@teamscala/service-boot 0.23.463 → 0.23.465

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.463",
+  "version": "0.23.465",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/proposal-gate.ts

@@ -178,6 +178,19 @@ export const proposalGateConfig: ContentGateConfig = {
 			headerData.row2Value = "";
 			headerData.row3Value = "";
 		}
+		// Neutralize the CRM contact record too. The v8 adapter ignores select
+		// (the full record returns), so without this the gate floor's hydration
+		// payload ships the recipient's whole contact row — first/last/full
+		// name, emails, phones, CRM ids — to every unauthorised visitor. The
+		// company fields stay: the header's Organisation row shows the company,
+		// which is brand chrome, not recipient identity.
+		const contact = resolved.contact as Record<string, unknown> | undefined;
+		if (contact) {
+			const keep = new Set(["id", "company_id", "company_name", "company_website"]);
+			for (const key of Object.keys(contact)) {
+				if (!keep.has(key)) contact[key] = "";
+			}
+		}
 	},
 };
 

package/src/register-registry-page-route/resolve-request-graph.ts

@@ -41,6 +41,48 @@ export interface ResolveRequestGraphArgs {
 	configFingerprint?: string;
 }
 
+/**
+ * Clone a loader graph for the cache, degrading loudly rather than silently.
+ *
+ * ONE CLONE, TWO CALLERS. The cold path and the background-refresh path both
+ * store a graph and both must survive a non-cloneable value in it — a function,
+ * a Proxy, a live client handle. They previously had SEPARATE implementations:
+ * the cold path carried this fallback ladder, the refresh path called
+ * structuredClone bare. So a graph that the cold path stored happily threw on
+ * every subsequent refresh, the cache never updated, and the entry aged out into
+ * a full in-request resolve. Two copies of one decision, and the copy nobody
+ * hardened is the one that fired.
+ *
+ * Returns undefined when the graph cannot be cloned at all; the caller then
+ * declines to cache that key. Both fallbacks log, so the offending source stays
+ * observable and fixable — never a silent fail-open
+ * (`protective-layers-fail-explicitly`).
+ */
+function cloneForCache(
+	graph: unknown,
+	graphKey: string,
+	serviceSlug: string,
+): unknown | undefined {
+	const log = getAppLogger();
+	try {
+		return structuredClone(graph);
+	} catch (err) {
+		log.warn(
+			`[scala-install:${serviceSlug}] graph-cache structuredClone failed for ${graphKey} — falling back to JSON-clone (non-cloneable value in loader graph): ${err instanceof Error ? err.message : err}`,
+		);
+		try {
+			// JSON-clone preserves the data graph, dropping the functions and
+			// undefined a loader graph should not be carrying anyway.
+			return JSON.parse(JSON.stringify(graph)) as unknown;
+		} catch (err2) {
+			log.warn(
+				`[scala-install:${serviceSlug}] graph-cache JSON-clone also failed for ${graphKey} — cache disabled for this key (observable): ${err2 instanceof Error ? err2.message : err2}`,
+			);
+			return undefined;
+		}
+	}
+}
+
 export async function resolveRequestGraph(
 	args: ResolveRequestGraphArgs,
 ): Promise<Record<string, unknown>> {
@@ -102,7 +144,23 @@ export async function resolveRequestGraph(
 							`primary resource "${primaryType}" missing — skip cache update for ${graphKey}`,
 						);
 					}
-					return structuredClone(freshGraph);
+					// SAME DEFENSIVE CLONE AS THE COLD PATH. This used to call
+					// structuredClone bare, so a non-cloneable value in the loader
+					// graph threw on EVERY background refresh: refreshInBackground
+					// caught it, kept the stale entry, and logged one line — so the
+					// cache could never update, expired at staleTtlMs, and the next
+					// request re-resolved the whole graph in-request. Measured
+					// 2026-09-03 on the live proposal page: "The object can not be
+					// cloned" every ~13 minutes on the same graphKey, indefinitely.
+					// The cold path was hardened for exactly this and the refresh
+					// path was not — one defect, two clone sites, one protected.
+					const refreshed = cloneForCache(freshGraph, graphKey, serviceSlug);
+					if (refreshed === undefined) {
+						throw new Error(
+							`graph for ${graphKey} is not cloneable — skip cache update`,
+						);
+					}
+					return refreshed;
 				},
 			),
 	);
@@ -125,22 +183,7 @@ export async function resolveRequestGraph(
 			// graph shouldn't carry) so the cache stays effective; both fallbacks
 			// are LOGGED so the offending non-cloneable source is observable +
 			// fixable, never silently disabling the cache again.
-			let cloned: unknown;
-			try {
-				cloned = structuredClone(resolved);
-			} catch (err) {
-				log.warn(
-					`[scala-install:${serviceSlug}] graph-cache structuredClone failed for ${graphKey} — falling back to JSON-clone (non-cloneable value in loader graph): ${err instanceof Error ? err.message : err}`,
-				);
-				try {
-					cloned = JSON.parse(JSON.stringify(resolved));
-				} catch (err2) {
-					log.warn(
-						`[scala-install:${serviceSlug}] graph-cache JSON-clone also failed for ${graphKey} — cache disabled for this key (observable): ${err2 instanceof Error ? err2.message : err2}`,
-					);
-					cloned = undefined;
-				}
-			}
+			const cloned = cloneForCache(resolved, graphKey, serviceSlug);
 			if (cloned !== undefined) {
 				graphCache.set(graphKey, cloned);
 			}