@rocapine/community 0.6.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocapine/community",
-  "version": "0.6.0",
+  "version": "0.9.0",
   "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
   "license": "MIT",
   "repository": {

package/templates/functions/_shared/copy.ts

@@ -17,8 +17,8 @@
 // Placeholders: `{name}` (actor display name) and `{count}` (the number of
 // OTHER people in a coalesced push). A `*.many` value is either a string or a
 // `{ one, few, many, other }` object picked by the CLDR plural category of
-// `{count}` for the recipient's locale (Polish needs all three; French treats
-// 0 like 1; everything else is one/other).
+// `{count}` for the recipient's locale (Polish needs all three; Ukrainian and
+// Romanian one/few/other; French treats 0 like 1; everything else is one/other).
 //
 // Legacy single-string secrets still apply, below the JSON and above the
 // built-ins: COMMUNITY_FALLBACK_NAME (every locale's fallbackName) and
@@ -165,13 +165,23 @@ const BUILTIN: Record<string, LocaleCopy> = {
 // Same rule set as the UI package's `pluralCategory` (packages/ui/src/i18n.ts).
 export function pluralCategory(locale: string, n: number): keyof Forms {
   const lang = locale.split("-")[0]?.toLowerCase();
+  const m10 = n % 10;
+  const m100 = n % 100;
   if (lang === "pl") {
     if (n === 1) return "one";
-    const m10 = n % 10;
-    const m100 = n % 100;
     if (m10 >= 2 && m10 <= 4 && !(m100 >= 12 && m100 <= 14)) return "few";
     return "many";
   }
+  if (lang === "uk") {
+    if (m10 === 1 && m100 !== 11) return "one";
+    if (m10 >= 2 && m10 <= 4 && !(m100 >= 12 && m100 <= 14)) return "few";
+    return "other";
+  }
+  if (lang === "ro") {
+    if (n === 1) return "one";
+    if (n === 0 || (m100 >= 2 && m100 <= 19)) return "few";
+    return "other";
+  }
   if (lang === "fr") return n === 0 || n === 1 ? "one" : "other";
   return n === 1 ? "one" : "other";
 }

package/templates/functions/_shared/push.ts

@@ -8,11 +8,36 @@ export interface ExpoPushMessage {
   title: string;
   body?: string;
   data: Record<string, string>;
-  // badge: 1 is a "something new" dot, not a real unread count — the app
-  // clears it on every foreground.
+  // The recipient's unread inbox count at send time (see `unreadBadge`); the
+  // app re-syncs the icon badge from the SDK's own count while it runs.
   badge?: number;
 }
 
+/** Unread inbox rows for `uid` (newer than the seen marker), at least 1 since a push
+ * is being sent. Falls back to 1 when the inbox module is not installed. */
+export async function unreadBadge(
+  supabase: { from: (table: string) => any },
+  uid: string,
+): Promise<number> {
+  try {
+    const { data: seen } = await supabase
+      .from("notification_seen")
+      .select("seen_at")
+      .eq("user_id", uid)
+      .maybeSingle();
+    let query = supabase
+      .from("notifications")
+      .select("*", { count: "exact", head: true })
+      .eq("user_id", uid);
+    if (seen?.seen_at) query = query.gt("created_at", seen.seen_at);
+    const { count, error } = await query;
+    if (error) return 1;
+    return Math.max(1, count ?? 0);
+  } catch {
+    return 1;
+  }
+}
+
 // Sends in chunks of 100 (Expo API limit), 4 requests in flight at a time, each
 // aborted after 10 s so one hung request can't stall a large broadcast past the
 // function's wall-clock limit. Best-effort: push failures must never fail the
@@ -28,14 +53,25 @@ export async function sendExpoPushBatch(
   if (accessToken) headers["Authorization"] = `Bearer ${accessToken}`;
   const chunks: ExpoPushMessage[][] = [];
   for (let i = 0; i < messages.length; i += 100) chunks.push(messages.slice(i, i + 100));
-  await runPool(chunks, opts.concurrency ?? 4, (chunk) =>
-    fetchImpl("https://exp.host/--/api/v2/push/send", {
-      method: "POST",
-      headers,
-      body: JSON.stringify(chunk.length === 1 ? chunk[0] : chunk),
-      signal: AbortSignal.timeout(10_000),
-    }).catch(() => {}),
-  );
+  await runPool(chunks, opts.concurrency ?? 4, async (chunk) => {
+    try {
+      const res = await fetchImpl("https://exp.host/--/api/v2/push/send", {
+        method: "POST",
+        headers,
+        body: JSON.stringify(chunk.length === 1 ? chunk[0] : chunk),
+        signal: AbortSignal.timeout(10_000),
+      });
+      // Best effort, but never silent: a project with push security enabled
+      // answers 401 UNAUTHORIZED without EXPO_ACCESS_TOKEN, and bad tokens
+      // come back as per-message tickets — both used to vanish here.
+      const body = await res.text();
+      if (!res.ok || /"status"\s*:\s*"error"/.test(body)) {
+        console.error(`expo push: HTTP ${res.status} ${body.slice(0, 500)}`);
+      }
+    } catch (error) {
+      console.error("expo push: request failed", error);
+    }
+  });
 }
 
 export async function sendExpoPush(message: ExpoPushMessage): Promise<void> {

package/templates/functions/_shared/translation.ts

@@ -18,7 +18,29 @@ export const TARGET_LOCALES: string[] = (Deno.env.get("COMMUNITY_TRANSLATION_LOC
   .map((l) => l.trim())
   .filter(Boolean);
 export const TRANSLATION_MODEL = Deno.env.get("COMMUNITY_TRANSLATION_MODEL") ?? "gpt-5-mini";
+// COMMUNITY_TRANSLATION_STYLE: a sentence (same voice for every target) or a JSON
+// object { "<locale>": "<hint>" } for per-locale register hints — e.g.
+// { "fr": "address the reader as vous", "de": "address the reader as Sie" }.
 export const TRANSLATION_STYLE = Deno.env.get("COMMUNITY_TRANSLATION_STYLE") ?? "";
+
+/** The "App voice" instruction lines for the given targets; empty when unset. */
+export function translationStyleLines(style: string, targets: string[]): string[] {
+  const raw = style.trim();
+  if (!raw) return [];
+  if (!raw.startsWith("{")) return [`App voice: ${raw}`];
+  let byLocale: Record<string, unknown>;
+  try {
+    byLocale = JSON.parse(raw);
+  } catch {
+    return [`App voice: ${raw}`];
+  }
+  return targets.flatMap((locale) => {
+    const hint = byLocale[locale] ?? byLocale[locale.split("-")[0]];
+    return typeof hint === "string" && hint.trim()
+      ? [`App voice for ${locale}: ${hint.trim()}`]
+      : [];
+  });
+}
 export const ENGINE = `openai:${TRANSLATION_MODEL}`;
 
 export type TranslationRow = {
@@ -140,7 +162,7 @@ export async function translateItem(input: {
     input.options.length > 0
       ? `The text is a poll: also translate the ${input.options.length} option labels, in the same order and count, into "options". Return an empty options array when there are none.`
       : "Return an empty options array for every locale.",
-    TRANSLATION_STYLE ? `App voice: ${TRANSLATION_STYLE}` : "",
+    ...translationStyleLines(TRANSLATION_STYLE, input.targets),
   ]
     .filter(Boolean)
     .join("\n");

package/templates/functions/notify-comment/index.ts

@@ -8,7 +8,7 @@
 // push comes from the request itself.
 
 import { adminClient } from "../_shared/client.ts";
-import { sendExpoPush } from "../_shared/push.ts";
+import { sendExpoPush, unreadBadge } from "../_shared/push.ts";
 import { pushCopy } from "../_shared/copy.ts";
 import { ensureTranslations, resolveTargetLocale, languageOf } from "../_shared/translation.ts";
 
@@ -84,7 +84,7 @@ Deno.serve(async (req) => {
     title: copy.text("comment.title"),
     body,
     data: { route: "/community", kind: "community_comment" },
-    badge: 1,
+    badge: await unreadBadge(supabase, post.author_id),
   });
   return new Response("ok");
 });

package/templates/functions/notify-like/index.ts

@@ -11,7 +11,7 @@
 // notifications early.
 
 import { adminClient } from "../_shared/client.ts";
-import { sendExpoPush } from "../_shared/push.ts";
+import { sendExpoPush, unreadBadge } from "../_shared/push.ts";
 import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
@@ -81,7 +81,7 @@ async function flushPost(postId: string) {
     to: pref.expo_push_token,
     title,
     data: { route: "/community", kind: "community_like" },
-    badge: 1,
+    badge: await unreadBadge(supabase, post.author_id),
   });
 }
 

package/templates/functions/notify-reaction/index.ts

@@ -15,7 +15,7 @@
 // untrusted body; everything else comes from post_reactions.
 
 import { adminClient } from "../_shared/client.ts";
-import { sendExpoPush } from "../_shared/push.ts";
+import { sendExpoPush, unreadBadge } from "../_shared/push.ts";
 import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
@@ -80,7 +80,7 @@ async function flushPost(postId: string) {
     to: pref.expo_push_token,
     title,
     data: { route: "/community", kind: "community_reaction" },
-    badge: 1,
+    badge: await unreadBadge(supabase, post.author_id),
   });
 }
 

package/templates/functions/update-profile/index.ts

@@ -1,10 +1,10 @@
-// update-profile: the ONLY write path for profiles.handle / bio / avatar_url.
+// update-profile: the ONLY moderated write path for profiles.username / handle / bio / avatar_url.
 // JWT-authenticated: uid comes from the caller's anon session token, never the
 // body. Text fields run through OpenAI omni-moderation (same category logic
 // as moderate-one); avatarPath runs image moderation on the object's public
 // URL. Fail closed: if moderation is unreachable, nothing is written.
 //
-// Fields are applied sequentially (handle, then bio, then avatar); the first
+// Fields are applied sequentially (username, handle, bio, then avatar); the first
 // failure aborts and reports its field. The app's editors send one field at a
 // time, so partial application is not observable in practice.
 
@@ -24,17 +24,23 @@ Deno.serve(async (req) => {
   const uid = userData.user?.id;
   if (!uid) return json({ status: "error", error: "unauthorized" }, 401);
 
-  let body: { handle?: unknown; bio?: unknown; avatarPath?: unknown };
+  let body: { username?: unknown; handle?: unknown; bio?: unknown; avatarPath?: unknown };
   try {
     body = await req.json();
   } catch {
     return json({ status: "error", error: "bad request" }, 400);
   }
-  const { handle, bio, avatarPath } = body;
-  if (handle === undefined && bio === undefined && avatarPath === undefined) {
+  const { username, handle, bio, avatarPath } = body;
+  if (
+    username === undefined &&
+    handle === undefined &&
+    bio === undefined &&
+    avatarPath === undefined
+  ) {
     return json({ status: "error", error: "bad request" }, 400);
   }
   if (
+    (username !== undefined && typeof username !== "string") ||
     (handle !== undefined && typeof handle !== "string") ||
     (bio !== undefined && typeof bio !== "string") ||
     (avatarPath !== undefined && typeof avatarPath !== "string")
@@ -42,6 +48,21 @@ Deno.serve(async (req) => {
     return json({ status: "error", error: "bad request" }, 400);
   }
 
+  // ============ USERNAME (display name) ============
+  if (username !== undefined) {
+    const u = (username as string).trim();
+    if (u.length < 2 || u.length > 24) {
+      return json({ status: "error", error: "invalid_username" }, 400);
+    }
+    const verdict = await moderateInput(u);
+    if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
+    if (verdict.flagged) {
+      return json({ status: "rejected", field: "username", reason: verdict.reason });
+    }
+    const { error } = await admin.from("profiles").update({ username: u }).eq("id", uid);
+    if (error) return json({ status: "error", error: error.message }, 500);
+  }
+
   // ============ HANDLE ============
   if (handle !== undefined) {
     const h = (handle as string).trim().toLowerCase();
@@ -119,11 +140,12 @@ Deno.serve(async (req) => {
   // ============ SUCCESS ============
   const { data: profile } = await admin
     .from("profiles")
-    .select("handle, bio, avatar_url")
+    .select("username, handle, bio, avatar_url")
     .eq("id", uid)
     .single();
   return json({
     status: "ok",
+    username: profile?.username ?? null,
     handle: profile?.handle ?? null,
     bio: profile?.bio ?? null,
     avatarUrl: profile?.avatar_url ?? null,

package/templates/migrations/push/004_delete_own_push_row.sql

@@ -0,0 +1,5 @@
+-- Lets a user delete their own push row (account deletion). Until now only
+-- select/insert/update existed, so a client delete() was a silent no-op.
+drop policy if exists "delete own push row" on public.push_tokens;
+create policy "delete own push row" on public.push_tokens for delete to authenticated
+  using (user_id = auth.uid());