fix

apps/api/internal/company/lang_content.go

@@ -31,6 +31,21 @@ type LocalizedFields struct {
 // LocalizedContent is language-code → per-language product output fields.
 type LocalizedContent map[string]LocalizedFields
 
+// Public returns a copy safe for API/UI clients. Drops enhance_input_hash
+// (pipeline cache key) so GET product payloads cannot leak job internals.
+// UpdateProcessedProduct merges from DB, so omitting the hash on GET is safe.
+func (c LocalizedContent) Public() LocalizedContent {
+	if len(c) == 0 {
+		return c
+	}
+	out := make(LocalizedContent, len(c))
+	for lang, fields := range c {
+		fields.EnhanceInputHash = ""
+		out[lang] = fields
+	}
+	return out
+}
+
 // SanitizeLangPromptMap validates language codes, sanitizes prompts, and drops empties.
 // Accepts LangPromptAny ("*") as a shared any-language prompt key.
 func SanitizeLangPromptMap(in map[string]string, maxRunes int) (LangPromptMap, error) {

apps/api/internal/company/lang_content_test.go

@@ -2,6 +2,7 @@ package company
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 )
 
@@ -101,3 +102,32 @@ func TestLocalizedContentRoundTrip(t *testing.T) {
 		t.Fatalf("got %#v", f)
 	}
 }
+
+func TestLocalizedContentPublicOmitsEnhanceHash(t *testing.T) {
+	t.Parallel()
+	c := LocalizedContent{
+		"sl": {
+			ProcessedName:        "Naslov",
+			ProcessedDescription: "Opis",
+			MetaTitle:            "Meta",
+			EnhanceInputHash:     "deadbeef",
+		},
+	}
+	pub := c.Public()
+	if pub["sl"].EnhanceInputHash != "" {
+		t.Fatalf("public hash leaked: %#v", pub["sl"])
+	}
+	if pub["sl"].ProcessedName != "Naslov" || pub["sl"].MetaTitle != "Meta" {
+		t.Fatalf("public stripped too much: %#v", pub["sl"])
+	}
+	if c["sl"].EnhanceInputHash != "deadbeef" {
+		t.Fatalf("Public must not mutate storage copy: %#v", c["sl"])
+	}
+	b, err := json.Marshal(pub)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(b), "enhance_input_hash") || strings.Contains(string(b), "deadbeef") {
+		t.Fatalf("hash in JSON: %s", b)
+	}
+}