@core / comments

1.0.1 ▾

1.0.1

verificadoMIT

Comentarios moderados sobre cualquier entidad: invitado o usuario, respuestas, valoración 1–5, bloqueos, RGPD y HTML seguro

Código9 archivosContexto~552 tokensescaneo superado

~552 tokens→ src/lib/comments/AGENTS.md→ .cursor/rules/genpm-core-comments.mdc

Esto es exactamente lo que lee tu IA cuando trabaja en src/lib/comments. No se añade nada más a su contexto.

@core/comments — rules for AI agents

Purpose

Comments on anything (entityType + entityId: posts, products, pages): guests (name + email, stored only as a hash) or signed-in users, one level of replies, optional 1–5 rating (reused by @core/reviews), moderation queue with email alerts, bans, GDPR erasure and safe HTML rendering. Anti-spam via @core/antispam. Tables: comments, comment_bans.

Map

index.ts — public API: postComment, listComments, moderate, ban, eraseComments, ratingSummary, commentHtml, commentsAdminResource.
comments.ts — logic and the comments.notify job. admin.ts — moderation queue. schema.ts — tables.
adapters/hono.ts — commentRoutes({ currentUser }). adapters/next.ts — commentRoute({ currentUser }) → { GET, POST }.

Integration

Env: optional COMMENTS_NOTIFY_TO (moderators, comma-separated) and EMAIL_FROM. Migrations as in src/lib/db/AGENTS.md; the @core/jobs cron must run.
Mount the endpoints at /api/comments/:type/:id with currentUser from @core/auth (getUser/getUserFromCookieHeader).
The form posts body (and name, email for guests, parentId for replies) plus the @core/antispam fields (honeypotProps, _ts). Show "your comment awaits moderation" when the response status is pending.
Render the list from GET or listComments(type, id); render each body with commentHtml(body) (escaped; the only HTML allowed).
Add commentsAdminResource to src/genpm/admin.ts (permissions comments:read, comments:moderate).
Verify: a guest comment is pending until approved in the admin, then it is listed.

Conventions

Default moderation is guests: guests and users without an approved comment wait for approval. Use none only on trusted, private sites.
Erase on request with eraseComments({ email }) or ({ userId }); delete user comments when the account is deleted.
Show ratings only from ratingSummary (approved comments).

Don't

Don't store or show guest emails; don't render comment bodies as Markdown/HTML.
Don't auto-approve guests to "increase engagement".
Don't expose pending, spam or deleted comments in public endpoints.

# @core/comments — rules for AI agents

## Purpose
Comments on anything (`entityType` + `entityId`: posts, products, pages): guests (name + email, stored only as a hash)
or signed-in users, one level of replies, optional 1–5 rating (reused by @core/reviews), moderation queue with email
alerts, bans, GDPR erasure and safe HTML rendering. Anti-spam via @core/antispam. Tables: `comments`, `comment_bans`.

## Map
- `index.ts` — public API: `postComment`, `listComments`, `moderate`, `ban`, `eraseComments`, `ratingSummary`, `commentHtml`, `commentsAdminResource`.
- `comments.ts` — logic and the `comments.notify` job. `admin.ts` — moderation queue. `schema.ts` — tables.
- `adapters/hono.ts` — `commentRoutes({ currentUser })`. `adapters/next.ts` — `commentRoute({ currentUser })` → `{ GET, POST }`.

## Integration
1. Env: optional `COMMENTS_NOTIFY_TO` (moderators, comma-separated) and `EMAIL_FROM`. Migrations as in `src/lib/db/AGENTS.md`; the @core/jobs cron must run.
2. Mount the endpoints at `/api/comments/:type/:id` with `currentUser` from @core/auth (`getUser`/`getUserFromCookieHeader`).
3. The form posts `body` (and `name`, `email` for guests, `parentId` for replies) plus the @core/antispam fields (`honeypotProps`, `_ts`).
   Show "your comment awaits moderation" when the response status is `pending`.
4. Render the list from `GET` or `listComments(type, id)`; render each body with `commentHtml(body)` (escaped; the only HTML allowed).
5. Add `commentsAdminResource` to `src/genpm/admin.ts` (permissions `comments:read`, `comments:moderate`).
6. Verify: a guest comment is pending until approved in the admin, then it is listed.

## Conventions
- Default moderation is `guests`: guests and users without an approved comment wait for approval. Use `none` only on trusted, private sites.
- Erase on request with `eraseComments({ email })` or `({ userId })`; delete user comments when the account is deleted.
- Show ratings only from `ratingSummary` (approved comments).

## Don't
- Don't store or show guest emails; don't render comment bodies as Markdown/HTML.
- Don't auto-approve guests to "increase engagement".
- Don't expose `pending`, `spam` or `deleted` comments in public endpoints.

El árbol exacto que se inyectará, tras aplicar .genpmignore. Anclado a

src/lib/comments/LICENSEsolo lectura · abfbbe8

MIT License

Copyright (c) 2026 GenPM

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.