@rocapine/community 0.10.2 → 0.12.0

package/README.md

@@ -13,7 +13,7 @@ version. The binary is named `community`.
 ## `init`
 
 ```bash
-npx @rocapine/community init [--modules core,push,polls,reaction,inbox,translation] [--project-url <url>] [--anon-key <key>] [--dir supabase]
+npx @rocapine/community init [--modules core,push,polls,reaction,inbox,translation,images] [--project-url <url>] [--anon-key <key>] [--dir supabase]
 ```
 
 Copies the migrations and Edge Functions for the requested modules into
@@ -21,10 +21,10 @@ Copies the migrations and Edge Functions for the requested modules into
 relative to the current directory), and writes a `community-sdk.json`
 manifest at the repo root recording what was installed.
 
-- `--modules` — comma-separated (`core,push,polls,reaction,inbox,translation`). `core`
+- `--modules` — comma-separated (`core,push,polls,reaction,inbox,translation,images`). `core`
   is always implied even if omitted. Omit the flag entirely to install every
   module. Regardless of the order you type them, modules are installed
-  `core → push → polls → reaction → inbox → translation` — this order is load-bearing:
+  `core → push → polls → reaction → inbox → translation → images` — this order is load-bearing:
   the inbox module's reaction trigger is guarded at install time and must
   find the reaction module's table already present, so reaction has to land
   first. Requesting `inbox` without `reaction`, or `translation` without `polls`, prints a (non-fatal) warning (reactions missing from the inbox; poll labels left untranslated).
@@ -64,7 +64,14 @@ are only needed if a newly-added migration carries a placeholder. Fails if
 `--add-modules <modules>` installs one or more modules not yet in
 `community-sdk.json` on top of the existing backend (comma-separated, same
 parsing as `init --modules`) — e.g. `upgrade --add-modules translation` to
-add the translation module to an already-initialized app.
+add the translation module to an already-initialized app, or
+`upgrade --add-modules images` for post and comment images (then
+`supabase db push` and `supabase functions deploy`: the moderation, push-copy
+and report functions changed too). `images` ships `images/001_images.sql`
+(columns, the public `post-images` bucket with its 2 MB / JPEG-only /
+own-folder rules, and the sweep RPC); a host that already has the translation
+module also receives `translation/003_skip_empty.sql` through the plain
+`upgrade`, so image-only items are not picked again by the translation sweep.
 
 ## `adopt`
 

package/lib/commands/init.js

@@ -141,5 +141,8 @@ function printNextSteps(log, modules, values) {
     if (modules.includes("translation")) {
         log('     translation module: COMMUNITY_TRANSLATION_LOCALES="en,es-419,..." (required, same list as modules.translation.locales in the app); optional: COMMUNITY_TRANSLATION_MODEL, COMMUNITY_TRANSLATION_STYLE');
     }
+    if (modules.includes("images")) {
+        log("     images module: requires expo-image-manipulator in the app; no secret");
+    }
     log("  4. Deploy the Edge Functions: supabase functions deploy");
 }

package/lib/commands/upgrade.js

@@ -284,4 +284,7 @@ function printSummary(log, onWarn, summary) {
     if (summary.addedModules.includes("translation")) {
         log('  3. translation module: COMMUNITY_TRANSLATION_LOCALES="en,es-419,..." (required, same list as modules.translation.locales in the app); optional: COMMUNITY_TRANSLATION_MODEL, COMMUNITY_TRANSLATION_STYLE');
     }
+    if (summary.addedModules.includes("images")) {
+        log("  4. images module: requires expo-image-manipulator in the app; no secret");
+    }
 }

package/lib/index.js

@@ -60,7 +60,7 @@ program
 program
     .command("init")
     .description("Copy the community backend into a Supabase project: migrations, Edge Functions, and a community-sdk.json manifest")
-    .option("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox,translation) — core is always implied; defaults to all modules")
+    .option("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox,translation,images) — core is always implied; defaults to all modules")
     .option("--project-url <url>", "Supabase project URL, e.g. https://<ref>.supabase.co — optional, only fills in the printed settings seed statement")
     .option("--anon-key <key>", "Supabase anon key — optional, only fills in the printed settings seed statement")
     .option("--dir <dir>", "target Supabase directory, relative to the current directory", "supabase")
@@ -103,7 +103,7 @@ program
     .command("adopt")
     .description("Register an already-live community backend (e.g. an app that hand-rolled its own before this SDK existed) with community-sdk.json, without copying any files")
     .requiredOption("--schema-version <n>", "the community-sdk schema version this app's live backend corresponds to")
-    .requiredOption("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox,translation) — core is always implied")
+    .requiredOption("--modules <modules>", "comma-separated module list (core,push,polls,reaction,inbox,translation,images) — core is always implied")
     .option("--dir <dir>", "Supabase directory this app would use, relative to the current directory", "supabase")
     .action(async (opts) => {
     try {

package/lib/install-shared.d.ts

@@ -1,6 +1,6 @@
 /**
  * Ruled install order (controller ruling, task 18): core -> push -> polls ->
- * reaction -> inbox -> translation. Reaction MUST land before inbox —
+ * reaction -> inbox -> translation -> images. Reaction MUST land before inbox —
  * inbox/001's reaction trigger is guarded with
  * `to_regclass('public.post_reactions')` at install time and is never
  * retroactively wired if the reaction module shows up later, so `reaction`
@@ -10,7 +10,7 @@
  * single source of truth for module names, order, and the function sets
  * each module pulls in.
  */
-export declare const MODULE_ORDER: readonly ["core", "push", "polls", "reaction", "inbox", "translation"];
+export declare const MODULE_ORDER: readonly ["core", "push", "polls", "reaction", "inbox", "translation", "images"];
 export type Module = (typeof MODULE_ORDER)[number];
 export declare function functionsForModules(modules: readonly Module[]): string[];
 /**

package/lib/install-shared.js

@@ -55,7 +55,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 /**
  * Ruled install order (controller ruling, task 18): core -> push -> polls ->
- * reaction -> inbox -> translation. Reaction MUST land before inbox —
+ * reaction -> inbox -> translation -> images. Reaction MUST land before inbox —
  * inbox/001's reaction trigger is guarded with
  * `to_regclass('public.post_reactions')` at install time and is never
  * retroactively wired if the reaction module shows up later, so `reaction`
@@ -65,7 +65,15 @@ const path = __importStar(require("node:path"));
  * single source of truth for module names, order, and the function sets
  * each module pulls in.
  */
-exports.MODULE_ORDER = ["core", "push", "polls", "reaction", "inbox", "translation"];
+exports.MODULE_ORDER = [
+    "core",
+    "push",
+    "polls",
+    "reaction",
+    "inbox",
+    "translation",
+    "images",
+];
 const ALWAYS_FUNCTIONS = [
     "moderate-one",
     "daily-moderation",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocapine/community",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
   "license": "MIT",
   "repository": {

package/templates/functions/_shared/copy.ts

@@ -10,6 +10,7 @@
 //     "comment.title": { "pl": "Otrzymałaś komentarz" },
 //     "like.one":      { "pl": "{name} polubiła twój post" },
 //     "reaction.one":  { "en": "{name} prayed for you 🙏" },
+//     "photo":         { "en": "📷 A picture" },
 //     "reaction.many": { "en": "{name} and {count} others prayed for you 🙏",
 //                        "pl": { "one": "…", "few": "…", "many": "…" } }
 //   }'
@@ -29,11 +30,18 @@ type CopyValue = string | Forms;
 type LocaleCopy = Record<string, CopyValue>;
 
 export type PushCopyKey =
-  "fallbackName" | "comment.title" | "like.one" | "like.many" | "reaction.one" | "reaction.many";
+  | "fallbackName"
+  | "comment.title"
+  | "like.one"
+  | "like.many"
+  | "reaction.one"
+  | "reaction.many"
+  | "photo";
 
 const BUILTIN: Record<string, LocaleCopy> = {
   en: {
     fallbackName: "Someone",
+    photo: "📷 Photo",
     "comment.title": "You received a comment",
     "like.one": "{name} liked your post",
     "like.many": {
@@ -48,6 +56,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   "pt-PT": {
     fallbackName: "Alguém",
+    photo: "📷 Foto",
     "comment.title": "Recebeste um comentário",
     "like.one": "{name} gostou da tua publicação",
     "like.many": {
@@ -62,6 +71,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   "pt-BR": {
     fallbackName: "Alguém",
+    photo: "📷 Foto",
     "comment.title": "Você recebeu um comentário",
     "like.one": "{name} curtiu seu post",
     "like.many": {
@@ -76,6 +86,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   "es-ES": {
     fallbackName: "Alguien",
+    photo: "📷 Foto",
     "comment.title": "Has recibido un comentario",
     "like.one": "A {name} le ha gustado tu publicación",
     "like.many": {
@@ -90,6 +101,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   "es-419": {
     fallbackName: "Alguien",
+    photo: "📷 Foto",
     "comment.title": "Recibiste un comentario",
     "like.one": "A {name} le gustó tu publicación",
     "like.many": {
@@ -104,6 +116,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   it: {
     fallbackName: "Qualcuno",
+    photo: "📷 Foto",
     "comment.title": "Hai ricevuto un commento",
     "like.one": "A {name} piace il tuo post",
     "like.many": {
@@ -118,6 +131,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   pl: {
     fallbackName: "Ktoś",
+    photo: "📷 Zdjęcie",
     "comment.title": "Masz nowy komentarz",
     "like.one": "{name} polubił(a) twój post",
     "like.many": {
@@ -134,6 +148,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   fr: {
     fallbackName: "Quelqu'un",
+    photo: "📷 Photo",
     "comment.title": "Tu as reçu un commentaire",
     "like.one": "{name} a aimé ta publication",
     "like.many": {
@@ -148,6 +163,7 @@ const BUILTIN: Record<string, LocaleCopy> = {
   },
   de: {
     fallbackName: "Jemand",
+    photo: "📷 Foto",
     "comment.title": "Du hast einen Kommentar erhalten",
     "like.one": "{name} gefällt dein Beitrag",
     "like.many": {
@@ -232,6 +248,12 @@ function fill(template: string, params: { name?: string; count?: number }): stri
     .replace(/\{count\}/g, params.count === undefined ? "" : String(params.count));
 }
 
+/** Push/inbox excerpt: the first 140 characters, or `photo` for an image-only item. */
+export function excerptOrPhoto(content: string, photo: string): string {
+  if (!content.trim()) return photo;
+  return content.length > 140 ? `${content.slice(0, 137)}...` : content;
+}
+
 /** Copy resolver for one recipient (`profiles.locale`). */
 export function pushCopy(recipientLocale: string | null | undefined) {
   const locale = resolveLocale(recipientLocale);

package/templates/functions/_shared/images.ts

@@ -0,0 +1,62 @@
+// Post/comment images (optional `images` module): bucket name, public URL and
+// the soft-failing lookups the moderation functions share.
+
+import { adminClient, SUPABASE_URL } from "./client.ts";
+
+type Admin = ReturnType<typeof adminClient>;
+
+export const POST_IMAGES_BUCKET = "post-images";
+
+export function postImageUrl(path: string): string {
+  return `${SUPABASE_URL}/storage/v1/object/public/${POST_IMAGES_BUCKET}/${path}`;
+}
+
+// Postgres' undefined_column (42703) or PostgREST's own "column not found"
+// (PGRST204): the install has no images module. Any other error is a transient
+// failure, never "no image".
+const isMissingColumn = (code: string | undefined) => code === "42703" || code === "PGRST204";
+
+// Separate select (never part of a wider one) so an install without the images
+// module keeps its text-only behavior: only a missing column means "no image".
+// Any other error is `ok: false` and the caller must fail closed, otherwise an
+// unchecked image could be published.
+export async function fetchImagePath(
+  supabase: Admin,
+  table: "posts" | "comments",
+  id: string,
+): Promise<{ ok: true; path: string | null } | { ok: false }> {
+  const { data, error } = await supabase.from(table).select("image_path").eq("id", id).single();
+  if (error) return isMissingColumn(error.code) ? { ok: true, path: null } : { ok: false };
+  return { ok: true, path: (data as { image_path: string | null } | null)?.image_path ?? null };
+}
+
+// Batch variant for the daily sweep, chunked so a backlog can't build an
+// over-long URL. `paths` holds the rows that have an image; `failedIds` the
+// rows whose chunk errored (caller must not process them this run). A missing
+// column ends the lookup: no images module, nobody has an image.
+export async function fetchImagePaths(
+  supabase: Admin,
+  table: "posts" | "comments",
+  ids: string[],
+  chunkSize = 100,
+): Promise<{ paths: Map<string, string>; failedIds: Set<string> }> {
+  const paths = new Map<string, string>();
+  const failedIds = new Set<string>();
+  for (let i = 0; i < ids.length; i += chunkSize) {
+    const chunk = ids.slice(i, i + chunkSize);
+    const { data, error } = await supabase
+      .from(table)
+      .select("id, image_path")
+      .in("id", chunk)
+      .not("image_path", "is", null);
+    if (error) {
+      if (isMissingColumn(error.code)) return { paths: new Map(), failedIds: new Set() };
+      chunk.forEach((id) => failedIds.add(id));
+      continue;
+    }
+    for (const r of (data ?? []) as { id: string; image_path: string }[]) {
+      paths.set(r.id, r.image_path);
+    }
+  }
+  return { paths, failedIds };
+}

package/templates/functions/_shared/moderation.ts

@@ -49,13 +49,17 @@ export interface ModerationResult {
   category_scores: Record<string, number>;
 }
 
-export function flaggedCategories(result: ModerationResult): string[] {
+// `strict` (image calls) ignores MODERATION_EXCLUDED_CATEGORIES: the exclusion
+// exists for text discussion, never for pictures. Set by the caller, not
+// inferred from the response, so a missing response field can't relax it.
+export function flaggedCategories(result: ModerationResult, strict = false): string[] {
+  const hide = strict ? CATEGORIES_TO_HIDE : SCORE_HIDE;
   const cats = new Set<string>();
   for (const [cat, v] of Object.entries(result.categories)) {
     if (v && CATEGORIES_TO_HIDE.includes(cat)) cats.add(cat);
   }
   for (const [cat, score] of Object.entries(result.category_scores)) {
-    if (SCORE_HIDE.includes(cat) && score >= SCORE_THRESHOLD) cats.add(cat);
+    if (hide.includes(cat) && score >= SCORE_THRESHOLD) cats.add(cat);
   }
   return [...cats];
 }
@@ -73,14 +77,24 @@ export function assertModerationConfigured(): void {
   }
 }
 
-export type ImageInput = { type: "image_url"; image_url: { url: string } }[];
+export type ContentPart =
+  { type: "text"; text: string } | { type: "image_url"; image_url: { url: string } };
 
-// POSTs to OpenAI moderation. `input` is a string for text or the image_url
-// content-part array for an avatar. Returns null on a non-OK response so the
-// caller can fail closed (nothing published / nothing written).
+// Kept as an alias for update-profile (avatars).
+export type ImageInput = ContentPart[];
+
+// POSTs to OpenAI moderation. `input` is a string for text or a content-part
+// array; pass `{ strict: true }` for image calls (see flaggedCategories).
+// Returns null on a non-OK response so the caller can fail closed (nothing
+// published / nothing written).
 export async function moderateInput(
-  input: string | ImageInput,
-): Promise<{ flagged: boolean; reason: string | null } | null> {
+  input: string | ContentPart[],
+  { strict = false }: { strict?: boolean } = {},
+): Promise<{
+  flagged: boolean;
+  reason: string | null;
+  categories: string[];
+} | null> {
   const res = await fetch("https://api.openai.com/v1/moderations", {
     method: "POST",
     headers: {
@@ -95,8 +109,32 @@ export async function moderateInput(
     return null;
   }
   const { results } = await res.json();
-  const cats = flaggedCategories(results[0]);
-  return cats.length > 0
-    ? { flagged: true, reason: cats.join(",") }
-    : { flagged: false, reason: null };
+  const categories = flaggedCategories(results[0], strict);
+  return {
+    flagged: categories.length > 0,
+    reason: categories.length > 0 ? categories.join(",") : null,
+    categories,
+  };
+}
+
+// One verdict for a post/comment. Text and image are moderated in separate
+// calls so only the image is judged by the strict rules: a combined call can't
+// tell which part drove a score, so allowed (excluded) text would be too.
+export async function moderateItem(
+  text: string,
+  imageUrl: string | null,
+): Promise<{ flagged: boolean; reason: string | null; categories: string[] } | null> {
+  const verdicts = await Promise.all([
+    text ? moderateInput(text) : { categories: [] as string[] },
+    imageUrl
+      ? moderateInput([{ type: "image_url", image_url: { url: imageUrl } }], { strict: true })
+      : { categories: [] as string[] },
+  ]);
+  if (verdicts.some((v) => v === null)) return null;
+  const categories = [...new Set(verdicts.flatMap((v) => v!.categories))];
+  return {
+    flagged: categories.length > 0,
+    reason: categories.length > 0 ? categories.join(",") : null,
+    categories,
+  };
 }

package/templates/functions/_shared/names.ts

@@ -0,0 +1,53 @@
+// Display name / handle rules shared by update-profile and the daily sweep:
+// the app's own name is reserved (no "Unchaind Team" impersonating the app),
+// a few staff-sounding handles too, and a taken handle gets a free suggestion.
+
+const APP_NAME = Deno.env.get("COMMUNITY_APP_NAME") ?? "";
+
+/** Lowercase, accents stripped, letters and digits only. */
+function collapse(s: string): string {
+  return s
+    .normalize("NFD")
+    .replace(/\p{Diacritic}/gu, "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, "");
+}
+
+/** True when `value` contains the app's name. Short names (< 4 chars, "Eve") only match a whole word so "Steve" stays allowed. */
+export function containsAppName(value: string, appName: string = APP_NAME): boolean {
+  const app = collapse(appName);
+  if (app === "") return false;
+  if (app.length >= 4) return collapse(value).includes(app);
+  return value
+    .normalize("NFD")
+    .replace(/\p{Diacritic}/gu, "")
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .includes(app);
+}
+
+const RESERVED_HANDLES = ["admin", "support", "official", "team", "moderator"];
+
+export function isReservedHandle(handle: string, appName: string = APP_NAME): boolean {
+  return RESERVED_HANDLES.includes(handle) || containsAppName(handle, appName);
+}
+
+/**
+ * A free handle on `handle`'s base: "superuser" -> "superuser-4821". Same
+ * digit widening as generate_handle (core/009). `isFree` checks the table.
+ */
+export async function suggestHandle(
+  handle: string,
+  isFree: (candidate: string) => Promise<boolean>,
+): Promise<string | null> {
+  const base = handle.replace(/-[0-9]+$/, "").slice(0, 15) || "user";
+  for (let tries = 0; tries < 10; tries++) {
+    const digits =
+      tries < 5
+        ? Math.floor(Math.random() * 9000) + 1000
+        : Math.floor(Math.random() * 900000) + 100000;
+    const candidate = `${base}-${digits}`;
+    if (await isFree(candidate)) return candidate;
+  }
+  return null;
+}

package/templates/functions/_shared/translation.ts

@@ -68,6 +68,11 @@ export type ParsedTranslation = {
   translations: Record<string, { content: string; options: string[] }>;
 };
 
+/** Image-only items store content = "": nothing to translate, never sent to OpenAI. */
+export function hasTranslatableContent(content: string): boolean {
+  return content.trim().length > 0;
+}
+
 export function languageOf(locale: string): string {
   return locale.split("-")[0].toLowerCase();
 }
@@ -395,6 +400,7 @@ export async function ensureTranslations(
     return null;
   }
   if (!row || row.status !== "visible") return [];
+  if (!hasTranslatableContent(row.content)) return [];
 
   const { data: existing, error: existingError } = await supabase
     .from(tTable)

package/templates/functions/broadcast-post/index.ts

@@ -5,6 +5,7 @@
 // verify_jwt but must NOT be able to trigger a broadcast.
 
 import { adminClient, fetchAllRows, isServiceCaller } from "../_shared/client.ts";
+import { excerptOrPhoto, pushCopy } from "../_shared/copy.ts";
 import { sendExpoPushBatch } from "../_shared/push.ts";
 import { BROADCAST_FALLBACK_TITLE } from "../_shared/config.ts";
 import { ensureTranslations, resolveTargetLocale, TARGET_LOCALES } from "../_shared/translation.ts";
@@ -33,17 +34,17 @@ Deno.serve(async (req) => {
     .single();
   const title = author?.username?.trim() || BROADCAST_FALLBACK_TITLE;
 
-  const original = post.content.length > 140 ? `${post.content.slice(0, 137)}...` : post.content;
   // waitMs: when translate-one holds the claim (it fires on the same insert),
   // wait for its rows instead of pushing the source language.
   const translations =
     TARGET_LOCALES.length === 0
       ? []
       : ((await ensureTranslations(supabase, "post", post.id, { waitMs: 20_000 })) ?? []);
-  const excerptFor = (locale: string | null): string => {
-    if (!locale) return original;
-    const t = translations.find((r) => r.locale === locale);
-    return t ? (t.content.length > 140 ? `${t.content.slice(0, 137)}...` : t.content) : original;
+  // `profileLocale` picks the "Photo" label for an image-only post (empty
+  // content has no translations); `locale` is the resolved translation target.
+  const excerptFor = (locale: string | null, profileLocale: string | null): string => {
+    const t = locale ? translations.find((r) => r.locale === locale) : undefined;
+    return excerptOrPhoto(t?.content ?? post.content, pushCopy(profileLocale).text("photo"));
   };
 
   // Paged (PostgREST max_rows caps a single select, default 1000) with a total
@@ -66,6 +67,7 @@ Deno.serve(async (req) => {
       const profile = Array.isArray(r.profiles) ? r.profiles[0] : r.profiles;
       return {
         to: r.expo_push_token as string,
+        profileLocale: (profile?.locale ?? null) as string | null,
         locale: resolveTargetLocale(profile?.locale ?? null),
       };
     })
@@ -75,10 +77,10 @@ Deno.serve(async (req) => {
       seen.add(m.to);
       return true;
     })
-    .map(({ to, locale }) => ({
+    .map(({ to, locale, profileLocale }) => ({
       to,
       title,
-      body: excerptFor(locale),
+      body: excerptFor(locale, profileLocale),
       data: { route: "/community", kind: "community_official_post" },
       badge: 1,
     }));

package/templates/functions/daily-moderation/index.ts

@@ -3,7 +3,8 @@
 // 'pending' -> promote to 'visible' (catches items whose synchronous
 // moderate-one call failed), clean 'visible' -> just stamp. Also sweeps
 // not-yet-checked usernames (profiles.username is client-writable, see
-// core/007_username_moderation.sql): flagged -> blanked. Posts a Slack
+// core/007_username_moderation.sql): flagged or containing the app's name ->
+// blanked, i.e. back to the default name (core/009). Posts a Slack
 // summary when there was something to check (no-op if SLACK_WEBHOOK_URL is
 // unset — see _shared/slack.ts). Never deletes rows. App criticism is not a
 // category (stays visible).
@@ -16,8 +17,11 @@ import { adminClient } from "../_shared/client.ts";
 import {
   assertModerationConfigured,
   flaggedCategories,
+  moderateItem,
   type ModerationResult,
 } from "../_shared/moderation.ts";
+import { fetchImagePaths, POST_IMAGES_BUCKET, postImageUrl } from "../_shared/images.ts";
+import { containsAppName } from "../_shared/names.ts";
 import { postToSlack } from "../_shared/slack.ts";
 
 assertModerationConfigured();
@@ -29,6 +33,9 @@ interface Item {
   content: string;
   author_id: string;
   status: string;
+  imagePath: string | null;
+  // The image_path lookup errored: not moderated (nor stamped/promoted) this run.
+  imageLookupFailed: boolean;
   profiles: {
     username: string | null;
     amplitude_id: string | null;
@@ -104,6 +111,7 @@ async function sweepUsernames(): Promise<{
     }
     results.forEach((r, idx) => {
       const cats = flaggedCategories(r);
+      if (containsAppName(batch[idx].username)) cats.push("app_name");
       if (cats.length > 0) blanked.push({ profile: batch[idx], categories: cats });
     });
     processed.push(...batch);
@@ -126,6 +134,24 @@ async function sweepUsernames(): Promise<{
   return { checked: processed.length, blanked, failedBatches, skipped: false };
 }
 
+/** Deletes storage objects no live post/comment references (abandoned uploads,
+ * deleted authors' files), capped per run. Skipped silently without the images
+ * module (the RPC doesn't exist). Returns how many files were removed, and the
+ * storage error when the removal failed (surfaced in the Slack summary). */
+async function sweepUnreferencedImages(): Promise<{ removed: number; error?: string }> {
+  const { data, error } = await supabase.rpc("post_images_unreferenced", { p_limit: 500 });
+  const names = (data ?? []) as string[];
+  if (error || names.length === 0) return { removed: 0 };
+  const { data: removed, error: removeError } = await supabase.storage
+    .from(POST_IMAGES_BUCKET)
+    .remove(names);
+  if (removeError) {
+    console.error("image sweep: remove failed", removeError.message);
+    return { removed: 0, error: removeError.message };
+  }
+  return { removed: removed?.length ?? 0 };
+}
+
 Deno.serve(async () => {
   const { data: posts, error: postsError } = await supabase
     .from("posts")
@@ -167,9 +193,21 @@ Deno.serve(async () => {
       }
     }
   }
+  const postImages = await fetchImagePaths(
+    supabase,
+    "posts",
+    (posts ?? []).map((p) => p.id),
+  );
+  const commentImages = await fetchImagePaths(
+    supabase,
+    "comments",
+    (comments ?? []).map((c) => c.id),
+  );
   const items: Item[] = [
     ...(posts ?? []).map((p) => ({
       ...p,
+      imagePath: postImages.paths.get(p.id) ?? null,
+      imageLookupFailed: postImages.failedIds.has(p.id),
       profiles: toOne(p.profiles),
       content: [
         p.content,
@@ -179,6 +217,8 @@ Deno.serve(async () => {
     })),
     ...(comments ?? []).map((c) => ({
       ...c,
+      imagePath: commentImages.paths.get(c.id) ?? null,
+      imageLookupFailed: commentImages.failedIds.has(c.id),
       profiles: toOne(c.profiles),
       table: "comments" as const,
     })),
@@ -189,8 +229,10 @@ Deno.serve(async () => {
   const flagged: { item: Item; categories: string[] }[] = [];
   const processed: Item[] = [];
   let failedBatches = 0;
-  for (let i = 0; i < items.length; i += 100) {
-    const batch = items.slice(i, i + 100);
+  const textItems = items.filter((it) => !it.imagePath && !it.imageLookupFailed);
+  if (items.some((it) => it.imageLookupFailed)) failedBatches++;
+  for (let i = 0; i < textItems.length; i += 100) {
+    const batch = textItems.slice(i, i + 100);
     const results = await moderateBatch(batch.map((it) => it.content));
     if (!results) {
       failedBatches++; // API/network error; skip stamping, retried next run
@@ -202,13 +244,35 @@ Deno.serve(async () => {
     });
     processed.push(...batch);
   }
+  // Items with an image go one by one (text + image calls); a failed one
+  // counts as a failed batch: not stamped, retried next run.
+  for (const item of items.filter((it) => it.imagePath)) {
+    const verdict = await moderateItem(item.content, postImageUrl(item.imagePath!));
+    if (!verdict) {
+      failedBatches++;
+      continue;
+    }
+    if (verdict.flagged) flagged.push({ item, categories: verdict.categories });
+    processed.push(item);
+  }
   const totalItems = items.length;
 
   const flaggedIds = new Set(flagged.map((f) => f.item.id));
   // Status guards: a row the author soft-deleted while the sweep ran must not
   // be resurrected as hidden/visible, so every write re-checks the status it
   // was selected with.
+  const imageErrors: string[] = [];
   for (const { item, categories } of flagged) {
+    // Child-safety hit: the file goes now. Any other hide keeps it.
+    if (item.imagePath && categories.includes("sexual/minors")) {
+      const { error } = await supabase.storage.from(POST_IMAGES_BUCKET).remove([item.imagePath]);
+      if (error) {
+        console.error("sexual/minors image not deleted", item.imagePath, error.message);
+        imageErrors.push(
+          `sexual/minors image \`${item.imagePath}\` NOT deleted (${error.message}), remove it by hand`,
+        );
+      }
+    }
     await supabase
       .from(item.table)
       .update({ status: "hidden", moderation_reason: categories.join(",") })
@@ -245,11 +309,20 @@ Deno.serve(async () => {
   }
 
   const usernames = await sweepUsernames();
+  const sweep = await sweepUnreferencedImages();
+  const imagesSwept = sweep.removed;
+  if (sweep.error) imageErrors.push(`image sweep failed: ${sweep.error}`);
   const allFailedBatches = failedBatches + usernames.failedBatches;
 
   // Quiet when there was nothing to check at all (a stray or duplicate call
   // finds every item already stamped): no Slack noise, no API cost.
-  if (totalItems === 0 && usernames.checked === 0 && allFailedBatches === 0) {
+  if (
+    totalItems === 0 &&
+    usernames.checked === 0 &&
+    allFailedBatches === 0 &&
+    imagesSwept === 0 &&
+    imageErrors.length === 0
+  ) {
     return new Response(
       JSON.stringify({
         checked: 0,
@@ -278,20 +351,24 @@ Deno.serve(async () => {
     usernames.checked > 0
       ? ` Usernames: ${usernames.blanked.length}/${usernames.checked} blanked.`
       : "";
+  const sweepSummary = imagesSwept > 0 ? ` Images swept: ${imagesSwept}.` : "";
   let summaryText: string;
   if (allFailedBatches > 0) {
     const uncheckedCount = totalItems - processed.length;
     summaryText =
       `Daily moderation: WARNING, ${allFailedBatches} batch(es) failed to reach the moderation API ` +
       `(${uncheckedCount} of ${totalItems} items were not checked and will be retried). ` +
-      `${flagged.length} items hidden.${usernameSummary}`;
+      `${flagged.length} items hidden.${usernameSummary}${sweepSummary}`;
   } else if (flagged.length === 0 && usernames.blanked.length === 0) {
-    summaryText = `Daily moderation: ${processed.length} items checked, nothing to report.${usernameSummary}`;
+    summaryText = `Daily moderation: ${processed.length} items checked, nothing to report.${usernameSummary}${sweepSummary}`;
   } else {
     summaryText =
-      `Daily moderation: ${flagged.length}/${processed.length} items hidden.${usernameSummary}\n\n` +
+      `Daily moderation: ${flagged.length}/${processed.length} items hidden.${usernameSummary}${sweepSummary}\n\n` +
       [...lines, ...usernameLines].join("\n");
   }
+  if (imageErrors.length > 0) {
+    summaryText += `\n\n${imageErrors.map((e) => `* WARNING: ${e}`).join("\n")}`;
+  }
   await postToSlack({ text: summaryText });
 
   return new Response(

package/templates/functions/moderate-one/index.ts

@@ -11,7 +11,9 @@
 // resurrected.
 
 import { adminClient, callerUserId, isServiceCaller, json } from "../_shared/client.ts";
-import { assertModerationConfigured, moderateInput } from "../_shared/moderation.ts";
+import { fetchImagePath, POST_IMAGES_BUCKET, postImageUrl } from "../_shared/images.ts";
+import { assertModerationConfigured, moderateItem } from "../_shared/moderation.ts";
+import { postToSlack } from "../_shared/slack.ts";
 
 assertModerationConfigured();
 
@@ -60,7 +62,13 @@ Deno.serve(async (req) => {
     }
   }
 
-  const verdict = await moderateInput(input);
+  // Optional images module: no column = text-only, as before. Any other
+  // lookup error fails closed (an unchecked image must never be published).
+  const image = await fetchImagePath(supabase, table, id);
+  if (!image.ok) return json({ status: "pending", error: "image lookup failed" });
+  const imagePath = image.path;
+
+  const verdict = await moderateItem(input, imagePath ? postImageUrl(imagePath) : null);
   if (!verdict) {
     // Fail closed: leave pending, let the client retry / the daily sweep catch it.
     return json({ status: "pending", error: "moderation unavailable" });
@@ -68,6 +76,17 @@ Deno.serve(async (req) => {
 
   const now = new Date().toISOString();
   if (verdict.flagged) {
+    // Child-safety hit: the file goes now. Any other hide keeps it.
+    if (imagePath && verdict.categories.includes("sexual/minors")) {
+      const { error } = await supabase.storage.from(POST_IMAGES_BUCKET).remove([imagePath]);
+      if (error) {
+        console.error("sexual/minors image not deleted", imagePath, error.message);
+        // The row is hidden below; the file stays public until removed by hand.
+        await postToSlack({
+          text: `Moderation: sexual/minors image \`${imagePath}\` (${kind} ${id}) NOT deleted (${error.message}), remove it by hand.`,
+        }).catch((e) => console.error("slack alert failed", e));
+      }
+    }
     await supabase
       .from(table)
       .update({ status: "hidden", moderation_reason: verdict.reason, moderated_at: now })

package/templates/functions/notify-comment/index.ts

@@ -9,7 +9,7 @@
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush, unreadBadge } from "../_shared/push.ts";
-import { pushCopy } from "../_shared/copy.ts";
+import { excerptOrPhoto, pushCopy } from "../_shared/copy.ts";
 import { ensureTranslations, resolveTargetLocale, languageOf } from "../_shared/translation.ts";
 
 const supabase = adminClient();
@@ -74,10 +74,12 @@ Deno.serve(async (req) => {
     );
     if (match) excerptSource = match.content;
   }
-  const excerpt = excerptSource.length > 140 ? `${excerptSource.slice(0, 137)}...` : excerptSource;
   // Title states the event; body is the commenter's name then the comment in
-  // quotes, e.g.  Marie: "So happy for you!".
-  const body = `${name}: "${excerpt}"`;
+  // quotes, e.g.  Marie: "So happy for you!". An image-only comment has no text:
+  // the localized "Photo" label stands in, unquoted.
+  const body = comment.content.trim()
+    ? `${name}: "${excerptOrPhoto(excerptSource, "")}"`
+    : `${name}: ${copy.text("photo")}`;
 
   await sendExpoPush({
     to: pref.expo_push_token,

package/templates/functions/report-to-slack/index.ts

@@ -8,6 +8,7 @@
 // into the ops channel or probe another user's report count).
 
 import { adminClient } from "../_shared/client.ts";
+import { fetchImagePath, postImageUrl } from "../_shared/images.ts";
 import { postToSlack } from "../_shared/slack.ts";
 
 const supabase = adminClient();
@@ -18,7 +19,7 @@ Deno.serve(async (req) => {
 
   const { data: report } = await supabase
     .from("reports")
-    .select("id, reported_user_id, reason, details")
+    .select("id, reported_user_id, post_id, comment_id, reason, details")
     .eq("id", record.id)
     .single();
   if (!report) return new Response("skip: unknown report");
@@ -33,10 +34,21 @@ Deno.serve(async (req) => {
     .select("*", { count: "exact", head: true })
     .eq("reported_user_id", report.reported_user_id);
 
+  // The reported item's image, when it has one. A failed lookup only drops the
+  // line: an alert must never be blocked by it.
+  const target = report.comment_id
+    ? ({ table: "comments", id: report.comment_id } as const)
+    : report.post_id
+      ? ({ table: "posts", id: report.post_id } as const)
+      : null;
+  const image = target ? await fetchImagePath(supabase, target.table, target.id) : null;
+  const imageLine = image?.ok && image.path ? `Image: ${postImageUrl(image.path)}\n` : "";
+
   await postToSlack({
     text:
       `:rotating_light: Report (*${report.reason}*) against *${reported?.username ?? report.reported_user_id}*, ${count ?? "?"} report(s) total\n` +
       `${report.details ? `> ${report.details}\n` : ""}` +
+      imageLine +
       `amplitude: \`${reported?.amplitude_id ?? "?"}\` | revenuecat: \`${reported?.revenuecat_id ?? "?"}\``,
   });
   return new Response("ok");

package/templates/functions/update-profile/index.ts

@@ -11,6 +11,7 @@
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { adminClient, json, SUPABASE_URL } from "../_shared/client.ts";
 import { assertModerationConfigured, moderateInput } from "../_shared/moderation.ts";
+import { containsAppName, isReservedHandle, suggestHandle } from "../_shared/names.ts";
 
 assertModerationConfigured();
 
@@ -54,12 +55,17 @@ Deno.serve(async (req) => {
     if (u.length < 2 || u.length > 24) {
       return json({ status: "error", error: "invalid_username" }, 400);
     }
+    if (containsAppName(u)) return json({ status: "error", error: "reserved_name" }, 400);
     const verdict = await moderateInput(u);
     if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
     if (verdict.flagged) {
       return json({ status: "rejected", field: "username", reason: verdict.reason });
     }
-    const { error } = await admin.from("profiles").update({ username: u }).eq("id", uid);
+    // The user's own name: the host app's sync no longer overwrites it (core/009).
+    const { error } = await admin
+      .from("profiles")
+      .update({ username: u, username_set_by_user: true })
+      .eq("id", uid);
     if (error) return json({ status: "error", error: error.message }, 500);
   }
 
@@ -69,15 +75,26 @@ Deno.serve(async (req) => {
     if (!/^[a-z0-9-]{3,20}$/.test(h)) {
       return json({ status: "error", error: "invalid_handle" }, 400);
     }
+    if (isReservedHandle(h)) return json({ status: "error", error: "reserved_handle" }, 400);
     const verdict = await moderateInput(h);
     if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
     if (verdict.flagged) {
       return json({ status: "rejected", field: "handle", reason: verdict.reason });
     }
-    const { error } = await admin.from("profiles").update({ handle: h }).eq("id", uid);
+    const { error } = await admin
+      .from("profiles")
+      .update({ handle: h, handle_set_by_user: true })
+      .eq("id", uid);
     if (error) {
       if (error.code === "23505") {
-        return json({ status: "error", code: "handle_taken" }, 409);
+        const suggestion = await suggestHandle(h, async (candidate) => {
+          const { count } = await admin
+            .from("profiles")
+            .select("id", { count: "exact", head: true })
+            .eq("handle", candidate);
+          return count === 0;
+        });
+        return json({ status: "error", code: "handle_taken", suggestion }, 409);
       }
       return json({ status: "error", error: error.message }, 500);
     }
@@ -111,7 +128,9 @@ Deno.serve(async (req) => {
       return json({ status: "error", error: "forbidden_path" }, 403);
     }
     const publicUrl = `${SUPABASE_URL}/storage/v1/object/public/avatars/${path}`;
-    const verdict = await moderateInput([{ type: "image_url", image_url: { url: publicUrl } }]);
+    const verdict = await moderateInput([{ type: "image_url", image_url: { url: publicUrl } }], {
+      strict: true,
+    });
     if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
     if (verdict.flagged) {
       await admin.storage.from("avatars").remove([path]);

package/templates/migrations/core/009_default_names.sql

@@ -0,0 +1,199 @@
+-- community-sdk core/009_default_names.sql
+-- Default names: every profile gets "<label> <digits>" / "<prefix>-<digits>"
+-- (assign_default_profile, called by the client once per launch). The host
+-- app's name seeds the profile until the user edits it through update-profile;
+-- from then on a client write of `username` is ignored (the user wins). See
+-- docs/superpowers/specs/2026-10-26-default-names-design.md.
+
+alter table public.profiles
+  add column if not exists default_username text,
+  add column if not exists default_handle text,
+  add column if not exists username_set_by_user boolean not null default false,
+  add column if not exists handle_set_by_user boolean not null default false;
+
+-- generate_handle with the slug to use when `base` has no usable letters
+-- (a Korean or emoji-only name): the app's handle prefix instead of "member".
+create or replace function public.generate_handle(base text, fallback text)
+returns text
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  slug text;
+  candidate text;
+  tries int := 0;
+begin
+  slug := left(regexp_replace(lower(unaccent(coalesce(base, ''))), '[^a-z0-9]', '', 'g'), 12);
+  if slug = '' then
+    slug := left(regexp_replace(lower(coalesce(fallback, '')), '[^a-z0-9]', '', 'g'), 12);
+  end if;
+  if slug = '' then
+    slug := 'member';
+  end if;
+  loop
+    if tries < 5 then
+      candidate := slug || '-' || (floor(random() * 9000) + 1000)::int;
+    else
+      candidate := slug || '-' || (floor(random() * 900000) + 100000)::int;
+    end if;
+    exit when not exists (select 1 from public.profiles where handle = candidate);
+    tries := tries + 1;
+  end loop;
+  return candidate;
+end;
+$$;
+
+create or replace function public.generate_handle(base text)
+returns text
+language sql volatile security definer
+set search_path = public, extensions
+as $$ select public.generate_handle(base, 'member') $$;
+
+-- The default handle when it is still free, else a fresh one on its prefix.
+create or replace function public.default_handle_for(p_id uuid, p_default text)
+returns text
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+begin
+  if p_default is null then
+    return null;
+  end if;
+  if not exists (select 1 from public.profiles where handle = p_default and id <> p_id) then
+    return p_default;
+  end if;
+  return public.generate_handle('', regexp_replace(p_default, '-[0-9]+$', ''));
+end;
+$$;
+
+-- One trigger owns username + handle consistency (replaces core/001's
+-- assign_handle and core/007's profiles_username_changed, whose relative order
+-- mattered). "Trusted" writes are update-profile (service role) and this
+-- file's security definer functions (they set community.trusted).
+create or replace function public.profiles_names()
+returns trigger
+language plpgsql security definer
+set search_path = public, extensions
+as $$
+declare
+  trusted boolean := coalesce(auth.role(), '') = 'service_role'
+    or coalesce(current_setting('community.trusted', true), '') = 'on';
+  prefix text;
+begin
+  if tg_op = 'UPDATE' and new.username is distinct from old.username then
+    if not trusted and old.username_set_by_user then
+      -- Host sync after the user picked their own name: the user wins.
+      new.username := old.username;
+    elsif new.username is null
+      or (new.username = old.username_rejected and not trusted) then
+      -- Blanked (moderation sweep, old clients, account scrub) or a re-sync of
+      -- a name the sweep already blanked: back to the default name.
+      new.username := old.default_username;
+      new.username_checked_at := now();
+    elsif new.username is not distinct from new.default_username then
+      new.username_checked_at := now();
+    else
+      -- A genuinely new name: re-check it on the next sweep.
+      new.username_checked_at := null;
+    end if;
+  end if;
+
+  if new.username is not null and new.handle is null then
+    new.handle := public.generate_handle(new.username,
+      regexp_replace(coalesce(new.default_handle, ''), '-[0-9]+$', ''));
+  elsif tg_op = 'UPDATE'
+    and not new.handle_set_by_user
+    and not new.username_set_by_user
+    and new.username is distinct from old.username
+    and new.handle is not distinct from old.handle then
+    -- The host's name changed (or the sweep blanked it) and the user never
+    -- picked a handle: follow it.
+    if new.username is not distinct from new.default_username then
+      new.handle := coalesce(public.default_handle_for(new.id, new.default_handle), new.handle);
+    else
+      prefix := regexp_replace(coalesce(new.default_handle, ''), '-[0-9]+$', '');
+      new.handle := public.generate_handle(new.username, prefix);
+    end if;
+  end if;
+  return new;
+end;
+$$;
+
+drop trigger if exists profiles_assign_handle on public.profiles;
+drop trigger if exists profiles_username_changed_trg on public.profiles;
+drop function if exists public.assign_handle();
+drop function if exists public.profiles_username_changed();
+
+create trigger profiles_names_trg
+  before insert or update of username, handle on public.profiles
+  for each row execute function public.profiles_names();
+
+-- Called by the client once per launch; idempotent. `p_label` is the app's
+-- default name in the user's language ("Frère"), `p_handle` its ASCII handle
+-- prefix ("brother"). Fills username / handle only when still null.
+create or replace function public.assign_default_profile(p_label text, p_handle text)
+returns void
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  uid uuid := auth.uid();
+  label text := left(btrim(coalesce(p_label, '')), 17);
+  h text;
+  name text;
+begin
+  if uid is null then
+    return;
+  end if;
+  if exists (select 1 from public.profiles where id = uid and default_username is not null) then
+    return;
+  end if;
+  if label = '' then
+    label := 'User';
+  end if;
+  h := public.generate_handle('', coalesce(nullif(p_handle, ''), 'user'));
+  name := label || ' ' || substring(h from '-([0-9]+)$');
+  perform set_config('community.trusted', 'on', true);
+  update public.profiles
+     set default_username = name,
+         default_handle = h,
+         username = coalesce(username, name),
+         handle = coalesce(handle, h)
+   where id = uid;
+  perform set_config('community.trusted', '', true);
+end;
+$$;
+
+-- Account deletion: default name and handle back, bio / avatar / edits cleared.
+create or replace function public.reset_profile_identity()
+returns void
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  uid uuid := auth.uid();
+begin
+  if uid is null then
+    return;
+  end if;
+  perform set_config('community.trusted', 'on', true);
+  update public.profiles
+     set username = default_username,
+         handle = coalesce(public.default_handle_for(id, default_handle), handle),
+         username_set_by_user = false,
+         handle_set_by_user = false,
+         bio = null,
+         avatar_url = null
+   where id = uid;
+  perform set_config('community.trusted', '', true);
+end;
+$$;
+
+revoke execute on function public.generate_handle(text, text) from public, anon, authenticated;
+revoke execute on function public.generate_handle(text) from public, anon, authenticated;
+revoke execute on function public.default_handle_for(uuid, text) from public, anon, authenticated;
+revoke execute on function public.profiles_names() from public, anon, authenticated;
+revoke execute on function public.assign_default_profile(text, text) from public, anon;
+revoke execute on function public.reset_profile_identity() from public, anon;
+grant execute on function public.assign_default_profile(text, text) to authenticated;
+grant execute on function public.reset_profile_identity() to authenticated;

package/templates/migrations/images/001_images.sql

@@ -0,0 +1,119 @@
+-- community-sdk images/001_images.sql (schema v1)
+-- Images module: one optional image per post and per comment.
+-- Columns hold the Storage object name in the public `post-images` bucket
+-- ({uid}/{uuid}.jpg) plus the dimensions the client needs to lay the frame out
+-- before the bytes arrive. Public read (plain public object URLs), 2MB cap,
+-- JPEG only (the client re-encodes on device, which also strips EXIF/GPS).
+-- Unlike avatars, a hidden item KEEPS its file; the daily sweep removes only
+-- objects no live (status <> 'deleted') row references, via
+-- post_images_unreferenced() below. Fully idempotent.
+
+-- ============ COLUMNS ============
+alter table public.posts
+  add column if not exists image_path text,
+  add column if not exists image_width int,
+  add column if not exists image_height int;
+alter table public.comments
+  add column if not exists image_path text,
+  add column if not exists image_width int,
+  add column if not exists image_height int;
+
+-- Dimensions are set iff the path is set, and positive.
+alter table public.posts drop constraint if exists posts_image_check;
+alter table public.posts add constraint posts_image_check check (
+  (image_path is null and image_width is null and image_height is null)
+  or (image_path is not null and image_width > 0 and image_height > 0)
+);
+alter table public.comments drop constraint if exists comments_image_check;
+alter table public.comments add constraint comments_image_check check (
+  (image_path is null and image_width is null and image_height is null)
+  or (image_path is not null and image_width > 0 and image_height > 0)
+);
+
+-- The path is `{uid}/{name}.jpg` (name: a uuid, or the client's
+-- `{Date.now()}-{base36}` fallback when crypto.randomUUID is missing), so a
+-- crafted insert can't point at another bucket path or a non-JPEG name.
+alter table public.posts drop constraint if exists posts_image_path_format;
+alter table public.posts add constraint posts_image_path_format check (
+  image_path is null or image_path ~ '^[0-9a-f-]{36}/[A-Za-z0-9_-]+\.jpg$'
+);
+alter table public.comments drop constraint if exists comments_image_path_format;
+alter table public.comments add constraint comments_image_path_format check (
+  image_path is null or image_path ~ '^[0-9a-f-]{36}/[A-Za-z0-9_-]+\.jpg$'
+);
+
+-- Text becomes optional when an image is present (image-only items store '').
+-- core/001_tables.sql leaves the inline check auto-named <table>_content_check.
+alter table public.posts drop constraint if exists posts_content_check;
+alter table public.posts add constraint posts_content_check check (
+  char_length(content) <= 2000 and (char_length(content) >= 1 or image_path is not null)
+);
+alter table public.comments drop constraint if exists comments_content_check;
+alter table public.comments add constraint comments_content_check check (
+  char_length(content) <= 1000 and (char_length(content) >= 1 or image_path is not null)
+);
+
+-- ============ CLIENT WRITE ACCESS ============
+-- Both tables use column-scoped insert grants (core/002_rls.sql); extend them.
+grant insert (image_path, image_width, image_height) on table public.posts to authenticated;
+grant insert (image_path, image_width, image_height) on table public.comments to authenticated;
+
+-- Restrictive: ANDed with the existing permissive insert policies, so an image
+-- can only point into the author's own storage folder.
+drop policy if exists "post image in own folder" on public.posts;
+create policy "post image in own folder"
+  on public.posts as restrictive for insert to authenticated
+  with check (
+    image_path is null or (storage.foldername(image_path))[1] = auth.uid()::text
+  );
+drop policy if exists "comment image in own folder" on public.comments;
+create policy "comment image in own folder"
+  on public.comments as restrictive for insert to authenticated
+  with check (
+    image_path is null or (storage.foldername(image_path))[1] = auth.uid()::text
+  );
+
+-- ============ STORAGE ============
+insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+  values ('post-images', 'post-images', true, 2097152, array['image/jpeg'])
+  on conflict (id) do nothing;
+
+-- Clients may only CREATE objects inside their own folder. No UPDATE/DELETE
+-- policies: removal is done by the Edge Functions with the service role.
+drop policy if exists "post image upload to own folder" on storage.objects;
+create policy "post image upload to own folder"
+  on storage.objects for insert to authenticated
+  with check (
+    bucket_id = 'post-images'
+    and (storage.foldername(name))[1] = auth.uid()::text
+  );
+
+-- ============ SWEEP ============
+-- Object names older than 24h that no live post/comment references: abandoned
+-- uploads, plus files of deleted items. Hidden items stay referenced (file
+-- kept). Service role only (called by daily-moderation).
+create or replace function public.post_images_unreferenced(p_limit int default 500)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select o.name
+  from storage.objects o
+  where o.bucket_id = 'post-images'
+    and o.created_at < now() - interval '24 hours'
+    and not exists (
+      select 1 from public.posts p
+      where p.image_path = o.name and p.status <> 'deleted'
+    )
+    and not exists (
+      select 1 from public.comments c
+      where c.image_path = o.name and c.status <> 'deleted'
+    )
+  order by o.created_at
+  limit p_limit;
+$$;
+
+revoke all on function public.post_images_unreferenced(int) from public, anon, authenticated;
+grant execute on function public.post_images_unreferenced(int) to service_role;

package/templates/migrations/translation/003_skip_empty.sql

@@ -0,0 +1,48 @@
+-- community-sdk translation/003_skip_empty.sql (schema v1)
+-- Image-only posts and comments (images module) store content = '': there is
+-- nothing to translate, so ensureTranslations writes no row for them, and the
+-- sweep helper below would re-pick them on every daily run (filling its
+-- newest-first window and keeping the chain going). Same function as
+-- 001_translations.sql with `content <> ''` added to both inner selects.
+-- Idempotent (create or replace); service role only, as before.
+create or replace function public.items_missing_translations(
+  kind text, target_locales text[], max_items int
+) returns table (id uuid)
+language sql stable security definer set search_path = public as $$
+  select x.id from (
+    select p.id, p.created_at,
+      exists (select 1 from public.post_translations t where t.post_id = p.id) as has_any,
+      (select array_agg(t.locale) filter (where t.locale not in ('source', 'attempt'))
+         from public.post_translations t where t.post_id = p.id) as have,
+      (select min(t.source_locale) filter (where t.locale <> 'attempt')
+         from public.post_translations t where t.post_id = p.id) as src,
+      exists (select 1 from public.post_translations t
+               where t.post_id = p.id and t.locale = 'attempt'
+                 and t.created_at > now() - interval '6 hours') as fresh_attempt
+    from public.posts p where kind = 'post' and p.status = 'visible' and p.content <> ''
+    union all
+    select c.id, c.created_at,
+      exists (select 1 from public.comment_translations t where t.comment_id = c.id) as has_any,
+      (select array_agg(t.locale) filter (where t.locale not in ('source', 'attempt'))
+         from public.comment_translations t where t.comment_id = c.id) as have,
+      (select min(t.source_locale) filter (where t.locale <> 'attempt')
+         from public.comment_translations t where t.comment_id = c.id) as src,
+      exists (select 1 from public.comment_translations t
+               where t.comment_id = c.id and t.locale = 'attempt'
+                 and t.created_at > now() - interval '6 hours') as fresh_attempt
+    from public.comments c where kind = 'comment' and c.status = 'visible' and c.content <> ''
+  ) x
+  where not x.fresh_attempt
+    and (not x.has_any
+      or exists (
+        select 1 from unnest(target_locales) l
+        -- `is distinct from`: src is null when the only row is a stale attempt
+        -- (a failed try), and that item must be retried.
+        where split_part(l, '-', 1) is distinct from x.src
+          and not (l = any (coalesce(x.have, '{}')))
+      ))
+  order by x.created_at desc
+  limit max_items
+$$;
+revoke execute on function public.items_missing_translations(text, text[], int) from public, anon, authenticated;
+grant execute on function public.items_missing_translations(text, text[], int) to service_role;