERROR");
 	}
 };
 
 //#endregion
-export { GET, POST, prerender };
+export { GET, POST, prepareCommentRequest, prerender };

package/dist/astro/routes/api/comments/_collection_/_contentId_/reactions.mjs

@@ -2,22 +2,22 @@ import "../../../../../../base64-Cz-aU0X1.mjs";
 import "../../../../../../types-BqxIv8Il.mjs";
 import "../../../../../../after-BVaUn7bK.mjs";
 import { s as invalidateCommentObjectCache } from "../../../../../../object-cache-BGjIlY9s.mjs";
-import "../../../../../../comment-Bi7cJ9SS.mjs";
+import "../../../../../../comment-kgLTdtQD.mjs";
 import "../../../../../../options-BcqHWpc-.mjs";
-import "../../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../../runtime-env-CQVAWHzH.mjs";
-import { a as resolveSecretsCached } from "../../../../../../secrets-Cg0D2gQW.mjs";
-import "../../../../../../public-discovery-BAbOvKiR.mjs";
-import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse--7nG62_h.mjs";
-import { vt as createReactionBody } from "../../../../../../redirects-UCXyL0lP.mjs";
-import "../../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../../runtime-env-v-1UXPAH.mjs";
+import { a as resolveSecretsCached } from "../../../../../../secrets-BP2YTPWn.mjs";
+import "../../../../../../public-discovery-CTql6jdZ.mjs";
+import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-BscLr3p2.mjs";
+import { vt as createReactionBody } from "../../../../../../redirects-DpRiuRWn.mjs";
+import "../../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../../status-DBSB6tdS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import "../../../../../../trusted-proxy-CAW9o4Dw.mjs";
-import { t as extractRequestMeta } from "../../../../../../request-meta-BOcuHAXD.mjs";
-import { t as CommentReactionRepository } from "../../../../../../comment-reaction-BLqIj5mx.mjs";
-import { c as hashIp } from "../../../../../../comments-Dg_gWBEB.mjs";
+import "../../../../../../trusted-proxy-CvDP0g0F.mjs";
+import { t as extractRequestMeta } from "../../../../../../request-meta-C6yGqnGD.mjs";
+import { t as CommentReactionRepository } from "../../../../../../comment-reaction-Cun5eIXL.mjs";
+import { c as hashIp } from "../../../../../../comments-ZYK_cZvx.mjs";
 
 //#region src/api/handlers/comment-reactions.ts
 const REACTION_RATE_LIMIT = 30;

package/dist/astro/routes/api/content/_collection_/_id_/compare.mjs

@@ -1,5 +1,5 @@
-import { a as unwrapResult, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import { n as requirePerm } from "../../../../../../authorize-EnP57AQl.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { n as requirePerm } from "../../../../../../authorize-CXIjxIfC.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/compare.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/discard-draft.mjs

@@ -2,10 +2,10 @@ import "../../../../../../base64-Cz-aU0X1.mjs";
 import "../../../../../../types-BqxIv8Il.mjs";
 import "../../../../../../actor-DxUAJgQX.mjs";
 import "../../../../../../site-activity-BrN2NviL.mjs";
-import { a as unwrapResult, o as mapErrorStatus, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import "../../../../../../activity-CZnq5YlZ.mjs";
-import { a as extractActivityItemId, n as contentApiRouteSource, o as logContentActivity } from "../../../../../../activity-events-D-yGV7cW.mjs";
-import { t as requireOwnerPerm } from "../../../../../../authorize-EnP57AQl.mjs";
+import { a as unwrapResult, o as mapErrorStatus, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import "../../../../../../activity-BbtYp_4V.mjs";
+import { a as extractActivityItemId, n as contentApiRouteSource, o as logContentActivity } from "../../../../../../activity-events-CiFN61xq.mjs";
+import { t as requireOwnerPerm } from "../../../../../../authorize-CXIjxIfC.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/discard-draft.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/duplicate.mjs

@@ -2,10 +2,10 @@ import "../../../../../../base64-Cz-aU0X1.mjs";
 import "../../../../../../types-BqxIv8Il.mjs";
 import "../../../../../../actor-DxUAJgQX.mjs";
 import "../../../../../../site-activity-BrN2NviL.mjs";
-import { a as unwrapResult, o as mapErrorStatus, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import "../../../../../../activity-CZnq5YlZ.mjs";
-import { a as extractActivityItemId, n as contentApiRouteSource, o as logContentActivity } from "../../../../../../activity-events-D-yGV7cW.mjs";
-import { n as requirePerm, t as requireOwnerPerm } from "../../../../../../authorize-EnP57AQl.mjs";
+import { a as unwrapResult, o as mapErrorStatus, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import "../../../../../../activity-BbtYp_4V.mjs";
+import { a as extractActivityItemId, n as contentApiRouteSource, o as logContentActivity } from "../../../../../../activity-events-CiFN61xq.mjs";
+import { n as requirePerm, t as requireOwnerPerm } from "../../../../../../authorize-CXIjxIfC.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/duplicate.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/permanent.mjs

@@ -2,10 +2,10 @@ import "../../../../../../base64-Cz-aU0X1.mjs";
 import "../../../../../../types-BqxIv8Il.mjs";
 import "../../../../../../actor-DxUAJgQX.mjs";
 import "../../../../../../site-activity-BrN2NviL.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import "../../../../../../activity-CZnq5YlZ.mjs";
-import { n as contentApiRouteSource, o as logContentActivity } from "../../../../../../activity-events-D-yGV7cW.mjs";
-import { n as requirePerm } from "../../../../../../authorize-EnP57AQl.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import "../../../../../../activity-BbtYp_4V.mjs";
+import { n as contentApiRouteSource, o as logContentActivity } from "../../../../../../activity-events-CiFN61xq.mjs";
+import { n as requirePerm } from "../../../../../../authorize-CXIjxIfC.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/permanent.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/preview-url.mjs

@@ -7,23 +7,23 @@ import "../../../../../../types-BqxIv8Il.mjs";
 import "../../../../../../after-BVaUn7bK.mjs";
 import { t as RevisionRepository } from "../../../../../../revision-090sZyGc.mjs";
 import "../../../../../../options-BcqHWpc-.mjs";
-import "../../../../../../context-types-DqTo6C79.mjs";
-import "../../../../../../runtime-env-CQVAWHzH.mjs";
-import { a as resolveSecretsCached } from "../../../../../../secrets-Cg0D2gQW.mjs";
-import "../../../../../../content-refresh-l4mPoGeX.mjs";
-import "../../../../../../fts-manager-BeWtB7ZD.mjs";
-import "../../../../../../public-discovery-BAbOvKiR.mjs";
-import { n as SchemaRegistry } from "../../../../../../registry-RD9qTnYL.mjs";
-import { t as resolveContentUrl } from "../../../../../../public-url-C7pbmS_7.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-Dd8LtpG5.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse--7nG62_h.mjs";
-import { in as contentPreviewUrlBody } from "../../../../../../redirects-UCXyL0lP.mjs";
-import "../../../../../../byline-fields-BGEIA9dZ.mjs";
-import "../../../../../../status-Bwkeuz8g.mjs";
+import "../../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../../runtime-env-v-1UXPAH.mjs";
+import { a as resolveSecretsCached } from "../../../../../../secrets-BP2YTPWn.mjs";
+import "../../../../../../content-refresh-9M9cc55-.mjs";
+import "../../../../../../fts-manager-DA74x_uP.mjs";
+import "../../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as SchemaRegistry } from "../../../../../../registry-DcV93OL_.mjs";
+import { t as resolveContentUrl } from "../../../../../../public-url-DNt9A1yS.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-BscLr3p2.mjs";
+import { in as contentPreviewUrlBody } from "../../../../../../redirects-DpRiuRWn.mjs";
+import "../../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../../status-DBSB6tdS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { i as getPreviewUrl, r as buildPreviewUrl } from "../../../../../../preview-q0pkibNO.mjs";
-import { t as generatePreviewToken } from "../../../../../../tokens-Bjuf1HID.mjs";
-import { n as requirePerm } from "../../../../../../authorize-EnP57AQl.mjs";
+import { i as getPreviewUrl, r as buildPreviewUrl } from "../../../../../../preview-E1xKZGsX.mjs";
+import { t as generatePreviewToken } from "../../../../../../tokens-I3tSjoFI.mjs";
+import { n as requirePerm } from "../../../../../../authorize-CXIjxIfC.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/preview-url.ts
 const prerender = false;