Add shared Community comments client (#189)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex a50cc36..343b2e8 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.139.0 (2026-11-10)
++
++- `community.comments`: shared comment thread resolve/read/write/edit/delete and visibility methods, including ordered pages and paged replies.
++
  ## 0.138.0 (2026-11-10)
  
  - **`chat.rooms.insight(id)`**: a room's public AI insight (`chat.room-insight-result@1`), as `GET /api/v1/rooms/:id/insight` answers it: `{ overview: { text, topics, people, messages, from, to, updated_at }, timeline: [{ at, kind, title, text, message_id }], state: 'ready' | 'quiet' | 'off' }`. `id` is a room slug or `global`; a room the rollout does not cover answers `null` (404 like `rooms.get`). No account is needed, so an anonymous client reads it too. Typed as `RoomInsight` in `types/chat.d.ts`.
ddiff --git a/README.md b/README.md
iindex f69fa58..5a42279 100644
---- a/README.md
++++ b/README.md
@@@ -13,7 +13,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.138.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.139.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -22,7 +22,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.138.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.139.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -202,7 +202,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/sso` | server | `createSsoClient({site, baseUrl, clientId, clientSecret, networkUrl, networkInternalUrl, secureCookies})`: a product site's sign-in with OpenVibe.Network: `router(express)` (`/login` with state + PKCE S256, `/callback`, `/fedcm`, `/logout`, `/me`, `/refresh`), `optionalAuth()`, `requireAuth()`, `verify(token)` (offline, shared JWKS), `extractToken(req)`; `sanitizeNext`, `COOKIES` |
  | `openvibe-sdk/realtime` | both | `subscribe(topics, onEvent, {lastEventId, onGap, …})`, `createRealtimeClient(client)`, `parseSSE(body)` |
  | `openvibe-sdk/media` | both (credentials: server) | `createMediaClient(client, {app, apiKey?, actingUserId?})`: `files.upload/list/iterate/get/delete`; `mediaUrls(origin)` public URL helpers; `createObjectsClient({app, baseUrl?, tokenClient \| apiKey \| client})`: object API v2 `upload` (single or multipart by size, resumable), `resume`, `get`, `signedUrl`, `delete`, `list`, `iterate`, and `jobs.create/get/list/approve/cancel/wait`; Media's origin from the platform descriptor when `baseUrl` is omitted |
--| `openvibe-sdk/community` | both | `createCommunityClient(client, {actingSubject?, origin?, sourceRef?, staff?})`: `pastes.list/iterate/get/create/update/delete/fork/like/copy/versions/byUser/config`, `pastes.comments.list/create/delete`, `as(subject)` |
++| `openvibe-sdk/community` | both | `createCommunityClient(client, {actingSubject?, origin?, sourceRef?, staff?})`: `pastes.list/iterate/get/create/update/delete/fork/like/copy/versions/byUser/config`, `pastes.comments.list/create/delete`, shared `comments.resolve/get/create/edit/delete/visibility`, `as(subject)` |
  | `openvibe-sdk/home-feed` | both | `createHomeFeedClient(client)` gives `ov.home.get()/set(layout)`, `ov.network.today()`, `ov.feed.list({ for: 'me', cursor })`, `ov.feed.post(text)`, and `ov.feed.contribute({ id, text, url })`. Personal calls need a user Bearer token; contribution needs an app token granted `community.pulse.contribute`. Today is public and cached by Network for five minutes. |
  | `openvibe-sdk/bot` | both | `createBotClient(client, {actingSubject?})`: OpenVibe.Bot robots. `robots.list/get/create/update/delete/pairingCode`, `robots.operators.list/add/remove`, `robots.devices`, `robots.streaming.get/set`, `robots.audit`/`iterateAudit`, `robots.estop`/`clearEstop`, `robots.command` (`bot.command@1`), `devices.rotate/revoke`, public `profiles.list/get` and `kits.list/get`, `pair` (the agent's one-time code, never retried), `as(subject)`; a service acts for a person with `X-OV-Subject` (capabilities `bot.robot.read`/`manage`/`control`, `bot.device.connect`) |
  | `openvibe-sdk/themes` | both | `createThemesClient(client)`: `catalog({mode, search, sort, limit})` (seasonal themes carry `season`), `get(idOrSlug)` (null when missing), `export(idOrSlug)`, `active()` (`{theme_id, custom_variables, display}`), `set(themeId, {custom})`, `setDisplay({motion, text, seasonal})`, `seasons({date})`, `submissions()`, `submit(theme)`, `import(file)`. In the browser: `followTheme(fn)` calls back now and on every theme, display or season change with `readTheme()` (`{id, mode, tokens, display: {motion, text, textScale, seasonal, calm}, season, seasonMark}`) and returns `stop()`, for a canvas or game to keep up; `applyTheme(vars, {root})`, `seasonOn(date, seasons)`, `onColor(hex)`, `DISPLAY_OPTIONS`, `TOKENS` |
@@@ -593,7 +593,7 @@ shows the cards in `GET /api/frame`.
  
  ## Not wrapped yet (intentionally)
  
--- **Community comments on other content, the forum and Pulse** are being built in Community right now. Only paste comments are wrapped. The rest is a TODO in `src/community.js` until those APIs settle.
++- **Community other-site comments and forum API** remain outside this SDK surface; shared typed comment thread routes are wrapped by `community.comments`.
  - **Media:** the v1 files API, the object API v2 (`createObjectsClient`) and the public URL helpers are wrapped. Retention holds on v2 objects are not (app keys only). VOD, clip, thumbnail and admin-storage routes are not wrapped because apps reach them only through Live and Media's own servers. Media's own paste API is not wrapped because pastes moved to Community (ADR-011). The mock platform (`openvibe-sdk/testing`) models Media's v1 files only, not v2 objects.
  - **Media from the browser:** Media refuses user JWTs on the v1 files and v2 objects APIs, so a browser uploads through its own app server. That server holds the app credential and names the user with `actingUserId` or a subject.
  - **Network coins, notifications and legacy-map writes** are internal service-to-service routes with no public capability, so they are not wrapped. Staff-only paste routes are also internal: admin stats, bulk, censor and the AI pass.
ddiff --git a/STATUS.json b/STATUS.json
iindex e36d0ce..3a2f28c 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.138.0",
++  "version": "0.139.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), \u00a73.2; roadmap \u00a730",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 05a9d22..19cdad2 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.138.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.139.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, levels, modules, realtime, media, cam, mediaUpload, ui, community, homeFeed, bot, search, bench, meme, vision, themes, design, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -57,7 +57,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.138.0';
++const SDK_VERSION = '0.139.0';
  
  module.exports = {
      createClient,
@@@ -3572,8 +3572,21 @@ function createCommunityClient(client, defaults = {}) {
          create: (input = {}, o = {}) => call({ method: 'POST', path: '/api/v1/posts', json: input, ...once }, o),
      };
  
++    const comments = {
++        /** Resolve an EntityRef to its shared thread (created by the first write). */
++        resolve: (ref, o = {}) => call({ method: 'POST', path: '/api/v1/comments/threads/resolve', json: { ref }, ...once }, o),
++        /** Read a page; sort is old|new, or parent pages replies after the first page. */
++        get: (id, query = {}, o = {}) => call({ path: `/api/v1/comments/threads/${enc(id)}`, query }, o),
++        /** Add a comment or reply; replies to replies are filed under their first comment. */
++        create: (id, input, o = {}) => call({ method: 'POST', path: `/api/v1/comments/threads/${enc(id)}/comments`, json: input, ...once }, o),
++        edit: (commentId, input, o = {}) => call({ method: 'PATCH', path: `/api/v1/comments/${enc(commentId)}`, json: input }, o),
++        delete: (commentId, o = {}) => call({ method: 'DELETE', path: `/api/v1/comments/${enc(commentId)}` }, o),
++        visibility: (id, visibility, o = {}) => call({ method: 'PUT', path: `/api/v1/comments/threads/${enc(id)}/visibility`, json: { visibility } }, o),
++    };
++
      return {
          pastes,
++        comments,
          feed,
          posts,
          /** The same client acting for someone else: as('usr_…') or as({ actingSubject, origin, sourceRef, staff }). */
ddiff --git a/package-lock.json b/package-lock.json
iindex 5d3f1c9..43e6019 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.138.0",
++  "version": "0.139.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.138.0",
++      "version": "0.139.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 27589a0..83bdf2c 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.138.0",
++  "version": "0.139.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/community.js b/src/community.js
iindex 901e2af..2e36173 100644
---- a/src/community.js
++++ b/src/community.js
@@@ -121,8 +121,21 @@ function createCommunityClient(client, defaults = {}) {
          create: (input = {}, o = {}) => call({ method: 'POST', path: '/api/v1/posts', json: input, ...once }, o),
      };
  
++    const comments = {
++        /** Resolve an EntityRef to its shared thread (created by the first write). */
++        resolve: (ref, o = {}) => call({ method: 'POST', path: '/api/v1/comments/threads/resolve', json: { ref }, ...once }, o),
++        /** Read a page; sort is old|new, or parent pages replies after the first page. */
++        get: (id, query = {}, o = {}) => call({ path: `/api/v1/comments/threads/${enc(id)}`, query }, o),
++        /** Add a comment or reply; replies to replies are filed under their first comment. */
++        create: (id, input, o = {}) => call({ method: 'POST', path: `/api/v1/comments/threads/${enc(id)}/comments`, json: input, ...once }, o),
++        edit: (commentId, input, o = {}) => call({ method: 'PATCH', path: `/api/v1/comments/${enc(commentId)}`, json: input }, o),
++        delete: (commentId, o = {}) => call({ method: 'DELETE', path: `/api/v1/comments/${enc(commentId)}` }, o),
++        visibility: (id, visibility, o = {}) => call({ method: 'PUT', path: `/api/v1/comments/threads/${enc(id)}/visibility`, json: { visibility } }, o),
++    };
++
      return {
          pastes,
++        comments,
          feed,
          posts,
          /** The same client acting for someone else: as('usr_…') or as({ actingSubject, origin, sourceRef, staff }). */
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 6615539..8a8506c 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.138.0';
++const SDK_VERSION = '0.139.0';
  
  module.exports = {
      createClient,
ddiff --git a/test/community.test.js b/test/community.test.js
iindex adca86a..69c942f 100644
---- a/test/community.test.js
++++ b/test/community.test.js
@@@ -91,6 +91,25 @@ run([
          await srv.close();
      }],
  
++    ['shared comment threads support resolving, ordered paging, replies and edits', async () => {
++        const srv = await echo();
++        const community = createCommunityClient(createClient({ baseUrls: { community: srv.url } }));
++        await community.comments.resolve({ service: 'live', type: 'vod', id: '42' });
++        await community.comments.get('cth_test', { sort: 'new', limit: 2 });
++        await community.comments.get('cth_test', { parent: 7, after: 12, limit: 50 });
++        await community.comments.create('cth_test', { message: 'reply', parent_id: 7 });
++        await community.comments.edit(8, { message: 'edited' });
++        assert.deepEqual(srv.requests.map((r) => `${r.method} ${r.url}`), [
++            'POST /api/v1/comments/threads/resolve',
++            'GET /api/v1/comments/threads/cth_test?sort=new&limit=2',
++            'GET /api/v1/comments/threads/cth_test?parent=7&after=12&limit=50',
++            'POST /api/v1/comments/threads/cth_test/comments',
++            'PATCH /api/v1/comments/8',
++        ]);
++        assert.deepEqual(JSON.parse(srv.requests[3].body), { message: 'reply', parent_id: 7 });
++        await srv.close();
++    }],
++
      ['routes: fork, copy, versions, by-user, config, comments, screenshot multipart, iterate', async () => {
          const srv = await echo();
          const p = createCommunityClient(createClient({ baseUrls: { community: srv.url } })).pastes;
ddiff --git a/types/community.d.ts b/types/community.d.ts
iindex fa7c286..828bbed 100644
---- a/types/community.d.ts
++++ b/types/community.d.ts
@@@ -9,6 +9,18 @@ export interface ActingOptions {
  }
  export type CallOptions = ActingOptions & { signal?: AbortSignal };
  
++export interface CommentQuery { after?: string | number; sort?: 'old' | 'new'; limit?: number; parent?: string | number; }
++export interface Comment { id: number; thread_id: number | string; parent_id: number | null; message: string | null; reply_count?: number | null; replies?: Comment[]; [field: string]: unknown; }
++export interface CommentPage { thread: Record<string, unknown>; comments: Comment[]; next_cursor: string | null; viewer: Record<string, boolean>; }
++export interface CommentsApi {
++    resolve(ref: EntityRef, opts?: CallOptions): Promise<{ thread: Record<string, unknown>; created: boolean }>;
++    get(id: string, query?: CommentQuery, opts?: CallOptions): Promise<CommentPage>;
++    create(id: string, input: { message: string; parent_id?: number | string | null; anon_name?: string }, opts?: CallOptions): Promise<{ comment: Comment }>;
++    edit(commentId: number | string, input: { message: string }, opts?: CallOptions): Promise<{ comment: Comment }>;
++    delete(commentId: number | string, opts?: CallOptions): Promise<{ ok: true; id: number }>;
++    visibility(id: string, visibility: 'public' | 'hidden' | 'locked', opts?: CallOptions): Promise<{ thread: Record<string, unknown> }>;
++}
++
  export interface Paste { id: number; slug: string; title?: string; content?: string; language?: string; type?: string; visibility?: string; [field: string]: unknown; }
  export interface PasteListQuery { limit?: number; offset?: number; type?: string; search?: string; sort?: string; origin?: string; username?: string; include_unlisted?: boolean; }
  export interface CreateTextPaste { title?: string; content: string; language?: string; visibility?: 'public' | 'unlisted' | 'private'; burn_after_read?: boolean; is_nsfw?: boolean; [field: string]: unknown; }
@@@ -60,6 +72,7 @@ export interface PostsApi {
  }
  export interface CommunityClient {
      pastes: PastesApi;
++    comments: CommentsApi;
      feed(query?: FeedQuery, opts?: CallOptions): Promise<{ items: FeedItem[]; next_cursor: string | null }>;
      posts: PostsApi;
      as(who: string | ActingOptions): CommunityClient;