@rocapine/community 0.3.3 → 0.6.0

package/README.md

@@ -13,7 +13,7 @@ version. The binary is named `community`.
 ## `init`
 
 ```bash
-npx @rocapine/community init [--modules core,push,polls,reaction,inbox] [--project-url <url>] [--anon-key <key>] [--dir supabase]
+npx @rocapine/community init [--modules core,push,polls,reaction,inbox,translation] [--project-url <url>] [--anon-key <key>] [--dir supabase]
 ```
 
 Copies the migrations and Edge Functions for the requested modules into
@@ -21,13 +21,13 @@ Copies the migrations and Edge Functions for the requested modules into
 relative to the current directory), and writes a `community-sdk.json`
 manifest at the repo root recording what was installed.
 
-- `--modules` — comma-separated (`core,push,polls,reaction,inbox`). `core`
+- `--modules` — comma-separated (`core,push,polls,reaction,inbox,translation`). `core`
   is always implied even if omitted. Omit the flag entirely to install every
   module. Regardless of the order you type them, modules are installed
-  `core → push → polls → reaction → inbox` — this order is load-bearing:
+  `core → push → polls → reaction → inbox → translation` — this order is load-bearing:
   the inbox module's reaction trigger is guarded at install time and must
   find the reaction module's table already present, so reaction has to land
-  first. Requesting `inbox` without `reaction` prints a (non-fatal) warning.
+  first. Requesting `inbox` without `reaction`, or `translation` without `polls`, prints a (non-fatal) warning (reactions missing from the inbox; poll labels left untranslated).
 - `--project-url` / `--anon-key` — needed only if a migration in the
   selected modules carries a placeholder (see "Placeholder guard" below).
   If omitted, the CLI tries to read the project URL from
@@ -107,17 +107,23 @@ the _current_ template set and points at `docs/compat.md` to check/adjust
   is what `upgrade` diffs against (timestamped destination filenames can't
   be compared meaningfully run to run).
 
-## Placeholder guard
-
-Three backend migration files (`core/003_moderation.sql`,
-`push/002_triggers.sql`, `reaction/001_reactions.sql`) embed the project's
-own URL/anon key (pg_net crons and webhooks that call back into the same
-project) as `__SUPABASE_PROJECT_URL__` / `__SUPABASE_ANON_KEY__`
-placeholders in the shipped template. `init`/`upgrade` substitute real
-values before writing the
-file to disk; if a value is missing and can't be resolved (flag, then
-`config.toml`, then a TTY prompt), the command fails rather than writing a
-file with a literal placeholder still in it — a migration with an
-unsubstituted placeholder would push successfully to Postgres and then fail
-silently at cron/webhook runtime, so this guard turns that into a loud,
-immediate CLI error instead.
+## Project settings (no value is ever baked into a migration)
+
+The pg_cron jobs and pg_net webhooks that call back into the project's own
+Edge Functions read the project URL and anon key from Supabase Vault, through
+two private helpers defined by `core/000_settings.sql`
+(`community_project_url()` / `community_anon_key()`). The migration files are
+therefore identical for every project: the same `supabase/` folder deploys to
+a sandbox and to production. What differs is one statement, run once per
+project after `db push`:
+
+```bash
+supabase db query --linked "select public.community_settings_set('https://<ref>.supabase.co', '<anon key>');"
+```
+
+`init`/`upgrade` print it (filled in when `--project-url` / `--anon-key` are
+passed, placeholders otherwise). Until a project is seeded, every webhook
+logs a warning instead of calling out — inserts are never blocked — and the
+daily sweeps catch up once it is. The anon key is public by design (it ships
+inside the app binary): the Edge Functions do privileged work through their
+own service-role env, the JWT only passes `verify_jwt`.

package/lib/commands/init.d.ts

@@ -5,6 +5,7 @@ export declare const ALREADY_INITIALIZED_MESSAGE = "community-sdk: already initi
 export interface InitOptions {
     /** Modules to install. Defaults to every module. `core` is always implied. */
     modules?: string[];
+    /** Optional: only used to print the settings seed statement ready to run. */
     projectUrl?: string;
     anonKey?: string;
     /** Target Supabase directory, relative to `cwd`. Defaults to "supabase". */
@@ -13,8 +14,6 @@ export interface InitOptions {
     cwd?: string;
     /** Source of the migrations/ + functions/ trees. Defaults to the shipped templates. */
     templatesDir?: string;
-    /** Used to ask for projectUrl/anonKey when missing and not derivable. */
-    prompt?: (question: string) => Promise<string>;
     /** Called for non-fatal dependency warnings (e.g. inbox without reaction). */
     onWarn?: (message: string) => void;
     /** Used to print the summary + next steps. */

package/lib/commands/init.js

@@ -37,7 +37,6 @@ exports.ALREADY_INITIALIZED_MESSAGE = exports.MODULE_ORDER = void 0;
 exports.runInit = runInit;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-const substitute_1 = require("../substitute");
 const manifest_1 = require("../manifest");
 const install_shared_1 = require("../install-shared");
 Object.defineProperty(exports, "MODULE_ORDER", { enumerable: true, get: function () { return install_shared_1.MODULE_ORDER; } });
@@ -54,17 +53,10 @@ async function runInit(options = {}) {
     const dir = (0, install_shared_1.resolveContainedDir)(cwd, dirRel);
     const templatesDir = options.templatesDir ?? (0, install_shared_1.defaultTemplatesDir)();
     const { migrationsSrcRoot, functionsSrcRoot } = (0, install_shared_1.resolveTemplateRoots)(templatesDir);
-    const { projectUrl, anonKey } = await (0, install_shared_1.resolveProjectCredentials)({
-        dir,
-        projectUrl: options.projectUrl,
-        anonKey: options.anonKey,
-        prompt: options.prompt,
-    });
     const now = options.now ?? new Date();
     // ---- migrations + functions, staged atomically: on any failure partway
-    // through, every file this run wrote (which may already contain the real
-    // project URL / anon key) is removed before the error propagates, so a
-    // retry starts clean instead of finding stale/duplicate files and no
+    // through, every file this run wrote is removed before the error
+    // propagates, so a retry starts clean instead of finding stale/duplicate files and no
     // manifest to explain them. The manifest itself is written last, only once
     // every file below has landed successfully.
     const migrationsDestRoot = path.join(dir, "migrations");
@@ -89,16 +81,8 @@ async function runInit(options = {}) {
                 fileIndex += 1;
                 const destFilename = (0, install_shared_1.migrationDestFilename)(timestamp, moduleName, name);
                 const rawSql = fs.readFileSync(path.join(moduleSrcDir, filename), "utf8");
-                let substituted;
-                try {
-                    substituted = (0, substitute_1.substitutePlaceholders)(rawSql, { projectUrl, anonKey });
-                }
-                catch (err) {
-                    const message = err instanceof Error ? err.message : String(err);
-                    throw new Error(`${message} (source: ${moduleName}/${filename})`);
-                }
                 const destPath = path.join(migrationsDestRoot, destFilename);
-                fs.writeFileSync(destPath, substituted, "utf8");
+                fs.writeFileSync(destPath, rawSql, "utf8");
                 writtenPaths.push(destPath);
                 installedTemplates.push((0, manifest_1.migrationTemplateId)(moduleName, name));
             }
@@ -135,15 +119,19 @@ async function runInit(options = {}) {
         installedTemplates: installedTemplates.sort(),
     };
     (0, manifest_1.writeManifest)(cwd, manifest);
-    printNextSteps(log, canonicalModules);
+    printNextSteps(log, canonicalModules, {
+        projectUrl: options.projectUrl,
+        anonKey: options.anonKey,
+    });
     return { manifest, dir };
 }
-function printNextSteps(log, modules) {
+function printNextSteps(log, modules, values) {
     log("");
     log(`community-sdk initialized (${modules.join(", ")}).`);
     log("Next steps:");
     log("  1. Review the copied migrations, then: supabase db push");
-    log("  2. Set Edge Function secrets: supabase secrets set OPENAI_API_KEY=...");
+    (0, install_shared_1.printSettingsSeedStep)(log, values, 2);
+    log("  3. Set Edge Function secrets: supabase secrets set OPENAI_API_KEY=...");
     log("     optional: SLACK_WEBHOOK_URL, COMMUNITY_APP_NAME, COMMUNITY_FALLBACK_NAME");
     if (modules.includes("push")) {
         log("     push module: EXPO_ACCESS_TOKEN (only if your Expo project enforces Enhanced Security for push); COMMUNITY_PUSH_COPY (optional per-locale copy)");
@@ -151,5 +139,5 @@ function printNextSteps(log, modules) {
     if (modules.includes("translation")) {
         log('     translation module: COMMUNITY_TRANSLATION_LOCALES="en,es-419,..." (required, same list as modules.translation.locales in the app); optional: COMMUNITY_TRANSLATION_MODEL, COMMUNITY_TRANSLATION_STYLE');
     }
-    log("  3. Deploy the Edge Functions: supabase functions deploy");
+    log("  4. Deploy the Edge Functions: supabase functions deploy");
 }

package/lib/commands/upgrade.d.ts

@@ -11,8 +11,6 @@ export interface UpgradeOptions {
     templatesDir?: string;
     /** Module names to install on top of what's already in the manifest — validated, ordered and merged via resolveModules, same rules as `init --modules` (unknown names throw, dependency gaps warn). */
     addModules?: string[];
-    /** Used to ask for projectUrl/anonKey when a newly copied migration needs them. */
-    prompt?: (question: string) => Promise<string>;
     /** Called for non-fatal warnings — most importantly, functions overwritten with new content. */
     onWarn?: (message: string) => void;
     /** Used to print the summary + next steps. */

package/lib/commands/upgrade.js

@@ -38,7 +38,6 @@ exports.runUpgrade = runUpgrade;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
-const substitute_1 = require("../substitute");
 const manifest_1 = require("../manifest");
 const install_shared_1 = require("../install-shared");
 exports.NOT_INITIALIZED_MESSAGE = "community-sdk: not initialized, run init (or adopt)";
@@ -112,20 +111,6 @@ async function runUpgrade(options = {}) {
             overwrittenFunctions: [],
         };
     }
-    // ---- credentials, only if a pending migration actually needs them ----
-    const needsCredentials = pending.some((p) => p.rawSql.includes("__SUPABASE"));
-    let projectUrl;
-    let anonKey;
-    if (needsCredentials) {
-        const creds = await (0, install_shared_1.resolveProjectCredentials)({
-            dir,
-            projectUrl: options.projectUrl,
-            anonKey: options.anonKey,
-            prompt: options.prompt,
-        });
-        projectUrl = creds.projectUrl;
-        anonKey = creds.anonKey;
-    }
     const migrationsDestRoot = path.join(dir, "migrations");
     const writtenMigrationPaths = [];
     const addedMigrations = [];
@@ -133,23 +118,8 @@ async function runUpgrade(options = {}) {
     const createdFunctionDirs = [];
     const backups = [];
     try {
-        // ---- prepare every migration's final content up front: a placeholder
-        // error here must throw before a single byte is written to disk. ----
         const now = options.now ?? new Date();
-        const prepared = pending.map((p) => {
-            if (!p.rawSql.includes("__SUPABASE"))
-                return { ...p, content: p.rawSql };
-            try {
-                return {
-                    ...p,
-                    content: (0, substitute_1.substitutePlaceholders)(p.rawSql, { projectUrl: projectUrl, anonKey: anonKey }),
-                };
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                throw new Error(`${message} (source: ${p.moduleName}/${p.templateFilename})`);
-            }
-        });
+        const prepared = pending.map((p) => ({ ...p, content: p.rawSql }));
         if (prepared.length > 0) {
             fs.mkdirSync(migrationsDestRoot, { recursive: true });
             prepared.forEach((p, index) => {
@@ -225,6 +195,7 @@ async function runUpgrade(options = {}) {
     };
     (0, manifest_1.writeManifest)(cwd, updatedManifest);
     printSummary(log, onWarn, {
+        values: { projectUrl: options.projectUrl, anonKey: options.anonKey },
         addedModules,
         addedMigrations,
         newFunctions,
@@ -296,6 +267,13 @@ function printSummary(log, onWarn, summary) {
     if (summary.addedMigrations.length > 0) {
         log("  1. Review the new migrations, then: supabase db push");
     }
+    if (summary.addedMigrations.some((f) => /_community_core_settings\.sql$/.test(f))) {
+        // First upgrade onto the Vault-backed settings: the new *_webhooks
+        // migrations read the project URL / anon key from there, so the seed must
+        // follow this push (until then every webhook logs a warning and the
+        // daily sweeps catch up — nothing is lost, nothing is blocked).
+        (0, install_shared_1.printSettingsSeedStep)(log, summary.values, 2);
+    }
     if (summary.newFunctions.length > 0 || summary.overwrittenFunctions.length > 0) {
         log("  2. Review the function changes, then: supabase functions deploy");
     }

package/lib/index.js

@@ -60,9 +60,9 @@ program
 program
     .command("init")
     .description("Copy the community backend into a Supabase project: migrations, Edge Functions, and a community-sdk.json manifest")
-    .option("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox) — core is always implied; defaults to all modules")
-    .option("--project-url <url>", "Supabase project URL, e.g. https://<ref>.supabase.co")
-    .option("--anon-key <key>", "Supabase anon key")
+    .option("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox,translation) — core is always implied; defaults to all modules")
+    .option("--project-url <url>", "Supabase project URL, e.g. https://<ref>.supabase.co — optional, only fills in the printed settings seed statement")
+    .option("--anon-key <key>", "Supabase anon key — optional, only fills in the printed settings seed statement")
     .option("--dir <dir>", "target Supabase directory, relative to the current directory", "supabase")
     .action(async (opts) => {
     try {
@@ -82,8 +82,8 @@ program
     .command("upgrade")
     .description("Copy any new migrations/Edge Functions shipped since this repo's community-sdk.json was last written, and overwrite changed function code (with a warning)")
     .option("--add-modules <modules>", "comma-separated module list to install on top of what's already in community-sdk.json (e.g. translation)")
-    .option("--project-url <url>", "Supabase project URL, e.g. https://<ref>.supabase.co (only needed if a new migration carries a placeholder)")
-    .option("--anon-key <key>", "Supabase anon key (only needed if a new migration carries a placeholder)")
+    .option("--project-url <url>", "Supabase project URL, e.g. https://<ref>.supabase.co — optional, only fills in the printed settings seed statement")
+    .option("--anon-key <key>", "Supabase anon key — optional, only fills in the printed settings seed statement")
     .option("--dir <dir>", "target Supabase directory, relative to the current directory", "supabase")
     .action(async (opts) => {
     try {
@@ -103,7 +103,7 @@ program
     .command("adopt")
     .description("Register an already-live community backend (e.g. an app that hand-rolled its own before this SDK existed) with community-sdk.json, without copying any files")
     .requiredOption("--schema-version <n>", "the community-sdk schema version this app's live backend corresponds to")
-    .requiredOption("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox) — core is always implied")
+    .requiredOption("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox,translation) — core is always implied")
     .option("--dir <dir>", "Supabase directory this app would use, relative to the current directory", "supabase")
     .action(async (opts) => {
     try {

package/lib/install-shared.d.ts

@@ -48,23 +48,6 @@ export declare function resolveTemplateRoots(templatesDir: string): {
     functionsSrcRoot: string;
 };
 export declare function readOwnPackageVersion(): string;
-export declare function deriveProjectUrlFromConfig(dir: string): string | null;
-/**
- * Resolves the Supabase project URL + anon key from (in order) explicit
- * flags, `<dir>/config.toml` (URL only), or an interactive prompt — failing
- * loudly instead of hanging when stdin is not a TTY and no `prompt`
- * override was injected. Shared by `init` and `upgrade`, both of which only
- * need this when a placeholder-bearing file is about to be written.
- */
-export declare function resolveProjectCredentials(options: {
-    dir: string;
-    projectUrl?: string;
-    anonKey?: string;
-    prompt?: (question: string) => Promise<string>;
-}): Promise<{
-    projectUrl: string;
-    anonKey: string;
-}>;
 export declare function formatTimestamp(date: Date): string;
 export declare function addSeconds(date: Date, seconds: number): Date;
 /** Deno test files (`*_test.ts`) stay in the repo: never copied into a host's
@@ -74,3 +57,18 @@ export declare function listFilesRecursive(dir: string): string[];
 export declare function toRelativePosix(base: string, target: string): string;
 /** Resolves `dirRel` against `cwd`, throwing if it would escape the project root. */
 export declare function resolveContainedDir(cwd: string, dirRel: string): string;
+/**
+ * The one statement to run once per Supabase project after `db push`: it
+ * stores the project's own URL and anon key in Vault, where the pg_cron jobs
+ * and pg_net webhooks read them (core/000_settings.sql). The migration files
+ * themselves carry no project-specific value, so the same files deploy to a
+ * sandbox and a production project.
+ */
+export declare function settingsSeedSql(values?: {
+    projectUrl?: string;
+    anonKey?: string;
+}): string;
+export declare function printSettingsSeedStep(log: (message: string) => void, values: {
+    projectUrl?: string;
+    anonKey?: string;
+}, step: number): void;

package/lib/install-shared.js

@@ -42,17 +42,16 @@ exports.parseMigrationDestFilename = parseMigrationDestFilename;
 exports.defaultTemplatesDir = defaultTemplatesDir;
 exports.resolveTemplateRoots = resolveTemplateRoots;
 exports.readOwnPackageVersion = readOwnPackageVersion;
-exports.deriveProjectUrlFromConfig = deriveProjectUrlFromConfig;
-exports.resolveProjectCredentials = resolveProjectCredentials;
 exports.formatTimestamp = formatTimestamp;
 exports.addSeconds = addSeconds;
 exports.isShippedFunctionFile = isShippedFunctionFile;
 exports.listFilesRecursive = listFilesRecursive;
 exports.toRelativePosix = toRelativePosix;
 exports.resolveContainedDir = resolveContainedDir;
+exports.settingsSeedSql = settingsSeedSql;
+exports.printSettingsSeedStep = printSettingsSeedStep;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-const promises_1 = require("node:readline/promises");
 /**
  * Ruled install order (controller ruling, task 18): core -> push -> polls ->
  * reaction -> inbox -> translation. Reaction MUST land before inbox —
@@ -177,54 +176,6 @@ function readOwnPackageVersion() {
     const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
     return pkg.version;
 }
-function deriveProjectUrlFromConfig(dir) {
-    const configPath = path.join(dir, "config.toml");
-    if (!fs.existsSync(configPath))
-        return null;
-    const raw = fs.readFileSync(configPath, "utf8");
-    const match = raw.match(/^\s*project_id\s*=\s*"([^"]+)"/m);
-    if (!match)
-        return null;
-    return `https://${match[1]}.supabase.co`;
-}
-function defaultPrompt(question) {
-    const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
-    return rl.question(question).then((answer) => {
-        rl.close();
-        return answer;
-    });
-}
-/**
- * Resolves the Supabase project URL + anon key from (in order) explicit
- * flags, `<dir>/config.toml` (URL only), or an interactive prompt — failing
- * loudly instead of hanging when stdin is not a TTY and no `prompt`
- * override was injected. Shared by `init` and `upgrade`, both of which only
- * need this when a placeholder-bearing file is about to be written.
- */
-async function resolveProjectCredentials(options) {
-    const usingDefaultPrompt = !options.prompt;
-    const prompt = options.prompt ?? defaultPrompt;
-    let projectUrl = options.projectUrl;
-    let anonKey = options.anonKey;
-    if (!projectUrl) {
-        projectUrl = deriveProjectUrlFromConfig(options.dir) ?? undefined;
-    }
-    const stillMissingFlags = [];
-    if (!projectUrl)
-        stillMissingFlags.push("--project-url");
-    if (!anonKey)
-        stillMissingFlags.push("--anon-key");
-    if (stillMissingFlags.length > 0 && usingDefaultPrompt && !process.stdin.isTTY) {
-        throw new Error(`community-sdk: missing required flag(s) ${stillMissingFlags.join(", ")}. stdin is not a TTY, so this command cannot prompt for ${stillMissingFlags.length > 1 ? "them" : "it"} — pass ${stillMissingFlags.length > 1 ? "them" : "it"} explicitly.`);
-    }
-    if (!projectUrl) {
-        projectUrl = (await prompt("Supabase project URL (https://<ref>.supabase.co): ")).trim();
-    }
-    if (!anonKey) {
-        anonKey = (await prompt("Supabase anon key: ")).trim();
-    }
-    return { projectUrl, anonKey };
-}
 function formatTimestamp(date) {
     const pad = (n) => String(n).padStart(2, "0");
     return (String(date.getUTCFullYear()) +
@@ -268,3 +219,20 @@ function resolveContainedDir(cwd, dirRel) {
     }
     return dir;
 }
+/**
+ * The one statement to run once per Supabase project after `db push`: it
+ * stores the project's own URL and anon key in Vault, where the pg_cron jobs
+ * and pg_net webhooks read them (core/000_settings.sql). The migration files
+ * themselves carry no project-specific value, so the same files deploy to a
+ * sandbox and a production project.
+ */
+function settingsSeedSql(values = {}) {
+    const url = values.projectUrl?.trim() || "https://<ref>.supabase.co";
+    const key = values.anonKey?.trim() || "<anon key>";
+    return `select public.community_settings_set('${url.replace(/'/g, "''")}', '${key.replace(/'/g, "''")}');`;
+}
+function printSettingsSeedStep(log, values, step) {
+    log(`  ${step}. Seed the project settings (once per Supabase project, after db push):`);
+    log(`     supabase db query --linked "${settingsSeedSql(values)}"`);
+    log("     (or run that statement in the SQL editor — the migrations carry no project URL/key)");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocapine/community",
-  "version": "0.3.3",
+  "version": "0.6.0",
   "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
   "license": "MIT",
   "repository": {

package/templates/migrations/core/000_settings.sql

@@ -0,0 +1,128 @@
+-- community-sdk core/000_settings.sql (schema v1)
+-- Community SDK — 00 project settings: where the pg_cron jobs and pg_net
+-- webhooks learn this project's own URL and anon key.
+--
+-- They live in Supabase Vault, seeded ONCE PER PROJECT after `db push`:
+--
+--   select public.community_settings_set('https://<ref>.supabase.co', '<anon key>');
+--
+-- so the very same migration files deploy to a sandbox and a production
+-- project. The anon key is public by design (it ships inside the app binary):
+-- the Edge Functions do privileged work through their own service-role env,
+-- the JWT only passes verify_jwt.
+--
+-- Every helper here is security definer and private (postgres + service_role):
+-- the webhook trigger functions are security definer too, cron runs as
+-- postgres, and nothing is exposed over PostgREST.
+
+create extension if not exists supabase_vault;
+create extension if not exists pg_cron;
+create extension if not exists pg_net;
+
+-- Upsert both settings. Idempotent: re-run it to rotate the key or move the
+-- project.
+create or replace function public.community_settings_set(p_project_url text, p_anon_key text)
+returns void
+language plpgsql
+security definer set search_path = ''
+as $$
+declare
+  v_id uuid;
+  v_name text;
+  v_value text;
+begin
+  for v_name, v_value in
+    values ('community_project_url', rtrim(p_project_url, '/')), ('community_anon_key', p_anon_key)
+  loop
+    select id into v_id from vault.secrets where name = v_name;
+    if v_id is null then
+      perform vault.create_secret(v_value, v_name);
+    else
+      perform vault.update_secret(v_id, v_value);
+    end if;
+  end loop;
+end;
+$$;
+
+create or replace function public.community_setting(p_name text)
+returns text
+language plpgsql
+stable
+security definer set search_path = ''
+as $$
+declare
+  v_value text;
+begin
+  select decrypted_secret into v_value from vault.decrypted_secrets where name = p_name;
+  if v_value is null then
+    raise exception 'community-sdk: project setting % is not seeded. Run once per project: select public.community_settings_set(''https://<ref>.supabase.co'', ''<anon key>'');', p_name;
+  end if;
+  return v_value;
+end;
+$$;
+
+create or replace function public.community_project_url()
+returns text language sql stable security definer set search_path = ''
+as $$ select public.community_setting('community_project_url') $$;
+
+create or replace function public.community_anon_key()
+returns text language sql stable security definer set search_path = ''
+as $$ select public.community_setting('community_anon_key') $$;
+
+-- Call one of this project's own Edge Functions through pg_net. A failure
+-- (settings not seeded, pg_net unavailable) is logged as a warning and never
+-- aborts the insert/update that triggered it: the content stays `pending`
+-- (or untranslated) and the daily sweep catches up.
+create or replace function public.community_call_function(p_function text, p_body jsonb default null)
+returns void
+language plpgsql
+security definer set search_path = ''
+as $$
+begin
+  perform net.http_post(
+    url := public.community_project_url() || '/functions/v1/' || p_function,
+    headers := jsonb_build_object(
+      'Content-Type', 'application/json',
+      'Authorization', 'Bearer ' || public.community_anon_key()
+    ),
+    body := coalesce(p_body, '{}'::jsonb)
+  );
+exception when others then
+  raise warning 'community-sdk: could not call Edge Function %: %', p_function, sqlerrm;
+end;
+$$;
+
+-- (Re)schedule a cron job by name: replaces an existing job of the same name,
+-- so a re-run (or an upgrade from a release that baked the URL into the job
+-- command) always ends with exactly one job carrying the current command.
+create or replace function public.community_schedule(p_name text, p_schedule text, p_command text)
+returns void
+language plpgsql
+security definer set search_path = ''
+as $$
+declare
+  v_jobid bigint;
+begin
+  for v_jobid in select jobid from cron.job where jobname = p_name loop
+    perform cron.unschedule(v_jobid);
+  end loop;
+  perform cron.schedule(p_name, p_schedule, p_command);
+end;
+$$;
+
+revoke execute on function
+  public.community_settings_set(text, text),
+  public.community_setting(text),
+  public.community_project_url(),
+  public.community_anon_key(),
+  public.community_call_function(text, jsonb),
+  public.community_schedule(text, text, text)
+from public, anon, authenticated;
+grant execute on function
+  public.community_settings_set(text, text),
+  public.community_setting(text),
+  public.community_project_url(),
+  public.community_anon_key(),
+  public.community_call_function(text, jsonb),
+  public.community_schedule(text, text, text)
+to service_role;

package/templates/migrations/core/003_moderation.sql

@@ -1,68 +1,7 @@
 -- community-sdk core/003_moderation.sql (schema v1)
--- Community SDK — 03 moderation plumbing: daily cron batch + real-time report
--- webhook.
---
--- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
--- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
--- its anon key. The anon key is public by design (shipped inside the app
--- binary): the Edge Functions do privileged work through their own
--- service-role env, the JWT only passes verify_jwt.
---
--- The DO block below fails the migration loudly if the placeholders were not
--- replaced.
-do $$ begin
-  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
-    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
-  end if;
-end $$;
-
+-- Community SDK — 03 moderation plumbing: the extensions the report webhook
+-- and the daily moderation cron need. The webhook function, its trigger and
+-- the cron job themselves live in core/008_webhooks.sql (they read the
+-- project URL / anon key from the settings seeded via core/000_settings.sql).
 create extension if not exists pg_cron;
 create extension if not exists pg_net;
-
--- Real-time: forward each new report to the report-to-slack Edge Function.
-create or replace function public.notify_report_webhook()
-returns trigger
-language plpgsql
-security definer set search_path = public
-as $$
-begin
-  perform net.http_post(
-    url := '__SUPABASE_PROJECT_URL__/functions/v1/report-to-slack',
-    headers := jsonb_build_object(
-      'Content-Type', 'application/json',
-      'Authorization', 'Bearer __SUPABASE_ANON_KEY__'
-    ),
-    body := jsonb_build_object('record', to_jsonb(new))
-  );
-  return new;
-end;
-$$;
-
-drop trigger if exists on_report_created on public.reports;
-create trigger on_report_created
-  after insert on public.reports
-  for each row execute function public.notify_report_webhook();
-
--- Daily 08:00 UTC moderation batch. Wrapped defensively: cron.schedule
--- upserts by job name, but if a prior manual run already created the job
--- and this raises anyway, do not fail the whole migration on a rerun.
-do $$
-begin
-  perform cron.schedule(
-    'daily-moderation',
-    '0 8 * * *',
-    $cron$
-    select net.http_post(
-      url := '__SUPABASE_PROJECT_URL__/functions/v1/daily-moderation',
-      headers := jsonb_build_object('Authorization', 'Bearer __SUPABASE_ANON_KEY__')
-    );
-    $cron$
-  );
-exception when others then
-  if sqlerrm like '%already exists%' then
-    raise notice 'cron job daily-moderation already scheduled, skipping';
-  else
-    raise;
-  end if;
-end;
-$$;

package/templates/migrations/core/008_webhooks.sql

@@ -0,0 +1,27 @@
+-- community-sdk core/008_webhooks.sql (schema v1)
+-- Community SDK — 08 report webhook + daily moderation cron, built on the
+-- project settings helpers (core/000_settings.sql). On an existing install
+-- this replaces the function and job that carried the project URL baked in.
+
+-- Real-time: forward each new report to the report-to-slack Edge Function.
+create or replace function public.notify_report_webhook()
+returns trigger
+language plpgsql
+security definer set search_path = public
+as $$
+begin
+  perform public.community_call_function('report-to-slack', jsonb_build_object('record', to_jsonb(new)));
+  return new;
+end;
+$$;
+
+create or replace trigger on_report_created
+  after insert on public.reports
+  for each row execute function public.notify_report_webhook();
+
+-- Daily 08:00 UTC moderation batch.
+select public.community_schedule(
+  'daily-moderation',
+  '0 8 * * *',
+  $cron$ select public.community_call_function('daily-moderation'); $cron$
+);

package/templates/migrations/push/002_triggers.sql

@@ -1,89 +1,9 @@
 -- community-sdk push/002_triggers.sql (schema v1)
--- Community SDK — push module (OPTIONAL): webhook functions, triggers and the
--- hourly digest cron job. Requires the notify-comment / notify-like Edge
--- Functions and an EXPO_ACCESS_TOKEN secret. References core module tables
+-- Community SDK — push module (OPTIONAL): the extensions the push webhooks
+-- need. The webhook functions, triggers and the hourly digest cron live in
+-- push/003_webhooks.sql (they read the project URL / anon key from the
+-- settings seeded via core/000_settings.sql). References core module tables
 -- (public.comments, public.likes) — the core module must be installed first,
 -- and push/001_push.sql (push_tokens) before this file.
---
--- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
--- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
--- its anon key. The anon key is public by design (shipped inside the app
--- binary): the Edge Functions do privileged work through their own
--- service-role env, the JWT only passes verify_jwt.
---
--- The DO block below fails the migration loudly if the placeholders were not
--- replaced.
-do $$ begin
-  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
-    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
-  end if;
-end $$;
-
 create extension if not exists pg_cron;
 create extension if not exists pg_net;
-
--- ============ WEBHOOK FUNCTIONS ============
-create or replace function public.notify_comment_webhook()
-returns trigger language plpgsql security definer set search_path = public as $$
-begin
-  perform net.http_post(
-    url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-comment',
-    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
-    body := jsonb_build_object('record', to_jsonb(new))
-  );
-  return new;
-end; $$;
-
-create or replace function public.notify_like_webhook()
-returns trigger language plpgsql security definer set search_path = public as $$
-begin
-  perform net.http_post(
-    url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-like',
-    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
-    body := jsonb_build_object('record', to_jsonb(new))
-  );
-  return new;
-end; $$;
-
--- ============ TRIGGERS ============
--- Notify the post author only once a comment is actually published, never on
--- the pending insert (a rejected comment must never send a push).
-create trigger on_comment_published
-  after update on public.comments
-  for each row
-  when (old.status = 'pending' and new.status = 'visible')
-  execute function public.notify_comment_webhook();
-
--- Dashboard comments are inserted directly as 'visible' (service role) and
--- must notify too. App comments are always inserted 'pending' (RLS-enforced),
--- so nothing double-notifies.
-create trigger on_comment_created_visible
-  after insert on public.comments
-  for each row
-  when (new.status = 'visible')
-  execute function public.notify_comment_webhook();
-
-create trigger on_like_created
-  after insert on public.likes
-  for each row execute function public.notify_like_webhook();
-
--- Hourly digest: flush the tail of any coalesced like bursts.
-do $$
-begin
-  perform cron.schedule(
-    'community-like-digest', '0 * * * *',
-    $cron$
-    select net.http_post(
-      url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-like',
-      headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__')
-    );
-    $cron$
-  );
-exception when others then
-  if sqlerrm like '%already exists%' then
-    raise notice 'cron job community-like-digest already scheduled, skipping';
-  else
-    raise;
-  end if;
-end;
-$$;

package/templates/migrations/push/003_webhooks.sql

@@ -0,0 +1,50 @@
+-- community-sdk push/003_webhooks.sql (schema v1)
+-- Community SDK — push module: webhook functions, triggers and the hourly
+-- digest cron, built on the project settings helpers (core/000_settings.sql).
+-- Requires the notify-comment / notify-like Edge Functions. On an existing
+-- install this replaces the functions and job that carried the project URL
+-- baked in.
+
+-- ============ WEBHOOK FUNCTIONS ============
+create or replace function public.notify_comment_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform public.community_call_function('notify-comment', jsonb_build_object('record', to_jsonb(new)));
+  return new;
+end; $$;
+
+create or replace function public.notify_like_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform public.community_call_function('notify-like', jsonb_build_object('record', to_jsonb(new)));
+  return new;
+end; $$;
+
+-- ============ TRIGGERS ============
+-- Notify the post author only once a comment is actually published, never on
+-- the pending insert (a rejected comment must never send a push).
+create or replace trigger on_comment_published
+  after update on public.comments
+  for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.notify_comment_webhook();
+
+-- Dashboard comments are inserted directly as 'visible' (service role) and
+-- must notify too. App comments are always inserted 'pending' (RLS-enforced),
+-- so nothing double-notifies.
+create or replace trigger on_comment_created_visible
+  after insert on public.comments
+  for each row
+  when (new.status = 'visible')
+  execute function public.notify_comment_webhook();
+
+create or replace trigger on_like_created
+  after insert on public.likes
+  for each row execute function public.notify_like_webhook();
+
+-- Hourly digest: flush the tail of any coalesced like bursts.
+select public.community_schedule(
+  'community-like-digest',
+  '0 * * * *',
+  $cron$ select public.community_call_function('notify-like'); $cron$
+);

package/templates/migrations/reaction/001_reactions.sql

@@ -13,20 +13,9 @@
 -- notify-reaction webhook below still fires either way — it is the Edge
 -- Function's job to look up push_tokens if/when that module is present).
 --
--- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
--- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
--- its anon key. The anon key is public by design (shipped inside the app
--- binary): the Edge Functions do privileged work through their own
--- service-role env, the JWT only passes verify_jwt.
---
--- The DO block below fails the migration loudly if the placeholders were not
--- replaced.
-do $$ begin
-  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
-    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
-  end if;
-end $$;
-
+-- The reaction webhook, its trigger and the half-hourly digest cron live in
+-- reaction/002_webhooks.sql (they read the project URL / anon key from the
+-- settings seeded via core/000_settings.sql).
 create extension if not exists pg_cron;
 create extension if not exists pg_net;
 
@@ -97,43 +86,3 @@ begin
     alter table public.push_tokens add column if not exists notify_reactions boolean not null default true;
   end if;
 end $$;
-
--- ============ WEBHOOK + DIGEST ============
--- Same pattern as push/002_triggers.sql's notify-like: an immediate webhook
--- on insert plus a coalescing digest cron for anything the webhook missed.
--- Requires the notify-reaction Edge Function.
-create or replace function public.notify_reaction_webhook()
-returns trigger language plpgsql security definer set search_path = public as $$
-begin
-  perform net.http_post(
-    url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-reaction',
-    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
-    body := jsonb_build_object('record', to_jsonb(new))
-  );
-  return new;
-end; $$;
-
-create trigger on_post_reaction_created
-  after insert on public.post_reactions
-  for each row execute function public.notify_reaction_webhook();
-
--- Half-hourly digest: flush the tail of any coalesced reaction bursts.
-do $$
-begin
-  perform cron.schedule(
-    'community-reaction-digest', '30 * * * *',
-    $cron$
-    select net.http_post(
-      url := '__SUPABASE_PROJECT_URL__/functions/v1/notify-reaction',
-      headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__')
-    );
-    $cron$
-  );
-exception when others then
-  if sqlerrm like '%already exists%' then
-    raise notice 'cron job community-reaction-digest already scheduled, skipping';
-  else
-    raise;
-  end if;
-end;
-$$;

package/templates/migrations/reaction/002_webhooks.sql

@@ -0,0 +1,24 @@
+-- community-sdk reaction/002_webhooks.sql (schema v1)
+-- Community SDK — reaction module: webhook + half-hourly digest, built on the
+-- project settings helpers (core/000_settings.sql). Same pattern as
+-- push/003_webhooks.sql's notify-like: an immediate webhook on insert plus a
+-- coalescing digest cron for anything the webhook missed. Requires the
+-- notify-reaction Edge Function. On an existing install this replaces the
+-- function and job that carried the project URL baked in.
+create or replace function public.notify_reaction_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform public.community_call_function('notify-reaction', jsonb_build_object('record', to_jsonb(new)));
+  return new;
+end; $$;
+
+create or replace trigger on_post_reaction_created
+  after insert on public.post_reactions
+  for each row execute function public.notify_reaction_webhook();
+
+-- Half-hourly digest: flush the tail of any coalesced reaction bursts.
+select public.community_schedule(
+  'community-reaction-digest',
+  '30 * * * *',
+  $cron$ select public.community_call_function('notify-reaction'); $cron$
+);

package/templates/migrations/translation/001_translations.sql

@@ -9,20 +9,9 @@
 -- likes). Additive: no core table changes. poll_option_translations is
 -- guarded so this module installs on a backend without the polls module.
 --
--- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
--- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
--- its anon key. The anon key is public by design (shipped inside the app
--- binary): the Edge Functions do privileged work through their own
--- service-role env, the JWT only passes verify_jwt.
---
--- The DO block below fails the migration loudly if the placeholders were not
--- replaced.
-do $$ begin
-  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
-    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
-  end if;
-end $$;
-
+-- The translate webhooks, their triggers and the daily sweep cron live in
+-- translation/002_webhooks.sql (they read the project URL / anon key from the
+-- settings seeded via core/000_settings.sql).
 create table public.post_translations (
   post_id       uuid not null references public.posts(id) on delete cascade,
   locale        text not null,
@@ -120,71 +109,3 @@ language sql stable security definer set search_path = public as $$
 $$;
 revoke execute on function public.items_missing_translations(text, text[], int) from public, anon, authenticated;
 grant execute on function public.items_missing_translations(text, text[], int) to service_role;
-
--- ============ TRIGGERS ============
-create or replace function public.translate_post_webhook()
-returns trigger language plpgsql security definer set search_path = public as $$
-begin
-  perform net.http_post(
-    url := '__SUPABASE_PROJECT_URL__/functions/v1/translate-one',
-    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
-    body := jsonb_build_object('kind', 'post', 'id', new.id)
-  );
-  return new;
-end; $$;
-
-create or replace function public.translate_comment_webhook()
-returns trigger language plpgsql security definer set search_path = public as $$
-begin
-  perform net.http_post(
-    url := '__SUPABASE_PROJECT_URL__/functions/v1/translate-one',
-    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
-    body := jsonb_build_object('kind', 'comment', 'id', new.id)
-  );
-  return new;
-end; $$;
-
-drop trigger if exists on_post_published_translate on public.posts;
-create trigger on_post_published_translate
-  after update of status on public.posts for each row
-  when (old.status = 'pending' and new.status = 'visible')
-  execute function public.translate_post_webhook();
-drop trigger if exists on_post_created_visible_translate on public.posts;
-create trigger on_post_created_visible_translate
-  after insert on public.posts for each row
-  when (new.status = 'visible')
-  execute function public.translate_post_webhook();
-
-drop trigger if exists on_comment_published_translate on public.comments;
-create trigger on_comment_published_translate
-  after update of status on public.comments for each row
-  when (old.status = 'pending' and new.status = 'visible')
-  execute function public.translate_comment_webhook();
-drop trigger if exists on_comment_created_visible_translate on public.comments;
-create trigger on_comment_created_visible_translate
-  after insert on public.comments for each row
-  when (new.status = 'visible')
-  execute function public.translate_comment_webhook();
-
--- ============ CRON ============
--- Daily sweep at 08:30 UTC (after the 08:00 moderation sweep): back-fills the
--- history on first installation, then catches anything translate-one missed.
-do $$
-begin
-  perform cron.schedule(
-    'community-translation-sweep',
-    '30 8 * * *',
-    $cron$
-    select net.http_post(
-      url := '__SUPABASE_PROJECT_URL__/functions/v1/daily-translation',
-      headers := jsonb_build_object('Authorization', 'Bearer __SUPABASE_ANON_KEY__')
-    );
-    $cron$
-  );
-exception when others then
-  if sqlerrm like '%already exists%' then
-    raise notice 'cron job community-translation-sweep already scheduled, skipping';
-  else
-    raise;
-  end if;
-end $$;

package/templates/migrations/translation/002_webhooks.sql

@@ -0,0 +1,48 @@
+-- community-sdk translation/002_webhooks.sql (schema v1)
+-- Community SDK — translation module: translate webhooks, triggers and the
+-- daily sweep cron, built on the project settings helpers
+-- (core/000_settings.sql). Requires the translate-one / daily-translation
+-- Edge Functions. On an existing install this replaces the functions and job
+-- that carried the project URL baked in.
+
+-- ============ TRIGGERS ============
+create or replace function public.translate_post_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform public.community_call_function('translate-one', jsonb_build_object('kind', 'post', 'id', new.id));
+  return new;
+end; $$;
+
+create or replace function public.translate_comment_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform public.community_call_function('translate-one', jsonb_build_object('kind', 'comment', 'id', new.id));
+  return new;
+end; $$;
+
+create or replace trigger on_post_published_translate
+  after update of status on public.posts for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.translate_post_webhook();
+create or replace trigger on_post_created_visible_translate
+  after insert on public.posts for each row
+  when (new.status = 'visible')
+  execute function public.translate_post_webhook();
+
+create or replace trigger on_comment_published_translate
+  after update of status on public.comments for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.translate_comment_webhook();
+create or replace trigger on_comment_created_visible_translate
+  after insert on public.comments for each row
+  when (new.status = 'visible')
+  execute function public.translate_comment_webhook();
+
+-- ============ CRON ============
+-- Daily sweep at 08:30 UTC (after the 08:00 moderation sweep): back-fills the
+-- history on first installation, then catches anything translate-one missed.
+select public.community_schedule(
+  'community-translation-sweep',
+  '30 8 * * *',
+  $cron$ select public.community_call_function('daily-translation'); $cron$
+);