Empire Mercenary Company

Companion app for the company: a Next.js PWA that talks to Supabase. Players sign in with a magic link, take a recruit oath, record work and goals, and spend banks the server awards. Brand rules are in docs/BRAND.md. The 10/28 attribute rules and the weekly check-in are in docs/OPEN_QUESTIONS.md.

This repository is public. Do not commit keys, service-role secrets, or a hosted project URL that is private to you. .env.example holds placeholders only. Do not commit font files.

Brand files

The marks in public/brand/ are the approved v2 set:

• emc_mark.png — transparent helm and kettlebell. Header, sign-in, and About.
• emc_app_icon.png — the same mark on Iron Black, 1024. PWA icons, the apple touch icon, the favicon, and the splash are resizes of this file.
• emc_badge_light.png — full badge on parchment, for a light surface.

Nothing is recolored. The wide lockup is not used. Headings are live type.

Corleone is FontMesa's cut, licensed for web and app use, and never committed. Put Corleone-Regular.woff2 (font-family: Corleone, mixed-case display) and Corleone-Due-Regular.woff2 (font-family: "Corleone Due", all-caps headings) in public/fonts/corleone/ (gitignored). Both faces are weight 400. The display stack is "Corleone Due", Corleone, "Nunito Sans", sans-serif. A missing file does not fail the build; headings then use Nunito Sans. See public/fonts/private/README.md.

Body text is Nunito Sans. Headlines, buttons, and labels are Bebas Neue. The sign-off can use Corleone Due as the one accent line. The Sirath journal uses EB Garamond. League Spartan is not used.

The Flutter app on the other pull requests is reference material. Leave those branches and pull requests alone.

What you need

• Node.js 22
• A Supabase project, or the Supabase CLI with Docker, when you want the app itself
• Postgres 16, for the SQL tests, if you are not using the CLI

There is no public deploy in this repo and no paid service.

Environment

cp .env.example .env.local

Set:

• NEXT_PUBLIC_SUPABASE_URL — project URL, or http://127.0.0.1:54321 for the local CLI
• NEXT_PUBLIC_SUPABASE_ANON_KEY — the anon key only

The app never reads a service-role key. Leave it out.

Without those two values the shell, dice roller, and About page still open. Sign-in and the company book stay closed.

Dev login

Password sign-in is for local play only. It appears when NEXT_PUBLIC_DEV_LOGIN=1 and the host is localhost or 127.0.0.1. Anywhere else the form is hidden and POST /api/dev-login returns 404. Magic link stays the real sign-in path. No mail is sent for a dev login.

The shared password is the dev-only constant emc-dev-login. It is not a production secret. Accounts use @example.test and character names only.

The roster lives in supabase/seed/roster.json (squads included). Swap that file, then regenerate the seed:

node scripts/render-test-seed.mjs

Play locally

cp .env.example .env.local

Set NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, and NEXT_PUBLIC_DEV_LOGIN=1.

Apply the migrations, then the test accounts, on the database you mean to use. Do not run the seed from CI against a hosted project.

npx supabase db push
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f supabase/migrations/20261031120000_sheet_record.sql
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f supabase/seed/test_accounts.sql

If db push already applied 20261031120000_sheet_record.sql, skip that file. To remove the test accounts:

psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f supabase/seed/delete_test_accounts.sql

npm install
npm run dev -- -H 127.0.0.1

Open http://127.0.0.1:3000/sign-in and pick a test account:

• Alexandria, Aligher, David, Earl, Jadross, Valthar Brightlance
• DM ([email protected])
• Curator ([email protected], lore approver)

Run the app

npm install
npm run dev

Open http://127.0.0.1:3000. Sign-in emails a link to /auth/callback.

With the Supabase CLI, local mail is captured by Inbucket (the CLI prints the port, often 54324). Open the message there. Nothing is sent to a real inbox unless you configure SMTP yourself, and this repo does not.

Migrations

SQL lives in supabase/migrations, in filename order. A fresh Supabase project applies them with:

npx supabase db push

Local CLI:

npx supabase start
npx supabase db reset

supabase/config.toml points the site at http://127.0.0.1:3000 and allows http://localhost:3000. Magic link is the email provider. Confirmations are off for local mail so the link signs you in. Signup still creates a profile and a membership in the seeded company through handle_new_user.

The SQL tests do not need Docker. They rebuild a database named emc_test:

npm run test:rls

That script refuses a DATABASE_URL on supabase.co or supabase.com. Against CI or another local Postgres:

DATABASE_URL=postgres://postgres:postgres@localhost:5432/emc_test npm run test:rls

Make yourself the DM

The signup trigger creates a player. After your first magic-link sign-in, promote that profile from the Supabase SQL editor (or psql). Replace the email.

update public.profiles
set app_role = 'dm'
where email = '[email protected]';

Roles are player, dm, admin, and curator. A Captain is an in-fiction rank, not a role. Only a DM can change roles, from the Schedule page, and the function will not remove the last DM.

Checks

npm run lint
npm run typecheck
npm test
npm run test:rls
npm run build
npm run test:e2e

npm test is the rules engine (Vitest). test:e2e is Playwright against the shell and does not need Supabase keys. GitHub Actions runs the same list.

Award rules, as configured

Numbers live in scoring_config, not in the pages. The seed is a placeholder John can change:

This is the beginning of the README. Read the rest at the original. Read the full README ↗