@core / comments

1.0.1 ▾

1.0.1

認証済みMIT

GitHub

任意のエンティティへのモデレーション付きコメント：ゲスト/ユーザー、返信、1〜5 評価、ブロック、GDPR 削除、安全な HTML

コード9 ファイルコンテキスト約 552 トークンスキャン合格

約 552 トークン→ src/lib/comments/AGENTS.md→ .cursor/rules/genpm-core-comments.mdc

これは AI が src/lib/comments で作業するときに読む内容そのものです。それ以外はコンテキストに追加されません。

@core/comments — rules for AI agents

Purpose

Comments on anything (entityType + entityId: posts, products, pages): guests (name + email, stored only as a hash) or signed-in users, one level of replies, optional 1–5 rating (reused by @core/reviews), moderation queue with email alerts, bans, GDPR erasure and safe HTML rendering. Anti-spam via @core/antispam. Tables: comments, comment_bans.

Map

index.ts — public API: postComment, listComments, moderate, ban, eraseComments, ratingSummary, commentHtml, commentsAdminResource.
comments.ts — logic and the comments.notify job. admin.ts — moderation queue. schema.ts — tables.
adapters/hono.ts — commentRoutes({ currentUser }). adapters/next.ts — commentRoute({ currentUser }) → { GET, POST }.

Integration

Env: optional COMMENTS_NOTIFY_TO (moderators, comma-separated) and EMAIL_FROM. Migrations as in src/lib/db/AGENTS.md; the @core/jobs cron must run.
Mount the endpoints at /api/comments/:type/:id with currentUser from @core/auth (getUser/getUserFromCookieHeader).
The form posts body (and name, email for guests, parentId for replies) plus the @core/antispam fields (honeypotProps, _ts). Show "your comment awaits moderation" when the response status is pending.
Render the list from GET or listComments(type, id); render each body with commentHtml(body) (escaped; the only HTML allowed).
Add commentsAdminResource to src/genpm/admin.ts (permissions comments:read, comments:moderate).
Verify: a guest comment is pending until approved in the admin, then it is listed.

Conventions

Default moderation is guests: guests and users without an approved comment wait for approval. Use none only on trusted, private sites.
Erase on request with eraseComments({ email }) or ({ userId }); delete user comments when the account is deleted.
Show ratings only from ratingSummary (approved comments).

Don't

Don't store or show guest emails; don't render comment bodies as Markdown/HTML.
Don't auto-approve guests to "increase engagement".
Don't expose pending, spam or deleted comments in public endpoints.

# @core/comments — rules for AI agents

## Purpose
Comments on anything (`entityType` + `entityId`: posts, products, pages): guests (name + email, stored only as a hash)
or signed-in users, one level of replies, optional 1–5 rating (reused by @core/reviews), moderation queue with email
alerts, bans, GDPR erasure and safe HTML rendering. Anti-spam via @core/antispam. Tables: `comments`, `comment_bans`.

## Map
- `index.ts` — public API: `postComment`, `listComments`, `moderate`, `ban`, `eraseComments`, `ratingSummary`, `commentHtml`, `commentsAdminResource`.
- `comments.ts` — logic and the `comments.notify` job. `admin.ts` — moderation queue. `schema.ts` — tables.
- `adapters/hono.ts` — `commentRoutes({ currentUser })`. `adapters/next.ts` — `commentRoute({ currentUser })` → `{ GET, POST }`.

## Integration
1. Env: optional `COMMENTS_NOTIFY_TO` (moderators, comma-separated) and `EMAIL_FROM`. Migrations as in `src/lib/db/AGENTS.md`; the @core/jobs cron must run.
2. Mount the endpoints at `/api/comments/:type/:id` with `currentUser` from @core/auth (`getUser`/`getUserFromCookieHeader`).
3. The form posts `body` (and `name`, `email` for guests, `parentId` for replies) plus the @core/antispam fields (`honeypotProps`, `_ts`).
   Show "your comment awaits moderation" when the response status is `pending`.
4. Render the list from `GET` or `listComments(type, id)`; render each body with `commentHtml(body)` (escaped; the only HTML allowed).
5. Add `commentsAdminResource` to `src/genpm/admin.ts` (permissions `comments:read`, `comments:moderate`).
6. Verify: a guest comment is pending until approved in the admin, then it is listed.

## Conventions
- Default moderation is `guests`: guests and users without an approved comment wait for approval. Use `none` only on trusted, private sites.
- Erase on request with `eraseComments({ email })` or `({ userId })`; delete user comments when the account is deleted.
- Show ratings only from `ratingSummary` (approved comments).

## Don't
- Don't store or show guest emails; don't render comment bodies as Markdown/HTML.
- Don't auto-approve guests to "increase engagement".
- Don't expose `pending`, `spam` or `deleted` comments in public endpoints.

.genpmignore 適用後に組み込まれる正確なツリーです。固定先:

src/lib/comments/index.ts読み取り専用 · abfbbe8

// @core/comments — API pública. Importa desde aquí; endpoints en adapters/hono.ts y adapters/next.ts.
export { commentsAdminResource } from './admin.ts';
export {
  ban,
  CommentError,
  commentHtml,
  emailHash,
  eraseComments,
  listComments,
  type ModerationAction,
  type Moderation,
  moderate,
  notifyModeratorsJob,
  type PostCommentInput,
  type PublicComment,
  postComment,
  type RatingSummary,
  ratingSummary,
} from './comments.ts';
export { type Comment, commentBans, comments } from './schema.ts';

バージョン	コミット	公開日	スキャン
1.0.1	abfbbe8	6 時間前	スキャン合格

$genpm add @core/comments

組み込み先: src/lib/comments
コミット
タグ: v1.0.1
必要: @core/antispam ^1.0.0 @core/auth ^1.1.0 @core/contracts ^1.0.0 @core/db ^1.0.0 @core/email ^1.0.1 @core/jobs ^1.0.0
npm: zod ^4.0.0
Env: COMMENTS_NOTIFY_TO
品質: 100/100
利用元: 2
インストール数: 0 / 30日
公開日: 6 時間前 · genpm-system

README バッジ

[![genpm](https://api.genpm.net/v1/badge/@core/comments.svg)](https://genpm.net/p/@core/comments)