@rocapine/community 0.1.0 → 0.3.0

package/README.md

@@ -61,6 +61,11 @@ warning** — review the diff before deploying. `--project-url`/`--anon-key`
 are only needed if a newly-added migration carries a placeholder. Fails if
 `community-sdk.json` doesn't exist yet (run `init` or `adopt` first).
 
+`--add-modules <modules>` installs one or more modules not yet in
+`community-sdk.json` on top of the existing backend (comma-separated, same
+parsing as `init --modules`) — e.g. `upgrade --add-modules translation` to
+add the translation module to an already-initialized app.
+
 ## `adopt`
 
 ```bash

package/lib/commands/init.js

@@ -110,7 +110,7 @@ async function runInit(options = {}) {
             if (!fs.existsSync(srcDir))
                 continue;
             const destDir = path.join(functionsDestRoot, fnName);
-            fs.cpSync(srcDir, destDir, { recursive: true });
+            fs.cpSync(srcDir, destDir, { recursive: true, filter: install_shared_1.isShippedFunctionFile });
             writtenPaths.push(...(0, install_shared_1.listFilesRecursive)(destDir));
         }
     }
@@ -146,7 +146,10 @@ function printNextSteps(log, modules) {
     log("  2. Set Edge Function secrets: supabase secrets set OPENAI_API_KEY=...");
     log("     optional: SLACK_WEBHOOK_URL, COMMUNITY_APP_NAME, COMMUNITY_FALLBACK_NAME");
     if (modules.includes("push")) {
-        log("     push module: EXPO_ACCESS_TOKEN (required for notify-like/notify-comment)");
+        log("     push module: EXPO_ACCESS_TOKEN (only if your Expo project enforces Enhanced Security for push); COMMUNITY_PUSH_COPY (optional per-locale copy)");
+    }
+    if (modules.includes("translation")) {
+        log('     translation module: COMMUNITY_TRANSLATION_LOCALES="en,es-419,..." (required, same list as modules.translation.locales in the app); optional: COMMUNITY_TRANSLATION_MODEL, COMMUNITY_TRANSLATION_STYLE');
     }
     log("  3. Deploy the Edge Functions: supabase functions deploy");
 }

package/lib/commands/upgrade.d.ts

@@ -9,6 +9,8 @@ export interface UpgradeOptions {
     cwd?: string;
     /** Source of the migrations/ + functions/ trees. Defaults to the shipped templates. */
     templatesDir?: string;
+    /** Module names to install on top of what's already in the manifest — validated, ordered and merged via resolveModules, same rules as `init --modules` (unknown names throw, dependency gaps warn). */
+    addModules?: string[];
     /** Used to ask for projectUrl/anonKey when a newly copied migration needs them. */
     prompt?: (question: string) => Promise<string>;
     /** Called for non-fatal warnings — most importantly, functions overwritten with new content. */
@@ -23,6 +25,8 @@ export interface UpgradeResult {
     dir: string;
     /** True when nothing needed to change — no new migrations, no function drift. */
     upToDate: boolean;
+    /** Modules newly added by `addModules` (not already in the manifest). Empty when `addModules` was omitted or every named module was already installed. */
+    addedModules: string[];
     /** Relative (to `cwd`) paths of newly copied migration files, in copy order. */
     addedMigrations: string[];
     /** Function names copied because they weren't present on disk yet. */

package/lib/commands/upgrade.js

@@ -54,10 +54,15 @@ async function runUpgrade(options = {}) {
     const dir = (0, install_shared_1.resolveContainedDir)(cwd, dirRel);
     const templatesDir = options.templatesDir ?? (0, install_shared_1.defaultTemplatesDir)();
     const { migrationsSrcRoot, functionsSrcRoot } = (0, install_shared_1.resolveTemplateRoots)(templatesDir);
-    // Only modules the app actually has installed are diffed/re-synced —
-    // upgrade never adds or removes modules (that's what re-running init on a
-    // fresh dir, or a future dedicated command, would be for).
-    const canonicalModules = install_shared_1.MODULE_ORDER.filter((m) => manifest.modules.includes(m));
+    // By default only modules the app already has installed are diffed/re-synced.
+    // `addModules` extends that list through the same validation/ordering/warning
+    // rules `init --modules` uses; left empty/undefined, behaviour here must stay
+    // byte-identical to the pre-`addModules` path (no resolveModules call, no
+    // spurious warnings for e.g. an existing inbox-without-reaction install).
+    const canonicalModules = options.addModules && options.addModules.length > 0
+        ? (0, install_shared_1.resolveModules)([...manifest.modules, ...options.addModules], onWarn)
+        : install_shared_1.MODULE_ORDER.filter((m) => manifest.modules.includes(m));
+    const addedModules = canonicalModules.filter((m) => !manifest.modules.includes(m));
     const installedTemplateIds = new Set(manifest.installedTemplates ?? reconstructInstalledTemplateIds(manifest.installedFiles));
     const pending = [];
     for (const moduleName of canonicalModules) {
@@ -101,6 +106,7 @@ async function runUpgrade(options = {}) {
             manifest,
             dir,
             upToDate: true,
+            addedModules,
             addedMigrations: [],
             newFunctions: [],
             overwrittenFunctions: [],
@@ -162,7 +168,10 @@ async function runUpgrade(options = {}) {
         }
         for (const fnName of newFunctions) {
             const destDir = path.join(functionsDestRoot, fnName);
-            fs.cpSync(path.join(functionsSrcRoot, fnName), destDir, { recursive: true });
+            fs.cpSync(path.join(functionsSrcRoot, fnName), destDir, {
+                recursive: true,
+                filter: install_shared_1.isShippedFunctionFile,
+            });
             createdFunctionDirs.push(destDir);
         }
         for (const fnName of changedFunctions) {
@@ -171,7 +180,10 @@ async function runUpgrade(options = {}) {
             fs.cpSync(destDir, backupDir, { recursive: true });
             backups.push({ destDir, backupDir });
             fs.rmSync(destDir, { recursive: true, force: true });
-            fs.cpSync(path.join(functionsSrcRoot, fnName), destDir, { recursive: true });
+            fs.cpSync(path.join(functionsSrcRoot, fnName), destDir, {
+                recursive: true,
+                filter: install_shared_1.isShippedFunctionFile,
+            });
         }
     }
     catch (err) {
@@ -205,12 +217,15 @@ async function runUpgrade(options = {}) {
     const updatedManifest = {
         schemaVersion: manifest_1.CURRENT_SCHEMA_VERSION,
         sdkVersion: (0, install_shared_1.readOwnPackageVersion)(),
-        modules: manifest.modules,
+        // Only --add-modules rewrites the module list; a plain upgrade keeps the
+        // manifest's own (order and any entry this CLI doesn't know).
+        modules: options.addModules && options.addModules.length > 0 ? canonicalModules : manifest.modules,
         installedFiles,
         installedTemplates: [...newInstalledTemplateIds].sort(),
     };
     (0, manifest_1.writeManifest)(cwd, updatedManifest);
     printSummary(log, onWarn, {
+        addedModules,
         addedMigrations,
         newFunctions,
         overwrittenFunctions: changedFunctions,
@@ -219,6 +234,7 @@ async function runUpgrade(options = {}) {
         manifest: updatedManifest,
         dir,
         upToDate: false,
+        addedModules,
         addedMigrations,
         newFunctions,
         overwrittenFunctions: changedFunctions,
@@ -242,8 +258,11 @@ function reconstructInstalledTemplateIds(installedFiles) {
     return ids;
 }
 function functionDirDiffers(srcDir, destDir) {
-    const srcRel = new Set((0, install_shared_1.listFilesRecursive)(srcDir).map((f) => path.relative(srcDir, f)));
-    const destRel = new Set((0, install_shared_1.listFilesRecursive)(destDir).map((f) => path.relative(destDir, f)));
+    const rel = (dir) => new Set((0, install_shared_1.listFilesRecursive)(dir)
+        .filter(install_shared_1.isShippedFunctionFile)
+        .map((f) => path.relative(dir, f)));
+    const srcRel = rel(srcDir);
+    const destRel = rel(destDir);
     if (srcRel.size !== destRel.size)
         return true;
     for (const rel of srcRel) {
@@ -259,6 +278,9 @@ function functionDirDiffers(srcDir, destDir) {
 function printSummary(log, onWarn, summary) {
     log("");
     log("community-sdk upgraded.");
+    if (summary.addedModules.length > 0) {
+        log(`Added module(s): ${summary.addedModules.join(", ")}`);
+    }
     if (summary.addedMigrations.length > 0) {
         log(`Added ${summary.addedMigrations.length} migration(s):`);
         for (const f of summary.addedMigrations)
@@ -277,4 +299,7 @@ function printSummary(log, onWarn, summary) {
     if (summary.newFunctions.length > 0 || summary.overwrittenFunctions.length > 0) {
         log("  2. Review the function changes, then: supabase functions deploy");
     }
+    if (summary.addedModules.includes("translation")) {
+        log('  3. translation module: COMMUNITY_TRANSLATION_LOCALES="en,es-419,..." (required, same list as modules.translation.locales in the app); optional: COMMUNITY_TRANSLATION_MODEL, COMMUNITY_TRANSLATION_STYLE');
+    }
 }

package/lib/index.js

@@ -81,12 +81,14 @@ program
 program
     .command("upgrade")
     .description("Copy any new migrations/Edge Functions shipped since this repo's community-sdk.json was last written, and overwrite changed function code (with a warning)")
+    .option("--add-modules <modules>", "comma-separated module list to install on top of what's already in community-sdk.json (e.g. translation)")
     .option("--project-url <url>", "Supabase project URL, e.g. https://<ref>.supabase.co (only needed if a new migration carries a placeholder)")
     .option("--anon-key <key>", "Supabase anon key (only needed if a new migration carries a placeholder)")
     .option("--dir <dir>", "target Supabase directory, relative to the current directory", "supabase")
     .action(async (opts) => {
     try {
         await (0, upgrade_1.runUpgrade)({
+            addModules: parseModulesFlag(opts.addModules),
             projectUrl: opts.projectUrl,
             anonKey: opts.anonKey,
             dir: opts.dir,

package/lib/install-shared.d.ts

@@ -1,15 +1,16 @@
 /**
  * Ruled install order (controller ruling, task 18): core -> push -> polls ->
- * reaction -> inbox. Reaction MUST land before inbox — inbox/001's reaction
- * trigger is guarded with `to_regclass('public.post_reactions')` at install
- * time and is never retroactively wired if the reaction module shows up
- * later, so `reaction` needs to already exist when `inbox` runs.
+ * reaction -> inbox -> translation. Reaction MUST land before inbox —
+ * inbox/001's reaction trigger is guarded with
+ * `to_regclass('public.post_reactions')` at install time and is never
+ * retroactively wired if the reaction module shows up later, so `reaction`
+ * needs to already exist when `inbox` runs.
  *
  * Shared between `init` (task 18) and `upgrade`/`adopt` (task 19) — the
  * single source of truth for module names, order, and the function sets
  * each module pulls in.
  */
-export declare const MODULE_ORDER: readonly ["core", "push", "polls", "reaction", "inbox"];
+export declare const MODULE_ORDER: readonly ["core", "push", "polls", "reaction", "inbox", "translation"];
 export type Module = (typeof MODULE_ORDER)[number];
 export declare function functionsForModules(modules: readonly Module[]): string[];
 /**
@@ -66,6 +67,9 @@ export declare function resolveProjectCredentials(options: {
 }>;
 export declare function formatTimestamp(date: Date): string;
 export declare function addSeconds(date: Date, seconds: number): Date;
+/** Deno test files (`*_test.ts`) stay in the repo: never copied into a host's
+ * functions, and ignored when diffing a host's function dir. */
+export declare function isShippedFunctionFile(file: string): boolean;
 export declare function listFilesRecursive(dir: string): string[];
 export declare function toRelativePosix(base: string, target: string): string;
 /** Resolves `dirRel` against `cwd`, throwing if it would escape the project root. */

package/lib/install-shared.js

@@ -46,6 +46,7 @@ exports.deriveProjectUrlFromConfig = deriveProjectUrlFromConfig;
 exports.resolveProjectCredentials = resolveProjectCredentials;
 exports.formatTimestamp = formatTimestamp;
 exports.addSeconds = addSeconds;
+exports.isShippedFunctionFile = isShippedFunctionFile;
 exports.listFilesRecursive = listFilesRecursive;
 exports.toRelativePosix = toRelativePosix;
 exports.resolveContainedDir = resolveContainedDir;
@@ -54,16 +55,17 @@ const path = __importStar(require("node:path"));
 const promises_1 = require("node:readline/promises");
 /**
  * Ruled install order (controller ruling, task 18): core -> push -> polls ->
- * reaction -> inbox. Reaction MUST land before inbox — inbox/001's reaction
- * trigger is guarded with `to_regclass('public.post_reactions')` at install
- * time and is never retroactively wired if the reaction module shows up
- * later, so `reaction` needs to already exist when `inbox` runs.
+ * reaction -> inbox -> translation. Reaction MUST land before inbox —
+ * inbox/001's reaction trigger is guarded with
+ * `to_regclass('public.post_reactions')` at install time and is never
+ * retroactively wired if the reaction module shows up later, so `reaction`
+ * needs to already exist when `inbox` runs.
  *
  * Shared between `init` (task 18) and `upgrade`/`adopt` (task 19) — the
  * single source of truth for module names, order, and the function sets
  * each module pulls in.
  */
-exports.MODULE_ORDER = ["core", "push", "polls", "reaction", "inbox"];
+exports.MODULE_ORDER = ["core", "push", "polls", "reaction", "inbox", "translation"];
 const ALWAYS_FUNCTIONS = [
     "moderate-one",
     "daily-moderation",
@@ -73,6 +75,7 @@ const ALWAYS_FUNCTIONS = [
 ];
 const PUSH_FUNCTIONS = ["notify-like", "notify-comment", "broadcast-post"];
 const REACTION_FUNCTIONS = ["notify-reaction"];
+const TRANSLATION_FUNCTIONS = ["translate-one", "daily-translation"];
 function functionsForModules(modules) {
     const set = new Set(ALWAYS_FUNCTIONS);
     if (modules.includes("push"))
@@ -81,6 +84,9 @@ function functionsForModules(modules) {
     if (modules.includes("reaction"))
         for (const f of REACTION_FUNCTIONS)
             set.add(f);
+    if (modules.includes("translation"))
+        for (const f of TRANSLATION_FUNCTIONS)
+            set.add(f);
     return [...set];
 }
 /**
@@ -102,6 +108,9 @@ function resolveModules(requested, onWarn) {
     if (canonicalModules.includes("inbox") && !canonicalModules.includes("reaction")) {
         onWarn("community-sdk: module 'inbox' selected without 'reaction' — reaction notifications won't appear in the inbox until the reaction module is also installed.");
     }
+    if (canonicalModules.includes("translation") && !canonicalModules.includes("polls")) {
+        onWarn("community-sdk: module 'translation' selected without 'polls' — poll option labels won't be translated (posts and comments are).");
+    }
     return canonicalModules;
 }
 /**
@@ -228,6 +237,11 @@ function formatTimestamp(date) {
 function addSeconds(date, seconds) {
     return new Date(date.getTime() + seconds * 1000);
 }
+/** Deno test files (`*_test.ts`) stay in the repo: never copied into a host's
+ * functions, and ignored when diffing a host's function dir. */
+function isShippedFunctionFile(file) {
+    return !file.endsWith("_test.ts");
+}
 function listFilesRecursive(dir) {
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     const files = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocapine/community",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
   "license": "MIT",
   "repository": {

package/templates/functions/_shared/client.ts

@@ -1,15 +1,48 @@
-// Shared Supabase admin client + JSON response helper.
+// Shared Supabase admin client, caller identity helpers + JSON response helper.
 
 import { createClient } from "jsr:@supabase/supabase-js@2";
 
 export const SUPABASE_URL = Deno.env.get("SUPABASE_URL")!;
 
 // Service-role client: bypasses RLS. Every function does privileged work
-// through this; callers only ever pass the public anon JWT (verify_jwt).
+// through this; callers only ever pass the public anon JWT (verify_jwt) or a
+// user JWT.
 export function adminClient() {
   return createClient(SUPABASE_URL, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!);
 }
 
+// The gateway (verify_jwt) has already validated the bearer's signature, so
+// only the role claim needs checking here. An exact string match against the
+// injected SUPABASE_SERVICE_ROLE_KEY broke when a project migrated to the new
+// API keys: the runtime then receives the sb_secret_* value while callers
+// still hold the legacy service_role JWT. Accept either proof.
+export function isServiceCaller(req: Request): boolean {
+  const bearer = (req.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+  if (bearer && bearer === Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")) return true;
+  try {
+    const payload = JSON.parse(
+      atob(bearer.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")),
+    ) as { role?: string };
+    return payload.role === "service_role";
+  } catch {
+    return false;
+  }
+}
+
+// The user behind the request's bearer, or null for an anon-key-only call
+// (or an invalid/expired user JWT). Resolved through Auth so a forged `sub`
+// claim can't be smuggled in with a plain anon token.
+export async function callerUserId(req: Request): Promise<string | null> {
+  const authorization = req.headers.get("authorization");
+  if (!authorization) return null;
+  const client = createClient(SUPABASE_URL, Deno.env.get("SUPABASE_ANON_KEY")!, {
+    global: { headers: { Authorization: authorization } },
+  });
+  const { data, error } = await client.auth.getUser();
+  if (error || !data.user) return null;
+  return data.user.id;
+}
+
 // The client consumes responses via supabase.functions.invoke, which only
 // parses the body as JSON when the Content-Type says so. Without this header
 // invoke returns a raw string and verdict.status is undefined.

package/templates/functions/_shared/config.ts

@@ -1,23 +1,7 @@
-// Per-app copy used inside notifications, injected as function secrets so the
-// same function code deploys unchanged to every app:
-//
-//   supabase secrets set COMMUNITY_FALLBACK_NAME="A member"
-//   supabase secrets set COMMUNITY_APP_NAME="My App"
-//   supabase secrets set COMMUNITY_REACTION_PUSH_TEXT="{name} sent you support"
-//
-// Defaults are deliberately neutral.
-
-// Display name used when the acting user has no username yet
-// ("<name>: ..." in comment pushes, "<name> liked your post").
-export const FALLBACK_ACTOR_NAME = Deno.env.get("COMMUNITY_FALLBACK_NAME") ?? "Someone";
+// Per-app copy injected as function secrets so the same function code
+// deploys unchanged to every app. Push copy (actor fallback name, like /
+// comment / reaction titles) lives in _shared/copy.ts (COMMUNITY_PUSH_COPY).
 
 // Push title fallback for official broadcast posts whose author has no
 // username (normally the official account's display name).
 export const BROADCAST_FALLBACK_TITLE = Deno.env.get("COMMUNITY_APP_NAME") ?? "Community";
-
-// notify-reaction's single-reactor push title template. `{name}` is
-// substituted with the reactor's display name (or FALLBACK_ACTOR_NAME).
-// Neutral default; an app with its own reaction semantics overrides this
-// secret rather than the function code.
-export const REACTION_PUSH_TEXT =
-  Deno.env.get("COMMUNITY_REACTION_PUSH_TEXT") ?? "{name} is thinking of you";

package/templates/functions/_shared/copy.ts

@@ -0,0 +1,247 @@
+// Locale-aware push copy for notify-comment / notify-like / notify-reaction.
+//
+// Every string below is a neutral built-in for the 9 locales the UI package
+// ships. An app with its own voice overrides ANY of them — per locale, per
+// key — through ONE JSON secret instead of forking the function bodies (the
+// way one host app had to before this existed):
+//
+//   supabase secrets set COMMUNITY_PUSH_COPY='{
+//     "fallbackName":  { "en": "A sister", "pt-PT": "Uma irmã" },
+//     "comment.title": { "pl": "Otrzymałaś komentarz" },
+//     "like.one":      { "pl": "{name} polubiła twój post" },
+//     "reaction.one":  { "en": "{name} prayed for you 🙏" },
+//     "reaction.many": { "en": "{name} and {count} others prayed for you 🙏",
+//                        "pl": { "one": "…", "few": "…", "many": "…" } }
+//   }'
+//
+// Placeholders: `{name}` (actor display name) and `{count}` (the number of
+// OTHER people in a coalesced push). A `*.many` value is either a string or a
+// `{ one, few, many, other }` object picked by the CLDR plural category of
+// `{count}` for the recipient's locale (Polish needs all three; French treats
+// 0 like 1; everything else is one/other).
+//
+// Legacy single-string secrets still apply, below the JSON and above the
+// built-ins: COMMUNITY_FALLBACK_NAME (every locale's fallbackName) and
+// COMMUNITY_REACTION_PUSH_TEXT (every locale's reaction.one).
+
+type Forms = { one?: string; few?: string; many?: string; other?: string };
+type CopyValue = string | Forms;
+type LocaleCopy = Record<string, CopyValue>;
+
+export type PushCopyKey =
+  "fallbackName" | "comment.title" | "like.one" | "like.many" | "reaction.one" | "reaction.many";
+
+const BUILTIN: Record<string, LocaleCopy> = {
+  en: {
+    fallbackName: "Someone",
+    "comment.title": "You received a comment",
+    "like.one": "{name} liked your post",
+    "like.many": {
+      one: "{name} and {count} other liked your post",
+      other: "{name} and {count} others liked your post",
+    },
+    "reaction.one": "{name} is thinking of you",
+    "reaction.many": {
+      one: "{name} and {count} other are thinking of you",
+      other: "{name} and {count} others are thinking of you",
+    },
+  },
+  "pt-PT": {
+    fallbackName: "Alguém",
+    "comment.title": "Recebeste um comentário",
+    "like.one": "{name} gostou da tua publicação",
+    "like.many": {
+      one: "{name} e mais {count} pessoa gostou da tua publicação",
+      other: "{name} e mais {count} pessoas gostaram da tua publicação",
+    },
+    "reaction.one": "{name} está a pensar em ti",
+    "reaction.many": {
+      one: "{name} e mais {count} pessoa está a pensar em ti",
+      other: "{name} e mais {count} pessoas estão a pensar em ti",
+    },
+  },
+  "pt-BR": {
+    fallbackName: "Alguém",
+    "comment.title": "Você recebeu um comentário",
+    "like.one": "{name} curtiu seu post",
+    "like.many": {
+      one: "{name} e mais {count} pessoa curtiu seu post",
+      other: "{name} e mais {count} pessoas curtiram seu post",
+    },
+    "reaction.one": "{name} está pensando em você",
+    "reaction.many": {
+      one: "{name} e mais {count} pessoa está pensando em você",
+      other: "{name} e mais {count} pessoas estão pensando em você",
+    },
+  },
+  "es-ES": {
+    fallbackName: "Alguien",
+    "comment.title": "Has recibido un comentario",
+    "like.one": "A {name} le ha gustado tu publicación",
+    "like.many": {
+      one: "A {name} y a {count} persona más les ha gustado tu publicación",
+      other: "A {name} y a {count} personas más les ha gustado tu publicación",
+    },
+    "reaction.one": "{name} está pensando en ti",
+    "reaction.many": {
+      one: "{name} y {count} persona más está pensando en ti",
+      other: "{name} y {count} personas más están pensando en ti",
+    },
+  },
+  "es-419": {
+    fallbackName: "Alguien",
+    "comment.title": "Recibiste un comentario",
+    "like.one": "A {name} le gustó tu publicación",
+    "like.many": {
+      one: "A {name} y a {count} persona más les gustó tu publicación",
+      other: "A {name} y a {count} personas más les gustó tu publicación",
+    },
+    "reaction.one": "{name} está pensando en ti",
+    "reaction.many": {
+      one: "{name} y {count} persona más está pensando en ti",
+      other: "{name} y {count} personas más están pensando en ti",
+    },
+  },
+  it: {
+    fallbackName: "Qualcuno",
+    "comment.title": "Hai ricevuto un commento",
+    "like.one": "A {name} piace il tuo post",
+    "like.many": {
+      one: "A {name} e ad altra {count} persona piace il tuo post",
+      other: "A {name} e ad altre {count} persone piace il tuo post",
+    },
+    "reaction.one": "{name} sta pensando a te",
+    "reaction.many": {
+      one: "{name} e altra {count} persona sta pensando a te",
+      other: "{name} e altre {count} persone stanno pensando a te",
+    },
+  },
+  pl: {
+    fallbackName: "Ktoś",
+    "comment.title": "Masz nowy komentarz",
+    "like.one": "{name} polubił(a) twój post",
+    "like.many": {
+      one: "{name} i {count} inna osoba polubiły twój post",
+      few: "{name} i {count} inne osoby polubiły twój post",
+      many: "{name} i {count} innych osób polubiło twój post",
+    },
+    "reaction.one": "{name} myśli o tobie",
+    "reaction.many": {
+      one: "{name} i {count} inna osoba myśli o tobie",
+      few: "{name} i {count} inne osoby myślą o tobie",
+      many: "{name} i {count} innych osób myśli o tobie",
+    },
+  },
+  fr: {
+    fallbackName: "Quelqu'un",
+    "comment.title": "Tu as reçu un commentaire",
+    "like.one": "{name} a aimé ta publication",
+    "like.many": {
+      one: "{name} et {count} autre personne ont aimé ta publication",
+      other: "{name} et {count} autres personnes ont aimé ta publication",
+    },
+    "reaction.one": "{name} pense à toi",
+    "reaction.many": {
+      one: "{name} et {count} autre personne pensent à toi",
+      other: "{name} et {count} autres personnes pensent à toi",
+    },
+  },
+  de: {
+    fallbackName: "Jemand",
+    "comment.title": "Du hast einen Kommentar erhalten",
+    "like.one": "{name} gefällt dein Beitrag",
+    "like.many": {
+      one: "{name} und {count} weiterer Person gefällt dein Beitrag",
+      other: "{name} und {count} weiteren Personen gefällt dein Beitrag",
+    },
+    "reaction.one": "{name} denkt an dich",
+    "reaction.many": {
+      one: "{name} und {count} weitere Person denken an dich",
+      other: "{name} und {count} weitere Personen denken an dich",
+    },
+  },
+};
+
+// Same rule set as the UI package's `pluralCategory` (packages/ui/src/i18n.ts).
+export function pluralCategory(locale: string, n: number): keyof Forms {
+  const lang = locale.split("-")[0]?.toLowerCase();
+  if (lang === "pl") {
+    if (n === 1) return "one";
+    const m10 = n % 10;
+    const m100 = n % 100;
+    if (m10 >= 2 && m10 <= 4 && !(m100 >= 12 && m100 <= 14)) return "few";
+    return "many";
+  }
+  if (lang === "fr") return n === 0 || n === 1 ? "one" : "other";
+  return n === 1 ? "one" : "other";
+}
+
+function parseOverrides(): Record<string, Record<string, CopyValue>> {
+  const raw = Deno.env.get("COMMUNITY_PUSH_COPY");
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch (e) {
+    console.error("community-sdk: COMMUNITY_PUSH_COPY is not valid JSON, ignoring it", e);
+    return {};
+  }
+}
+
+const OVERRIDES = parseOverrides();
+const LEGACY_FALLBACK_NAME = Deno.env.get("COMMUNITY_FALLBACK_NAME");
+const LEGACY_REACTION_ONE = Deno.env.get("COMMUNITY_REACTION_PUSH_TEXT");
+
+/** `es-MX` → `es-ES`, `pt-AO` → `pt-PT`, `fr-CA` → `fr`; unknown → `en`. */
+function resolveLocale(locale: string | null | undefined): string {
+  if (!locale) return "en";
+  if (BUILTIN[locale]) return locale;
+  const lang = locale.split("-")[0].toLowerCase();
+  if (BUILTIN[lang]) return lang;
+  if (lang === "es") return "es-ES";
+  if (lang === "pt") return "pt-PT";
+  return "en";
+}
+
+function pick(key: PushCopyKey, locale: string, exact: string | null | undefined): CopyValue {
+  const overrideByLocale = OVERRIDES[key] ?? {};
+  // Override lookup: exact locale as sent by the client, then the resolved one.
+  const override =
+    (exact ? overrideByLocale[exact] : undefined) ??
+    overrideByLocale[locale] ??
+    overrideByLocale[locale.split("-")[0]];
+  if (override !== undefined) return override;
+  if (key === "fallbackName" && LEGACY_FALLBACK_NAME) return LEGACY_FALLBACK_NAME;
+  if (key === "reaction.one" && LEGACY_REACTION_ONE) return LEGACY_REACTION_ONE;
+  return BUILTIN[locale][key] ?? BUILTIN.en[key];
+}
+
+function fill(template: string, params: { name?: string; count?: number }): string {
+  return template
+    .replace(/\{name\}/g, params.name ?? "")
+    .replace(/\{count\}/g, params.count === undefined ? "" : String(params.count));
+}
+
+/** Copy resolver for one recipient (`profiles.locale`). */
+export function pushCopy(recipientLocale: string | null | undefined) {
+  const locale = resolveLocale(recipientLocale);
+  const text = (key: PushCopyKey, params: { name?: string; count?: number } = {}): string => {
+    const value = pick(key, locale, recipientLocale);
+    if (typeof value === "string") return fill(value, params);
+    const category = pluralCategory(locale, params.count ?? 0);
+    const form =
+      value[category] ??
+      value.other ??
+      value.many ??
+      value.one ??
+      // A partial override object: fall through to the built-in forms.
+      (() => {
+        const builtin = BUILTIN[locale][key] ?? BUILTIN.en[key];
+        return typeof builtin === "string"
+          ? builtin
+          : (builtin[category] ?? builtin.other ?? builtin.many ?? builtin.one ?? "");
+      })();
+    return fill(form, params);
+  };
+  return { locale, fallbackName: text("fallbackName"), text };
+}