@reproapp/node-sdk 0.0.3 → 0.0.5

package/test/privacy-runtime-policy.test.js

@@ -0,0 +1,2043 @@
+const assert = require('assert');
+const {
+    applyRuntimePrivacyPolicy,
+    applyRuntimePrivacyPolicyAsync,
+    clearRuntimePrivacyProvenance,
+    normalizeRuntimePrivacyPolicy,
+} = require('../dist/privacy');
+
+function policyFromStatements(statements) {
+    return normalizeRuntimePrivacyPolicy({
+        environment: 'dev',
+        groups: [{ gid: 'test', scope: 'FIELD', selector: 'field:test', statements }],
+    });
+}
+
+function policyFromStatementsAndRawTextHints(statements, rawTextHints) {
+    return normalizeRuntimePrivacyPolicy({
+        environment: 'dev',
+        rawTextHints,
+        groups: [{ gid: 'test', scope: 'FIELD', selector: 'field:test', statements }],
+    });
+}
+
+async function testSerializedJsonStringsUseNestedRulesAndFallbacks() {
+    const policy = policyFromStatements([
+        {
+            sid: 'drop-webhook-secret',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:webhookSecret',
+                target: 'db.query.metadata.webhookSecret|trace.returnValue.metadata.webhookSecret|response.body.data.metadata.webhookSecret',
+            },
+            apply: { action: 'DROP' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const rawPayload = {
+        safeOrderId: 'ORD-123',
+        caseId: 'CASE-53FE88B2',
+        paymentInstrument: {
+            cardLast4: '4242',
+            cvv: '123',
+            fullPan: '4242 4242 4242 4242',
+        },
+        metadata: {
+            webhookSecret: 'whsec_abcdefghijklmnopqrstuvwxyz',
+            providerConnection: 'postgres://drill:secret@payments.internal:5432/security',
+            providerToken: 'ghp_abcdefghijklmnopqrstuvwxyz1234567890',
+            supportEmail: 'support@example.com',
+        },
+        headersSnapshot: {
+            'x-api-key': 'rk_live_debugoverride1234567890',
+            cookie: 'sid=SessionSecret123; refresh=RefreshOverrideSecret456',
+        },
+    };
+
+    const input = {
+        command: 'set',
+        args: ['datalab:drills:by-case:CASE-53FE88B2', JSON.stringify(rawPayload)],
+    };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(policy, 'db.query', input, {
+        appId: 'APP_test',
+        appSecret: 'secret',
+        db: { type: 'redis', collection: 'redis', op: 'set' },
+    });
+    const parsed = JSON.parse(transformed.args[1]);
+
+    assert.strictEqual(transformed.args[0], 'datalab:drills:by-case:CASE-53FE88B2');
+    assert.strictEqual(parsed.safeOrderId, 'ORD-123');
+    assert.strictEqual(parsed.caseId, 'CASE-53FE88B2');
+    assert.strictEqual(parsed.paymentInstrument.cardLast4, '[dropped]');
+    assert.strictEqual(parsed.paymentInstrument.cvv, '[dropped]');
+    assert.strictEqual(parsed.paymentInstrument.fullPan, '[dropped]');
+    assert.strictEqual(parsed.metadata.webhookSecret, '[dropped]');
+    assert.strictEqual(parsed.metadata.providerConnection, '[dropped]');
+    assert.strictEqual(parsed.metadata.providerToken, '[dropped]');
+    assert.match(parsed.metadata.supportEmail, /^email_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(parsed.headersSnapshot['x-api-key'], '[dropped]');
+    assert.strictEqual(parsed.headersSnapshot.cookie, '[dropped]');
+}
+
+async function testLongSerializedJsonStringsAreTransformedBeforeTruncation() {
+    const rawPayload = {
+        id: '69ed2d5c585264544573ea4f',
+        safeOrderId: 'ORD-123',
+        padding: 'x'.repeat(3000),
+        nested: {
+            cardLast4: '4242',
+            cvv: '123',
+            apiKey: 'rk_live_debugoverride1234567890',
+            customerEmail: 'john@example.com',
+        },
+    };
+    const input = { args: ['cache:key:69ed2d5c585264544573ea4f', JSON.stringify(rawPayload)] };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(null, 'db.query', input, {
+        appId: 'APP_test',
+        appSecret: 'secret',
+        db: { type: 'redis', collection: 'redis', op: 'set' },
+    });
+    const parsed = JSON.parse(transformed.args[1]);
+
+    assert.strictEqual(parsed.id, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(parsed.safeOrderId, 'ORD-123');
+    assert.strictEqual(parsed.nested.cardLast4, '[dropped]');
+    assert.strictEqual(parsed.nested.cvv, '[dropped]');
+    assert.strictEqual(parsed.nested.apiKey, '[dropped]');
+    assert.match(parsed.nested.customerEmail, /^email_tok_[a-f0-9]{12}$/);
+}
+
+async function testSerializedRedisPayloadTokenizesNestedReviewerIdentity() {
+    const rawPayload = {
+        id: '69ee0619a8e4553a9905c0c6',
+        reference: 'SLB-MOFR1QG7-TBAMUA',
+        providerPayload: {
+            reviewer: {
+                name: 'Mira Sentinel',
+                email: 'signal.reviewer@example.com',
+            },
+            system: {
+                component: 'gateway-router',
+                environment: 'sandbox',
+            },
+        },
+        snapshot: {
+            providerPayload: {
+                reviewer: {
+                    name: 'Mira Sentinel',
+                    email: 'signal.reviewer@example.com',
+                },
+            },
+        },
+    };
+    const input = {
+        args: ['signallab:drills:by-id:69ee0619a8e4553a9905c0c6', JSON.stringify(rawPayload)],
+    };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(null, 'db.query', input, {
+        appId: 'APP_test',
+        appSecret: 'secret',
+        db: { type: 'redis', collection: 'redis', op: 'set' },
+    });
+    const parsed = JSON.parse(transformed.args[1]);
+    const serialized = JSON.stringify(parsed);
+
+    assert(!serialized.includes('Mira Sentinel'), serialized);
+    assert(!serialized.includes('signal.reviewer@example.com'), serialized);
+    assert.match(parsed.providerPayload.reviewer.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.providerPayload.reviewer.email, /^email_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.snapshot.providerPayload.reviewer.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.snapshot.providerPayload.reviewer.email, /^email_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(parsed.providerPayload.system.component, 'gateway-router');
+    assert.strictEqual(parsed.providerPayload.system.environment, 'sandbox');
+}
+
+async function testSummarizedSerializedJsonKeepsOperationalLeavesReadable() {
+    const policy = policyFromStatements([
+        {
+            sid: 'summarize-serialized-provider-payload',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:serializedProviderPayload',
+                target: 'db.query.args[1].serializedProviderPayload',
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 1 },
+        },
+    ]);
+    const serializedProviderPayload = JSON.stringify({
+        providerPayload: {
+            provider: 'signallab-risk-router-v2',
+            status: 'blocked',
+            reasonCode: 'secret_rotation_required',
+            system: {
+                component: 'gateway-router',
+                environment: 'sandbox',
+                region: 'us-west-2',
+            },
+            workflow: {
+                lane: 'rollback-review-high',
+                taskStatus: 'todo',
+            },
+            reviewer: {
+                name: 'Mira Sentinel',
+                email: 'signal.reviewer@example.com',
+            },
+            credentials: {
+                webhookSecret: 'whsec_abcdefghijklmnopqrstuvwxyz',
+            },
+        },
+        evidence: [
+            {
+                step: 'operator-review',
+                status: 'queued',
+                safeLane: 'rollback-review-high',
+            },
+        ],
+        headersSnapshot: {
+            'x-workflow-stage': 'tenant-signal-review',
+        },
+    });
+    const input = {
+        args: [
+            'signallab:drills:activity',
+            JSON.stringify({ serializedProviderPayload }),
+        ],
+    };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(policy, 'db.query', input, {
+        appId: 'APP_test',
+        appSecret: 'secret',
+        db: { type: 'redis', collection: 'redis', op: 'lpush' },
+    });
+    const parsed = JSON.parse(transformed.args[1]);
+    const serialized = JSON.parse(parsed.serializedProviderPayload);
+
+    assert.strictEqual(serialized.providerPayload.provider, 'signallab-risk-router-v2');
+    assert.strictEqual(serialized.providerPayload.status, 'blocked');
+    assert.strictEqual(serialized.providerPayload.reasonCode, 'secret_rotation_required');
+    assert.strictEqual(serialized.providerPayload.system.component, 'gateway-router');
+    assert.strictEqual(serialized.providerPayload.system.environment, 'sandbox');
+    assert.strictEqual(serialized.providerPayload.system.region, 'us-west-2');
+    assert.strictEqual(serialized.providerPayload.workflow.lane, 'rollback-review-high');
+    assert.strictEqual(serialized.evidence[0].step, 'operator-review');
+    assert.strictEqual(serialized.evidence[0].safeLane, 'rollback-review-high');
+    assert.strictEqual(serialized.headersSnapshot['x-workflow-stage'], 'tenant-signal-review');
+    assert.match(serialized.providerPayload.reviewer.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(serialized.providerPayload.reviewer.email, /^email_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(serialized.providerPayload.credentials.webhookSecret, '[dropped]');
+}
+
+async function testEmptyArrayBracketTargetsMatchArrayItems() {
+    const policy = policyFromStatements([
+        {
+            sid: 'summarize-description',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:description',
+                target: 'response.body.data[].payload.description',
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'known-signal-description',
+            when: {
+                scope: 'PATTERN',
+                selector: 'signal-lab-description-template',
+                target: 'response.body.data[].payload.description',
+                pattern: '^SignalLab incident\\s',
+            },
+            apply: {
+                action: 'KEEP_EXACT',
+                textPolicy: {
+                    mode: 'KNOWN_TEMPLATE',
+                    fragments: [
+                        { kind: 'literal', text: 'SignalLab incident ' },
+                        { kind: 'slot', label: 'safeSignalId', action: 'KEEP_EXACT' },
+                        { kind: 'literal', text: ': feature-flag rollback is queued for verification.' },
+                    ],
+                },
+            },
+            meta: { priority: 2 },
+        },
+    ]);
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'response.body',
+        {
+            data: [
+                {
+                    payload: {
+                        description: 'SignalLab incident SIG-FLHIRS2N: feature-flag rollback is queued for verification.',
+                    },
+                },
+            ],
+        },
+        { appId: 'APP_test', routeKey: 'GET /api/integrations/payment-events' },
+    );
+
+    assert.strictEqual(
+        transformed.data[0].payload.description,
+        'SignalLab incident SIG-FLHIRS2N: feature-flag rollback is queued for verification.',
+    );
+}
+
+async function testKnownEvidenceMessagesApplyInsideWrappersAndSerializedPayloads() {
+    const evidenceMessageTargets = [
+        'response.body.data[].payload.evidence[].message',
+        'response.body.data[].payload.serializedProviderPayload.evidence[].message',
+        'db.query.doc.payload.evidence[].message',
+        'db.query.doc.payload.serializedProviderPayload.evidence[].message',
+        'trace.returnValue[].payload.evidence[].message',
+        'trace.returnValue[].payload.serializedProviderPayload.evidence[].message',
+    ].join('|');
+    const policy = policyFromStatements([
+        {
+            sid: 'summarize-evidence-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:message',
+                target: evidenceMessageTargets,
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'known-webhook-evidence-message',
+            when: {
+                scope: 'PATTERN',
+                selector: 'signal-lab-evidence-webhook-message-template',
+                target: evidenceMessageTargets,
+                pattern: '^Webhook for\\s',
+            },
+            apply: {
+                action: 'KEEP_EXACT',
+                textPolicy: {
+                    mode: 'KNOWN_TEMPLATE',
+                    fragments: [
+                        { kind: 'literal', text: 'Webhook for ' },
+                        { kind: 'slot', label: 'email', action: 'TOKENIZE' },
+                        { kind: 'literal', text: ' failed on ' },
+                        { kind: 'slot', label: 'safeSignalId', action: 'KEEP_EXACT' },
+                        { kind: 'literal', text: '; provider returned token ' },
+                        { kind: 'slot', label: 'providerToken', action: 'DROP' },
+                        { kind: 'literal', text: '.' },
+                    ],
+                },
+            },
+            meta: { priority: 2 },
+        },
+        {
+            sid: 'known-operator-evidence-message',
+            when: {
+                scope: 'PATTERN',
+                selector: 'signal-lab-evidence-operator-message-template',
+                target: evidenceMessageTargets,
+                pattern: '^Keep task\\s"',
+            },
+            apply: {
+                action: 'KEEP_EXACT',
+                textPolicy: {
+                    mode: 'KNOWN_TEMPLATE',
+                    fragments: [
+                        { kind: 'literal', text: 'Keep task "' },
+                        { kind: 'slot', label: 'taskTitle', action: 'KEEP_EXACT' },
+                        { kind: 'literal', text: '" in review lane until signal clears for ' },
+                        { kind: 'slot', label: 'safeSignalId', action: 'KEEP_EXACT' },
+                        { kind: 'literal', text: '.' },
+                    ],
+                },
+            },
+            meta: { priority: 3 },
+        },
+        {
+            sid: 'known-serialized-evidence-message',
+            when: {
+                scope: 'PATTERN',
+                selector: 'signal-lab-evidence-serialized-message-template',
+                target: evidenceMessageTargets,
+                pattern: '^\\{"safeSignalId"',
+            },
+            apply: {
+                action: 'KEEP_EXACT',
+                textPolicy: {
+                    mode: 'KNOWN_TEMPLATE',
+                    fragments: [
+                        { kind: 'literal', text: '{"safeSignalId":"' },
+                        { kind: 'slot', label: 'safeSignalId', action: 'KEEP_EXACT' },
+                        { kind: 'literal', text: '","email":"' },
+                        { kind: 'slot', label: 'email', action: 'TOKENIZE' },
+                        { kind: 'literal', text: '","token":"' },
+                        { kind: 'slot', label: 'providerToken', action: 'DROP' },
+                        { kind: 'literal', text: '","card":"' },
+                        { kind: 'slot', label: 'card', action: 'DROP' },
+                        { kind: 'literal', text: '","connection":"' },
+                        { kind: 'slot', label: 'connection', action: 'DROP' },
+                        { kind: 'literal', text: '"}' },
+                    ],
+                },
+            },
+            meta: { priority: 4 },
+        },
+    ]);
+
+    const evidence = [
+        {
+            message: 'Webhook for john@example.com failed on SIG-FLHIRS2N; provider returned token sk_live_signallab1234567890abcdef.',
+        },
+        {
+            message: 'Keep task "SignalLab Drill 16:07:13 for john@example.com" in review lane until signal clears for SIG-FLHIRS2N.',
+        },
+        {
+            message: JSON.stringify({
+                safeSignalId: 'SIG-FLHIRS2N',
+                email: 'john@example.com',
+                token: 'ghp_abcdefghijklmnopqrstuvwxyz1234567890',
+                card: '4242 4242 4242 4242',
+                connection: 'redis://:secret@signal-lab.internal:6379/0',
+            }),
+        },
+    ];
+    const input = {
+        data: [
+            {
+                payload: {
+                    evidence,
+                    serializedProviderPayload: JSON.stringify({ evidence }),
+                },
+            },
+        ],
+    };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'response.body',
+        input,
+        { appId: 'APP_test', routeKey: 'GET /api/integrations/payment-events' },
+    );
+    const messages = transformed.data[0].payload.evidence.map((item) => item.message);
+    const serialized = JSON.parse(transformed.data[0].payload.serializedProviderPayload);
+    const serializedMessages = serialized.evidence.map((item) => item.message);
+
+    for (const message of [...messages, ...serializedMessages]) {
+        assert(!message.includes('john@example.com'), message);
+        assert(!message.includes('sk_live_signallab1234567890abcdef'), message);
+        assert(!message.includes('ghp_abcdefghijklmnopqrstuvwxyz1234567890'), message);
+        assert(!message.includes('4242 4242 4242 4242'), message);
+        assert(!message.includes('redis://:secret@signal-lab.internal:6379/0'), message);
+        assert(!message.includes('Web..ok'), message);
+        assert(!message.includes('Sig..Lab'), message);
+    }
+
+    assert.match(messages[0], /^Webhook for email_tok_[a-f0-9]{12} failed on SIG-FLHIRS2N; provider returned token \[dropped\]\.$/);
+    assert.match(
+        messages[1],
+        /^Keep task "SignalLab Drill 16:07:13 for email_tok_[a-f0-9]{12}" in review lane until signal clears for SIG-FLHIRS2N\.$/,
+    );
+    assert.match(
+        messages[2],
+        /^\{"safeSignalId":"SIG-FLHIRS2N","email":"email_tok_[a-f0-9]{12}","token":"\[dropped\]","card":"\[dropped\]","connection":"\[dropped\]"\}$/,
+    );
+    assert.deepStrictEqual(serializedMessages, messages);
+}
+
+async function testSerializedJsonIsNotDroppedAsAtomicSecretText() {
+    const policy = policyFromStatements([
+        {
+            sid: 'secret-pattern',
+            when: {
+                scope: 'PATTERN',
+                selector: 'baseline-secrets',
+                target: 'response.body',
+                pattern: 'whsec_[A-Za-z0-9_]+',
+            },
+            apply: { action: 'DROP' },
+            meta: { priority: 1 },
+        },
+    ]);
+    const serializedProviderPayload = JSON.stringify({
+        providerPayload: {
+            provider: 'signallab-risk-router-v2',
+            system: {
+                component: 'gateway-router',
+            },
+            reviewer: {
+                name: 'Mira Sentinel',
+                email: 'signal.reviewer@example.com',
+            },
+            credentials: {
+                webhookSecret: 'whsec_abcdefghijklmnopqrstuvwxyz',
+            },
+        },
+    });
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(
+        policy,
+        'response.body',
+        { data: { serializedProviderPayload } },
+        { appId: 'APP_test' },
+    );
+    const parsed = JSON.parse(transformed.data.serializedProviderPayload);
+
+    assert.strictEqual(parsed.providerPayload.provider, 'signallab-risk-router-v2');
+    assert.strictEqual(parsed.providerPayload.system.component, 'gateway-router');
+    assert.match(parsed.providerPayload.reviewer.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.providerPayload.reviewer.email, /^email_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(parsed.providerPayload.credentials.webhookSecret, '[dropped]');
+}
+
+function testOperationalIdsDoNotFallbackMaskOrLookLikeCreditCards() {
+    const policy = policyFromStatements([
+        {
+            sid: 'summarize-cache-key',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:getCaseCacheKey',
+                target: 'trace.returnValue',
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const cacheKey = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.returnValue',
+        'datalab:drills:by-case:CASE-53FE88B2',
+        { trace: { fn: 'getCaseCacheKey' }, appId: 'APP_test' },
+    );
+    assert.strictEqual(cacheKey, 'datalab:drills:by-case:CASE-53FE88B2');
+
+    const headers = applyRuntimePrivacyPolicy(null, 'request.headers', {
+        'x-bug-request-start': '1777148070302',
+        'x-repro-request-rid': '1777148070302-2d2r7',
+        'x-repro-trace-id': '1777148070302-2d2r7',
+        'x-safe-order-id': 'ORD-123',
+    }, { appId: 'APP_test' });
+
+    assert.strictEqual(headers['x-bug-request-start'], '1777148070302');
+    assert.strictEqual(headers['x-repro-request-rid'], '1777148070302-2d2r7');
+    assert.strictEqual(headers['x-repro-trace-id'], '1777148070302-2d2r7');
+    assert.strictEqual(headers['x-safe-order-id'], 'ORD-123');
+}
+
+function testPlainObjectsWithIdAreNotCollapsedToObjectId() {
+    const input = {
+        success: true,
+        data: {
+            id: '69ed2d5c585264544573ea4f',
+            amount: 867.53,
+            status: 'failed',
+            customerEmail: 'john@example.com',
+            cardLast4: '4242',
+        },
+    };
+
+    const transformed = applyRuntimePrivacyPolicy(null, 'response.body', input, { appId: 'APP_test' });
+
+    assert.strictEqual(transformed.success, true);
+    assert.strictEqual(transformed.data.id, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(transformed.data.amount, 867.53);
+    assert.strictEqual(transformed.data.status, 'failed');
+    assert.match(transformed.data.customerEmail, /^email_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(transformed.data.cardLast4, '[dropped]');
+}
+
+function testNestedIdentityFieldsUseGenericSemanticFallback() {
+    const input = {
+        providerPayload: {
+            customer: {
+                id: 'cust_external_123',
+                name: 'Example Customer',
+                email: 'customer@example.com',
+                accountId: 'acct_external_456',
+            },
+            incidentOwner: {
+                name: 'Example Owner',
+                email: 'owner@example.com',
+            },
+            routing: {
+                taskId: '69ed2d5c585264544573ea4f',
+                status: 'declined',
+                queue: 'risk-review-high',
+            },
+        },
+        accountId: 'acct_top_level_789',
+        safeOrderId: 'ORD-123',
+        status: 'failed',
+    };
+
+    const transformed = applyRuntimePrivacyPolicy(null, 'response.body', input, { appId: 'APP_test' });
+
+    assert.match(transformed.providerPayload.customer.id, /^id_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.providerPayload.customer.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.providerPayload.customer.email, /^email_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.providerPayload.customer.accountId, /^accountId_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.providerPayload.incidentOwner.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.providerPayload.incidentOwner.email, /^email_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.accountId, /^accountId_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(transformed.providerPayload.routing.taskId, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(transformed.providerPayload.routing.status, 'declined');
+    assert.strictEqual(transformed.providerPayload.routing.queue, 'risk-review-high');
+    assert.strictEqual(transformed.safeOrderId, 'ORD-123');
+    assert.strictEqual(transformed.status, 'failed');
+}
+
+function testObjectTokenizePreservesStructure() {
+    const policy = policyFromStatements([
+        {
+            sid: 'bad-container-tokenize',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:badContainerRule',
+                target: 'trace.args[0]',
+            },
+            apply: { action: 'TOKENIZE' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const input = [{
+        status: 'failed',
+        customer: {
+            name: 'Data Lab Customer',
+            accountId: 'acct_datalab_1024',
+        },
+        safeOrderId: 'ORD-123',
+    }];
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'trace.args', input, {
+        appId: 'APP_test',
+        trace: { fn: 'badContainerRule' },
+    });
+
+    assert(Array.isArray(transformed));
+    assert.strictEqual(typeof transformed[0], 'object');
+    assert(!Object.prototype.hasOwnProperty.call(transformed[0], 'token'));
+    assert.match(transformed[0].status, /^status_tok_[a-f0-9]{12}$/);
+    assert.match(transformed[0].customer.name, /^name_tok_[a-f0-9]{12}$/);
+    assert.match(transformed[0].customer.accountId, /^accountId_tok_[a-f0-9]{12}$/);
+    assert.match(transformed[0].safeOrderId, /^safeOrderId_tok_[a-f0-9]{12}$/);
+}
+
+async function testTopLevelKnownTextPolicyIsAcceptedInSerializedValues() {
+    const policy = policyFromStatements([
+        {
+            sid: 'known-status-note',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:statusNote',
+                target: 'db.after.statusNote|db.resultMeta.result.statusNote',
+            },
+            apply: { action: 'KEEP_EXACT' },
+            textPolicy: {
+                mode: 'KNOWN_TEMPLATE',
+                fragments: [
+                    { kind: 'literal', text: 'Manual review owner' },
+                    { kind: 'slot', label: 'incidentOwnerName', action: 'TOKENIZE' },
+                    { kind: 'literal', text: 'can debug' },
+                    { kind: 'slot', label: 'safeOrderId', action: 'KEEP_EXACT' },
+                    { kind: 'literal', text: ', but provider token' },
+                    { kind: 'slot', label: 'providerToken', action: 'DROP' },
+                    { kind: 'literal', text: 'must never be logged raw.' },
+                ],
+            },
+            meta: { priority: 1 },
+        },
+    ]);
+    const input = {
+        args: [
+            'datalab:drills:by-case:CASE-53FE88B2',
+            JSON.stringify({
+                statusNote: 'Manual review owner Jane Security can debug ORD-123, but provider token ghp_abcdefghijklmnopqrstuvwxyz1234567890 must never be logged raw.',
+            }),
+        ],
+    };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(policy, 'db.query', input, {
+        appId: 'APP_test',
+        appSecret: 'secret',
+        db: { type: 'redis', collection: 'redis', op: 'set' },
+    });
+    const parsed = JSON.parse(transformed.args[1]);
+
+    assert(!parsed.statusNote.includes('Jane Security'), parsed.statusNote);
+    assert(!parsed.statusNote.includes('ghp_abcdefghijklmnopqrstuvwxyz1234567890'), parsed.statusNote);
+    assert.match(
+        parsed.statusNote,
+        /^Manual review owner incidentOwnerName_tok_[a-f0-9]{12} can debug ORD-123, but provider token \[dropped\] must never be logged raw\.$/,
+    );
+}
+
+function testUnknownFreeTextLeafStaysExactWithoutExplicitRawMode() {
+    const input = {
+        success: true,
+        data: {
+            status: 'failed',
+            safeOrderId: 'ORD-123',
+            statusNote: 'Manual review owner Jane Security can debug ORD-123, but provider token ghp_abcdefghijklmnopqrstuvwxyz1234567890 must never be logged raw.',
+        },
+    };
+
+    const transformed = applyRuntimePrivacyPolicy(null, 'response.body', input, { appId: 'APP_test' });
+
+    assert.strictEqual(transformed.success, true);
+    assert.strictEqual(transformed.data.status, 'failed');
+    assert.strictEqual(transformed.data.safeOrderId, 'ORD-123');
+    assert.strictEqual(
+        transformed.data.statusNote,
+        input.data.statusNote,
+    );
+}
+
+function testRawTextRegexHintsPreserveUnmatchedTextWhenExplicitlyEnabled() {
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'raw-provider-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'message',
+                target: 'response.body.data.message',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Internal username',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\busr_[a-z0-9]{8}\\b',
+            tokenLabel: 'internalUsername',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: {
+            message: 'Provider rejected usr_ab12cd34 for john@example.com using token ghp_abcdefghijklmnopqrstuvwxyz1234567890 for order ORD-123',
+        },
+    }, { appId: 'APP_test' });
+
+    assert.match(
+        transformed.data.message,
+        /^Provider rejected internalUsername_tok_[a-f0-9]{12} for email_tok_[a-f0-9]{12} using token ghp_abcdefghijklmnopqrstuvwxyz1234567890 for order ORD-123$/,
+    );
+    assert(!transformed.data.message.includes('usr_ab12cd34'), transformed.data.message);
+    assert(!transformed.data.message.includes('john@example.com'), transformed.data.message);
+    assert(!transformed.data.message.includes('Pro..er'), transformed.data.message);
+}
+
+function testRawTextRegexHintsSupportMultipleActionsOnSameRawString() {
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'raw-provider-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'message',
+                target: 'response.body.data.message',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Opaque diagnostic',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'opaqueDiagnostic',
+        },
+        {
+            name: 'Provider secret',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'DROP',
+            regex: '\\bsk_live_[A-Za-z0-9_-]{8,128}\\b',
+            tokenLabel: 'providerSecret',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: {
+            message: 'Provider returned opaque ZXQABCDEF123456A19KLM with token sk_live_privacy_abcdef12345678 for order ORD-123',
+        },
+    }, { appId: 'APP_test' });
+
+    assert.match(
+        transformed.data.message,
+        /^Provider returned opaque opaqueDiagnostic_tok_[a-f0-9]{12} with token \[dropped\] for order ORD-123$/,
+    );
+    assert(!transformed.data.message.includes('ZXQABCDEF123456A19KLM'), transformed.data.message);
+    assert(!transformed.data.message.includes('sk_live_privacy_abcdef12345678'), transformed.data.message);
+    assert(!transformed.data.message.includes('Pro..er'), transformed.data.message);
+}
+
+function testRegexAssistedRawTextRuleBeatsSamePathSafePartialMask() {
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'copied-raw-narrative-safe',
+            when: {
+                scope: 'FIELD',
+                selector: 'rawNarrative',
+                target: 'response.body.data.rawNarrative',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'reviewed-raw-narrative-regex',
+            when: {
+                scope: 'FIELD',
+                selector: 'rawNarrative',
+                target: 'response.body.data.rawNarrative',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Opaque diagnostic detector',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'opaqueDiagnostic',
+        },
+    ]);
+
+    const rawNarrative = 'Provider narrative contains token A1b2C3d4E5f6G7h8J9k0L1m2 and opaque ZXQABCDEF123456A19KLM for debugging.';
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: { rawNarrative },
+    }, { appId: 'APP_test' });
+
+    assert.match(
+        transformed.data.rawNarrative,
+        /^Provider narrative contains token A1b2C3d4E5f6G7h8J9k0L1m2 and opaque opaqueDiagnostic_tok_[a-f0-9]{12} for debugging\.$/,
+    );
+    assert(!transformed.data.rawNarrative.includes('ZXQABCDEF123456A19KLM'), transformed.data.rawNarrative);
+    assert(!transformed.data.rawNarrative.includes('Pro..er'), transformed.data.rawNarrative);
+}
+
+function testSyncSafePartialRawTextRunsBuiltInDetectorsBeforeMasking() {
+    const policy = policyFromStatements([
+        {
+            sid: 'raw-narrative-safe',
+            when: {
+                scope: 'FIELD',
+                selector: 'rawNarrative',
+                target: 'response.body.data.rawNarrative',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const rawNarrative = 'Provider narrative includes authorization Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA== and connection postgres://user:pass@localhost:5432/app.';
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: { rawNarrative },
+    }, { appId: 'APP_test' });
+
+    assert(transformed.data.rawNarrative.includes('[auth-token]'), transformed.data.rawNarrative);
+    assert(transformed.data.rawNarrative.includes('[connection-string]'), transformed.data.rawNarrative);
+    assert(!transformed.data.rawNarrative.includes('Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA=='), transformed.data.rawNarrative);
+    assert(!transformed.data.rawNarrative.includes('postgres://user:pass@localhost:5432/app'), transformed.data.rawNarrative);
+}
+
+function testRawTextRegexHintsPreferCurrentPathLabel() {
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'opaque-diagnostic',
+            when: {
+                scope: 'FIELD',
+                selector: 'opaqueDiagnostic',
+                target: 'response.body.data.metadata.opaqueDiagnostic',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'opaque-trace-id',
+            when: {
+                scope: 'FIELD',
+                selector: 'opaqueTraceId',
+                target: 'response.body.data.opaqueTraceId',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Opaque diagnostic',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[A-Z0-9-]{8,80}\\b',
+            tokenLabel: 'opaqueDiagnostic',
+        },
+        {
+            name: 'Opaque trace id',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[A-Z0-9-]{8,80}\\b',
+            tokenLabel: 'opaqueTraceId',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: {
+            metadata: {
+                opaqueDiagnostic: 'ZXQ9ABCD9911KLM',
+            },
+            opaqueTraceId: 'ZXQ9ABCD9911KLM-SEC-MOJXXOIH',
+        },
+    }, { appId: 'APP_test' });
+
+    assert.match(transformed.data.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.data.opaqueTraceId, /^opaqueTraceId_tok_[a-f0-9]{12}$/);
+}
+
+function testRawTextRegexHintsDoNotRunWithoutExplicitRawTextMode() {
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'default-provider-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'message',
+                target: 'response.body.data.message',
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Internal username',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\busr_[a-z0-9]{8}\\b',
+            tokenLabel: 'internalUsername',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: {
+            message: 'Provider rejected usr_ab12cd34 for john@example.com',
+        },
+    }, { appId: 'APP_test' });
+
+    assert(!transformed.data.message.includes('internalUsername_tok_'), transformed.data.message);
+    assert(!transformed.data.message.includes('john@example.com'), transformed.data.message);
+    assert.strictEqual(
+        transformed.data.message,
+        'Provider rejected usr_ab12cd34 for email_tok_855f96e983f1',
+    );
+}
+
+function testRegexAssistedRawTextWithoutHintsKeepsUnmatchedTextExact() {
+    const policy = policyFromStatements([
+        {
+            sid: 'raw-provider-message-without-hints',
+            when: {
+                scope: 'FIELD',
+                selector: 'message',
+                target: 'response.body.data.message',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: {
+            message: 'Provider rejected usr_ab12cd34 for john@example.com',
+        },
+    }, { appId: 'APP_test' });
+
+    assert(!transformed.data.message.includes('john@example.com'), transformed.data.message);
+    assert.strictEqual(
+        transformed.data.message,
+        'Provider rejected usr_ab12cd34 for email_tok_855f96e983f1',
+    );
+}
+
+function testRawTextRegexHintsDoNotRunOnStructuredFields() {
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'unrelated-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'message',
+                target: 'response.body.data.message',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Internal username',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\busr_[a-z0-9]{8}\\b',
+            tokenLabel: 'internalUsername',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(policy, 'response.body', {
+        data: {
+            actor: 'usr_ab12cd34',
+        },
+    }, { appId: 'APP_test' });
+
+    assert.strictEqual(transformed.data.actor, 'usr_ab12cd34');
+}
+
+function testExactSensitiveTargetBeatsExactFunctionKeepExact() {
+    const policy = policyFromStatements([
+        {
+            sid: 'function-keep-positional-owner',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:DataDrillsService.buildProviderPayload',
+                target: 'trace.args[4]',
+            },
+            apply: { action: 'KEEP_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'field-tokenize-positional-owner',
+            when: {
+                scope: 'FIELD',
+                selector: 'field:incidentOwnerName',
+                target: 'trace.args[4]',
+            },
+            apply: { action: 'TOKENIZE' },
+            meta: { priority: 2 },
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [{ taskId: '69ed2d5c585264544573ea4f' }, 'ORD-123', 'CASE-123', 'john@example.com', 'Jane Security'],
+        {
+            appId: 'APP_test',
+            trace: { fn: 'DataDrillsService.buildProviderPayload' },
+        },
+    );
+
+    assert.strictEqual(transformed[1], 'ORD-123');
+    assert.strictEqual(transformed[2], 'CASE-123');
+    assert.match(transformed[3], /^email_tok_[a-f0-9]{12}$/);
+    assert.match(transformed[4], /^4_tok_[a-f0-9]{12}$/);
+}
+
+function testBroadFunctionKeepExactKeepsNestedFreeTextExactUntilReviewed() {
+    const policy = policyFromStatements([
+        {
+            sid: 'function-keep-return-container',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:IntegrationsService.runDataLabDrillForTask',
+                target: 'trace.returnValue',
+            },
+            apply: { action: 'KEEP_EXACT' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.returnValue',
+        {
+            status: 'failed',
+            safeOrderId: 'ORD-123',
+            statusNote: 'Manual review owner Jane Security can debug ORD-123, but provider token ghp_abcdefghijklmnopqrstuvwxyz1234567890 must never be logged raw.',
+        },
+        {
+            appId: 'APP_test',
+            trace: { fn: 'IntegrationsService.runDataLabDrillForTask' },
+        },
+    );
+
+    assert.strictEqual(transformed.status, 'failed');
+    assert.strictEqual(transformed.safeOrderId, 'ORD-123');
+    assert.strictEqual(
+        transformed.statusNote,
+        'Manual review owner Jane Security can debug ORD-123, but provider token ghp_abcdefghijklmnopqrstuvwxyz1234567890 must never be logged raw.',
+    );
+}
+
+function testRawHeaderTimestampsAreNotTreatedAsCards() {
+    const input = {
+        rawHeaders: [
+            'X-Bug-Request-Start',
+            '1777157149184',
+            'X-Repro-Request-Rid',
+            '1777157149184-2gctv',
+            'X-Safe-Order-Id',
+            'ORD-123',
+        ],
+    };
+
+    const transformed = applyRuntimePrivacyPolicy(null, 'trace.args', input, { appId: 'APP_test' });
+
+    assert.deepStrictEqual(transformed.rawHeaders, input.rawHeaders);
+}
+
+function testKafkaTimestampsAreNotTreatedAsCards() {
+    const input = [{
+        message: {
+            timestamp: '1777161230133',
+            batchContext: {
+                firstTimestamp: '1777161230133',
+                maxTimestamp: '1777161230142',
+            },
+        },
+    }];
+
+    const transformed = applyRuntimePrivacyPolicy(null, 'trace.args', input, { appId: 'APP_test' });
+
+    assert.deepStrictEqual(transformed, input);
+}
+
+function testFreeTextStillRedactsKnownSensitiveValues() {
+    const text = 'Payment failed for john@example.com with card 4242 4242 4242 4242 and authorization Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA==';
+    const transformed = applyRuntimePrivacyPolicy(null, 'trace.returnValue', text, { appId: 'APP_test' });
+
+    assert(!transformed.includes('john@example.com'), transformed);
+    assert(!transformed.includes('4242 4242 4242 4242'), transformed);
+    assert(!transformed.includes('Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA=='), transformed);
+    assert.match(transformed, /email_tok_[a-f0-9]{12}/);
+    assert(transformed.includes('[credit-card]'), transformed);
+    assert(transformed.includes('[auth-token]'), transformed);
+}
+
+async function testAuthLikeNestedFieldsDropWholeValueAndKeepReadableSpacing() {
+    const input = {
+        debugOverride: {
+            headerAuthorization: 'Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA==',
+        },
+        message: 'Payment failed for john@example.com on order ORD-123 with card 4242 4242 4242 4242 and authorization Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA==',
+        safeFeatureFlag: 'privacy-policy-v2',
+        safeQueue: 'risk-review-high',
+        safeRegion: 'us-east-1',
+        workflowStage: 'provider-callback-review',
+    };
+
+    const transformed = await applyRuntimePrivacyPolicyAsync(null, 'db.query', input, {
+        appId: 'APP_test',
+        appSecret: 'secret',
+    });
+
+    assert.strictEqual(transformed.debugOverride.headerAuthorization, '[dropped]');
+    assert.match(
+        transformed.message,
+        /^Payment failed for email_tok_[a-f0-9]{12} on order ORD-123 with card \[credit-card\] and authorization \[auth-token\]$/,
+    );
+    assert.strictEqual(transformed.safeFeatureFlag, 'privacy-policy-v2');
+    assert.strictEqual(transformed.safeQueue, 'risk-review-high');
+    assert.strictEqual(transformed.safeRegion, 'us-east-1');
+    assert.strictEqual(transformed.workflowStage, 'provider-callback-review');
+}
+
+function testKnownTextPolicyNormalizesGluedSlots() {
+    const policy = policyFromStatements([
+        {
+            sid: 'known-text',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:formatFailure',
+                target: 'trace.returnValue',
+            },
+            apply: {
+                action: 'KEEP_EXACT',
+                textPolicy: {
+                    mode: 'KNOWN_TEMPLATE',
+                    fragments: [
+                        { kind: 'literal', text: 'Payment failed for' },
+                        { kind: 'slot', label: 'email', action: 'TOKENIZE' },
+                        { kind: 'literal', text: 'on order ' },
+                        { kind: 'slot', label: 'orderId', action: 'KEEP_EXACT' },
+                    ],
+                },
+            },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.returnValue',
+        'Payment failed forjohn@example.comon order ORD-123',
+        { appId: 'APP_test', trace: { fn: 'formatFailure' } },
+    );
+
+    assert.match(transformed, /^Payment failed for email_tok_[a-f0-9]{12} on order ORD-123$/);
+}
+
+function testSafePartialRawTextKeepsOperationalScalarsReadable() {
+    const policy = policyFromStatements([
+        {
+            sid: 'raw-external-result',
+            when: {
+                scope: 'FIELD',
+                selector: 'externalResult',
+                target: 'response.body.data',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 1 },
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'response.body',
+        {
+            data: {
+                id: '69ed2d5c585264544573ea4f',
+                priority: 'high',
+                riskLevel: 'high',
+                safeSeverity: 'high',
+                retryCount: '3',
+                scenario: 'rule-drill',
+                createdAt: '2026-04-29T10:24:40.123Z',
+                reference: 'RLD-MOJZF582-SMS7QG',
+                statusNote: 'Manual review owner Jane Security can debug RLD-MOJZF582-SMS7QG, but provider authorization Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA== must never be logged raw.',
+                customerEmail: 'john@example.com',
+                webhookSecret: 'whsec_abcdefghijklmnopqrstuvwxyz',
+            },
+        },
+        { appId: 'APP_test', routeKey: 'POST /api/external-result' },
+    );
+
+    assert.strictEqual(transformed.data.id, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(transformed.data.priority, 'high');
+    assert.strictEqual(transformed.data.riskLevel, 'high');
+    assert.strictEqual(transformed.data.safeSeverity, 'high');
+    assert.strictEqual(transformed.data.retryCount, '3');
+    assert.strictEqual(transformed.data.scenario, 'rule-drill');
+    assert.strictEqual(transformed.data.createdAt, '2026-04-29T10:24:40.123Z');
+    assert.strictEqual(transformed.data.reference, 'RLD-MOJZF582-SMS7QG');
+    assert(!transformed.data.statusNote.includes('Jane Security'), transformed.data.statusNote);
+    assert(!transformed.data.statusNote.includes('Bearer QWxhZGRpbjpPcGVuU2VzYW1lMTIzNA=='), transformed.data.statusNote);
+    assert.match(transformed.data.customerEmail, /^email_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(transformed.data.webhookSecret, '[dropped]');
+}
+
+function testDescendantRawTextPolicyProvenanceFollowsCopiedObjectsAndSerializedValues() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'source-external-drill-response',
+            when: {
+                scope: 'FIELD',
+                selector: 'externalDrillResponse',
+                target: 'response.body.data',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'scenario-remains-operational-on-db-copy',
+            when: {
+                scope: 'FIELD',
+                selector: 'scenario',
+                target: 'db.query.doc.payload.metadata.scenario',
+            },
+            apply: { action: 'KEEP_EXACT' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Opaque diagnostic code',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'opaqueDiagnostic',
+        },
+    ]);
+
+    const drill = {
+        id: '69ed2d5c585264544573ea4f',
+        status: 'blocked',
+        metadata: {
+            opaqueDiagnostic: 'ZXQ9SIGNALLAB9911KLM',
+            scenario: 'security-drill',
+            supportEmail: 'support@example.com',
+        },
+        providerMessage: 'Provider returned ZXQ9SIGNALLAB9911KLM for john@example.com and left status blocked',
+    };
+
+    const source = applyRuntimePrivacyPolicy(
+        policy,
+        'response.body',
+        { data: drill, success: true },
+        { appId: 'APP_test', routeKey: 'POST /api/external-drill' },
+    );
+
+    assert.strictEqual(source.success, true);
+    assert.strictEqual(typeof source.data, 'object');
+    assert.strictEqual(source.data.id, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(source.data.status, 'blocked');
+    assert.strictEqual(source.data.metadata.scenario, 'security-drill');
+    assert.match(source.data.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(source.data.metadata.supportEmail, /^email_tok_[a-f0-9]{12}$/);
+    assert.match(source.data.providerMessage, /^Provider returned opaqueDiagnostic_tok_[a-f0-9]{12} for email_tok_[a-f0-9]{12} and left status blocked$/);
+
+    const dbCopy = applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        { doc: { payload: drill } },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'create' } },
+    );
+
+    assert.strictEqual(typeof dbCopy.doc.payload, 'object');
+    assert.strictEqual(dbCopy.doc.payload.id, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(dbCopy.doc.payload.status, 'blocked');
+    assert.strictEqual(dbCopy.doc.payload.metadata.scenario, 'security-drill');
+    assert.match(dbCopy.doc.payload.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(dbCopy.doc.payload.metadata.supportEmail, /^email_tok_[a-f0-9]{12}$/);
+    assert.match(dbCopy.doc.payload.providerMessage, /^Provider returned opaqueDiagnostic_tok_[a-f0-9]{12} for email_tok_[a-f0-9]{12} and left status blocked$/);
+
+    const redisCopy = applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        { args: ['cache:key', JSON.stringify(drill)] },
+        { appId: 'APP_test', db: { type: 'redis', collection: 'redis', op: 'set' } },
+    );
+    const parsed = JSON.parse(redisCopy.args[1]);
+
+    assert.strictEqual(parsed.id, '69ed2d5c585264544573ea4f');
+    assert.strictEqual(parsed.status, 'blocked');
+    assert.strictEqual(parsed.metadata.scenario, 'security-drill');
+    assert.match(parsed.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.metadata.supportEmail, /^email_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.providerMessage, /^Provider returned opaqueDiagnostic_tok_[a-f0-9]{12} for email_tok_[a-f0-9]{12} and left status blocked$/);
+    clearRuntimePrivacyProvenance();
+}
+
+function testInheritedRegexAssistedFallbackBeatsChildSafePartialMask() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'reviewed-payload-boundary',
+            when: {
+                scope: 'FIELD',
+                selector: 'PaymentCommunicationLog.payload',
+                target: 'db.query.doc.payload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'generic-provider-payload-fallback',
+            when: {
+                scope: 'FIELD',
+                selector: 'providerPayload',
+                target: 'db.query.doc.payload.providerPayload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Customer loyalty tier',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bgold\\b',
+            tokenLabel: 'loyaltyTier',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        {
+            doc: {
+                payload: {
+                    providerPayload: {
+                        customer: {
+                            loyaltyTier: 'gold',
+                            note: 'customer tier is gold',
+                        },
+                        status: 'declined',
+                    },
+                },
+            },
+        },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'create' } },
+    );
+
+    assert.match(transformed.doc.payload.providerPayload.customer.loyaltyTier, /^loyaltyTier_tok_[a-f0-9]{12}$/);
+    assert.match(transformed.doc.payload.providerPayload.customer.note, /^customer tier is loyaltyTier_tok_[a-f0-9]{12}$/);
+    assert.strictEqual(transformed.doc.payload.providerPayload.status, 'declined');
+    assert(!JSON.stringify(transformed).includes('"gold"'), JSON.stringify(transformed));
+    assert(!JSON.stringify(transformed).includes('"g..d"'), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+function testInheritedRegexAssistedFallbackBeatsSerializedSafePartialMask() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'reviewed-payload-boundary',
+            when: {
+                scope: 'FIELD',
+                selector: 'PaymentCommunicationLog.payload',
+                target: 'db.query.doc.payload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'generic-serialized-provider-payload-fallback',
+            when: {
+                scope: 'FIELD',
+                selector: 'serializedProviderPayload',
+                target: 'db.query.doc.payload.serializedProviderPayload',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Customer loyalty tier',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bgold\\b',
+            tokenLabel: 'loyaltyTier',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        {
+            doc: {
+                payload: {
+                    serializedProviderPayload: JSON.stringify({
+                        providerPayload: {
+                            customer: {
+                                loyaltyTier: 'gold',
+                            },
+                            providerText: 'tier gold accepted',
+                            status: 'declined',
+                        },
+                    }),
+                },
+            },
+        },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'create' } },
+    );
+    const parsed = JSON.parse(transformed.doc.payload.serializedProviderPayload);
+
+    assert.match(parsed.providerPayload.customer.loyaltyTier, /^loyaltyTier_tok_[a-f0-9]{12}$/);
+    assert.match(parsed.providerPayload.providerText, /^tier loyaltyTier_tok_[a-f0-9]{12} accepted$/);
+    assert.strictEqual(parsed.providerPayload.status, 'declined');
+    assert(!transformed.doc.payload.serializedProviderPayload.includes('"gold"'), transformed.doc.payload.serializedProviderPayload);
+    assert(!transformed.doc.payload.serializedProviderPayload.includes('"g..d"'), transformed.doc.payload.serializedProviderPayload);
+    clearRuntimePrivacyProvenance();
+}
+
+function testSafePartialMaskStillAppliesWithoutInheritedRegexBoundary() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'generic-provider-payload-fallback',
+            when: {
+                scope: 'FIELD',
+                selector: 'providerPayload',
+                target: 'db.query.doc.payload.providerPayload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Customer loyalty tier',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bgold\\b',
+            tokenLabel: 'loyaltyTier',
+        },
+    ]);
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        {
+            doc: {
+                payload: {
+                    providerPayload: {
+                        customer: {
+                            loyaltyTier: 'gold',
+                        },
+                    },
+                },
+            },
+        },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'create' } },
+    );
+
+    assert.strictEqual(transformed.doc.payload.providerPayload.customer.loyaltyTier, 'g..d');
+    assert(!JSON.stringify(transformed).includes('loyaltyTier_tok_'), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+function testCopiedKafkaPayloadKeepsInheritedRegexOverChildSafePartialMask() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'source-external-drill-response',
+            when: {
+                scope: 'FIELD',
+                selector: 'externalDrillResponse',
+                target: 'response.body.data',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'generic-kafka-payment-provider-payload-fallback',
+            when: {
+                scope: 'FIELD',
+                selector: 'providerPayload',
+                target: 'trace.args[0].messages[].value.payment.providerPayload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'SAFE_PARTIAL_MASK' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Customer loyalty tier',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bgold\\b',
+            tokenLabel: 'loyaltyTier',
+        },
+    ]);
+
+    const drill = {
+        id: '69ed2d5c585264544573ea4f',
+        providerPayload: {
+            customer: {
+                loyaltyTier: 'gold',
+            },
+            providerText: 'tier gold accepted',
+        },
+    };
+
+    applyRuntimePrivacyPolicy(
+        policy,
+        'response.body',
+        { data: drill },
+        { appId: 'APP_test', routeKey: 'POST /api/external-drill' },
+    );
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [{ messages: [{ value: { payment: drill } }] }],
+        { appId: 'APP_test', trace: { fn: 'producer.send' } },
+    );
+    const payment = transformed[0].messages[0].value.payment;
+
+    assert.match(payment.providerPayload.customer.loyaltyTier, /^loyaltyTier_tok_[a-f0-9]{12}$/);
+    assert.match(payment.providerPayload.providerText, /^tier loyaltyTier_tok_[a-f0-9]{12} accepted$/);
+    assert(!JSON.stringify(transformed).includes('"gold"'), JSON.stringify(transformed));
+    assert(!JSON.stringify(transformed).includes('"g..d"'), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+function testKafkaOpaqueDiagnosticCopiesUseSameLeafRegexProtection() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'source-opaque-diagnostic',
+            when: {
+                scope: 'FIELD',
+                selector: 'opaqueDiagnostic',
+                target: 'response.body.data.metadata.opaqueDiagnostic',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+        {
+            sid: 'copied-kafka-opaque-diagnostic',
+            when: {
+                scope: 'FIELD',
+                selector: 'opaqueDiagnostic',
+                target: 'trace.args[0].payment.metadata.opaqueDiagnostic|trace.args[0].messages[].value.payment.metadata.opaqueDiagnostic',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 2 },
+        },
+    ], [
+        {
+            name: 'Opaque diagnostic detector',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'opaqueDiagnostic',
+        },
+    ]);
+
+    const opaqueDiagnostic = 'ZXQ9DATALAB9911KLM';
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [
+            {
+                payment: {
+                    metadata: {
+                        opaqueDiagnostic,
+                    },
+                },
+                messages: [
+                    {
+                        value: {
+                            payment: {
+                                metadata: {
+                                    opaqueDiagnostic,
+                                },
+                            },
+                        },
+                    },
+                    {
+                        value: JSON.stringify({
+                            payment: {
+                                metadata: {
+                                    opaqueDiagnostic,
+                                },
+                            },
+                        }),
+                    },
+                ],
+            },
+        ],
+        { appId: 'APP_test', trace: { fn: 'producer.send' } },
+    );
+
+    assert.match(transformed[0].payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(transformed[0].messages[0].value.payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    const parsedKafkaValue = JSON.parse(transformed[0].messages[1].value);
+    assert.match(parsedKafkaValue.payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert(!JSON.stringify(transformed).includes(opaqueDiagnostic), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+function testOpaqueDiagnosticPayloadCopyTargetsTokenizeRuntimeSurfaces() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatements([
+        {
+            sid: 'opaque-diagnostic-runtime-copies',
+            when: {
+                scope: 'FIELD',
+                selector: 'opaqueDiagnostic',
+                target: [
+                    'response.body.data.metadata.opaqueDiagnostic',
+                    'db.query.doc.payload.metadata.opaqueDiagnostic',
+                    'db.after.payload.metadata.opaqueDiagnostic',
+                    'trace.args[0].payload.metadata.opaqueDiagnostic',
+                    'trace.returnValue.payload.metadata.opaqueDiagnostic',
+                    'db.query.doc.payload.payment.metadata.opaqueDiagnostic',
+                    'db.after.payload.payment.metadata.opaqueDiagnostic',
+                    'trace.args[0].payload.payment.metadata.opaqueDiagnostic',
+                    'trace.returnValue.payload.payment.metadata.opaqueDiagnostic',
+                ].join('|'),
+            },
+            apply: { action: 'TOKENIZE' },
+            meta: { priority: 1 },
+        },
+    ]);
+    const opaqueDiagnostic = 'ZXQ9DATALAB9911KLM';
+
+    const response = applyRuntimePrivacyPolicy(
+        policy,
+        'response.body',
+        { data: { metadata: { opaqueDiagnostic } } },
+        { appId: 'APP_test' },
+    );
+    const dbQuery = applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        {
+            doc: {
+                payload: {
+                    metadata: { opaqueDiagnostic },
+                    payment: { metadata: { opaqueDiagnostic } },
+                },
+            },
+        },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'insert' } },
+    );
+    const dbAfter = applyRuntimePrivacyPolicy(
+        policy,
+        'db.after',
+        {
+            payload: {
+                metadata: { opaqueDiagnostic },
+                payment: { metadata: { opaqueDiagnostic } },
+            },
+        },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'insert' } },
+    );
+    const traceArgs = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [
+            {
+                payload: {
+                    metadata: { opaqueDiagnostic },
+                    payment: { metadata: { opaqueDiagnostic } },
+                },
+            },
+        ],
+        { appId: 'APP_test', trace: { fn: 'emitCommunicationLog' } },
+    );
+    const traceReturnValue = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.returnValue',
+        {
+            payload: {
+                metadata: { opaqueDiagnostic },
+                payment: { metadata: { opaqueDiagnostic } },
+            },
+        },
+        { appId: 'APP_test', trace: { fn: 'emitCommunicationLog' } },
+    );
+
+    assert.match(response.data.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(dbQuery.doc.payload.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(dbQuery.doc.payload.payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(dbAfter.payload.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(dbAfter.payload.payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(traceArgs[0].payload.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(traceArgs[0].payload.payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(traceReturnValue.payload.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(traceReturnValue.payload.payment.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert(!JSON.stringify({ response, dbQuery, dbAfter, traceArgs, traceReturnValue }).includes(opaqueDiagnostic));
+    clearRuntimePrivacyProvenance();
+}
+
+function testOpaqueCorrelationPatternTokenizesMissedRuntimeCopies() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatements([
+        {
+            sid: 'baseline-opaque-correlation-values',
+            when: {
+                scope: 'PATTERN',
+                selector: 'pattern:baseline-opaque-correlation-values',
+                target: 'response.body|trace.args|trace.returnValue|db.query|db.after|db.before',
+                pattern: '(?i)(^|\\.)(opaque[A-Za-z0-9_]*(Id|Token|Trace|Diagnostic)|[A-Za-z0-9_]*(OpaqueId|OpaqueToken|OpaqueTrace|OpaqueDiagnostic))$',
+            },
+            apply: { action: 'TOKENIZE' },
+            meta: { priority: 1 },
+        },
+    ]);
+    const opaqueDiagnostic = 'ZXQ9SIGNALLAB9911KLM';
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [
+            {
+                payload: {
+                    metadata: { opaqueDiagnostic },
+                    payment: { metadata: { opaqueTraceId: opaqueDiagnostic } },
+                },
+            },
+        ],
+        { appId: 'APP_test', trace: { fn: 'opaqueFlow' } },
+    );
+
+    assert.match(transformed[0].payload.metadata.opaqueDiagnostic, /^opaqueDiagnostic_tok_[a-f0-9]{12}$/);
+    assert.match(transformed[0].payload.payment.metadata.opaqueTraceId, /^opaqueTraceId_tok_[a-f0-9]{12}$/);
+    assert(!JSON.stringify(transformed).includes(opaqueDiagnostic), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+function testDbWriteQueryPolicySeedsAfterSnapshotProvenance() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'communication-log-payload',
+            when: {
+                scope: 'SCHEMA',
+                selector: 'CommunicationLog.payload',
+                target: 'db.query.doc.payload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Customer loyalty tier',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bgold\\b',
+            tokenLabel: 'loyaltyTier',
+        },
+    ]);
+
+    const savedDocument = {
+        payload: {
+            payment: {
+                providerPayload: {
+                    customer: {
+                        loyaltyTier: 'gold',
+                    },
+                },
+            },
+        },
+    };
+
+    applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        { doc: savedDocument },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'insert' } },
+    );
+
+    const transformedAfter = applyRuntimePrivacyPolicy(
+        policy,
+        'db.after',
+        savedDocument,
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'insert' } },
+    );
+
+    assert.match(transformedAfter.payload.payment.providerPayload.customer.loyaltyTier, /^loyaltyTier_tok_[a-f0-9]{12}$/);
+    assert(!JSON.stringify(transformedAfter).includes('"gold"'), JSON.stringify(transformedAfter));
+    clearRuntimePrivacyProvenance();
+}
+
+function testDbWriteQueryPolicySeedsSerializedKafkaTraceProvenance() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'communication-log-payload',
+            when: {
+                scope: 'SCHEMA',
+                selector: 'CommunicationLog.payload',
+                target: 'db.query.doc.payload',
+            },
+            apply: { action: 'KEEP_EXACT', descendantRawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 1 },
+        },
+    ], [
+        {
+            name: 'Customer loyalty tier',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bgold\\b',
+            tokenLabel: 'loyaltyTier',
+        },
+    ]);
+
+    const envelope = {
+        payment: {
+            providerPayload: {
+                customer: {
+                    loyaltyTier: 'gold',
+                },
+            },
+        },
+    };
+
+    applyRuntimePrivacyPolicy(
+        policy,
+        'db.query',
+        { doc: { payload: envelope } },
+        { appId: 'APP_test', db: { type: 'mongo', collection: 'communicationlogs', op: 'insert' } },
+    );
+
+    const transformedTraceString = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.returnValue',
+        JSON.stringify(envelope),
+        { appId: 'APP_test', trace: { fn: 'message.value.toString' } },
+    );
+
+    assert.match(transformedTraceString, /loyaltyTier_tok_[a-f0-9]{12}/);
+    assert(!transformedTraceString.includes('"gold"'), transformedTraceString);
+    clearRuntimePrivacyProvenance();
+}
+
+function testTraceRawMessageRegexRuleBeatsFunctionParameterSummary() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'kafka-raw-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'rawMessage',
+                target: 'trace.args[2]',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 25, review: { rawTextHintNames: ['Raw message opaque detector'] } },
+        },
+        {
+            sid: 'record-consumed-event-container',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:PrivacyLabDrillsService.recordConsumedEvent',
+                target: 'trace.args',
+            },
+            apply: { action: 'KEEP_EXACT' },
+            meta: { priority: 51 },
+        },
+        {
+            sid: 'record-consumed-event-raw-message-param',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:PrivacyLabDrillsService.recordConsumedEvent',
+                target: 'trace.args[2]',
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 113 },
+        },
+    ], [
+        {
+            name: 'Raw narrative opaque detector',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'rawNarrative',
+        },
+        {
+            name: 'Raw message opaque detector',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'rawMessage',
+        },
+    ]);
+
+    const opaque = 'ZXQB763FF94061E84A19KLM-TRACE-B763FF';
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [{ eventId: 'evt-1' }, 'privacy-lab-mopvlblv', `raw message contained ${opaque}`],
+        { appId: 'APP_test', trace: { fn: 'PrivacyLabDrillsService.recordConsumedEvent' } },
+    );
+
+    assert.match(transformed[2], /^raw message contained rawMessage_tok_[a-f0-9]{12}$/);
+    assert(!JSON.stringify(transformed).includes(opaque), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+function testRegexAssistedRawStringPolicyAppliesInsideSerializedTraceString() {
+    clearRuntimePrivacyProvenance();
+    const policy = policyFromStatementsAndRawTextHints([
+        {
+            sid: 'kafka-raw-message',
+            when: {
+                scope: 'FIELD',
+                selector: 'rawMessage',
+                target: 'trace.args[0]',
+            },
+            apply: { action: 'SUMMARIZE', rawTextMode: 'REGEX_ASSISTED_EXACT' },
+            meta: { priority: 25, review: { rawTextHintNames: ['Raw message opaque detector'] } },
+        },
+        {
+            sid: 'json-parse-input',
+            when: {
+                scope: 'FUNCTION',
+                selector: 'fn:JSON.parse',
+                target: 'trace.args[0]',
+            },
+            apply: { action: 'SUMMARIZE' },
+            meta: { priority: 113 },
+        },
+    ], [
+        {
+            name: 'Raw narrative opaque detector',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'rawNarrative',
+        },
+        {
+            name: 'Raw message opaque detector',
+            scope: 'RAW_TEXT_ONLY',
+            action: 'TOKENIZE',
+            regex: '\\bZXQ[0-9A-Z]{8,32}(?:-[A-Z0-9]{2,32})*\\b',
+            tokenLabel: 'rawMessage',
+        },
+    ]);
+
+    const opaque = 'ZXQB763FF94061E84A19KLM-TRACE-B763FF';
+    const serialized = JSON.stringify({
+        providerResponse: {
+            supportTranscript: `Support transcript matched trace ${opaque} while the payload was visible.`,
+            status: 'received',
+        },
+    });
+
+    const transformed = applyRuntimePrivacyPolicy(
+        policy,
+        'trace.args',
+        [serialized],
+        { appId: 'APP_test', trace: { fn: 'JSON.parse' } },
+    );
+    const parsed = JSON.parse(transformed[0]);
+
+    assert.match(
+        parsed.providerResponse.supportTranscript,
+        /^Support transcript matched trace rawMessage_tok_[a-f0-9]{12} while the payload was visible\.$/,
+    );
+    assert.strictEqual(parsed.providerResponse.status, 'received');
+    assert(!JSON.stringify(transformed).includes(opaque), JSON.stringify(transformed));
+    clearRuntimePrivacyProvenance();
+}
+
+async function main() {
+    await testSerializedJsonStringsUseNestedRulesAndFallbacks();
+    await testLongSerializedJsonStringsAreTransformedBeforeTruncation();
+    await testSerializedRedisPayloadTokenizesNestedReviewerIdentity();
+    await testSummarizedSerializedJsonKeepsOperationalLeavesReadable();
+    await testEmptyArrayBracketTargetsMatchArrayItems();
+    await testKnownEvidenceMessagesApplyInsideWrappersAndSerializedPayloads();
+    await testSerializedJsonIsNotDroppedAsAtomicSecretText();
+    testOperationalIdsDoNotFallbackMaskOrLookLikeCreditCards();
+    testPlainObjectsWithIdAreNotCollapsedToObjectId();
+    testNestedIdentityFieldsUseGenericSemanticFallback();
+    testObjectTokenizePreservesStructure();
+    await testTopLevelKnownTextPolicyIsAcceptedInSerializedValues();
+    testUnknownFreeTextLeafStaysExactWithoutExplicitRawMode();
+    testRawTextRegexHintsPreserveUnmatchedTextWhenExplicitlyEnabled();
+    testRawTextRegexHintsSupportMultipleActionsOnSameRawString();
+    testRegexAssistedRawTextRuleBeatsSamePathSafePartialMask();
+    testSyncSafePartialRawTextRunsBuiltInDetectorsBeforeMasking();
+    testRawTextRegexHintsPreferCurrentPathLabel();
+    testRawTextRegexHintsDoNotRunWithoutExplicitRawTextMode();
+    testRegexAssistedRawTextWithoutHintsKeepsUnmatchedTextExact();
+    testRawTextRegexHintsDoNotRunOnStructuredFields();
+    testExactSensitiveTargetBeatsExactFunctionKeepExact();
+    testBroadFunctionKeepExactKeepsNestedFreeTextExactUntilReviewed();
+    testRawHeaderTimestampsAreNotTreatedAsCards();
+    testKafkaTimestampsAreNotTreatedAsCards();
+    testFreeTextStillRedactsKnownSensitiveValues();
+    await testAuthLikeNestedFieldsDropWholeValueAndKeepReadableSpacing();
+    testKnownTextPolicyNormalizesGluedSlots();
+    testSafePartialRawTextKeepsOperationalScalarsReadable();
+    testDescendantRawTextPolicyProvenanceFollowsCopiedObjectsAndSerializedValues();
+    testInheritedRegexAssistedFallbackBeatsChildSafePartialMask();
+    testInheritedRegexAssistedFallbackBeatsSerializedSafePartialMask();
+    testSafePartialMaskStillAppliesWithoutInheritedRegexBoundary();
+    testCopiedKafkaPayloadKeepsInheritedRegexOverChildSafePartialMask();
+    testKafkaOpaqueDiagnosticCopiesUseSameLeafRegexProtection();
+    testOpaqueDiagnosticPayloadCopyTargetsTokenizeRuntimeSurfaces();
+    testOpaqueCorrelationPatternTokenizesMissedRuntimeCopies();
+    testDbWriteQueryPolicySeedsAfterSnapshotProvenance();
+    testDbWriteQueryPolicySeedsSerializedKafkaTraceProvenance();
+    testTraceRawMessageRegexRuleBeatsFunctionParameterSummary();
+    testRegexAssistedRawStringPolicyAppliesInsideSerializedTraceString();
+    console.log('privacy runtime policy enforcement OK');
+}
+
+main().catch(err => {
+    console.error(err);
+    process.exitCode = 1;
+});