fix(report): project ordinary reports onto public prose only

frontend/src/app/api/reports/[reportId]/professional-reference/route.ts

@@ -5,6 +5,7 @@ import {
   parseLongformAppendixRow,
 } from "@/lib/personal-report-longform-appendix";
 import { PERSONAL_REPORT_LEGACY_PLACEHOLDER } from "@/lib/personal-report-longform-copy";
+import { releaseProfessionalReference } from "@/lib/report-public-projection";
 import {
   checkSameOrigin,
   resolveAllowedReportOrigins,
@@ -60,7 +61,8 @@ export async function POST(request: Request, context: RouteContext) {
       .maybeSingle();
     const cached = appendixRead.error ? null : parseLongformAppendixRow(appendixRead.data);
     if (cached?.status === "ready" && cached.markdown) {
-      return NextResponse.json({ format: "markdown", markdown: cached.markdown });
+      // Kind is explicit. The path name is not a permission to return internal fields.
+      return NextResponse.json(releaseProfessionalReference(cached.markdown));
     }
     return NextResponse.json(
       { error: PERSONAL_REPORT_LEGACY_PLACEHOLDER, code: "legacy_report" },

frontend/src/app/api/reports/route.ts

@@ -29,6 +29,7 @@ import { loadReportCandidateRange } from "@/lib/report-candidate-range";
 import { createAdminSupabaseClient } from "@/lib/supabase/admin";
 import { authorizeUsage, completeUsage, releaseUsage } from "@/lib/consultation-billing";
 import { FeaturePricingError, resolveFeaturePricing } from "@/lib/feature-pricing";
+import { projectOrdinarySnippet } from "@/lib/report-public-projection";
 import { sanitizedErrorReason } from "@/lib/safe-error-reason";
 import { isSupabaseConfigurationError } from "@/lib/supabase/config";
 import { createServerSupabaseClient } from "@/lib/supabase/server";
@@ -64,6 +65,9 @@ function listReportView(
   failure?: ReturnType<typeof summarizePersonalReportFailure> | null,
 ) {
   const row = value && typeof value === "object" ? value as Record<string, unknown> : {};
+  const cardSummary = typeof row.card_summary === "string"
+    ? projectOrdinarySnippet(row.card_summary).slice(0, 240)
+    : "";
   return {
     id: typeof row.id === "string" ? row.id : "",
     requestId: typeof row.request_id === "string" ? row.request_id : "",
@@ -79,9 +83,7 @@ function listReportView(
     completedAt: row.completed_at == null || row.completed_at === ""
       ? null
       : reportListTimestamp(row.completed_at) || null,
-    ...(typeof row.card_summary === "string" && row.card_summary.trim()
-      ? { cardSummary: row.card_summary.trim().slice(0, 240) }
-      : {}),
+    ...(cardSummary ? { cardSummary } : {}),
     ...(failure?.summary ? { failureSummary: failure.summary } : {}),
   };
 }