@rocapine/community 0.1.0

package/templates/migrations/core/005_avatars.sql

@@ -0,0 +1,19 @@
+-- community-sdk core/005_avatars.sql (schema v1)
+-- Community SDK — 05 avatars Storage bucket.
+-- Public read (avatar URLs are plain public object URLs), 1MB cap, JPEG only.
+-- Uploads land at avatars/{uid}/{timestamp}.jpg and are pending until the
+-- update-profile Edge Function approves them; a rejected object is deleted by
+-- the function. An unapproved object is technically fetchable at its URL until
+-- then, but the URL is unguessable in practice and never linked. Accepted.
+insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+  values ('avatars', 'avatars', true, 1048576, array['image/jpeg'])
+  on conflict (id) do nothing;
+
+-- Clients may only CREATE objects inside their own folder. No UPDATE/DELETE
+-- policies: replacement cleanup is done by the function with the service role.
+create policy "avatar upload to own folder"
+  on storage.objects for insert to authenticated
+  with check (
+    bucket_id = 'avatars'
+    and (storage.foldername(name))[1] = auth.uid()::text
+  );

package/templates/migrations/core/006_meta.sql

@@ -0,0 +1,11 @@
+-- community-sdk core/006_meta.sql (schema v1)
+-- Community SDK — 06 schema metadata: lets the CLI / dashboard detect which
+-- schema version an installed community backend is running.
+create table if not exists public.community_meta (
+  id boolean primary key default true check (id),
+  schema_version int not null
+);
+insert into public.community_meta (schema_version) values (1)
+  on conflict (id) do update set schema_version = excluded.schema_version;
+alter table public.community_meta enable row level security;
+create policy "community_meta readable" on public.community_meta for select using (true);

package/templates/migrations/inbox/001_inbox.sql

@@ -0,0 +1,237 @@
+-- community-sdk inbox/001_inbox.sql (schema v1)
+-- Community SDK — inbox module (OPTIONAL): a notification-center inbox for
+-- actor -> recipient events (like / comment / reaction, plus any custom
+-- service-role kind a host app writes itself — see the `kind` column note
+-- below). Official-account posts are NOT fanned out per user: they are
+-- unioned straight from posts in list_notifications() so a broadcast post
+-- shows up for everyone without a write per recipient. Read state is one
+-- seen_at marker per user (opening the center marks everything read), not
+-- per-row read_at. Rows are written by SQL triggers so the inbox fills
+-- independently of any push pipeline and of push permission.
+--
+-- Ported from a host app's two-migration notification-center feature,
+-- merged into one file; this ships the FINAL form (the later revision's
+-- list_notifications(), which unions ALL visible posts by an is_official
+-- profile regardless of topic, supersedes the earlier topic-scoped version —
+-- there is no intermediate "topic = news only" state to replay).
+--
+-- Dependencies: core module tables (public.posts, public.profiles,
+-- public.likes, public.comments, public.blocks) — the core module must be
+-- installed first. The reaction-kind trigger additionally depends on the
+-- reaction module's public.post_reactions table; that trigger is created
+-- inside a guarded DO block (`if to_regclass('public.post_reactions') is not
+-- null then ...`) so this module installs cleanly without the reaction
+-- module — likes/comments notifications work either way.
+--
+-- `kind` is intentionally an UNCONSTRAINED text column (no CHECK), unlike
+-- the source migration this was ported from: a host's own backend (e.g. a
+-- support/help-desk integration) may write custom kinds via service role
+-- (spec §6), and this module must not need a schema change to allow that.
+
+create extension if not exists pg_cron;
+
+-- ============ NOTIFICATIONS ============
+create table public.notifications (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  -- Unconstrained on purpose — see header note. Built-in kinds emitted by
+  -- this module: 'like', 'comment', 'reaction', 'official_post' (the last is
+  -- synthesized by list_notifications(), never stored as a row).
+  kind text not null,
+  actor_id uuid references public.profiles(id) on delete cascade,
+  post_id uuid references public.posts(id) on delete cascade,
+  created_at timestamptz not null default now()
+);
+create index notifications_user_idx on public.notifications (user_id, created_at desc);
+
+alter table public.notifications enable row level security;
+
+-- Owner-only read; writes happen only via the security-definer triggers
+-- below (and, optionally, service-role inserts from a host's own backend for
+-- custom kinds).
+create policy "read own notifications" on public.notifications
+  for select to authenticated using (user_id = auth.uid());
+
+-- "Everything up to seen_at is read". Upserted by the client when the center
+-- opens; both the stored rows and the unioned official posts compare
+-- against it.
+create table public.notification_seen (
+  user_id uuid primary key references public.profiles(id) on delete cascade,
+  seen_at timestamptz not null default now()
+);
+
+alter table public.notification_seen enable row level security;
+
+create policy "read own seen" on public.notification_seen
+  for select to authenticated using (user_id = auth.uid());
+create policy "insert own seen" on public.notification_seen
+  for insert to authenticated with check (user_id = auth.uid());
+create policy "update own seen" on public.notification_seen
+  for update to authenticated using (user_id = auth.uid()) with check (user_id = auth.uid());
+
+-- ============ TRIGGERS ============
+-- Same skip rules throughout: never notify yourself, never notify a
+-- recipient who blocked the actor.
+
+create or replace function public.inbox_on_like()
+returns trigger language plpgsql security definer set search_path = public as $$
+declare recipient uuid;
+begin
+  select author_id into recipient from posts where id = new.post_id;
+  if recipient is null or recipient = new.user_id then return new; end if;
+  if exists (select 1 from blocks where blocker_id = recipient and blocked_id = new.user_id) then
+    return new;
+  end if;
+  begin
+    insert into notifications (user_id, kind, actor_id, post_id)
+    values (recipient, 'like', new.user_id, new.post_id);
+  exception when others then null; -- the inbox must never break a like
+  end;
+  return new;
+end; $$;
+
+create trigger on_like_inbox
+  after insert on public.likes
+  for each row execute function public.inbox_on_like();
+
+-- Unlike retracts the inbox entry (also keeps like/unlike toggling from
+-- accumulating duplicate rows).
+create or replace function public.inbox_on_unlike()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  begin
+    delete from notifications
+    where kind = 'like' and post_id = old.post_id and actor_id = old.user_id;
+  exception when others then null; -- the inbox must never break an unlike
+  end;
+  return old;
+end; $$;
+
+create trigger on_unlike_inbox
+  after delete on public.likes
+  for each row execute function public.inbox_on_unlike();
+
+-- Comments enter as 'pending' and publish on moderation; mirror the push
+-- module's own comment triggers: fire on pending -> visible, and on direct
+-- visible inserts (dashboard replies).
+create or replace function public.inbox_on_comment()
+returns trigger language plpgsql security definer set search_path = public as $$
+declare recipient uuid;
+begin
+  select author_id into recipient from posts where id = new.post_id;
+  if recipient is null or recipient = new.author_id then return new; end if;
+  if exists (select 1 from blocks where blocker_id = recipient and blocked_id = new.author_id) then
+    return new;
+  end if;
+  begin
+    insert into notifications (user_id, kind, actor_id, post_id)
+    values (recipient, 'comment', new.author_id, new.post_id);
+  exception when others then null; -- the inbox must never break a comment
+  end;
+  return new;
+end; $$;
+
+create trigger on_comment_published_inbox
+  after update on public.comments
+  for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.inbox_on_comment();
+
+create trigger on_comment_created_visible_inbox
+  after insert on public.comments
+  for each row
+  when (new.status = 'visible')
+  execute function public.inbox_on_comment();
+
+-- Reaction inbox entries (reaction module's post_reactions -> 'reaction'
+-- kind). The function is safe to create unconditionally — it only reads
+-- core tables (posts, blocks) and writes notifications — but the trigger
+-- itself must target public.post_reactions, so its creation is guarded.
+create or replace function public.inbox_on_reaction()
+returns trigger language plpgsql security definer set search_path = public as $$
+declare recipient uuid;
+begin
+  select author_id into recipient from posts where id = new.post_id;
+  if recipient is null or recipient = new.user_id then return new; end if;
+  if exists (select 1 from blocks where blocker_id = recipient and blocked_id = new.user_id) then
+    return new;
+  end if;
+  begin
+    insert into notifications (user_id, kind, actor_id, post_id)
+    values (recipient, 'reaction', new.user_id, new.post_id);
+  exception when others then null; -- the inbox must never break a reaction
+  end;
+  return new;
+end; $$;
+
+-- Guarded: only wire the trigger if the reaction module's table exists, so
+-- the inbox module installs standalone without the reaction module.
+do $$
+begin
+  if to_regclass('public.post_reactions') is not null then
+    drop trigger if exists on_reaction_inbox on public.post_reactions;
+    create trigger on_reaction_inbox
+      after insert on public.post_reactions
+      for each row execute function public.inbox_on_reaction();
+  end if;
+end $$;
+
+-- ============ READ API ============
+-- The center's single read path. Stored rows for me (minus rows whose post
+-- was since hidden/deleted) unioned with recent posts by official accounts
+-- (any topic — a broadcast push is topic-agnostic, so the inbox must be
+-- too), newest first. SECURITY DEFINER to join profiles/posts across RLS.
+create or replace function public.list_notifications(p_limit int default 50)
+returns table (
+  id uuid,
+  kind text,
+  actor_id uuid,
+  actor_username text,
+  post_id uuid,
+  post_excerpt text,
+  created_at timestamptz
+)
+language sql stable security definer set search_path = public
+as $$
+  (
+    select n.id, n.kind, n.actor_id, pr.username, n.post_id,
+           left(p.content, 140), n.created_at
+    from notifications n
+    left join profiles pr on pr.id = n.actor_id
+    left join posts p on p.id = n.post_id
+    where n.user_id = auth.uid()
+      and (n.post_id is null or p.status in ('visible', 'pending'))
+  )
+  union all
+  (
+    select p.id, 'official_post', p.author_id, pr.username, p.id,
+           left(p.content, 140), p.created_at
+    from posts p
+    join profiles pr on pr.id = p.author_id
+    where p.status = 'visible' and pr.is_official
+      and p.author_id <> auth.uid()
+      and p.created_at > now() - interval '90 days'
+  )
+  order by created_at desc
+  limit p_limit;
+$$;
+
+revoke execute on function public.list_notifications(int) from public, anon;
+grant execute on function public.list_notifications(int) to authenticated;
+
+-- Retention: the official-posts union already stops at 90 days; keep stored
+-- rows symmetric.
+do $$
+begin
+  perform cron.schedule(
+    'notifications-purge', '15 3 * * *',
+    $cron$ delete from public.notifications where created_at < now() - interval '90 days'; $cron$
+  );
+exception when others then
+  if sqlerrm like '%already exists%' then
+    raise notice 'cron job notifications-purge already scheduled, skipping';
+  else
+    raise;
+  end if;
+end;
+$$;

package/templates/migrations/polls/001_polls.sql

@@ -0,0 +1,120 @@
+-- community-sdk polls/001_polls.sql (schema v1)
+-- Community SDK — polls module (OPTIONAL): a post can carry 2-4 short
+-- options (the post content is the question). One vote per user per poll,
+-- changeable. Votes are anonymous at the API level: poll_votes is readable
+-- only by its owner, aggregate counts go through the security-definer
+-- poll_vote_counts(). Skip this module if the app does not ship polls
+-- (and set the app's dashboard feature flag accordingly).
+-- References core module tables (public.posts, public.profiles,
+-- public.current_user_banned()) — the core module must be installed first.
+
+-- ============ POLL OPTIONS ============
+create table public.poll_options (
+  id uuid primary key default gen_random_uuid(),
+  post_id uuid not null references public.posts(id) on delete cascade,
+  idx smallint not null check (idx between 0 and 3),
+  label text not null check (char_length(label) between 1 and 60),
+  created_at timestamptz not null default now(),
+  unique (post_id, idx),
+  -- Composite FK target so a vote's option is forced to belong to the same
+  -- post the vote points at (see poll_votes).
+  unique (id, post_id)
+);
+
+-- ============ POLL VOTES ============
+create table public.poll_votes (
+  post_id uuid not null references public.posts(id) on delete cascade,
+  option_id uuid not null,
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  created_at timestamptz not null default now(),
+  primary key (post_id, user_id),
+  foreign key (option_id, post_id) references public.poll_options(id, post_id) on delete cascade
+);
+create index poll_votes_counts_idx on public.poll_votes (post_id, option_id);
+
+-- ============ RLS ============
+alter table public.poll_options enable row level security;
+alter table public.poll_votes   enable row level security;
+
+-- Options follow their post's visibility: the subquery runs under the caller's
+-- posts RLS, so options of hidden posts / blocked authors stay invisible too.
+create policy "poll options follow post visibility"
+  on public.poll_options for select to authenticated
+  using (exists (select 1 from public.posts p where p.id = post_id));
+
+create policy "insert options on own post if not banned"
+  on public.poll_options for insert to authenticated
+  with check (
+    not public.current_user_banned()
+    and exists (select 1 from public.posts p where p.id = post_id and p.author_id = auth.uid())
+  );
+-- No update/delete policies: options are immutable once posted.
+
+-- Votes are private: only the voter reads her own row (the app uses it for
+-- "my choice"); everyone else only ever sees aggregates.
+create policy "read own poll votes"
+  on public.poll_votes for select to authenticated
+  using (user_id = auth.uid());
+
+create policy "vote as self on a readable post"
+  on public.poll_votes for insert to authenticated
+  with check (
+    user_id = auth.uid()
+    and not public.current_user_banned()
+    and exists (select 1 from public.posts p where p.id = post_id)
+  );
+
+-- Changing your vote = updating option_id on your own row (client upsert).
+create policy "change own vote"
+  on public.poll_votes for update to authenticated
+  using (user_id = auth.uid())
+  with check (user_id = auth.uid());
+
+-- ============ VOTE COUNTS ============
+-- Per-option counts for a batch of posts (one call per feed page).
+-- SECURITY DEFINER bypasses the private poll_votes RLS but returns counts only.
+create or replace function public.poll_vote_counts(p_post_ids uuid[])
+returns table (post_id uuid, option_id uuid, votes bigint)
+language sql stable security definer set search_path = public
+as $$
+  select v.post_id, v.option_id, count(*)::bigint
+  from poll_votes v
+  where v.post_id = any(p_post_ids)
+  group by v.post_id, v.option_id;
+$$;
+
+revoke execute on function public.poll_vote_counts(uuid[]) from public, anon;
+grant execute on function public.poll_vote_counts(uuid[]) to authenticated;
+
+-- ============ POLL POST CREATION ============
+-- Post + options in one transaction (no orphan post if an option insert
+-- fails). SECURITY INVOKER: posts/poll_options RLS applies, so the banned
+-- check and the pending-only insert status hold exactly as for a plain insert.
+create or replace function public.create_poll_post(
+  p_topic text,
+  p_content text,
+  p_options text[]
+) returns uuid
+language plpgsql set search_path = public
+as $$
+declare
+  new_id uuid;
+  n int := coalesce(array_length(p_options, 1), 0);
+  i int;
+begin
+  if n < 2 or n > 4 then
+    raise exception 'a poll needs 2 to 4 options';
+  end if;
+  insert into public.posts (author_id, topic, content)
+    values (auth.uid(), p_topic, p_content)
+    returning id into new_id;
+  for i in 1..n loop
+    insert into public.poll_options (post_id, idx, label)
+      values (new_id, i - 1, p_options[i]);
+  end loop;
+  return new_id;
+end;
+$$;
+
+revoke execute on function public.create_poll_post(text, text, text[]) from public, anon;
+grant execute on function public.create_poll_post(text, text, text[]) to authenticated;

package/templates/migrations/push/001_push.sql

@@ -0,0 +1,42 @@
+-- community-sdk push/001_push.sql (schema v1)
+-- Community SDK — push module (OPTIONAL): comment + like notifications.
+-- Skip this module entirely if the app does not ship community push.
+-- References core module tables (public.profiles, public.likes) — the core
+-- module must be installed first. likes.notified_at (core/001_tables.sql)
+-- simply stays unused if this module is skipped.
+--
+-- This file: push_tokens storage + RLS, plus profiles.locale (localized push
+-- copy needs it regardless of which notify-* functions are deployed). The
+-- webhook functions, triggers and cron digest job (which embed the project
+-- URL / anon key) live in push/002_triggers.sql.
+
+-- Owner-only token+prefs table (a push token must NOT live on the
+-- world-readable profiles table).
+create table public.push_tokens (
+  user_id uuid primary key references public.profiles(id) on delete cascade,
+  expo_push_token text,
+  notify_likes boolean not null default true,
+  notify_comments boolean not null default true,
+  updated_at timestamptz not null default now()
+);
+alter table public.push_tokens enable row level security;
+
+create policy "read own push row" on public.push_tokens for select to authenticated
+  using (user_id = auth.uid());
+create policy "insert own push row" on public.push_tokens for insert to authenticated
+  with check (user_id = auth.uid());
+create policy "update own push row" on public.push_tokens for update to authenticated
+  using (user_id = auth.uid()) with check (user_id = auth.uid());
+
+-- Recipient locale for localized push copy (written by the client's profile
+-- sync; read by the notify-* functions). Nullable: absent locale falls back
+-- to en. Loose length check only, same as Eve's reference migration
+-- (20260814150000_profile_locale.sql) — adding a language needs no migration.
+alter table public.profiles add column if not exists locale text check (char_length(locale) <= 10);
+
+-- profiles updates are column-scoped (core/002_rls.sql); grants are additive,
+-- so this just adds locale to what the client's own-profile sync may write.
+grant update (locale) on table public.profiles to authenticated;
+
+-- Like coalescing marker index (column lives in core/001_tables.sql).
+create index likes_unnotified_idx on public.likes (post_id) where notified_at is null;

package/templates/migrations/push/002_triggers.sql

@@ -0,0 +1,89 @@
+-- community-sdk push/002_triggers.sql (schema v1)
+-- Community SDK — push module (OPTIONAL): webhook functions, triggers and the
+-- hourly digest cron job. Requires the notify-comment / notify-like Edge
+-- Functions and an EXPO_ACCESS_TOKEN secret. References core module tables
+-- (public.comments, public.likes) — the core module must be installed first,
+-- and push/001_push.sql (push_tokens) before this file.
+--
+-- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
+-- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
+-- its anon key. The anon key is public by design (shipped inside the app
+-- binary): the Edge Functions do privileged work through their own
+-- service-role env, the JWT only passes verify_jwt.
+--
+-- The DO block below fails the migration loudly if the placeholders were not
+-- replaced.
+do $$ begin
+  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
+    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
+  end if;
+end $$;
+
+create extension if not exists pg_cron;
+create extension if not exists pg_net;
+
+-- ============ WEBHOOK FUNCTIONS ============
+create or replace function public.notify_comment_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-comment',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('record', to_jsonb(new))
+  );
+  return new;
+end; $$;
+
+create or replace function public.notify_like_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-like',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('record', to_jsonb(new))
+  );
+  return new;
+end; $$;
+
+-- ============ TRIGGERS ============
+-- Notify the post author only once a comment is actually published, never on
+-- the pending insert (a rejected comment must never send a push).
+create trigger on_comment_published
+  after update on public.comments
+  for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.notify_comment_webhook();
+
+-- Dashboard comments are inserted directly as 'visible' (service role) and
+-- must notify too. App comments are always inserted 'pending' (RLS-enforced),
+-- so nothing double-notifies.
+create trigger on_comment_created_visible
+  after insert on public.comments
+  for each row
+  when (new.status = 'visible')
+  execute function public.notify_comment_webhook();
+
+create trigger on_like_created
+  after insert on public.likes
+  for each row execute function public.notify_like_webhook();
+
+-- Hourly digest: flush the tail of any coalesced like bursts.
+do $$
+begin
+  perform cron.schedule(
+    'community-like-digest', '0 * * * *',
+    $cron$
+    select net.http_post(
+      url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-like',
+      headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__')
+    );
+    $cron$
+  );
+exception when others then
+  if sqlerrm like '%already exists%' then
+    raise notice 'cron job community-like-digest already scheduled, skipping';
+  else
+    raise;
+  end if;
+end;
+$$;

package/templates/migrations/reaction/001_reactions.sql

@@ -0,0 +1,139 @@
+-- community-sdk reaction/001_reactions.sql (schema v1)
+-- Community SDK — reaction module (OPTIONAL): a generic "I stand with you"
+-- reaction on a post, one row per (post, user). Counts + push only — the
+-- reaction carries no visible server-side content; any richer text a host
+-- app attaches client-side (an encouragement, a note, a kind word) never
+-- reaches this table.
+--
+-- References core module tables (public.posts, public.profiles,
+-- public.current_user_banned()) — the core module must be installed first.
+-- Optionally extends the push module's push_tokens table with a
+-- notify_reactions preference column; that ALTER is guarded with
+-- to_regclass() so this module installs cleanly without the push module (the
+-- notify-reaction webhook below still fires either way — it is the Edge
+-- Function's job to look up push_tokens if/when that module is present).
+--
+-- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
+-- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
+-- its anon key. The anon key is public by design (shipped inside the app
+-- binary): the Edge Functions do privileged work through their own
+-- service-role env, the JWT only passes verify_jwt.
+--
+-- The DO block below fails the migration loudly if the placeholders were not
+-- replaced.
+do $$ begin
+  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
+    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
+  end if;
+end $$;
+
+create extension if not exists pg_cron;
+create extension if not exists pg_net;
+
+-- ============ POST_REACTIONS ============
+create table public.post_reactions (
+  post_id uuid not null references public.posts(id) on delete cascade,
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  created_at timestamptz not null default now(),
+  -- Push-module coalescing marker (harmless if the push module is skipped).
+  notified_at timestamptz,
+  primary key (post_id, user_id)
+);
+
+alter table public.post_reactions enable row level security;
+
+-- Rows are private, like poll_votes: the client only ever selects its own
+-- rows (e.g. "did I already react"); counts and the latest-reactor line for
+-- the feed go through the security-definer post_reaction_summary() RPC below.
+create policy "read own reactions" on public.post_reactions
+  for select to authenticated using (user_id = auth.uid());
+
+-- One reaction row per (post, user); reacting again is a local-only event.
+-- No delete policy: a reaction is not retractable.
+create policy "react own" on public.post_reactions
+  for insert to authenticated
+  with check (
+    user_id = auth.uid()
+    and not public.current_user_banned()
+    and exists (select 1 from public.posts p where p.id = post_id)
+  );
+
+-- Per-post summary for a feed page: count, the display name of the most
+-- recent reactor (null when they have not chosen a display name — the client
+-- falls back to a generic label), and whether the caller has reacted.
+-- SECURITY DEFINER only to join profiles.username and read auth.uid() across
+-- rows that RLS would otherwise keep private to their own owner.
+create or replace function public.post_reaction_summary(p_post_ids uuid[])
+returns table (post_id uuid, reaction_count int, last_reactor_name text, has_reacted boolean)
+language sql stable security definer set search_path = public
+as $$
+  select
+    r.post_id,
+    count(*)::int as reaction_count,
+    (
+      select pr.username
+      from post_reactions r2
+      join profiles pr on pr.id = r2.user_id
+      where r2.post_id = r.post_id
+      order by r2.created_at desc
+      limit 1
+    ) as last_reactor_name,
+    bool_or(r.user_id = auth.uid()) as has_reacted
+  from post_reactions r
+  where r.post_id = any(p_post_ids)
+  group by r.post_id;
+$$;
+
+revoke execute on function public.post_reaction_summary(uuid[]) from public, anon;
+grant execute on function public.post_reaction_summary(uuid[]) to authenticated;
+
+create index post_reactions_unnotified_idx on public.post_reactions (post_id) where notified_at is null;
+
+-- Push preference (default on, same as likes/comments). Guarded so this
+-- module installs cleanly without the push module (push_tokens missing).
+do $$
+begin
+  if to_regclass('public.push_tokens') is not null then
+    alter table public.push_tokens add column if not exists notify_reactions boolean not null default true;
+  end if;
+end $$;
+
+-- ============ WEBHOOK + DIGEST ============
+-- Same pattern as push/002_triggers.sql's notify-like: an immediate webhook
+-- on insert plus a coalescing digest cron for anything the webhook missed.
+-- Requires the notify-reaction Edge Function.
+create or replace function public.notify_reaction_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-reaction',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('record', to_jsonb(new))
+  );
+  return new;
+end; $$;
+
+create trigger on_post_reaction_created
+  after insert on public.post_reactions
+  for each row execute function public.notify_reaction_webhook();
+
+-- Half-hourly digest: flush the tail of any coalesced reaction bursts.
+do $$
+begin
+  perform cron.schedule(
+    'community-reaction-digest', '30 * * * *',
+    $cron$
+    select net.http_post(
+      url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-reaction',
+      headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__')
+    );
+    $cron$
+  );
+exception when others then
+  if sqlerrm like '%already exists%' then
+    raise notice 'cron job community-reaction-digest already scheduled, skipping';
+  else
+    raise;
+  end if;
+end;
+$$;