Merge branch 'wave/v125-sec' into release/v1.25.0

src/app/api/insights/glp1-timeline/route.ts

@@ -12,6 +12,7 @@
 import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { apiSuccess } from "@/lib/api-response";
+import { readNote } from "@/lib/crypto/note-cipher";
 import { NextRequest } from "next/server";
 
 const DEFAULT_LIMIT = 60;
@@ -131,7 +132,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
         doseValue: dc.doseValue,
         doseUnit: dc.doseUnit,
         doseDelta: delta,
-        note: dc.note,
+        note: readNote(dc.noteEncrypted, dc.note),
       });
     }
     for (const intake of med.intakeEvents) {

src/app/api/insights/layout/route.ts

@@ -35,7 +35,7 @@ import { Prisma } from "@/generated/prisma/client";
 import { z } from "zod/v4";
 import { invalidateUserInsightsLayout } from "@/lib/cache/invalidate";
 import { cached, caches, type ServerCache } from "@/lib/cache/server-cache";
-import { redactSensitiveFields } from "@/lib/observability/redact-payload";
+import { redactForExcerpt } from "@/lib/observability/redact-payload";
 import { shouldEmitAuditRow } from "@/lib/audit-dedup";
 import type { NextRequest } from "next/server";
 
@@ -129,9 +129,7 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     // round-trip; the wide-event line carries the redacted payload
     // shape for operator debugging without leaking the raw body.
     const issues = sanitiseZodIssues(parsed.error.issues);
-    const payloadDiagnostic = buildPayloadDiagnostic(
-      redactSensitiveFields(body),
-    );
+    const payloadDiagnostic = buildPayloadDiagnostic(redactForExcerpt(body));
     annotate({
       action: { name: "insights.layout.validation-failed" },
       meta: {