@teamscala/service-boot 0.23.462 → 0.23.464

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.462",
+  "version": "0.23.464",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/handlers/upstream-issue-sync.ts

@@ -12,10 +12,12 @@
  * never goes unnoticed.
  *
  * Polls via the authenticated `gh` CLI (`@teamscala/os` spawn — `gh api` is the
- * off-the-shelf GitHub client; NOT a bespoke fetch). The intended
- * `@teamscala/api-github` `rest_client` adapter is deferred on the codegen-harness
- * breakage (open migration `rest-client-codegen-typescript-7-broken`); this
- * handler migrates to it once the harness is fixed.
+ * off-the-shelf GitHub client; NOT a bespoke fetch). There is deliberately NO
+ * `@teamscala/api-github` adapter: one existed as a hand-written `rest_client`
+ * row with zero importers — this handler chose the CLI instead — so it was
+ * deleted on 2026-09-02 rather than converted to a spec-derived adapter. GitHub
+ * publishes an OpenAPI spec, so if a future consumer needs typed access the
+ * answer is a spec-derived row, never a hand-listed one.
  *
  * Registered under slug `@teamscala/service-boot:upstream-issue-sync`. Mirrors
  * `bun-stable-watch` (dev-host pg-boss handler). Reads rows via the `getAllEntries`

package/src/proposal-gate.ts

@@ -164,6 +164,33 @@ export const proposalGateConfig: ContentGateConfig = {
 			prop.prepared_for = "";
 			prop.cover_image_url = "";
 		}
+		// Neutralize the resolved headerData too: it carries the recipient's
+		// name (row1Value = prepared_for) and title, resolved during the loader
+		// phase BEFORE this gate ran — without this, __PAGE_DATA__ ships the
+		// recipient name to every unauthorised visitor while the body is
+		// withheld. Labels stay (generic words); values go. Measured 2026-09-03:
+		// the gate floor's hydration payload carried the recipient name to
+		// anonymous visitors on the exact page this outage was about.
+		const headerData = resolved.headerData as Record<string, unknown> | undefined;
+		if (headerData) {
+			headerData.title = "";
+			headerData.row1Value = "";
+			headerData.row2Value = "";
+			headerData.row3Value = "";
+		}
+		// Neutralize the CRM contact record too. The v8 adapter ignores select
+		// (the full record returns), so without this the gate floor's hydration
+		// payload ships the recipient's whole contact row — first/last/full
+		// name, emails, phones, CRM ids — to every unauthorised visitor. The
+		// company fields stay: the header's Organisation row shows the company,
+		// which is brand chrome, not recipient identity.
+		const contact = resolved.contact as Record<string, unknown> | undefined;
+		if (contact) {
+			const keep = new Set(["id", "company_id", "company_name", "company_website"]);
+			for (const key of Object.keys(contact)) {
+				if (!keep.has(key)) contact[key] = "";
+			}
+		}
 	},
 };