@teamscala/service-boot 0.23.507 → 0.23.508

package/package.json

@@ -1131,5 +1131,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.507"
+  "version": "0.23.508"
 }

package/src/content-gate/access.ts

@@ -38,6 +38,17 @@ export async function attachContentGateAccess(
 		let email = "";
 		let name = "";
 		let phone = "";
+		// Optional prospect segmentation a capture gate's composed form may post
+		// (the quiz identity screen: company, LinkedIn, website, team size). Every
+		// field is optional and every reader treats absence as "" — a gate that
+		// never collects them (the GPT) is unaffected, and a form that collects
+		// only some carries the rest as absent. Field names follow the response
+		// columns the segmentation lands in (linkedin_url / team_size, snake case)
+		// because the composed form posts exactly what its FormField rows name.
+		let company = "";
+		let linkedinUrl = "";
+		let website = "";
+		let teamSize = "";
 		let bodyFailed = false;
 		// The resource id may ride on the URL instead of the body. A gate whose
 		// form is COMPOSED FROM BLOCKS has no place to put a hidden field — the
@@ -58,6 +69,10 @@ export async function attachContentGateAccess(
 			// Captured alongside the email by an open-capture gate's composed
 			// form. It rides in the signed token rather than any client store.
 			phone = String(form.phone ?? "").trim();
+			company = String(form.company ?? "").trim();
+			linkedinUrl = String(form.linkedin_url ?? "").trim();
+			website = String(form.website ?? "").trim();
+			teamSize = String(form.team_size ?? "").trim();
 		} catch (error) {
 			log.warn(`[content-gate:${config.cookieName}] body parse failed — redirecting back: ${String(error)}`);
 			bodyFailed = true;
@@ -94,6 +109,9 @@ export async function attachContentGateAccess(
 			Date.now(),
 			name || undefined,
 			phone || undefined,
+			company || linkedinUrl || website || teamSize
+				? { company, linkedinUrl, website, teamSize }
+				: undefined,
 		);
 		if (token) {
 			const maxAge = Math.floor(config.ttlMs / 1000);

package/src/content-gate/config-types.ts

@@ -11,6 +11,19 @@
 
 type Resolved = Record<string, unknown>;
 
+/**
+ * Optional prospect-segmentation a lead-capture gate may capture alongside the
+ * identity. The quiz gate collects these on its composed identity screen; the
+ * token carries them so the next render and the final submit know the visitor
+ * fully, with NO client storage (same reasoning as the captured name/phone).
+ */
+export interface GateSegmentation {
+	company?: string;
+	linkedinUrl?: string;
+	website?: string;
+	teamSize?: string;
+}
+
 /** Drives the SSR-time gate (gate.ts / runContentGate). */
 export interface ContentGateConfig {
 	/** Cookie that carries this gate's access token (e.g. "ag_token"). */
@@ -35,7 +48,7 @@ export interface ContentGateConfig {
 		token: string | undefined,
 		resourceId: string,
 		nowMs: number,
-	): { email: string; name?: string; phone?: string } | null;
+	): { email: string; name?: string; phone?: string; segmentation?: GateSegmentation } | null;
 	/**
 	 * BAKED-IN unified auth. When a gate provides this resolver, the engine
 	 * AUTOMATICALLY releases a logged-in viewer whose session email is in the
@@ -64,7 +77,7 @@ export interface ContentGateConfig {
 	onAuthorized(
 		resolved: Resolved,
 		resourceId: string,
-		identity: { email: string; name?: string; phone?: string },
+		identity: { email: string; name?: string; phone?: string; segmentation?: GateSegmentation },
 	): void | Promise<void>;
 	/** Withhold content (strip/inject the gate) — token absent/invalid. Async-
 	 *  capable so a gate can load its display/behaviour settings from a registry
@@ -111,9 +124,10 @@ export interface AccessConfig {
 	resolveAuthorizedEmails(resourceId: string): Promise<Set<string>>;
 	/**
 	 * Mint the access token for a matched email (token-agnostic per gate).
-	 * `name` and `phone` are the optional captured identity (open-capture gates
-	 * carry them in the token; allow-list gates ignore them). They exist so a
-	 * capture gate needs no browser storage to remember who this is.
+	 * `name` and `phone` are the optional captured identity, `segmentation` the
+	 * optional captured prospect fields (open-capture gates carry them in the
+	 * token; allow-list gates ignore them). They exist so a capture gate needs
+	 * no browser storage to remember who this is.
 	 */
 	signToken(
 		resourceId: string,
@@ -121,5 +135,6 @@ export interface AccessConfig {
 		nowMs: number,
 		name?: string,
 		phone?: string,
+		segmentation?: GateSegmentation,
 	): string | null;
 }

package/src/content-gate/token.segmentation.test.ts

@@ -0,0 +1,76 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Segmentation carriage in the content-gate token. The quiz's composed gate
+ * screen captures company/linkedin_url/website/team_size alongside the
+ * identity; the token carries them to the next render so the submit can put
+ * all seven fields on the ONE response row with no client storage. The
+ * generated `token.test.ts` owns the identity/binding suite; these are the
+ * segmentation-specific cases (including the backward-compatibility contract:
+ * a token minted before `s` existed verifies identically).
+ */
+
+process.env.AUTH_SECRET = "local-test-fixture-entropy-0001";
+
+import { describe, expect, test } from "bun:test";
+import { signAccessToken, verifyAccessTokenIdentity } from "./token.ts";
+
+const NOW = 1_000_000_000_000;
+const TTL = 60_000;
+
+function decodePayload(token: string): Record<string, unknown> {
+	return JSON.parse(Buffer.from(token.split(".")[0], "base64url").toString());
+}
+
+describe("content-gate token — segmentation carriage", () => {
+	test("round-trips the four captured fields", () => {
+		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, "Ann", "+614", {
+			company: "Acme",
+			linkedinUrl: "https://www.linkedin.com/in/ann",
+			website: "https://acme.test",
+			teamSize: "Me + team of 2–5",
+		});
+		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
+		expect(id?.email).toBe("a@b.com");
+		expect(id?.name).toBe("Ann");
+		expect(id?.phone).toBe("+614");
+		expect(id?.segmentation).toEqual({
+			company: "Acme",
+			linkedinUrl: "https://www.linkedin.com/in/ann",
+			website: "https://acme.test",
+			teamSize: "Me + team of 2–5",
+		});
+	});
+
+	test("BACKWARD COMPATIBILITY: a pre-widening token (no s key) verifies with segmentation undefined — never an error", () => {
+		// Mint with the old shape by omitting segmentation entirely, then assert
+		// the exact contract a deploy-window survivor must satisfy.
+		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, "Ann", "+614");
+		expect(decodePayload(t as string).s).toBeUndefined();
+		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
+		expect(id).toEqual({ email: "a@b.com", name: "Ann", phone: "+614", segmentation: undefined });
+	});
+
+	test("empty/whitespace segmentation values produce no s key at all", () => {
+		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, undefined, undefined, {
+			company: "   ",
+			linkedinUrl: "",
+			website: undefined,
+			teamSize: undefined,
+		});
+		expect(decodePayload(t as string).s).toBeUndefined();
+		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
+		expect(id?.segmentation).toBeUndefined();
+	});
+
+	test("values are trimmed on sign", () => {
+		const t = signAccessToken("quiz_token", "quiz-1", "a@b.com", NOW, TTL, undefined, undefined, {
+			company: "  Acme  ",
+			teamSize: "Just me",
+		});
+		const id = verifyAccessTokenIdentity(t, "quiz_token", "quiz-1", NOW + 1);
+		expect(id?.segmentation).toEqual({ company: "Acme", teamSize: "Just me" });
+	});
+});

package/src/content-gate/token.ts

@@ -24,6 +24,8 @@
  * Fail-closed: no usable secret yields null (no token, no access).
  */
 
+import type { GateSegmentation } from "./config-types.ts";
+
 function secret(): string | null {
 	for (const s of [
 		process.env.AUTH_SECRET,
@@ -68,10 +70,26 @@ export function signAccessToken(
 	 * localStorage.
 	 */
 	phone?: string,
+	/**
+	 * Optional prospect segmentation captured alongside the identity on the
+	 * quiz's composed gate screen (company / LinkedIn / website / team size).
+	 * Same reasoning as name/phone: it rides the signed request, never client
+	 * storage. OPTIONAL and absent from older tokens — a token without it
+	 * verifies exactly as before.
+	 */
+	segmentation?: GateSegmentation,
 ): string | null {
 	const key = secret();
 	if (!key) return null;
-	const payload: { c: string; r: string; e: string; x: number; n?: string; p?: string } = {
+	const payload: {
+		c: string;
+		r: string;
+		e: string;
+		x: number;
+		n?: string;
+		p?: string;
+		s?: GateSegmentation;
+	} = {
 		c: cookieName,
 		r: resourceId,
 		e: email.trim().toLowerCase(),
@@ -81,6 +99,16 @@ export function signAccessToken(
 	if (trimmedName) payload.n = trimmedName;
 	const trimmedPhone = phone?.trim();
 	if (trimmedPhone) payload.p = trimmedPhone;
+	const seg: GateSegmentation = {};
+	const segCompany = segmentation?.company?.trim();
+	if (segCompany) seg.company = segCompany;
+	const segLinkedin = segmentation?.linkedinUrl?.trim();
+	if (segLinkedin) seg.linkedinUrl = segLinkedin;
+	const segWebsite = segmentation?.website?.trim();
+	if (segWebsite) seg.website = segWebsite;
+	const segTeamSize = segmentation?.teamSize?.trim();
+	if (segTeamSize) seg.teamSize = segTeamSize;
+	if (Object.keys(seg).length > 0) payload.s = seg;
 	const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
 	return `${payloadB64}.${hmac(payloadB64, key)}`;
 }
@@ -121,17 +149,25 @@ export function verifyAccessToken(
 }
 
 /**
- * Like `verifyAccessToken` but returns the full verified identity ({email, name, phone})
- * so a gate that carries a display name in the token (the public GPT lead-capture
- * gate) can seed the visitor's name — not just the email — at SSR. Same
- * signature/expiry/gate-binding checks; null on any failure.
+ * Like `verifyAccessToken` but returns the full verified identity
+ * ({email, name, phone, segmentation}) so a gate that carries a display name in
+ * the token (the public GPT lead-capture gate) can seed the visitor's name — not
+ * just the email — at SSR, and the quiz gate can seed the captured prospect
+ * segmentation the same way. Same signature/expiry/gate-binding checks; null on
+ * any failure. A token minted BEFORE segmentation existed carries no `s` key and
+ * verifies identically (segmentation comes back undefined) — never an error.
  */
 export function verifyAccessTokenIdentity(
 	token: string | undefined | null,
 	cookieName: string,
 	resourceId: string,
 	nowMs: number,
-): { email: string; name?: string; phone?: string } | null {
+): {
+	email: string;
+	name?: string;
+	phone?: string;
+	segmentation?: GateSegmentation;
+} | null {
 	if (!token) return null;
 	const key = secret();
 	if (!key) return null;
@@ -148,15 +184,27 @@ export function verifyAccessTokenIdentity(
 			x?: number;
 			n?: string;
 			p?: string;
+			s?: GateSegmentation;
 		};
 		if (p.c !== cookieName) return null;
 		if (p.r !== resourceId) return null;
 		if (typeof p.x !== "number" || p.x < nowMs) return null;
 		if (typeof p.e !== "string") return null;
+		const segmentation =
+			p.s && typeof p.s === "object"
+				? {
+						company: typeof p.s.company === "string" ? p.s.company : undefined,
+						linkedinUrl:
+							typeof p.s.linkedinUrl === "string" ? p.s.linkedinUrl : undefined,
+						website: typeof p.s.website === "string" ? p.s.website : undefined,
+						teamSize: typeof p.s.teamSize === "string" ? p.s.teamSize : undefined,
+					}
+				: undefined;
 		return {
 			email: p.e,
 			name: typeof p.n === "string" ? p.n : undefined,
 			phone: typeof p.p === "string" ? p.p : undefined,
+			segmentation,
 		};
 	} catch {
 		return null;

package/src/handlers/platform-fault-escalation/delivery.ts

@@ -13,6 +13,7 @@
  */
 
 import type { ExecutionContext } from "@teamscala/os/contracts/mcp";
+import { idsWhereJsonKey } from "@teamscala/db/json-key-filter";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import {
 	composeEscalationMessage,
@@ -36,11 +37,18 @@ interface OperatorRelayBot {
 }
 
 async function resolveOperatorRelay(): Promise<OperatorRelayBot> {
+	// flow_config.mode lives inside json; the v8 builder cannot address it.
+	const relayBotIds = await idsWhereJsonKey({
+		table: "messaging_bots",
+		column: "flow_config",
+		key: "mode",
+		equals: "operator-relay",
+	});
 	const bot = (await (await orpc()).messaging_bots.findFirst({
 		where: {
 			is_active: true,
 			platform: "whatsapp",
-			flow_config: { path: ["mode"], equals: "operator-relay" },
+			id: { in: relayBotIds },
 		},
 		select: { id: true, organisation_id: true, external_id: true, flow_config: true },
 	})) as unknown as OperatorRelayBot | null;

package/src/pg-boss-mount.test.ts

@@ -0,0 +1,100 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The mount's poll-only contract: pg-boss v12 dispatches by polling, so the
+ * mount dials the INJECTED transaction-pooler URL unchanged (no endpoint
+ * derivation of its own — the session-port mapping died with the door,
+ * 2026-09-14) and constructs with useListenNotify false spelled explicitly
+ * rather than inherited from the supplier default, so a pg-boss bump cannot
+ * silently re-introduce a LISTEN dependency. The mock captures the opts
+ * PgBoss is constructed with — the claim is about what the mount DIALS and
+ * how it dispatches, so the assertions are on the captured opts.
+ */
+
+import { afterEach, describe, expect, it, mock } from "bun:test";
+
+interface CapturedOpts {
+	connectionString?: string;
+	max?: number;
+	useListenNotify?: boolean;
+}
+
+const POOLED_URL =
+	"postgresql://scala_container_gbg.gbg:s3cret@10.205.50.1:6543/scala_container_gbg?sslmode=require";
+
+function seedScheduledJob() {
+	return {
+		id: "test-job-1",
+		type: "scheduled_job",
+		slug: "scheduled_job:test-sync",
+		label: "Test Sync Job",
+		description: null,
+		config: {
+			handler_slug: "@teamscala/sync-worker:processSyncQueue",
+			cron: "*/5 * * * *",
+			queue_name: "sync-worker",
+		},
+		is_active: true,
+		sort_order: 0,
+		created_at: new Date(),
+		updated_at: new Date(),
+		noun: "scheduled_job",
+		kind: "scheduled_job",
+	};
+}
+
+describe("mountPgBoss poll-only contract", () => {
+	afterEach(() => {
+		mock.restore();
+	});
+
+	it("dials the injected transaction pooler unchanged and dispatches poll-only", async () => {
+		let captured: CapturedOpts | null = null;
+
+		mock.module("pg-boss", () => ({
+			PgBoss: mock((opts: CapturedOpts) => {
+				captured = opts;
+				return {
+					start: mock(() => Promise.resolve()),
+					stop: mock(() => Promise.resolve()),
+					on: mock(() => undefined),
+					createQueue: mock(() => Promise.resolve()),
+					work: mock(() => Promise.resolve("worker-id")),
+					schedule: mock(() => Promise.resolve()),
+					getSchedules: mock(() => Promise.resolve([])),
+					unschedule: mock(() => Promise.resolve()),
+				};
+			}),
+		}));
+		mock.module("@teamscala/db/registry/accessors", () => ({
+			getAllEntries: () => [seedScheduledJob()],
+		}));
+		mock.module("@teamscala/event-log/record-event", () => ({
+			recordEvent: () => undefined,
+		}));
+
+		const { mountPgBoss } = await import("./pg-boss-mount.ts");
+		await mountPgBoss({
+			databaseUrl: POOLED_URL,
+			serviceSlug: "scala-sync-worker",
+			packages: ["@teamscala/sync-worker"],
+		});
+
+		const connectionString = captured?.connectionString ?? "";
+		// The transaction pooler, exactly as injected — the mount adds no
+		// endpoint derivation.
+		expect(connectionString).toContain(":6543");
+		// NEVER the session port: the door is closing, not widening.
+		expect(connectionString).not.toContain(":5999");
+		// The tenant suffix the pooler routes by is kept.
+		expect(connectionString).toContain("scala_container_gbg.gbg:");
+		// The pg sslmode dialect rewrite still applies.
+		expect(connectionString).toContain("sslmode=no-verify");
+		// Poll-only, spelled: no LISTEN dependency, now and after a bump.
+		expect(captured?.useListenNotify).toBe(false);
+		// pg-boss stays a single sibling connection (pool sizing doctrine).
+		expect(captured?.max).toBe(1);
+	});
+});

package/src/pg-boss-mount.ts

@@ -135,7 +135,22 @@ export async function mountPgBoss(
 	// shared URL's libpq spelling — route through the canonical rewrite.
 	// Config object (not a bare connectionString) so the internal pool is
 	// bounded + tagged for the ~220ms cross-internet dev→Railway RTT.
+	// POLL-ONLY, EXPLICITLY. pg-boss v12 dispatches by polling (SELECT .. FOR
+	// UPDATE SKIP LOCKED inside a transaction; its locks are
+	// pg_advisory_xact_lock — transaction-scoped, so a transaction pooler
+	// cannot leak them); LISTEN/NOTIFY is a supplier-documented latency hint
+	// whose registration dies on a transaction-pooler backend reassignment
+	// (measured 2026-09-14: the opted-in sync worker boss logged
+	// `LISTEN/NOTIFY channel registration was lost` every log window).
+	// attorney.js defaults useListenNotify to false in 12.29.0 (pinned),
+	// 12.30.0 (deployed) and 12.31.1 (latest) — all three read directly —
+	// and spelling it here keeps that contract explicit so a pg-boss bump
+	// cannot silently re-introduce a LISTEN dependency
+	// (close-the-session-mode-door, 2026-09-14). The connection dials the
+	// injected DATABASE_URL — the transaction pooler — reconciling the pg
+	// sslmode dialect; the mount adds no endpoint derivation of its own.
 	const boss = new PgBoss({
+		useListenNotify: false,
 		connectionString: pgSslCompatUrl(ctx.databaseUrl),
 		application_name: `pgboss:${ctx.serviceSlug}`,
 		// ONE connection, not three: pg-boss is a sibling pool that sits OUTSIDE
@@ -145,7 +160,7 @@ export async function mountPgBoss(
 		// background degradation (`a-per-consumer-pool-max-is-not-a-bound-on-the-server`:
 		// background work degrades to a queue, interactive work degrades to an
 		// outage). The sibling total is declared in
-		// config/db-pool-sizing.perServiceOverhead (pg-boss 1 + LISTEN 1 = 2).
+		// config/db-pool-sizing.perServiceOverhead (pg-boss 1; the LISTEN allowance is gone with poll-only).
 		max: 1,
 		// Generous connection-acquisition budget for the cross-internet link so
 		// a slow TLS handshake under sustained load doesn't terminate the conn.

package/src/quiz-gate.ts

@@ -56,12 +56,23 @@ export const quizGateConfig: ContentGateConfig = {
 	verifyToken(token, resourceId, nowMs) {
 		return verifyAccessTokenIdentity(token, QUIZ_COOKIE, resourceId, nowMs);
 	},
-	onAuthorized(resolved, _resourceId, { email, name, phone }) {
+	onAuthorized(resolved, _resourceId, { email, name, phone, segmentation }) {
 		// The one fact the page's block conditions read. Present → the identity
 		// container hides and the quiz container shows; absent → the reverse.
+		// The segmentation (captured on the same composed screen) rides along so
+		// the quiz flow starts already knowing the prospect — its submit then
+		// persists all seven identity fields on the ONE response row.
 		(resolved as {
-			initialVisitor?: { name?: string; email: string; phone?: string };
-		}).initialVisitor = { name, email, phone };
+			initialVisitor?: {
+				name?: string;
+				email: string;
+				phone?: string;
+				company?: string;
+				linkedinUrl?: string;
+				website?: string;
+				teamSize?: string;
+			};
+		}).initialVisitor = { name, email, phone, ...segmentation };
 	},
 	onUnauthorized(resolved, resourceId) {
 		// The endpoint the identity form posts to, PUBLISHED INTO THE PAGE DATA
@@ -91,7 +102,7 @@ export const quizAccessConfig: AccessConfig = {
 	async resolveAuthorizedEmails() {
 		return new Set<string>();
 	},
-	signToken(resourceId, email, nowMs, name, phone) {
-		return signAccessToken(QUIZ_COOKIE, resourceId, email, nowMs, quizTtlMs(), name, phone);
+	signToken(resourceId, email, nowMs, name, phone, segmentation) {
+		return signAccessToken(QUIZ_COOKIE, resourceId, email, nowMs, quizTtlMs(), name, phone, segmentation);
 	},
 };