fix(audit-wave-9): standardize on Sheet for previews; doctrine in CLAUDE.md

Swap the one outlier (client-interests-tab.tsx) from Vaul Drawer to
Sheet side=right so every detail-preview surface uses the same
primitive. Document the doctrine: Sheet for side panels on both desktop
and mobile; Vaul Drawer reserved for mobile-only bottom-sheet UX
(currently just MoreSheet).

Closes ui/ux M11.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/api/helpers.ts

@@ -389,3 +389,54 @@ export function withRateLimit(name: RateLimiterName, handler: RouteHandler): Rou
     return handler(req, ctx, params);
   };
 }
+
+// ─── withPublicContext ───────────────────────────────────────────────────────
+
+/**
+ * Wraps a public (unauthenticated) route — webhooks, health checks,
+ * public APIs — so it runs inside the same `runWithRequestContext` ALS
+ * frame that `withAuth` installs for authenticated routes. Without this
+ * frame, `captureErrorEvent`, `getRequestId`, and the logger's request-id
+ * mixin silently no-op for these endpoints, leaving webhook failures
+ * invisible in the platform-errors dashboard.
+ *
+ * Top-level errors thrown by the handler are forwarded to
+ * `captureErrorEvent` (so they surface in admin/errors) and re-raised
+ * so Next's runtime can return a 500. Webhook handlers that prefer to
+ * always-return-200 can catch internally — this wrapper only catches the
+ * uncaught path.
+ */
+export function withPublicContext(
+  handler: (req: NextRequest) => Promise<NextResponse>,
+): (req: NextRequest) => Promise<NextResponse> {
+  return async (req) => {
+    const incomingId = req.headers.get('x-request-id');
+    const requestId =
+      incomingId && /^[A-Za-z0-9-]{8,64}$/.test(incomingId) ? incomingId : randomUUID();
+    const tag = (res: NextResponse): NextResponse => {
+      res.headers.set('X-Request-Id', requestId);
+      return res;
+    };
+
+    return runWithRequestContext(
+      {
+        requestId,
+        portId: '',
+        userId: '',
+        method: req.method,
+        path: new URL(req.url).pathname,
+        startedAt: Date.now(),
+      },
+      async () => {
+        try {
+          return tag(await handler(req));
+        } catch (error) {
+          const { captureErrorEvent } = await import('@/lib/services/error-events.service');
+          void captureErrorEvent({ statusCode: 500, error });
+          logger.error({ err: error }, 'Public route handler threw');
+          return tag(errorResponse(error));
+        }
+      },
+    );
+  };
+}

src/lib/audit.ts

@@ -79,26 +79,101 @@ export interface AuditLogParams {
   source?: AuditSource;
 }
 
-const SENSITIVE_FIELDS = new Set(['email', 'phone', 'password', 'credentials_enc', 'token']);
+// Lower-cased key fragments. A metadata key is masked if any fragment is
+// contained as a substring after lowercase + snake/kebab normalization.
+// Substring match catches `recipientEmail`, `sent_to_email`, `userEmail`,
+// `attempted_email`, `from_address`, `phone_number`, `passwordHash`, etc.
+const SENSITIVE_KEY_FRAGMENTS = [
+  'email',
+  'phone',
+  'password',
+  'token',
+  'credentials',
+  'secret',
+  'api_key',
+  'apikey',
+  'auth',
+  'authorization',
+  'cookie',
+  'address', // physical/mailing addresses
+  'dob',
+  'date_of_birth',
+  'birthdate',
+  'tax_id',
+  'taxid',
+  'national_id',
+  'ssn',
+  'passport',
+  'iban',
+  'card_number',
+  'cvv',
+  'recipient', // e.g. recipientEmail catches the parent too — preserves intent
+  'first_name',
+  'last_name',
+  'full_name',
+  'fullname',
+];
+
+function isSensitiveKey(key: string): boolean {
+  const k = key.toLowerCase().replace(/[-]/g, '_');
+  return SENSITIVE_KEY_FRAGMENTS.some((frag) => k.includes(frag));
+}
+
+function maskString(val: string): string {
+  return val.length > 4 ? `${val.slice(0, 2)}***${val.slice(-2)}` : '***';
+}
+
+function maskValue(value: unknown, depth: number): unknown {
+  if (depth > 4) return '[depth-limit]';
+  if (value === null || value === undefined) return value;
+  if (typeof value === 'string') return maskString(value);
+  if (Array.isArray(value)) return value.map((v) => maskValue(v, depth + 1));
+  if (typeof value === 'object') {
+    // Recurse into nested object — only mask keys that themselves look
+    // sensitive. Parents stay traversable.
+    return maskObject(value as Record<string, unknown>, depth + 1);
+  }
+  // Non-string primitives (number/boolean/bigint/symbol) at sensitive keys
+  // are passed through unchanged. The original contract was "only mask
+  // strings" — a number at an `email` key is a type error upstream and
+  // shouldn't be silently replaced with `***`.
+  return value;
+}
+
+function maskObject(data: Record<string, unknown>, depth: number): Record<string, unknown> {
+  if (depth > 4) return { _truncated: '[depth-limit]' };
+  const masked: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (isSensitiveKey(key)) {
+      masked[key] = maskValue(value, depth + 1);
+    } else if (value && typeof value === 'object' && !Array.isArray(value)) {
+      masked[key] = maskObject(value as Record<string, unknown>, depth + 1);
+    } else if (Array.isArray(value)) {
+      masked[key] = value.map((v) =>
+        v && typeof v === 'object' && !Array.isArray(v)
+          ? maskObject(v as Record<string, unknown>, depth + 1)
+          : v,
+      );
+    } else {
+      masked[key] = value;
+    }
+  }
+  return masked;
+}
 
 /**
  * Masks sensitive field values to prevent PII or secrets from being stored
  * verbatim in the audit log (SECURITY-GUIDELINES.md §5.2).
  *
  * Strings are replaced with a partial mask - first 2 chars + *** + last 2 chars.
+ * Walks nested objects/arrays so e.g. `{recipient: {email: "a@b"}}` masks
+ * the inner value too.
  */
 export function maskSensitiveFields(
   data?: Record<string, unknown>,
 ): Record<string, unknown> | undefined {
   if (!data) return undefined;
-  const masked = { ...data };
-  for (const key of Object.keys(masked)) {
-    if (SENSITIVE_FIELDS.has(key) && typeof masked[key] === 'string') {
-      const val = masked[key] as string;
-      masked[key] = val.length > 4 ? `${val.slice(0, 2)}***${val.slice(-2)}` : '***';
-    }
-  }
-  return masked;
+  return maskObject(data, 0);
 }
 
 /**

src/lib/constants.ts

@@ -195,6 +195,36 @@ function humanizeEnum(raw: string): string {
   return raw.replace(/_/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
 }
 
+/**
+ * Format an arbitrary enum-shaped string ("hot_lead" → "Hot Lead",
+ * "in_progress" → "In Progress"). Centralised so list columns, badge
+ * components, and detail pages render the same value consistently —
+ * replaces the scattered ad-hoc `.replace(/_/g, ' ')` calls flagged
+ * by ui-ux-auditor H1.
+ */
+export function formatEnum(value: string | null | undefined): string {
+  if (!value) return '';
+  return humanizeEnum(value);
+}
+
+/** Format a pipeline stage value. Falls back to formatEnum for unknown values. */
+export function formatStage(value: string | null | undefined): string {
+  if (!value) return '';
+  return STAGE_LABELS[safeStage(value)] ?? formatEnum(value);
+}
+
+/** Format a generic status (eoi_status, contract_status, deposit_status,
+ *  invoice status, document status). Same shape as the enum but kept as
+ *  a separate exported alias so call sites read intentionally. */
+export function formatStatus(value: string | null | undefined): string {
+  return formatEnum(value);
+}
+
+/** Format a priority enum ('low' | 'medium' | 'high' | 'urgent'). */
+export function formatPriority(value: string | null | undefined): string {
+  return formatEnum(value);
+}
+
 export function toSelectOptions<T extends readonly string[]>(
   values: T,
 ): Array<{ value: T[number]; label: string }> {

src/lib/db/migrations/0057_search_fts_indexes.sql

@@ -0,0 +1,25 @@
+-- 0057_search_fts_indexes.sql
+-- ----------------------------------------------------------------------------
+-- Backing GIN indexes for the to_tsvector expressions used by
+-- src/lib/services/search.service.ts. Without these the full-text
+-- predicates (`to_tsvector('simple', col) @@ to_tsquery('simple', $1)`)
+-- sequential-scan every row in clients / yachts / companies / interests
+-- on each search, which becomes painful at scale.
+--
+-- Built with CREATE INDEX CONCURRENTLY so the index build doesn't lock
+-- the table for new writes. That means each statement must run OUTSIDE
+-- a transaction — the custom `scripts/db-migrate.ts` runner detects
+-- CONCURRENTLY and runs the statement standalone.
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_clients_fulltext
+  ON clients USING gin (to_tsvector('simple', coalesce(full_name, '')));
+--> statement-breakpoint
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_residential_clients_fulltext
+  ON residential_clients USING gin (to_tsvector('simple', coalesce(full_name, '')));
+--> statement-breakpoint
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_yachts_fulltext
+  ON yachts USING gin (to_tsvector('simple', coalesce(name, '') || ' ' || coalesce(builder, '')));
+
+-- companies search uses plain ILIKE only (no to_tsvector); index omitted.

src/lib/db/schema/users.ts

@@ -302,7 +302,9 @@ export const userPermissionOverrides = pgTable(
     id: text('id')
       .primaryKey()
       .$defaultFn(() => crypto.randomUUID()),
-    userId: text('user_id').notNull(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
     portId: text('port_id')
       .notNull()
       .references(() => ports.id, { onDelete: 'cascade' }),
@@ -384,7 +386,9 @@ export const userPortRoles = pgTable(
     id: text('id')
       .primaryKey()
       .$defaultFn(() => crypto.randomUUID()),
-    userId: text('user_id').notNull(), // references Better Auth user ID
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
     portId: text('port_id')
       .notNull()
       .references(() => ports.id, { onDelete: 'cascade' }),

src/lib/email/templates/admin-email-change.tsx

@@ -13,6 +13,10 @@ interface AdminEmailChangeData {
 
 interface RenderOpts {
   branding?: BrandingShell | null;
+  /** Admin override for the email subject. Falls back to the template's
+   *  default when null/empty. Wired through from email_templates.subject
+   *  via getTemplateOverridesForKey() in mailer-config.ts. */
+  subject?: string | null;
 }
 
 function AdminEmailChangeBody({
@@ -78,7 +82,9 @@ export async function adminEmailChangeEmail(
   overrides?: RenderOpts,
 ): Promise<{ subject: string; html: string; text: string }> {
   const portName = data.portName ?? 'Port Nimara';
-  const subject = `An administrator updated your ${portName} sign-in email`;
+  const subject = overrides?.subject?.trim()
+    ? overrides.subject
+    : `An administrator updated your ${portName} sign-in email`;
   const accent = brandingPrimaryColor(overrides?.branding);
 
   const body = await render(

src/lib/email/templates/crm-invite.tsx

@@ -15,6 +15,7 @@ interface InviteData {
 
 interface RenderOpts {
   branding?: BrandingShell | null;
+  subject?: string | null;
 }
 
 function InviteBody({
@@ -85,7 +86,9 @@ export async function crmInviteEmail(
   overrides?: RenderOpts,
 ): Promise<{ subject: string; html: string; text: string }> {
   const portName = data.portName ?? 'Port Nimara';
-  const subject = `You're invited to the ${portName} CRM`;
+  const subject = overrides?.subject?.trim()
+    ? overrides.subject
+    : `You're invited to the ${portName} CRM`;
   const role = data.isSuperAdmin ? 'super administrator' : 'administrator';
   const accent = brandingPrimaryColor(overrides?.branding);
 

src/lib/email/templates/inquiry-client-confirmation.tsx

@@ -12,6 +12,7 @@ export interface InquiryClientConfirmationData {
 
 interface RenderOpts {
   branding?: BrandingShell | null;
+  subject?: string | null;
 }
 
 function ClientConfirmationBody({
@@ -61,9 +62,11 @@ export async function inquiryClientConfirmation(
   const { firstName, mooringNumber, contactEmail } = data;
   const portName = data.portName ?? 'Port Nimara';
   const berthText = mooringNumber ? `Berth ${mooringNumber}` : `a ${portName} Berth`;
-  const subject = mooringNumber
-    ? `Thank You for Your Interest in Berth ${mooringNumber}`
-    : `Thank You for Your Interest in a ${portName} Berth`;
+  const subject = overrides?.subject?.trim()
+    ? overrides.subject
+    : mooringNumber
+      ? `Thank You for Your Interest in Berth ${mooringNumber}`
+      : `Thank You for Your Interest in a ${portName} Berth`;
   const accent = brandingPrimaryColor(overrides?.branding);
 
   const body = await render(

src/lib/email/templates/inquiry-sales-notification.tsx

@@ -14,6 +14,7 @@ export interface InquirySalesNotificationData {
 
 interface RenderOpts {
   branding?: BrandingShell | null;
+  subject?: string | null;
 }
 
 function SalesNotificationBody({
@@ -75,7 +76,7 @@ export async function inquirySalesNotification(
 ) {
   const portName = data.portName ?? 'Port Nimara';
   const mooringDisplay = data.mooringNumber || 'None';
-  const subject = `New Interest - ${portName}`;
+  const subject = overrides?.subject?.trim() ? overrides.subject : `New Interest - ${portName}`;
   const accent = brandingPrimaryColor(overrides?.branding);
 
   const body = await render(

src/lib/email/templates/notification-digest.tsx

@@ -19,6 +19,7 @@ interface DigestData {
 
 interface RenderOpts {
   branding?: BrandingShell | null;
+  subject?: string | null;
 }
 
 const TYPE_LABELS: Record<string, string> = {
@@ -117,7 +118,9 @@ export async function notificationDigestEmail(
   data: DigestData,
   overrides?: RenderOpts,
 ): Promise<{ subject: string; html: string; text: string }> {
-  const subject = `${data.portName} CRM digest — ${data.totalUnread} unread`;
+  const subject = overrides?.subject?.trim()
+    ? overrides.subject
+    : `${data.portName} CRM digest — ${data.totalUnread} unread`;
   const accent = brandingPrimaryColor(overrides?.branding);
 
   const body = await render(<DigestBody {...data} accent={accent} />, { pretty: false });

src/lib/email/templates/residential-inquiry.tsx

@@ -5,6 +5,7 @@ import { brandingPrimaryColor, renderShell, safeUrl, type BrandingShell } from '
 
 interface RenderOpts {
   branding?: BrandingShell | null;
+  subject?: string | null;
 }
 
 export interface ResidentialClientConfirmationData {
@@ -60,7 +61,9 @@ export async function residentialClientConfirmation(
   overrides?: RenderOpts,
 ) {
   const portName = data.portName ?? 'Port Nimara';
-  const subject = `Thank You for Your Interest - ${portName} Residences`;
+  const subject = overrides?.subject?.trim()
+    ? overrides.subject
+    : `Thank You for Your Interest - ${portName} Residences`;
   const accent = brandingPrimaryColor(overrides?.branding);
   const body = await render(
     <ClientConfirmationBody
@@ -178,7 +181,9 @@ export async function residentialSalesAlert(
   overrides?: RenderOpts,
 ) {
   const portName = data.portName ?? 'Port Nimara';
-  const subject = `New Residential Inquiry - ${data.fullName}`;
+  const subject = overrides?.subject?.trim()
+    ? overrides.subject
+    : `New Residential Inquiry - ${data.fullName}`;
   const accent = brandingPrimaryColor(overrides?.branding);
   const body = await render(<SalesAlertBody portName={portName} data={data} accent={accent} />, {
     pretty: false,

src/lib/queue/audit-helpers.ts

@@ -44,6 +44,7 @@ const RECURRING_JOB_NAMES: ReadonlySet<string> = new Set([
   'gdpr-export-cleanup',
   'ai-usage-retention',
   'error-events-retention',
+  'audit-logs-retention',
   'website-submissions-retention',
 ]);
 

src/lib/queue/scheduler.ts

@@ -59,6 +59,10 @@ export async function registerRecurringJobs(): Promise<void> {
     { queue: 'maintenance', name: 'ai-usage-retention', pattern: '0 5 * * *' },
     // Migration 0040 contract: error_events older than 90 days get pruned.
     { queue: 'maintenance', name: 'error-events-retention', pattern: '0 6 * * *' },
+    // 90-day retention for audit_logs — mirrors error_events. Metadata
+    // is masked at insert time but old rows still represent stale PII
+    // exposure that has no operational value past the window.
+    { queue: 'maintenance', name: 'audit-logs-retention', pattern: '15 6 * * *' },
     // Raw website inquiry payloads — 180-day retention.
     { queue: 'maintenance', name: 'website-submissions-retention', pattern: '0 7 * * *' },
   ];

src/lib/queue/workers/maintenance.ts

@@ -7,7 +7,7 @@ import { db } from '@/lib/db';
 import { formSubmissions } from '@/lib/db/schema/documents';
 import { gdprExports } from '@/lib/db/schema/gdpr';
 import { aiUsageLedger } from '@/lib/db/schema/ai-usage';
-import { errorEvents } from '@/lib/db/schema/system';
+import { auditLogs, errorEvents } from '@/lib/db/schema/system';
 import { websiteSubmissions } from '@/lib/db/schema/website-submissions';
 import { logger } from '@/lib/logger';
 import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
@@ -19,6 +19,10 @@ const AI_USAGE_RETENTION_DAYS = 90;
 /** error_events rows older than this are pruned. Migration 0040 declares
  *  this contract; the worker had no implementation until now. */
 const ERROR_EVENTS_RETENTION_DAYS = 90;
+/** audit_logs rows older than this are pruned. Mirrors error_events.
+ *  Metadata is masked at insert time but older rows have no operational
+ *  value past the window and represent residual stale-PII exposure. */
+const AUDIT_LOGS_RETENTION_DAYS = 90;
 /** Raw website inquiry payloads (website_submissions) — kept long enough
  *  to investigate "why didn't this lead reach the CRM" inbound questions
  *  but not indefinitely. 180d aligns with the typical sales cycle. */
@@ -139,6 +143,18 @@ export const maintenanceWorker = new Worker(
         );
         break;
       }
+      case 'audit-logs-retention': {
+        const cutoff = new Date(Date.now() - AUDIT_LOGS_RETENTION_DAYS * 24 * 60 * 60 * 1000);
+        const result = await db
+          .delete(auditLogs)
+          .where(lt(auditLogs.createdAt, cutoff))
+          .returning({ id: auditLogs.id });
+        logger.info(
+          { deleted: result.length, retentionDays: AUDIT_LOGS_RETENTION_DAYS },
+          'Audit logs retention sweep complete',
+        );
+        break;
+      }
       case 'website-submissions-retention': {
         // Raw inquiry payloads from the marketing-site dual-write. Keep
         // long enough to debug capture issues but not forever — these

src/lib/queue/workers/notifications.ts

@@ -5,6 +5,18 @@ import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
 import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
+import { safeUrl } from '@/lib/email/shell';
+
+/** HTML-escape user-supplied text so notification.description / .title
+ *  can't break out of the surrounding `<p>` tag or smuggle <script>. */
+function escapeHtml(s: string): string {
+  return s
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
 
 export const notificationsWorker = new Worker(
   'notifications',
@@ -62,12 +74,19 @@ export const notificationsWorker = new Worker(
           .limit(1);
         if (!authUser?.email) break;
 
+        // Subject is set as plain text (not HTML) so escaping isn't
+        // needed there, but the body interpolates `notif.description`
+        // and `notif.link` into HTML — both attacker-influenceable via
+        // any service that enqueues a notification (e.g. document title
+        // copied from user-supplied filename, reminder note text).
+        const bodyText = escapeHtml(notif.description ?? notif.title);
+        const linkHtml = notif.link
+          ? `<p><a href="${safeUrl(`${process.env.APP_URL ?? ''}${notif.link}`)}">View in CRM</a></p>`
+          : '';
         await sendEmail(
           authUser.email,
           `[Port Nimara] ${notif.title}`,
-          `<p>${notif.description ?? notif.title}</p>${
-            notif.link ? `<p><a href="${process.env.APP_URL}${notif.link}">View in CRM</a></p>` : ''
-          }`,
+          `<p>${bodyText}</p>${linkHtml}`,
         );
 
         await db

src/lib/services/client-hard-delete.service.ts

@@ -29,10 +29,10 @@
 
 import { timingSafeEqual } from 'node:crypto';
 
-import { and, eq } from 'drizzle-orm';
+import { and, eq, inArray, sql } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
-import { clients, clientMergeLog } from '@/lib/db/schema/clients';
+import { clients, clientContacts, clientMergeLog } from '@/lib/db/schema/clients';
 import { interests } from '@/lib/db/schema/interests';
 import { berthReservations } from '@/lib/db/schema/reservations';
 import { files, documents, formSubmissions } from '@/lib/db/schema/documents';
@@ -40,6 +40,7 @@ import { documentSends } from '@/lib/db/schema/brochures';
 import { emailThreads } from '@/lib/db/schema/email';
 import { reminders } from '@/lib/db/schema/operations';
 import { scratchpadNotes } from '@/lib/db/schema/system';
+import { websiteSubmissions } from '@/lib/db/schema/website-submissions';
 import { user as authUser } from '@/lib/db/schema/users';
 import { redis } from '@/lib/redis';
 import { sendEmail } from '@/lib/email';
@@ -189,6 +190,29 @@ export async function hardDeleteClient(args: {
     if (!locked) throw new NotFoundError('client');
     if (!locked.archivedAt) throw new ConflictError('Client must be archived');
 
+    // Read email contacts BEFORE the cascade so we can wipe matching
+    // website_submissions rows — that table has no clientId FK (raw
+    // inquiry-form data, pre-promotion), matched only by email in the
+    // JSONB payload. Article-17 requires removing the data subject's
+    // submitted form data too.
+    const emailContactRows = await tx
+      .select({ value: clientContacts.value })
+      .from(clientContacts)
+      .where(and(eq(clientContacts.clientId, args.clientId), eq(clientContacts.channel, 'email')));
+    const emailValues = emailContactRows
+      .map((r) => r.value.trim().toLowerCase())
+      .filter((v) => v.length > 0);
+    if (emailValues.length > 0) {
+      await tx
+        .delete(websiteSubmissions)
+        .where(
+          and(
+            eq(websiteSubmissions.portId, args.portId),
+            inArray(sql<string>`LOWER(${websiteSubmissions.payload}->>'email')`, emailValues),
+          ),
+        );
+    }
+
     // Detach nullable FKs so we keep their audit history.
     await tx.update(files).set({ clientId: null }).where(eq(files.clientId, args.clientId));
     await tx.update(documents).set({ clientId: null }).where(eq(documents.clientId, args.clientId));
@@ -265,7 +289,7 @@ function hashIds(ids: string[]): string {
   // Stable hash so the same set always produces the same key — order
   // independent. SHA-1 is more than enough for collision-avoidance on
   // a per-user keyspace.
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
+
   const { createHash } = require('node:crypto') as typeof import('node:crypto');
   const sorted = [...ids].sort().join('|');
   return createHash('sha1').update(sorted).digest('hex');

src/lib/services/error-events.service.ts

@@ -25,43 +25,52 @@ const BODY_MAX_BYTES = 1 * 1024;
 // A 5xx in /api/v1/clients (create / update) was landing full client
 // PII (full name, DOB, address, phone, nationality, email) in
 // error_events.request_body_excerpt for the super-admin inspector.
-// Extend to cover GDPR-relevant fields too.
-const SENSITIVE_KEYS = new Set([
+// Match fragments case-insensitively + snake/kebab-normalized so the
+// redactor catches `recipientEmail`, `client_email`, `phone_number`,
+// `tax_id`, `passwordHash`, etc. without an exhaustive enumeration.
+const SENSITIVE_KEY_FRAGMENTS = [
   // Credentials
   'password',
-  'newPassword',
-  'oldPassword',
   'token',
   'secret',
-  'apiKey',
-  'accessKey',
-  'secretKey',
-  'creditCard',
-  'cardNumber',
+  'api_key',
+  'apikey',
+  'access_key',
+  'secret_key',
+  'credit_card',
+  'card_number',
   'cvv',
   'ssn',
   'authorization',
+  'cookie',
   // PII
   'email',
-  'emails',
   'phone',
-  'phoneNumber',
   'mobile',
   'whatsapp',
   'dob',
-  'dateOfBirth',
+  'date_of_birth',
   'birthdate',
   'address',
   'street',
   'postcode',
   'zip',
-  'nationalId',
+  'national_id',
   'passport',
-  'taxId',
-  'fullName',
-  'firstName',
-  'lastName',
-]);
+  'iban',
+  'tax_id',
+  'taxid',
+  'full_name',
+  'fullname',
+  'first_name',
+  'last_name',
+  'recipient',
+];
+
+function isSensitiveKey(key: string): boolean {
+  const k = key.toLowerCase().replace(/[-]/g, '_');
+  return SENSITIVE_KEY_FRAGMENTS.some((frag) => k.includes(frag));
+}
 
 /** Drop sensitive keys + cap the JSON length. */
 function sanitizeBody(body: unknown): string | null {
@@ -77,7 +86,7 @@ function sanitizeBody(body: unknown): string | null {
     if (value && typeof value === 'object') {
       const out: Record<string, unknown> = {};
       for (const [k, v] of Object.entries(value)) {
-        if (SENSITIVE_KEYS.has(k)) {
+        if (isSensitiveKey(k)) {
           out[k] = '[REDACTED]';
         } else {
           out[k] = walk(v);

src/lib/services/gdpr-bundle-builder.ts

@@ -9,7 +9,7 @@
  * yacht ownership rows that resolve to this client.
  */
 
-import { and, eq, or } from 'drizzle-orm';
+import { and, eq, inArray, or, sql } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
 import { NotFoundError } from '@/lib/errors';
@@ -20,15 +20,21 @@ import {
   clientNotes,
   clientRelationships,
   clientTags,
+  clientMergeLog,
 } from '@/lib/db/schema/clients';
-import { tags } from '@/lib/db/schema/system';
+import { tags, scratchpadNotes } from '@/lib/db/schema/system';
 import { companies, companyMemberships } from '@/lib/db/schema/companies';
 import { yachts } from '@/lib/db/schema/yachts';
 import { interests } from '@/lib/db/schema/interests';
 import { berthReservations } from '@/lib/db/schema/reservations';
 import { invoices } from '@/lib/db/schema/financial';
-import { documents } from '@/lib/db/schema/documents';
+import { documents, files, formSubmissions } from '@/lib/db/schema/documents';
 import { auditLogs } from '@/lib/db/schema/system';
+import { portalUsers } from '@/lib/db/schema/portal';
+import { emailThreads, emailMessages } from '@/lib/db/schema/email';
+import { reminders, interestContactLog } from '@/lib/db/schema/operations';
+import { documentSends } from '@/lib/db/schema/brochures';
+import { websiteSubmissions } from '@/lib/db/schema/website-submissions';
 
 export interface GdprBundle {
   /** Bundle metadata for traceability. */
@@ -50,9 +56,22 @@ export interface GdprBundle {
     company: Record<string, unknown>;
   }>;
   interests: Record<string, unknown>[];
+  contactLog: Record<string, unknown>[];
   reservations: Record<string, unknown>[];
   invoices: Record<string, unknown>[];
   documents: Record<string, unknown>[];
+  files: Record<string, unknown>[];
+  formSubmissions: Record<string, unknown>[];
+  websiteSubmissions: Record<string, unknown>[];
+  documentSends: Record<string, unknown>[];
+  emailThreads: Array<{
+    thread: Record<string, unknown>;
+    messages: Record<string, unknown>[];
+  }>;
+  reminders: Record<string, unknown>[];
+  scratchpadNotes: Record<string, unknown>[];
+  portalUsers: Record<string, unknown>[];
+  mergeLog: Record<string, unknown>[];
   auditTrail: Record<string, unknown>[];
 }
 
@@ -79,6 +98,14 @@ export async function buildClientBundle(clientId: string, portId: string): Promi
     reservationRows,
     invoiceRows,
     documentRows,
+    fileRows,
+    formSubmissionRows,
+    documentSendRows,
+    threadRows,
+    reminderRows,
+    scratchpadRows,
+    portalUserRows,
+    mergeLogRows,
     auditRows,
   ] = await Promise.all([
     db.query.clientContacts.findMany({ where: eq(clientContacts.clientId, clientId) }),
@@ -127,6 +154,34 @@ export async function buildClientBundle(clientId: string, portId: string): Promi
     db.query.documents.findMany({
       where: and(eq(documents.portId, portId), eq(documents.clientId, clientId)),
     }),
+    db.query.files.findMany({
+      where: and(eq(files.portId, portId), eq(files.clientId, clientId)),
+    }),
+    db.query.formSubmissions.findMany({
+      where: eq(formSubmissions.clientId, clientId),
+    }),
+    db.query.documentSends.findMany({
+      where: and(eq(documentSends.portId, portId), eq(documentSends.clientId, clientId)),
+    }),
+    db.query.emailThreads.findMany({
+      where: and(eq(emailThreads.portId, portId), eq(emailThreads.clientId, clientId)),
+    }),
+    db.query.reminders.findMany({
+      where: and(eq(reminders.portId, portId), eq(reminders.clientId, clientId)),
+    }),
+    db.query.scratchpadNotes.findMany({
+      where: eq(scratchpadNotes.linkedClientId, clientId),
+    }),
+    db.query.portalUsers.findMany({ where: eq(portalUsers.clientId, clientId) }),
+    db.query.clientMergeLog.findMany({
+      where: and(
+        eq(clientMergeLog.portId, portId),
+        or(
+          eq(clientMergeLog.survivingClientId, clientId),
+          eq(clientMergeLog.mergedClientId, clientId),
+        ),
+      ),
+    }),
     db.query.auditLogs.findMany({
       where: and(
         eq(auditLogs.portId, portId),
@@ -138,6 +193,56 @@ export async function buildClientBundle(clientId: string, portId: string): Promi
     }),
   ]);
 
+  // Email messages are linked through threads (no direct clientId column).
+  const threadIds = threadRows.map((t) => t.id);
+  const messageRows = threadIds.length
+    ? await db.query.emailMessages.findMany({
+        where: inArray(emailMessages.threadId, threadIds),
+        orderBy: (t, { asc }) => [asc(t.sentAt)],
+      })
+    : [];
+  const messagesByThread = new Map<string, Record<string, unknown>[]>();
+  for (const m of messageRows) {
+    const list = messagesByThread.get(m.threadId) ?? [];
+    list.push(toJsonRow(m));
+    messagesByThread.set(m.threadId, list);
+  }
+  const emailThreadBundle = threadRows.map((t) => ({
+    thread: toJsonRow(t),
+    messages: messagesByThread.get(t.id) ?? [],
+  }));
+
+  // Interest contact-log has no clientId — fetch via the client's interests.
+  const interestIds = interestRows.map((i) => i.id);
+  const contactLogRows = interestIds.length
+    ? await db.query.interestContactLog.findMany({
+        where: and(
+          eq(interestContactLog.portId, portId),
+          inArray(interestContactLog.interestId, interestIds),
+        ),
+        orderBy: (t, { desc }) => [desc(t.occurredAt)],
+      })
+    : [];
+
+  // Website submissions pre-date the client record (no FK). Match by any
+  // of the client's email contacts against payload->>'email' (case-
+  // insensitive) so the bundle includes inquiry forms that became this
+  // client.
+  const emailValues = contacts
+    .filter((c) => c.channel === 'email' && c.value)
+    .map((c) => c.value.toLowerCase());
+  const websiteSubmissionRows = emailValues.length
+    ? await db
+        .select()
+        .from(websiteSubmissions)
+        .where(
+          and(
+            eq(websiteSubmissions.portId, portId),
+            inArray(sql<string>`LOWER(${websiteSubmissions.payload}->>'email')`, emailValues),
+          ),
+        )
+    : [];
+
   return {
     meta: {
       generatedAt: new Date().toISOString(),
@@ -162,9 +267,19 @@ export async function buildClientBundle(clientId: string, portId: string): Promi
       company: toJsonRow(row.company),
     })),
     interests: interestRows.map(toJsonRow),
+    contactLog: contactLogRows.map(toJsonRow),
     reservations: reservationRows.map(toJsonRow),
     invoices: invoiceRows.map(toJsonRow),
     documents: documentRows.map(toJsonRow),
+    files: fileRows.map(toJsonRow),
+    formSubmissions: formSubmissionRows.map(toJsonRow),
+    websiteSubmissions: websiteSubmissionRows.map(toJsonRow),
+    documentSends: documentSendRows.map(toJsonRow),
+    emailThreads: emailThreadBundle,
+    reminders: reminderRows.map(toJsonRow),
+    scratchpadNotes: scratchpadRows.map(toJsonRow),
+    portalUsers: portalUserRows.map(toJsonRow),
+    mergeLog: mergeLogRows.map(toJsonRow),
     auditTrail: auditRows.map(toJsonRow),
   };
 }
@@ -245,9 +360,29 @@ export function renderBundleHtml(bundle: GdprBundle): string {
       })),
     ),
     tableSection('Interests', bundle.interests),
+    tableSection('Contact log', bundle.contactLog),
     tableSection('Reservations', bundle.reservations),
     tableSection('Invoices', bundle.invoices),
     tableSection('Documents', bundle.documents),
+    tableSection('Files', bundle.files),
+    tableSection('Form submissions', bundle.formSubmissions),
+    tableSection('Website submissions (inquiry forms)', bundle.websiteSubmissions),
+    tableSection('Document sends (PDFs / brochures emailed)', bundle.documentSends),
+    tableSection(
+      'Email threads',
+      bundle.emailThreads.map((t) => ({
+        ...t.thread,
+        messageCount: t.messages.length,
+      })),
+    ),
+    tableSection(
+      'Email messages',
+      bundle.emailThreads.flatMap((t) => t.messages.map((m) => ({ threadId: t.thread.id, ...m }))),
+    ),
+    tableSection('Reminders', bundle.reminders),
+    tableSection('Scratchpad notes', bundle.scratchpadNotes),
+    tableSection('Portal users', bundle.portalUsers),
+    tableSection('Merge log', bundle.mergeLog),
     tableSection('Audit trail (last 500 events)', bundle.auditTrail),
   ].join('\n');
 

src/lib/services/port-config.ts

@@ -17,8 +17,9 @@ export const SETTING_KEYS = {
   emailFromName: 'email_from_name',
   emailFromAddress: 'email_from_address',
   emailReplyTo: 'email_reply_to',
-  emailSignatureHtml: 'email_signature_html',
-  emailFooterHtml: 'email_footer_html',
+  // email_signature_html / email_footer_html — removed; the email shell
+  // reads branding_email_header_html / branding_email_footer_html from
+  // /admin/branding, which is the source of truth.
   emailAllowPersonalAccountSends: 'email_allow_personal_account_sends',
   smtpHostOverride: 'smtp_host_override',
   smtpPortOverride: 'smtp_port_override',
@@ -120,8 +121,6 @@ export interface PortEmailConfig {
   fromName: string;
   fromAddress: string;
   replyTo: string | null;
-  signatureHtml: string | null;
-  footerHtml: string | null;
   smtpHost: string;
   smtpPort: number;
   smtpUser: string | null;
@@ -139,8 +138,6 @@ export async function getPortEmailConfig(portId: string): Promise<PortEmailConfi
     fromName,
     fromAddress,
     replyTo,
-    signatureHtml,
-    footerHtml,
     smtpHost,
     smtpPort,
     smtpUser,
@@ -150,8 +147,6 @@ export async function getPortEmailConfig(portId: string): Promise<PortEmailConfi
     readSetting<string>(SETTING_KEYS.emailFromName, portId),
     readSetting<string>(SETTING_KEYS.emailFromAddress, portId),
     readSetting<string>(SETTING_KEYS.emailReplyTo, portId),
-    readSetting<string>(SETTING_KEYS.emailSignatureHtml, portId),
-    readSetting<string>(SETTING_KEYS.emailFooterHtml, portId),
     readSetting<string>(SETTING_KEYS.smtpHostOverride, portId),
     readSetting<number>(SETTING_KEYS.smtpPortOverride, portId),
     readSetting<string>(SETTING_KEYS.smtpUserOverride, portId),
@@ -176,8 +171,6 @@ export async function getPortEmailConfig(portId: string): Promise<PortEmailConfi
     fromName: fromName ?? envFromName,
     fromAddress: fromAddress ?? envFromAddress,
     replyTo: replyTo ?? null,
-    signatureHtml: signatureHtml ?? null,
-    footerHtml: footerHtml ?? null,
     smtpHost: smtpHost ?? env.SMTP_HOST,
     smtpPort: smtpPort ?? env.SMTP_PORT,
     smtpUser: smtpUser ?? env.SMTP_USER ?? null,