v4: weekly digests and monthly recaps go out by email, every email is written once as Markdown in the app's one catalog, and a review of the last two commits removes what they stated twice — users get a weekly digest (what happened to them, what the people and playlists they follow posted, the week's top dumps, the community) and a monthly recap (the month's top dumps and the community), both on by default, in their own style and scheme. digest-service sends what is due every quarter of an hour from digest_schedule (migration 0020), which holds each user's rolling 7- or 30-day period; existing users' first periods are spread over the coming week or month, a digest more than a period late covers the last full one, an empty one isn't sent, and an address like admin@localhost is skipped. Each digest carries a one-click unsubscribe (List-Unsubscribe and List-Unsubscribe-Post, POST /api/users/unsubscribe) and a link to the new /unsubscribe page, which asks before turning that cadence off, since mail scanners open every link; the token (lib/jwt) names the user and the cadence and never expires. The welcome email now says the digests are on. The emails' words moved out of a hand-written api/mail/strings.ts into the Lingui catalogs the interface uses: lingui extracts api/mail/ too, the catalogs moved to a top-level locales/ that both halves read, compile emits ES modules the server imports (api/mail/i18n.ts), messages take ICU plurals, and the labels the settings tab, the unsubscribe page and the emails share are one message each (their French had already drifted apart). Each template writes its email once as Markdown, which is the plain-text part, and EmailKit.render draws its blocks in the style (a lone link is a button, a list item starting with an image a thumbnail row, a numbered list a ranking, --- the footer), so no string is declared for an HTML and a text version; user text is escaped for Markdown, which the welcome body didn't do for usernames, whose _ read as emphasis. paint() set colors before a border-top shorthand that reset them, so every divider was black. The review also gave one home to what was written twice: the locale list (shared/locale.ts, read by lingui.config, the client, the server and its catalog loader), the base style and default scheme (shared/theme.ts), an email's look (lookOf, which digest-service, welcome and reset share), whether email is on (EMAIL_ENABLED, read by email-service and index.html), a setting's column and its default in the digests' SQL (SETTINGS_COLUMNS, DEFAULT_SETTINGS), the unsubscribe token (made once, not parsed back from a URL), AuthProvider's compare-and-store, ThemeProvider's twin style and scheme code (useThemeChoice), the test JWT encoder, and duplicate digest messages. The email palettes stay a flattened copy of the themes' tokens, now under a test that caught Times' secondary and link colors drifting. The Dockerfile copies api/mail and locales so the build extracts the emails' messages and the server finds its catalogs, and deno.json maps @lingui/core for the runtime image. 236 backend tests (new: digest building, sending, catch-up, scheduling and unsubscribing; the Markdown renderer; French from the catalog; palettes against themes; the stagger migration; unsubscribe tokens) and 661 frontend tests (new: the unsubscribe page) pass, and tsc, eslint, doc:lint, deno check, deno lint and deno fmt are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -3,8 +3,9 @@
 A small invite-only social platform for sharing links and files. Users can post
 URLs and media (YouTube, SoundCloud, Bandcamp, images, audio, video, …), vote,
 comment, follow each other, build playlists, and search content. A real-time
-WebSocket layer handles live presence, vote counts, and notifications. The UI is
-localized (English and French) and ships multiple visual themes.
+WebSocket layer handles live presence, vote counts, and notifications, and
+weekly and monthly email digests sum up what happened. The UI is localized
+(English and French) and ships multiple visual themes.
 
 ## Stack
 
@@ -125,6 +126,7 @@ example.com {
 ```
 shared/            # Imported by both halves: API and socket types, limits, permissions
   test/            # Tests of shared/ (Deno): test/<module>.test.ts
+locales/           # Lingui catalogues (en, fr): the interface's and the emails' messages
 api/
   main.ts          # Entry point — Oak application, middleware, routes
   config.ts        # Environment variables
@@ -155,7 +157,6 @@ src/               # React frontend (Vite)
   hooks/           # Every hook (useFoo.ts)
   utils/           # Every non-React module: pure helpers, storage, API glue
   test/            # Frontend tests (Vitest): test/<layer>/<domain>/<Module>.test.tsx
-  locales/         # Lingui message catalogues (en, fr)
   themes/          # Per-theme CSS files
   i18n.ts          # Lingui runtime setup
 public/            # Static assets (favicon, manifest, service worker)
@@ -249,16 +250,16 @@ types are used through the global `React` namespace rather than a default import
 of `react`, which `deno doc` can't follow.
 
 `deno task doc` builds the HTML reference into `docs/` from every module of
-`api/`, `shared/` and `src/` but the tests (and the generated `src/locales/`).
-Its index page is the module doc of `mod.ts` at the root, which introduces the
-repository's three parts and their layers in prose; `deno doc` builds the list
-of every module itself, grouped by path. The `docs` workflow publishes it on
-every push to `main` that touches them. `deno task doc:lint` checks the rules
-the linter can see, and that no summary ends in a colon, through `doc-lint.ts`.
-Two kinds of diagnostic are let through. A field without a doc passes, since a
-field gets one only when it adds to its type's. `deno doc` doesn't document npm
-packages, so it takes a type imported from one (react-hook-form's `FieldValues`,
-say) for a private one, and those references pass too.
+`api/`, `shared/` and `src/` but the tests. Its index page is the module doc of
+`mod.ts` at the root, which introduces the repository's three parts and their
+layers in prose; `deno doc` builds the list of every module itself, grouped by
+path. The `docs` workflow publishes it on every push to `main` that touches
+them. `deno task doc:lint` checks the rules the linter can see, and that no
+summary ends in a colon, through `doc-lint.ts`. Two kinds of diagnostic are let
+through. A field without a doc passes, since a field gets one only when it adds
+to its type's. `deno doc` doesn't document npm packages, so it takes a type
+imported from one (react-hook-form's `FieldValues`, say) for a private one, and
+those references pass too.
 
 Each of the frontend's `components/`, `contexts/`, `hooks/` and `utils/` is
 split into the same domain folders — `auth`, `category`, `chat`, `comment`,