@rocapine/community 0.2.0 → 0.3.2

package/templates/functions/daily-moderation/index.ts

@@ -1,9 +1,16 @@
 // Daily moderation batch + backstop. Runs every not-yet-moderated post/comment
 // through OpenAI's moderation endpoint (free): flagged -> soft-hide, clean
 // 'pending' -> promote to 'visible' (catches items whose synchronous
-// moderate-one call failed), clean 'visible' -> just stamp. Posts a Slack
-// summary (no-op if SLACK_WEBHOOK_URL is unset — see _shared/slack.ts). Never
-// deletes rows. App criticism is not a category (stays visible).
+// moderate-one call failed), clean 'visible' -> just stamp. Also sweeps
+// not-yet-checked usernames (profiles.username is client-writable, see
+// core/007_username_moderation.sql): flagged -> blanked. Posts a Slack
+// summary when there was something to check (no-op if SLACK_WEBHOOK_URL is
+// unset — see _shared/slack.ts). Never deletes rows. App criticism is not a
+// category (stays visible).
+//
+// Reachable with the anon key (the cron calls it that way) and idempotent:
+// once a sweep has stamped its items, a stray call finds nothing to check and
+// exits without an API call or a Slack post.
 
 import { adminClient } from "../_shared/client.ts";
 import {
@@ -37,6 +44,88 @@ function toOne<T>(v: T | T[] | null | undefined): T | null {
   return Array.isArray(v) ? (v[0] ?? null) : (v ?? null);
 }
 
+/** One OpenAI moderation call for up to 100 inputs; null on any failure so
+ * the caller can skip stamping and retry next run. */
+async function moderateBatch(inputs: string[]): Promise<ModerationResult[] | null> {
+  try {
+    const res = await fetch("https://api.openai.com/v1/moderations", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${Deno.env.get("OPENAI_API_KEY")}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ model: "omni-moderation-latest", input: inputs }),
+    });
+    if (!res.ok) return null;
+    const { results } = await res.json();
+    return results as ModerationResult[];
+  } catch {
+    return null;
+  }
+}
+
+interface ProfileItem {
+  id: string;
+  username: string;
+  amplitude_id: string | null;
+  revenuecat_id: string | null;
+}
+
+/**
+ * Username sweep (core/007): moderate every not-yet-checked username, blank
+ * the flagged ones (remembering the value in `username_rejected` so a client
+ * re-sync keeps it blank) and stamp the rest. Capped per run so the first
+ * sweep after the migration stays within the function's time budget. On an
+ * install without core/007 the select errors and the sweep is skipped.
+ */
+async function sweepUsernames(): Promise<{
+  checked: number;
+  blanked: { profile: ProfileItem; categories: string[] }[];
+  failedBatches: number;
+  skipped: boolean;
+}> {
+  const { data, error } = await supabase
+    .from("profiles")
+    .select("id, username, amplitude_id, revenuecat_id")
+    .not("username", "is", null)
+    .is("username_checked_at", null)
+    .limit(1000);
+  if (error) return { checked: 0, blanked: [], failedBatches: 0, skipped: true };
+  const profiles = (data ?? []) as ProfileItem[];
+  const blanked: { profile: ProfileItem; categories: string[] }[] = [];
+  const processed: ProfileItem[] = [];
+  let failedBatches = 0;
+  for (let i = 0; i < profiles.length; i += 100) {
+    const batch = profiles.slice(i, i + 100);
+    const results = await moderateBatch(batch.map((p) => p.username));
+    if (!results) {
+      failedBatches++;
+      continue;
+    }
+    results.forEach((r, idx) => {
+      const cats = flaggedCategories(r);
+      if (cats.length > 0) blanked.push({ profile: batch[idx], categories: cats });
+    });
+    processed.push(...batch);
+  }
+  const now = new Date().toISOString();
+  for (const { profile } of blanked) {
+    // Guarded on the current value: a name changed since the select is left
+    // for the next sweep (the change trigger reset its checked_at anyway).
+    await supabase
+      .from("profiles")
+      .update({ username: null, username_rejected: profile.username, username_checked_at: now })
+      .eq("id", profile.id)
+      .eq("username", profile.username);
+  }
+  const blankedIds = new Set(blanked.map((b) => b.profile.id));
+  const cleanIds = processed.filter((p) => !blankedIds.has(p.id)).map((p) => p.id);
+  if (cleanIds.length > 0) {
+    await supabase.from("profiles").update({ username_checked_at: now }).in("id", cleanIds);
+  }
+  return { checked: processed.length, blanked, failedBatches, skipped: false };
+}
+
 Deno.serve(async () => {
   const { data: posts, error: postsError } = await supabase
     .from("posts")
@@ -94,9 +183,6 @@ Deno.serve(async () => {
       table: "comments" as const,
     })),
   ];
-  if (items.length === 0) {
-    return new Response(JSON.stringify({ checked: 0, hidden: 0, failed_batches: 0 }));
-  }
 
   // Moderate in batches of 100 (API limit). Only items whose batch succeeded
   // get stamped moderated_at, so a transient failure is retried tomorrow.
@@ -105,31 +191,16 @@ Deno.serve(async () => {
   let failedBatches = 0;
   for (let i = 0; i < items.length; i += 100) {
     const batch = items.slice(i, i + 100);
-    try {
-      const res = await fetch("https://api.openai.com/v1/moderations", {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${Deno.env.get("OPENAI_API_KEY")}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          model: "omni-moderation-latest",
-          input: batch.map((it) => it.content),
-        }),
-      });
-      if (!res.ok) {
-        failedBatches++;
-        continue; // skip stamping; retried next run
-      }
-      const { results } = await res.json();
-      results.forEach((r: ModerationResult, idx: number) => {
-        const cats = flaggedCategories(r);
-        if (cats.length > 0) flagged.push({ item: batch[idx], categories: cats });
-      });
-      processed.push(...batch);
-    } catch {
-      failedBatches++; // network error; skip stamping, retried next run
+    const results = await moderateBatch(batch.map((it) => it.content));
+    if (!results) {
+      failedBatches++; // API/network error; skip stamping, retried next run
+      continue;
     }
+    results.forEach((r, idx) => {
+      const cats = flaggedCategories(r);
+      if (cats.length > 0) flagged.push({ item: batch[idx], categories: cats });
+    });
+    processed.push(...batch);
   }
   const totalItems = items.length;
 
@@ -173,6 +244,23 @@ Deno.serve(async () => {
     await supabase.from("comments").update({ moderated_at: now }).in("id", processedCommentIds);
   }
 
+  const usernames = await sweepUsernames();
+  const allFailedBatches = failedBatches + usernames.failedBatches;
+
+  // Quiet when there was nothing to check at all (a stray or duplicate call
+  // finds every item already stamped): no Slack noise, no API cost.
+  if (totalItems === 0 && usernames.checked === 0 && allFailedBatches === 0) {
+    return new Response(
+      JSON.stringify({
+        checked: 0,
+        hidden: 0,
+        usernames_checked: 0,
+        usernames_blanked: 0,
+        failed_batches: 0,
+      }),
+    );
+  }
+
   const lines = flagged.map(({ item, categories }) => {
     const p = item.profiles;
     return (
@@ -181,17 +269,28 @@ Deno.serve(async () => {
       `  amplitude: \`${p?.amplitude_id ?? "?"}\` | revenuecat: \`${p?.revenuecat_id ?? "?"}\``
     );
   });
+  const usernameLines = usernames.blanked.map(
+    ({ profile, categories }) =>
+      `* [username] *${profile.username}* blanked, _${categories.join(", ")}_\n` +
+      `  amplitude: \`${profile.amplitude_id ?? "?"}\` | revenuecat: \`${profile.revenuecat_id ?? "?"}\``,
+  );
+  const usernameSummary =
+    usernames.checked > 0
+      ? ` Usernames: ${usernames.blanked.length}/${usernames.checked} blanked.`
+      : "";
   let summaryText: string;
-  if (failedBatches > 0) {
+  if (allFailedBatches > 0) {
     const uncheckedCount = totalItems - processed.length;
     summaryText =
-      `Daily moderation: WARNING, ${failedBatches} batch(es) failed to reach the moderation API ` +
+      `Daily moderation: WARNING, ${allFailedBatches} batch(es) failed to reach the moderation API ` +
       `(${uncheckedCount} of ${totalItems} items were not checked and will be retried). ` +
-      `${flagged.length} items hidden.`;
-  } else if (flagged.length === 0) {
-    summaryText = `Daily moderation: ${processed.length} items checked, nothing to report.`;
+      `${flagged.length} items hidden.${usernameSummary}`;
+  } else if (flagged.length === 0 && usernames.blanked.length === 0) {
+    summaryText = `Daily moderation: ${processed.length} items checked, nothing to report.${usernameSummary}`;
   } else {
-    summaryText = `Daily moderation: ${flagged.length}/${processed.length} items hidden\n\n${lines.join("\n")}`;
+    summaryText =
+      `Daily moderation: ${flagged.length}/${processed.length} items hidden.${usernameSummary}\n\n` +
+      [...lines, ...usernameLines].join("\n");
   }
   await postToSlack({ text: summaryText });
 
@@ -199,7 +298,9 @@ Deno.serve(async () => {
     JSON.stringify({
       checked: processed.length,
       hidden: flagged.length,
-      failed_batches: failedBatches,
+      usernames_checked: usernames.checked,
+      usernames_blanked: usernames.blanked.length,
+      failed_batches: allFailedBatches,
     }),
   );
 });

package/templates/functions/daily-translation/index.ts

@@ -0,0 +1,120 @@
+// Daily translation sweep: back-fills the history after installation and
+// catches every item translate-one missed (API outage, secret set later, a
+// locale added to COMMUNITY_TRANSLATION_LOCALES). Each invocation runs a
+// bounded time budget at limited concurrency, then self-chains (POSTs itself)
+// to keep going until the backlog is drained or MAX_CHAIN is hit. Quiet
+// unless something failed.
+
+import { adminClient, json } from "../_shared/client.ts";
+import { ensureTranslations, runPool, TARGET_LOCALES } from "../_shared/translation.ts";
+import { postToSlack } from "../_shared/slack.ts";
+
+const supabase = adminClient();
+// COMMUNITY_TRANSLATION_SWEEP_BATCH: optional test/cost knob (a small value
+// forces chaining on a small backlog).
+const MAX_ITEMS_PER_KIND = Math.max(
+  1,
+  Number(Deno.env.get("COMMUNITY_TRANSLATION_SWEEP_BATCH")) || 250,
+);
+const CONCURRENCY = 4;
+const TIME_BUDGET_MS = 60_000;
+const MAX_CHAIN = 200;
+
+async function sweep(
+  kind: "post" | "comment",
+  withinBudget: () => boolean,
+): Promise<{ done: number; failed: number; remaining: number }> {
+  const { data, error } = await supabase.rpc("items_missing_translations", {
+    kind,
+    target_locales: TARGET_LOCALES,
+    max_items: MAX_ITEMS_PER_KIND,
+  });
+  if (error) {
+    console.error("items_missing_translations failed", error.message);
+    return { done: 0, failed: 1, remaining: 0 };
+  }
+  const ids = ((data ?? []) as { id: string }[]).map((row) => row.id);
+  const { results, processed } = await runPool(
+    ids,
+    CONCURRENCY,
+    (id) => ensureTranslations(supabase, kind, id),
+    withinBudget,
+  );
+  const done = results.filter((r) => r !== null).length;
+  const failed = processed - done;
+  const remaining = Math.max(ids.length - processed, ids.length === MAX_ITEMS_PER_KIND ? 1 : 0);
+  return { done, failed, remaining };
+}
+
+Deno.serve(async (req) => {
+  if (TARGET_LOCALES.length === 0) {
+    return json({
+      posts: 0,
+      comments: 0,
+      failed: 0,
+      note: "COMMUNITY_TRANSLATION_LOCALES not set",
+    });
+  }
+  const started = Date.now();
+  const withinBudget = () => Date.now() - started < TIME_BUDGET_MS;
+
+  const posts = await sweep("post", withinBudget);
+  const comments = await sweep("comment", withinBudget);
+  const done = posts.done + comments.done;
+  const failed = posts.failed + comments.failed;
+  const remaining = posts.remaining + comments.remaining;
+
+  // The endpoint only needs the public anon key, so the caller controls this
+  // header: clamp to a non-negative integer so a malicious/garbage value (a
+  // large negative number, NaN, -Infinity) can't bypass MAX_CHAIN.
+  const depth = Math.max(0, Math.trunc(Number(req.headers.get("x-community-chain"))) || 0);
+  let chained = false;
+  // Why no chain was started, reported to Slack when items remain.
+  let chainFailure = done > 0 ? "depth cap" : "no progress this run";
+  if (remaining > 0 && done > 0 && depth < MAX_CHAIN) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2_000);
+    try {
+      const res = await fetch(`${Deno.env.get("SUPABASE_URL")}/functions/v1/daily-translation`, {
+        method: "POST",
+        headers: {
+          // Forward the caller's own JWT (cron/pg_net sends the anon key the CLI
+          // substituted, which passes verify_jwt); the platform's SUPABASE_ANON_KEY
+          // env may be a publishable sb_ key that verify_jwt rejects.
+          Authorization:
+            req.headers.get("authorization") ?? `Bearer ${Deno.env.get("SUPABASE_ANON_KEY")}`,
+          "Content-Type": "application/json",
+          "x-community-chain": String(depth + 1),
+        },
+        body: JSON.stringify({}),
+        signal: controller.signal,
+      });
+      chained = res.ok;
+      if (!res.ok) chainFailure = `chain request failed (${res.status})`;
+    } catch (e) {
+      if (e instanceof DOMException && e.name === "AbortError") {
+        // We stopped waiting after 2s; the request was already sent and the
+        // chained run continues server-side regardless of our response.
+        chained = true;
+      } else {
+        chainFailure = "chain request failed";
+      }
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+
+  // Only the last link of a chain reports: an item that always fails would
+  // otherwise post a warning on every one of up to 200 chained links.
+  if (failed > 0 && !chained) {
+    await postToSlack({
+      text: `Daily translation: WARNING, ${failed} item(s) failed to translate (${posts.done} posts and ${comments.done} comments done, ${remaining} remaining); they will be retried by the next sweep.`,
+    });
+  }
+  if (remaining > 0 && !chained) {
+    await postToSlack({
+      text: `Translation sweep stopped with ${remaining} items remaining (chain not started: ${chainFailure}); the daily cron continues tomorrow.`,
+    });
+  }
+  return json({ posts: posts.done, comments: comments.done, failed, remaining, chained, depth });
+});

package/templates/functions/deno.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "lib": ["deno.window"], "strict": true } }

package/templates/functions/notify-comment/index.ts

@@ -10,6 +10,7 @@
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
 import { pushCopy } from "../_shared/copy.ts";
+import { ensureTranslations, resolveTargetLocale, languageOf } from "../_shared/translation.ts";
 
 const supabase = adminClient();
 
@@ -59,8 +60,21 @@ Deno.serve(async (req) => {
     .eq("id", comment.author_id)
     .single();
   const name = actor?.username?.trim() || copy.fallbackName;
-  const excerpt =
-    comment.content.length > 140 ? `${comment.content.slice(0, 137)}...` : comment.content;
+  // Recipient-language excerpt when the translation module is on: translate
+  // now (a few seconds) rather than push the source language; on failure the
+  // original goes out and the sweep fills the rows later. translate-one fires
+  // on the same insert, so when it holds the claim wait up to 20 s (the OpenAI
+  // request timeout) for its rows.
+  let excerptSource = comment.content;
+  const targetLocale = resolveTargetLocale(recipient?.locale);
+  if (targetLocale) {
+    const rows = await ensureTranslations(supabase, "comment", comment.id, { waitMs: 20_000 });
+    const match = rows?.find(
+      (r) => r.locale === targetLocale && languageOf(r.locale) !== r.source_locale,
+    );
+    if (match) excerptSource = match.content;
+  }
+  const excerpt = excerptSource.length > 140 ? `${excerptSource.slice(0, 137)}...` : excerptSource;
   // Title states the event; body is the commenter's name then the comment in
   // quotes, e.g.  Marie: "So happy for you!".
   const body = `${name}: "${excerpt}"`;

package/templates/functions/translate-one/index.ts

@@ -0,0 +1,20 @@
+// Translate one published post or comment into every target locale. Called by
+// the pg_net triggers in translation/001 (anon key, untrusted body: only
+// `kind` and `id` are read, the row is re-read). Idempotent: an item that
+// already has every translation costs no API call.
+
+import { adminClient, json } from "../_shared/client.ts";
+import { ensureTranslations } from "../_shared/translation.ts";
+
+const supabase = adminClient();
+
+Deno.serve(async (req) => {
+  const body = (await req.json().catch(() => ({}))) as { kind?: unknown; id?: unknown };
+  const kind = body.kind === "post" || body.kind === "comment" ? body.kind : null;
+  if (!kind || typeof body.id !== "string")
+    return json({ status: "error", error: "bad request" }, 400);
+
+  const rows = await ensureTranslations(supabase, kind, body.id);
+  if (rows === null) return json({ status: "failed" }, 502);
+  return json({ status: rows.length === 0 ? "skipped" : "ok", locales: rows.map((r) => r.locale) });
+});

package/templates/migrations/core/007_username_moderation.sql

@@ -0,0 +1,44 @@
+-- Username moderation (daily sweep).
+--
+-- `profiles.username` is client-writable by design: the host app syncs its
+-- own onboarding display name straight into it, so it never went through
+-- update-profile's synchronous moderation (handle / bio / avatar do). Revoking
+-- the grant would break the pre-SDK app versions still installed, which write
+-- the column directly, so moderation happens asynchronously instead: the
+-- daily-moderation sweep checks every username it has not checked yet
+-- (`username_checked_at is null`) and blanks the ones the moderation API
+-- flags — the app then shows its anonymous fallback name. `username_rejected`
+-- remembers the last blanked value so a client that re-syncs the same name
+-- (every launch, in both source apps) is silently kept blank instead of
+-- getting re-flagged every night.
+--
+-- Neither column is in the client-facing SELECT / UPDATE grants (core/002
+-- scopes both to an explicit column list), so clients can't read or tamper
+-- with the moderation state.
+alter table public.profiles
+  add column if not exists username_checked_at timestamptz,
+  add column if not exists username_rejected text;
+
+create or replace function public.profiles_username_changed()
+returns trigger language plpgsql as $$
+begin
+  if new.username is distinct from old.username then
+    if new.username is not null and new.username = old.username_rejected then
+      -- Re-sync of a name the sweep already blanked: keep it blank.
+      new.username := null;
+    else
+      -- A genuinely new name: re-check it on the next sweep.
+      new.username_checked_at := null;
+    end if;
+  end if;
+  return new;
+end;
+$$;
+
+drop trigger if exists profiles_username_changed_trg on public.profiles;
+create trigger profiles_username_changed_trg
+  before update of username on public.profiles
+  for each row execute function public.profiles_username_changed();
+
+-- Existing usernames are checked by the first sweeps after this migration
+-- (batches of up to 1000 per run, see daily-moderation).

package/templates/migrations/polls/001_polls.sql

@@ -118,3 +118,27 @@ $$;
 
 revoke execute on function public.create_poll_post(text, text, text[]) from public, anon;
 grant execute on function public.create_poll_post(text, text, text[]) to authenticated;
+
+-- ============ TRANSLATION (installed after the translation module) ============
+-- translation/001 creates poll_option_translations only when poll_options
+-- already exists; when polls is added later (`upgrade --add-modules polls` on
+-- a translation-enabled backend) this block creates it instead. Same
+-- definition as translation/001's guarded block.
+do $$
+begin
+  if to_regclass('public.post_translations') is not null then
+    create table if not exists public.poll_option_translations (
+      option_id uuid not null references public.poll_options(id) on delete cascade,
+      locale    text not null,
+      content   text not null,
+      primary key (option_id, locale)
+    );
+    alter table public.poll_option_translations enable row level security;
+    drop policy if exists "poll option translations readable where option readable"
+      on public.poll_option_translations;
+    create policy "poll option translations readable where option readable"
+      on public.poll_option_translations for select to authenticated
+      using (exists (select 1 from public.poll_options o where o.id = poll_option_translations.option_id));
+    grant select on public.poll_option_translations to authenticated;
+  end if;
+end $$;

package/templates/migrations/translation/001_translations.sql

@@ -0,0 +1,190 @@
+-- Translation module: posts, comments and poll option labels translated at
+-- publication into the app's declared locales (COMMUNITY_TRANSLATION_LOCALES
+-- secret, mirrored by the client's modules.translation.locales), shown in the
+-- reader's language by @rocapine/community-ui with a per-item "see original".
+--
+-- Written only by the service role (translate-one / daily-translation Edge
+-- Functions). Readable by authenticated users where the parent row is
+-- readable (RLS on posts/comments does the filtering, same pattern as
+-- likes). Additive: no core table changes. poll_option_translations is
+-- guarded so this module installs on a backend without the polls module.
+--
+-- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
+-- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
+-- its anon key. The anon key is public by design (shipped inside the app
+-- binary): the Edge Functions do privileged work through their own
+-- service-role env, the JWT only passes verify_jwt.
+--
+-- The DO block below fails the migration loudly if the placeholders were not
+-- replaced.
+do $$ begin
+  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
+    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
+  end if;
+end $$;
+
+create table public.post_translations (
+  post_id       uuid not null references public.posts(id) on delete cascade,
+  locale        text not null,
+  source_locale text not null,
+  content       text not null,
+  engine        text not null,
+  created_at    timestamptz not null default now(),
+  primary key (post_id, locale)
+);
+alter table public.post_translations enable row level security;
+create policy "post translations readable where post readable"
+  on public.post_translations for select to authenticated
+  using (exists (select 1 from public.posts p where p.id = post_translations.post_id));
+grant select on public.post_translations to authenticated;
+
+create table public.comment_translations (
+  comment_id    uuid not null references public.comments(id) on delete cascade,
+  locale        text not null,
+  source_locale text not null,
+  content       text not null,
+  engine        text not null,
+  created_at    timestamptz not null default now(),
+  primary key (comment_id, locale)
+);
+alter table public.comment_translations enable row level security;
+create policy "comment translations readable where comment readable"
+  on public.comment_translations for select to authenticated
+  using (exists (select 1 from public.comments c where c.id = comment_translations.comment_id));
+grant select on public.comment_translations to authenticated;
+
+do $$
+begin
+  if to_regclass('public.poll_options') is not null then
+    create table if not exists public.poll_option_translations (
+      option_id uuid not null references public.poll_options(id) on delete cascade,
+      locale    text not null,
+      content   text not null,
+      primary key (option_id, locale)
+    );
+    alter table public.poll_option_translations enable row level security;
+    drop policy if exists "poll option translations readable where option readable"
+      on public.poll_option_translations;
+    create policy "poll option translations readable where option readable"
+      on public.poll_option_translations for select to authenticated
+      using (exists (select 1 from public.poll_options o where o.id = poll_option_translations.option_id));
+    grant select on public.poll_option_translations to authenticated;
+  end if;
+end $$;
+
+-- ============ SWEEP HELPER ============
+-- Visible items that lack at least one target locale other than their own
+-- source language. Marker rows are not translations: 'source' (the detected
+-- source had nothing to translate) and 'attempt' (a translation claim, deleted
+-- on success). Items with no row at all have an unknown source and are always
+-- returned; an item with an 'attempt' younger than 6 h is skipped (in flight,
+-- or failed recently — retried once it ages out). Service role only.
+create or replace function public.items_missing_translations(
+  kind text, target_locales text[], max_items int
+) returns table (id uuid)
+language sql stable security definer set search_path = public as $$
+  select x.id from (
+    select p.id, p.created_at,
+      exists (select 1 from public.post_translations t where t.post_id = p.id) as has_any,
+      (select array_agg(t.locale) filter (where t.locale not in ('source', 'attempt'))
+         from public.post_translations t where t.post_id = p.id) as have,
+      (select min(t.source_locale) filter (where t.locale <> 'attempt')
+         from public.post_translations t where t.post_id = p.id) as src,
+      exists (select 1 from public.post_translations t
+               where t.post_id = p.id and t.locale = 'attempt'
+                 and t.created_at > now() - interval '6 hours') as fresh_attempt
+    from public.posts p where kind = 'post' and p.status = 'visible'
+    union all
+    select c.id, c.created_at,
+      exists (select 1 from public.comment_translations t where t.comment_id = c.id) as has_any,
+      (select array_agg(t.locale) filter (where t.locale not in ('source', 'attempt'))
+         from public.comment_translations t where t.comment_id = c.id) as have,
+      (select min(t.source_locale) filter (where t.locale <> 'attempt')
+         from public.comment_translations t where t.comment_id = c.id) as src,
+      exists (select 1 from public.comment_translations t
+               where t.comment_id = c.id and t.locale = 'attempt'
+                 and t.created_at > now() - interval '6 hours') as fresh_attempt
+    from public.comments c where kind = 'comment' and c.status = 'visible'
+  ) x
+  where not x.fresh_attempt
+    and (not x.has_any
+      or exists (
+        select 1 from unnest(target_locales) l
+        -- `is distinct from`: src is null when the only row is a stale attempt
+        -- (a failed try), and that item must be retried.
+        where split_part(l, '-', 1) is distinct from x.src
+          and not (l = any (coalesce(x.have, '{}')))
+      ))
+  order by x.created_at desc
+  limit max_items
+$$;
+revoke execute on function public.items_missing_translations(text, text[], int) from public, anon, authenticated;
+grant execute on function public.items_missing_translations(text, text[], int) to service_role;
+
+-- ============ TRIGGERS ============
+create or replace function public.translate_post_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/translate-one',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('kind', 'post', 'id', new.id)
+  );
+  return new;
+end; $$;
+
+create or replace function public.translate_comment_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/translate-one',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('kind', 'comment', 'id', new.id)
+  );
+  return new;
+end; $$;
+
+drop trigger if exists on_post_published_translate on public.posts;
+create trigger on_post_published_translate
+  after update of status on public.posts for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.translate_post_webhook();
+drop trigger if exists on_post_created_visible_translate on public.posts;
+create trigger on_post_created_visible_translate
+  after insert on public.posts for each row
+  when (new.status = 'visible')
+  execute function public.translate_post_webhook();
+
+drop trigger if exists on_comment_published_translate on public.comments;
+create trigger on_comment_published_translate
+  after update of status on public.comments for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.translate_comment_webhook();
+drop trigger if exists on_comment_created_visible_translate on public.comments;
+create trigger on_comment_created_visible_translate
+  after insert on public.comments for each row
+  when (new.status = 'visible')
+  execute function public.translate_comment_webhook();
+
+-- ============ CRON ============
+-- Daily sweep at 08:30 UTC (after the 08:00 moderation sweep): back-fills the
+-- history on first installation, then catches anything translate-one missed.
+do $$
+begin
+  perform cron.schedule(
+    'community-translation-sweep',
+    '30 8 * * *',
+    $cron$
+    select net.http_post(
+      url := '__SUPABASE_PROJECT_URL__/functions/v1/daily-translation',
+      headers := jsonb_build_object('Authorization', 'Bearer __SUPABASE_ANON_KEY__')
+    );
+    $cron$
+  );
+exception when others then
+  if sqlerrm like '%already exists%' then
+    raise notice 'cron job community-translation-sweep already scheduled, skipping';
+  else
+    raise;
+  end if;
+end $$;