fix(publisher): critical issues in businessToSpec and buildSpecs

1. Status gate: add mapper-level guard rejecting pending/rejected businesses
   - append &status=eq.published to businesses select
   - businessToSpec returns null for status !== published
   - prevents unpublished businesses leaking names via their deals

2. opening_hours JSONB: handle both string and object forms
   - column is OpeningHours JSONB, not a string
   - str() only works with strings, was a dead code path
   - now accepts string directly or JSON.stringifies objects
   - new test fixture with object-shaped hours serialization

3. buildSpecs fetch efficiency: add test coverage
   - datasets [businesses] alone: businesses fetched once
   - datasets [deals,businesses] together: businesses fetched once
   - nameById map reuses shared fetch, no duplicate fetches

All 51 tests pass, including 4 new tests and 2 status guard tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: MaxBrych

packages/publisher/src/mappers.ts

@@ -243,8 +243,14 @@ export function orgToSpec(row: Row, nodeId: string): PublishSpec | null {
  * deals with, so a record-mode client joins profile and offers by pubkey,
  * exactly the rule organisations already follow. Contact PERSONS are personal
  * data and are never read; the business's own public storefront data is not.
+ *
+ * Only published businesses show on the record; pending/rejected entries stay
+ * private (the app uses status as the moderation gate). This mirrors the
+ * eventToSpec guard and ensures deals from unpublished businesses don't leak
+ * their names via the deals feed.
  */
 export function businessToSpec(row: Row, nodeId: string): PublishSpec | null {
+  if (str(row, "status") !== "published") return null;
   const id = str(row, "id");
   const name = str(row, "name");
   if (!id || !name) return null;
@@ -258,8 +264,15 @@ export function businessToSpec(row: Row, nodeId: string): PublishSpec | null {
   if (banner) profile.banner = banner;
   const bizCategory = str(row, "category");
   if (bizCategory) profile.business_category = bizCategory;
-  const hours = str(row, "opening_hours");
-  if (hours) profile.opening_hours = hours;
+  // opening_hours is JSONB; handle both string and object forms.
+  const hoursRaw = row["opening_hours"];
+  if (hoursRaw) {
+    if (typeof hoursRaw === "string" && hoursRaw.trim()) {
+      profile.opening_hours = hoursRaw;
+    } else if (hoursRaw && typeof hoursRaw === "object") {
+      profile.opening_hours = JSON.stringify(hoursRaw);
+    }
+  }
   const website = str(row, "website_url");
   if (website) profile.website = website;
   const address = str(row, "address");

packages/publisher/src/sync.ts

@@ -191,7 +191,7 @@ export async function buildSpecs(
   if (wantsDeals || wantsBusinesses) {
     const businesses = await deps.fetchRows(
       "businesses",
-      "select=id,name,slug,description,category,logo_url,cover_image_url,address,opening_hours,website_url,updated_at,created_at",
+      "select=id,name,slug,description,category,logo_url,cover_image_url,address,opening_hours,website_url,status,updated_at,created_at&status=eq.published",
     );
     if (wantsBusinesses) {
       for (const row of businesses) {

packages/publisher/test/mappers.test.ts

@@ -367,6 +367,7 @@ describe("consented personal organisers and the wider record", () => {
       { id: "b1", name: "Bäckerei Müritz", description: "Brot seit 1904",
         category: "handwerk", logo_url: "https://x/l.png", cover_image_url: "https://x/c.png",
         address: "Marktplatz 1", opening_hours: "Mo-Fr 6-18", website_url: "https://baeckerei.example",
+        status: "published",
         updated_at: "2026-07-02T10:00:00Z" },
       "roebel",
     );
@@ -380,9 +381,41 @@ describe("consented personal organisers and the wider record", () => {
     assert.deepEqual(spec!.tags[0], ["netizen_org", "b1", "roebel"]);
   });
 
+  it("businessToSpec: refuses unpublished businesses — status is the moderation gate", () => {
+    assert.equal(businessToSpec(
+      { id: "b3", name: "Hidden", status: "pending", updated_at: "2026-07-02T10:00:00Z" },
+      "roebel",
+    ), null);
+    assert.equal(businessToSpec(
+      { id: "b4", name: "Rejected", status: "rejected", updated_at: "2026-07-02T10:00:00Z" },
+      "roebel",
+    ), null);
+  });
+
+  it("businessToSpec: opening_hours accepts both string and JSONB object forms", () => {
+    const stringHours = businessToSpec(
+      { id: "b5", name: "Cafe", status: "published", opening_hours: "Mo-Fr 8-20",
+        updated_at: "2026-07-02T10:00:00Z" },
+      "roebel",
+    )!;
+    const stringProfile = JSON.parse(stringHours.content);
+    assert.equal(stringProfile.opening_hours, "Mo-Fr 8-20");
+
+    const objectHours = businessToSpec(
+      { id: "b6", name: "Restaurant", status: "published",
+        opening_hours: { montag: { open: "09:00", close: "22:00" }, dienstag: { open: "09:00", close: "22:00" } },
+        updated_at: "2026-07-02T10:00:00Z" },
+      "roebel",
+    )!;
+    const objectProfile = JSON.parse(objectHours.content);
+    const hoursObj = JSON.parse(objectProfile.opening_hours);
+    assert.deepEqual(hoursObj.montag, { open: "09:00", close: "22:00" });
+  });
+
   it("businessToSpec: planted contact PII never serializes", () => {
     const spec = businessToSpec(
       { id: "b2", name: "X", email: "leak@example.com", phone: "01761234567",
+        status: "published",
         updated_at: "2026-07-02T10:00:00Z" },
       "roebel",
     );

packages/publisher/test/sync.test.ts

@@ -37,6 +37,38 @@ const TABLES: Record<string, Record<string, unknown>[]> = {
       updated_at: "2026-07-29T08:00:00+00:00",
     },
   ],
+  businesses: [
+    {
+      id: "biz-1",
+      name: "Bäckerei Müritz",
+      slug: "baeckerei",
+      description: "Brot seit 1904",
+      category: "handwerk",
+      logo_url: "https://cdn/logo.png",
+      cover_image_url: "https://cdn/cover.png",
+      address: "Marktplatz 1",
+      opening_hours: "Mo-Fr 6-18",
+      website_url: "https://baeckerei.example",
+      status: "published",
+      updated_at: "2026-07-28T10:00:00+00:00",
+    },
+  ],
+  business_deals: [
+    {
+      id: "deal-1",
+      business_id: "biz-1",
+      title: "2-für-1 Brot",
+      description: "Diese Woche",
+      deal_type: "rabatt",
+      deal_value: "50%",
+      image_url: "https://cdn/deal.png",
+      start_date: "2026-08-01",
+      end_date: "2026-08-07",
+      status: "active",
+      is_active: true,
+      updated_at: "2026-07-30T10:00:00+00:00",
+    },
+  ],
 };
 
 function harness(result: { ok: boolean; message: string } = { ok: true, message: "" }) {
@@ -115,3 +147,59 @@ describe("a publish pass", () => {
     assert.equal(summary.accepted, 0);
   });
 });
+
+describe("businesses dataset and buildSpecs fetch efficiency", () => {
+  it("datasets [businesses] alone: fetches businesses once, builds kind-0 profile specs", async () => {
+    let fetchCount = 0;
+    const deps: PublisherDeps = {
+      nodeSecret: SECRET,
+      nodeId: "roebel",
+      datasets: ["businesses"],
+      fetchRows: async (table) => {
+        if (table === "businesses") fetchCount++;
+        return TABLES[table] ?? [];
+      },
+      relayUrl: "ws://relay",
+      makeClient: () => ({
+        publish: async () => ({ ok: true, message: "" }),
+        close: () => {},
+      }),
+    };
+    const summary = await publishOnce(deps);
+
+    // One fetch for businesses (status filter applied server-side via query string)
+    assert.equal(fetchCount, 1);
+    // One business spec built
+    assert.equal(summary.built, 1);
+    assert.equal(summary.accepted, 1);
+  });
+
+  it("datasets [deals, businesses] together: fetches businesses once, builds both deal and profile specs", async () => {
+    const fetchLog: string[] = [];
+    const deps: PublisherDeps = {
+      nodeSecret: SECRET,
+      nodeId: "roebel",
+      datasets: ["deals", "businesses"],
+      fetchRows: async (table) => {
+        fetchLog.push(table);
+        return TABLES[table] ?? [];
+      },
+      relayUrl: "ws://relay",
+      makeClient: () => ({
+        publish: async () => ({ ok: true, message: "" }),
+        close: () => {},
+      }),
+    };
+    const summary = await publishOnce(deps);
+
+    // Businesses fetched once, business_deals fetched once
+    const businessesFetches = fetchLog.filter((t) => t === "businesses").length;
+    const dealsFetches = fetchLog.filter((t) => t === "business_deals").length;
+    assert.equal(businessesFetches, 1, "businesses table should be fetched exactly once");
+    assert.equal(dealsFetches, 1, "business_deals table should be fetched exactly once");
+
+    // Both a business profile spec and a deal spec are built (2 total)
+    assert.equal(summary.built, 2);
+    assert.equal(summary.accepted, 2);
+  });
+});