@rocapine/community 0.1.0

package/lib/install-shared.js

@@ -0,0 +1,256 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MODULE_ORDER = void 0;
+exports.functionsForModules = functionsForModules;
+exports.resolveModules = resolveModules;
+exports.templateBaseName = templateBaseName;
+exports.migrationDestFilename = migrationDestFilename;
+exports.parseMigrationDestFilename = parseMigrationDestFilename;
+exports.defaultTemplatesDir = defaultTemplatesDir;
+exports.resolveTemplateRoots = resolveTemplateRoots;
+exports.readOwnPackageVersion = readOwnPackageVersion;
+exports.deriveProjectUrlFromConfig = deriveProjectUrlFromConfig;
+exports.resolveProjectCredentials = resolveProjectCredentials;
+exports.formatTimestamp = formatTimestamp;
+exports.addSeconds = addSeconds;
+exports.listFilesRecursive = listFilesRecursive;
+exports.toRelativePosix = toRelativePosix;
+exports.resolveContainedDir = resolveContainedDir;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const promises_1 = require("node:readline/promises");
+/**
+ * Ruled install order (controller ruling, task 18): core -> push -> polls ->
+ * reaction -> inbox. Reaction MUST land before inbox — inbox/001's reaction
+ * trigger is guarded with `to_regclass('public.post_reactions')` at install
+ * time and is never retroactively wired if the reaction module shows up
+ * later, so `reaction` needs to already exist when `inbox` runs.
+ *
+ * Shared between `init` (task 18) and `upgrade`/`adopt` (task 19) — the
+ * single source of truth for module names, order, and the function sets
+ * each module pulls in.
+ */
+exports.MODULE_ORDER = ["core", "push", "polls", "reaction", "inbox"];
+const ALWAYS_FUNCTIONS = [
+    "moderate-one",
+    "daily-moderation",
+    "update-profile",
+    "report-to-slack",
+    "_shared",
+];
+const PUSH_FUNCTIONS = ["notify-like", "notify-comment", "broadcast-post"];
+const REACTION_FUNCTIONS = ["notify-reaction"];
+function functionsForModules(modules) {
+    const set = new Set(ALWAYS_FUNCTIONS);
+    if (modules.includes("push"))
+        for (const f of PUSH_FUNCTIONS)
+            set.add(f);
+    if (modules.includes("reaction"))
+        for (const f of REACTION_FUNCTIONS)
+            set.add(f);
+    return [...set];
+}
+/**
+ * Validates and canonicalizes a requested module list: rejects unknown
+ * names, always implies `core`, orders the result per MODULE_ORDER, and
+ * warns (non-fatally) when `inbox` is picked without `reaction`.
+ */
+function resolveModules(requested, onWarn) {
+    const source = requested && requested.length > 0 ? requested : [...exports.MODULE_ORDER];
+    const requestedSet = new Set(source.map((m) => m.trim()).filter(Boolean));
+    for (const m of requestedSet) {
+        if (!exports.MODULE_ORDER.includes(m)) {
+            throw new Error(`community-sdk: unknown module "${m}" (expected one of ${exports.MODULE_ORDER.join(", ")})`);
+        }
+    }
+    // core is always required/implied.
+    requestedSet.add("core");
+    const canonicalModules = exports.MODULE_ORDER.filter((m) => requestedSet.has(m));
+    if (canonicalModules.includes("inbox") && !canonicalModules.includes("reaction")) {
+        onWarn("community-sdk: module 'inbox' selected without 'reaction' — reaction notifications won't appear in the inbox until the reaction module is also installed.");
+    }
+    return canonicalModules;
+}
+/**
+ * Strips a template migration's leading numeric ordering prefix and `.sql`
+ * extension, e.g. "001_tables.sql" -> "tables". This is both the middle
+ * segment of the timestamped destination filename init/upgrade write
+ * (`<ts>_community_<module>_<name>.sql`) AND — paired with the module name —
+ * the stable identity `upgrade` diffs against (see manifest.ts
+ * `migrationTemplateId`).
+ */
+function templateBaseName(templateFilename) {
+    return templateFilename.replace(/\.sql$/, "").replace(/^\d+_/, "");
+}
+function migrationDestFilename(timestamp, moduleName, name) {
+    return `${timestamp}_community_${moduleName}_${name}.sql`;
+}
+const MIGRATION_DEST_RE = /^\d{14}_community_([a-z]+)_(.+)\.sql$/;
+/**
+ * Parses a filename previously written by init/upgrade
+ * (`<ts>_community_<module>_<name>.sql`) back into its module + base name.
+ * Returns null for anything else (e.g. a function file, or a migration a
+ * user hand-wrote outside the SDK) — used by `upgrade` as a fallback when
+ * reconstructing template identity from a manifest that predates the
+ * `installedTemplates` field.
+ */
+function parseMigrationDestFilename(filename) {
+    const match = MIGRATION_DEST_RE.exec(filename);
+    if (!match)
+        return null;
+    return { moduleName: match[1], name: match[2] };
+}
+function defaultTemplatesDir() {
+    // This file and src/commands/*.ts both sit two levels below the package
+    // root (packages/cli), so this resolves identically pre- and post-build.
+    const packageRoot = path.resolve(__dirname, "..");
+    const packaged = path.join(packageRoot, "templates");
+    // STALENESS TRAP: once packages/cli/templates/ exists on disk (written by
+    // any prior `npm run build`, whose `prebuild` hook runs
+    // scripts/copy-templates.mjs), it wins over the live repo-root supabase/
+    // tree below — even during local dev. Editing supabase/**/*.sql or
+    // supabase/functions/** and then running `node lib/index.js init` (or a
+    // test that doesn't pass an explicit `templatesDir`) will silently use the
+    // last-built snapshot, not your edits. Rerun `npm run build` (or `node
+    // scripts/copy-templates.mjs` directly) to refresh packages/cli/templates/
+    // after touching supabase/.
+    if (fs.existsSync(packaged))
+        return packaged;
+    // Dev/test fallback: the monorepo's own supabase/ source of truth, used
+    // only while packages/cli/templates/ has never been built.
+    const repoRoot = path.resolve(packageRoot, "..", "..");
+    return path.join(repoRoot, "supabase");
+}
+/** Asserts `templatesDir` looks like a real template tree and returns its two roots. */
+function resolveTemplateRoots(templatesDir) {
+    const migrationsSrcRoot = path.join(templatesDir, "migrations");
+    const functionsSrcRoot = path.join(templatesDir, "functions");
+    if (!fs.existsSync(migrationsSrcRoot) || !fs.existsSync(functionsSrcRoot)) {
+        throw new Error(`community-sdk: templates not found at ${templatesDir} (expected migrations/ and functions/ subdirectories)`);
+    }
+    return { migrationsSrcRoot, functionsSrcRoot };
+}
+function readOwnPackageVersion() {
+    const packageRoot = path.resolve(__dirname, "..");
+    const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+    return pkg.version;
+}
+function deriveProjectUrlFromConfig(dir) {
+    const configPath = path.join(dir, "config.toml");
+    if (!fs.existsSync(configPath))
+        return null;
+    const raw = fs.readFileSync(configPath, "utf8");
+    const match = raw.match(/^\s*project_id\s*=\s*"([^"]+)"/m);
+    if (!match)
+        return null;
+    return `https://${match[1]}.supabase.co`;
+}
+function defaultPrompt(question) {
+    const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+    return rl.question(question).then((answer) => {
+        rl.close();
+        return answer;
+    });
+}
+/**
+ * Resolves the Supabase project URL + anon key from (in order) explicit
+ * flags, `<dir>/config.toml` (URL only), or an interactive prompt — failing
+ * loudly instead of hanging when stdin is not a TTY and no `prompt`
+ * override was injected. Shared by `init` and `upgrade`, both of which only
+ * need this when a placeholder-bearing file is about to be written.
+ */
+async function resolveProjectCredentials(options) {
+    const usingDefaultPrompt = !options.prompt;
+    const prompt = options.prompt ?? defaultPrompt;
+    let projectUrl = options.projectUrl;
+    let anonKey = options.anonKey;
+    if (!projectUrl) {
+        projectUrl = deriveProjectUrlFromConfig(options.dir) ?? undefined;
+    }
+    const stillMissingFlags = [];
+    if (!projectUrl)
+        stillMissingFlags.push("--project-url");
+    if (!anonKey)
+        stillMissingFlags.push("--anon-key");
+    if (stillMissingFlags.length > 0 && usingDefaultPrompt && !process.stdin.isTTY) {
+        throw new Error(`community-sdk: missing required flag(s) ${stillMissingFlags.join(", ")}. stdin is not a TTY, so this command cannot prompt for ${stillMissingFlags.length > 1 ? "them" : "it"} — pass ${stillMissingFlags.length > 1 ? "them" : "it"} explicitly.`);
+    }
+    if (!projectUrl) {
+        projectUrl = (await prompt("Supabase project URL (https://<ref>.supabase.co): ")).trim();
+    }
+    if (!anonKey) {
+        anonKey = (await prompt("Supabase anon key: ")).trim();
+    }
+    return { projectUrl, anonKey };
+}
+function formatTimestamp(date) {
+    const pad = (n) => String(n).padStart(2, "0");
+    return (String(date.getUTCFullYear()) +
+        pad(date.getUTCMonth() + 1) +
+        pad(date.getUTCDate()) +
+        pad(date.getUTCHours()) +
+        pad(date.getUTCMinutes()) +
+        pad(date.getUTCSeconds()));
+}
+function addSeconds(date, seconds) {
+    return new Date(date.getTime() + seconds * 1000);
+}
+function listFilesRecursive(dir) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...listFilesRecursive(full));
+        }
+        else {
+            files.push(full);
+        }
+    }
+    return files;
+}
+function toRelativePosix(base, target) {
+    return path.relative(base, target).split(path.sep).join("/");
+}
+/** Resolves `dirRel` against `cwd`, throwing if it would escape the project root. */
+function resolveContainedDir(cwd, dirRel) {
+    const cwdResolved = path.resolve(cwd);
+    const dir = path.resolve(cwdResolved, dirRel);
+    if (dir !== cwdResolved && !dir.startsWith(cwdResolved + path.sep)) {
+        throw new Error(`community-sdk: --dir must resolve to a directory inside the project root, got "${dirRel}" -> ${dir}`);
+    }
+    return dir;
+}

package/lib/manifest.d.ts

@@ -0,0 +1,53 @@
+/**
+ * community-sdk.json — written at the app repo root by `community init`
+ * (and updated by `community upgrade` / `community adopt`). Tracks what was
+ * installed so a second `init`/`adopt` can refuse to run and `upgrade`
+ * knows what it is diffing against.
+ */
+export type Manifest = {
+    schemaVersion: number;
+    sdkVersion: string;
+    modules: string[];
+    installedFiles: string[];
+    /**
+     * Identity of every migration template already installed, one entry per
+     * template as `"<module>/<templateBaseName>"` (e.g. "core/tables",
+     * matching install-shared.ts `templateBaseName("001_tables.sql")`).
+     *
+     * This — not `installedFiles` — is what `upgrade` diffs the shipped
+     * template tree against, because installedFiles holds the *timestamped
+     * copy* name (`<ts>_community_core_tables.sql`) and a fresh timestamp is
+     * minted on every init/upgrade run, so those names can never be
+     * meaningfully compared across runs. The template's numeric ordering
+     * prefix (the "001" in "001_tables.sql") is intentionally dropped from
+     * the identity too: it only controls copy order within a module, and
+     * once a template has shipped, a real change to it must arrive as a new,
+     * separately-named template (migrations are append-only) rather than an
+     * edit — so base-name identity is exactly the granularity `upgrade`
+     * needs.
+     *
+     * Optional for backward compatibility: absent on manifests written by
+     * schemaVersion 1 `init` before this field existed (Task 18).
+     * `readManifest` still parses those manifests fine; `upgrade` falls back
+     * to reconstructing this set from `installedFiles`' timestamped filenames
+     * via `parseMigrationDestFilename` in that case (see install-shared.ts) —
+     * which recovers the exact same `<module>/<templateBaseName>` shape,
+     * since the prefix was already stripped before those filenames were
+     * written.
+     */
+    installedTemplates?: string[];
+};
+export declare const MANIFEST_FILENAME = "community-sdk.json";
+/** The only schemaVersion this CLI currently writes. */
+export declare const CURRENT_SCHEMA_VERSION = 1;
+/**
+ * Stable identity for a migration template, used to populate/diff
+ * `Manifest.installedTemplates`. `templateBaseName` is the template's
+ * filename with its numeric prefix and `.sql` extension stripped (see
+ * install-shared.ts) — callers pass that in, not the raw template filename,
+ * so this function has no filesystem-naming knowledge of its own.
+ */
+export declare function migrationTemplateId(moduleName: string, templateBaseName: string): string;
+export declare function manifestPath(dir: string): string;
+export declare function readManifest(dir: string): Manifest | null;
+export declare function writeManifest(dir: string, manifest: Manifest): void;

package/lib/manifest.js

@@ -0,0 +1,74 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURRENT_SCHEMA_VERSION = exports.MANIFEST_FILENAME = void 0;
+exports.migrationTemplateId = migrationTemplateId;
+exports.manifestPath = manifestPath;
+exports.readManifest = readManifest;
+exports.writeManifest = writeManifest;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+exports.MANIFEST_FILENAME = "community-sdk.json";
+/** The only schemaVersion this CLI currently writes. */
+exports.CURRENT_SCHEMA_VERSION = 1;
+/**
+ * Stable identity for a migration template, used to populate/diff
+ * `Manifest.installedTemplates`. `templateBaseName` is the template's
+ * filename with its numeric prefix and `.sql` extension stripped (see
+ * install-shared.ts) — callers pass that in, not the raw template filename,
+ * so this function has no filesystem-naming knowledge of its own.
+ */
+function migrationTemplateId(moduleName, templateBaseName) {
+    return `${moduleName}/${templateBaseName}`;
+}
+function manifestPath(dir) {
+    return path.join(dir, exports.MANIFEST_FILENAME);
+}
+function readManifest(dir) {
+    const file = manifestPath(dir);
+    if (!fs.existsSync(file))
+        return null;
+    const raw = fs.readFileSync(file, "utf8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`community-sdk: ${file} is corrupt (invalid JSON)`);
+    }
+}
+function writeManifest(dir, manifest) {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(manifestPath(dir), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+}

package/lib/substitute.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Replaces the `__SUPABASE_PROJECT_URL__` / `__SUPABASE_ANON_KEY__` placeholders
+ * baked into the shipped migration SQL (see core/003, push/002, reaction/001)
+ * with the values for the app's own Supabase project.
+ *
+ * Throws if any `__SUPABASE...` token remains after substitution — a guard
+ * against a third, unhandled placeholder silently reaching the app's
+ * migrations directory (the migration's own DO block re-checks this at
+ * `db push` time, but failing fast here gives a clearer error before any
+ * SQL is written to disk).
+ */
+export declare function substitutePlaceholders(sql: string, values: {
+    projectUrl: string;
+    anonKey: string;
+}): string;

package/lib/substitute.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.substitutePlaceholders = substitutePlaceholders;
+/**
+ * Replaces the `__SUPABASE_PROJECT_URL__` / `__SUPABASE_ANON_KEY__` placeholders
+ * baked into the shipped migration SQL (see core/003, push/002, reaction/001)
+ * with the values for the app's own Supabase project.
+ *
+ * Throws if any `__SUPABASE...` token remains after substitution — a guard
+ * against a third, unhandled placeholder silently reaching the app's
+ * migrations directory (the migration's own DO block re-checks this at
+ * `db push` time, but failing fast here gives a clearer error before any
+ * SQL is written to disk).
+ */
+function substitutePlaceholders(sql, values) {
+    const result = sql
+        .split("__SUPABASE_PROJECT_URL__")
+        .join(values.projectUrl)
+        .split("__SUPABASE_ANON_KEY__")
+        .join(values.anonKey);
+    if (result.includes("__SUPABASE")) {
+        throw new Error("community-sdk: unsubstituted __SUPABASE placeholder remains after substitution");
+    }
+    return result;
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@rocapine/community",
+  "version": "0.1.0",
+  "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Rocapine/community-sdk"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib",
+    "templates",
+    "LICENSE"
+  ],
+  "bin": {
+    "community": "lib/index.js"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "prebuild": "node scripts/copy-templates.mjs",
+    "build": "tsc -p tsconfig.json --outDir lib --noEmit false",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0"
+  }
+}

package/templates/functions/_shared/client.ts

@@ -0,0 +1,20 @@
+// Shared Supabase admin client + JSON response helper.
+
+import { createClient } from "jsr:@supabase/supabase-js@2";
+
+export const SUPABASE_URL = Deno.env.get("SUPABASE_URL")!;
+
+// Service-role client: bypasses RLS. Every function does privileged work
+// through this; callers only ever pass the public anon JWT (verify_jwt).
+export function adminClient() {
+  return createClient(SUPABASE_URL, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!);
+}
+
+// The client consumes responses via supabase.functions.invoke, which only
+// parses the body as JSON when the Content-Type says so. Without this header
+// invoke returns a raw string and verdict.status is undefined.
+export const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });

package/templates/functions/_shared/config.ts

@@ -0,0 +1,23 @@
+// Per-app copy used inside notifications, injected as function secrets so the
+// same function code deploys unchanged to every app:
+//
+//   supabase secrets set COMMUNITY_FALLBACK_NAME="A member"
+//   supabase secrets set COMMUNITY_APP_NAME="My App"
+//   supabase secrets set COMMUNITY_REACTION_PUSH_TEXT="{name} sent you support"
+//
+// Defaults are deliberately neutral.
+
+// Display name used when the acting user has no username yet
+// ("<name>: ..." in comment pushes, "<name> liked your post").
+export const FALLBACK_ACTOR_NAME = Deno.env.get("COMMUNITY_FALLBACK_NAME") ?? "Someone";
+
+// Push title fallback for official broadcast posts whose author has no
+// username (normally the official account's display name).
+export const BROADCAST_FALLBACK_TITLE = Deno.env.get("COMMUNITY_APP_NAME") ?? "Community";
+
+// notify-reaction's single-reactor push title template. `{name}` is
+// substituted with the reactor's display name (or FALLBACK_ACTOR_NAME).
+// Neutral default; an app with its own reaction semantics overrides this
+// secret rather than the function code.
+export const REACTION_PUSH_TEXT =
+  Deno.env.get("COMMUNITY_REACTION_PUSH_TEXT") ?? "{name} is thinking of you";

package/templates/functions/_shared/moderation.ts

@@ -0,0 +1,102 @@
+// Shared moderation policy: OpenAI omni-moderation categories, score
+// thresholds and the API call. Single source of truth for moderate-one,
+// daily-moderation and update-profile.
+
+// Categories that always hide a piece of content when OpenAI's own boolean
+// flag is true, regardless of MODERATION_EXCLUDED_CATEGORIES below.
+export const CATEGORIES_TO_HIDE = [
+  "hate",
+  "hate/threatening",
+  "harassment",
+  "harassment/threatening",
+  "sexual",
+  "sexual/minors",
+  "violence",
+  "violence/graphic",
+  "self-harm",
+  "self-harm/intent",
+  "self-harm/instructions",
+];
+
+// Comma-separated category list (e.g. "sexual,sexual/minors") an app can set
+// to skip the supplementary raw-score check below for those categories —
+// e.g. a wellness app allowing legitimate intimacy discussion sets
+// MODERATION_EXCLUDED_CATEGORIES=sexual. The boolean check above still
+// applies to every category regardless: this only silences the extra
+// under-scored-content catch for the excluded ones. Default empty (no
+// exclusion) — a neutral SDK default.
+const EXCLUDED_CATEGORIES = new Set(
+  (Deno.env.get("MODERATION_EXCLUDED_CATEGORIES") ?? "")
+    .split(",")
+    .map((c) => c.trim())
+    .filter(Boolean),
+);
+
+// Harm categories also hidden on a raw SCORE >= threshold, not just OpenAI's
+// conservative boolean, to catch under-scored insults/harassment (incl. other
+// languages). Starts from CATEGORIES_TO_HIDE, minus MODERATION_EXCLUDED_CATEGORIES.
+export const SCORE_HIDE = CATEGORIES_TO_HIDE.filter((c) => !EXCLUDED_CATEGORIES.has(c));
+
+const parsedThreshold = Number(Deno.env.get("MODERATION_SCORE_THRESHOLD"));
+// Number("") is 0, and Number.isFinite(0) is true — without the > 0 guard an
+// unset/blank env var silently sets the threshold to 0, which hides every
+// piece of content instead of falling back to the 0.5 default.
+export const SCORE_THRESHOLD =
+  Number.isFinite(parsedThreshold) && parsedThreshold > 0 ? parsedThreshold : 0.5;
+
+export interface ModerationResult {
+  categories: Record<string, boolean>;
+  category_scores: Record<string, number>;
+}
+
+export function flaggedCategories(result: ModerationResult): string[] {
+  const cats = new Set<string>();
+  for (const [cat, v] of Object.entries(result.categories)) {
+    if (v && CATEGORIES_TO_HIDE.includes(cat)) cats.add(cat);
+  }
+  for (const [cat, score] of Object.entries(result.category_scores)) {
+    if (SCORE_HIDE.includes(cat) && score >= SCORE_THRESHOLD) cats.add(cat);
+  }
+  return [...cats];
+}
+
+// Call once at module top-level in every function that moderates content
+// (moderate-one, daily-moderation, update-profile) so a missing secret fails
+// loudly at boot instead of degrading silently into "fail closed" forever
+// (moderateInput would otherwise just log a 401 from OpenAI on every call).
+export function assertModerationConfigured(): void {
+  if (!Deno.env.get("OPENAI_API_KEY")) {
+    throw new Error(
+      "community-sdk: OPENAI_API_KEY is not set. Moderation cannot run — set it with " +
+        "`supabase secrets set OPENAI_API_KEY=sk-...`.",
+    );
+  }
+}
+
+export type ImageInput = { type: "image_url"; image_url: { url: string } }[];
+
+// POSTs to OpenAI moderation. `input` is a string for text or the image_url
+// content-part array for an avatar. Returns null on a non-OK response so the
+// caller can fail closed (nothing published / nothing written).
+export async function moderateInput(
+  input: string | ImageInput,
+): Promise<{ flagged: boolean; reason: string | null } | null> {
+  const res = await fetch("https://api.openai.com/v1/moderations", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${Deno.env.get("OPENAI_API_KEY")}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ model: "omni-moderation-latest", input }),
+  });
+  if (!res.ok) {
+    // Logged for ops (e.g. image_parse_error on a corrupt upload).
+    console.error("moderation api error", res.status, (await res.text()).slice(0, 300));
+    return null;
+  }
+  const { results } = await res.json();
+  const cats = flaggedCategories(results[0]);
+  return cats.length > 0
+    ? { flagged: true, reason: cats.join(",") }
+    : { flagged: false, reason: null };
+}

package/templates/functions/_shared/push.ts

@@ -0,0 +1,33 @@
+// Shared Expo push sender. Used by notify-comment, notify-like,
+// notify-reaction and broadcast-post (push module).
+
+export interface ExpoPushMessage {
+  to: string;
+  title: string;
+  body?: string;
+  data: Record<string, string>;
+  // badge: 1 is a "something new" dot, not a real unread count — the app
+  // clears it on every foreground.
+  badge?: number;
+}
+
+// Sends in chunks of 100 (Expo API limit). Best-effort: push failures must
+// never fail the calling webhook. Projects with Enhanced Security for push
+// must set the EXPO_ACCESS_TOKEN function secret.
+export async function sendExpoPushBatch(messages: ExpoPushMessage[]): Promise<void> {
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  const accessToken = Deno.env.get("EXPO_ACCESS_TOKEN");
+  if (accessToken) headers["Authorization"] = `Bearer ${accessToken}`;
+  for (let i = 0; i < messages.length; i += 100) {
+    const chunk = messages.slice(i, i + 100);
+    await fetch("https://exp.host/--/api/v2/push/send", {
+      method: "POST",
+      headers,
+      body: JSON.stringify(chunk.length === 1 ? chunk[0] : chunk),
+    }).catch(() => {});
+  }
+}
+
+export async function sendExpoPush(message: ExpoPushMessage): Promise<void> {
+  await sendExpoPushBatch([message]);
+}

package/templates/functions/_shared/slack.ts

@@ -0,0 +1,12 @@
+export async function postToSlack(payload: unknown): Promise<void> {
+  const url = Deno.env.get("SLACK_WEBHOOK_URL");
+  if (!url) {
+    console.log("community-sdk: SLACK_WEBHOOK_URL not set, skipping Slack notification");
+    return;
+  }
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(payload),
+  });
+}