@reproapp/node-sdk 0.0.53 → 0.0.54

package/dist/index.js

@@ -1116,6 +1116,7 @@ let traceMaterializerWorkerDisabled = !TRACE_MATERIALIZE_OFFTHREAD_ENABLED;
 let traceMaterializerTaskSeq = 0;
 let traceMaterializerIdleTimer = null;
 const traceMaterializerExpectedTerminations = new WeakSet();
+const traceMaterializerWorkerPolicies = new WeakMap();
 const traceMaterializerPending = new Map();
 function hasActiveClientRequests() {
     return activeClientRequestCount > 0;
@@ -1332,12 +1333,22 @@ async function materializePendingTraceEventsOffThread(events, payload) {
             timeout,
         });
         try {
+            const previousPolicy = traceMaterializerWorkerPolicies.get(worker);
+            const sendPolicy = !previousPolicy || previousPolicy.policy !== payload.privacy;
+            const policyState = sendPolicy ? { policy: payload.privacy, id: taskId } : previousPolicy;
+            const { policy: _inlinePolicy, ...privacyConfig } = payload.cfg.privacy ?? {};
             const request = {
                 taskId,
                 type: 'materialize-trace-events',
-                payload,
+                payload: {
+                    ...payload,
+                    cfg: { ...payload.cfg, privacy: privacyConfig },
+                    privacy: sendPolicy ? payload.privacy : undefined,
+                    policyId: policyState.id,
+                },
             };
             worker.postMessage(request);
+            traceMaterializerWorkerPolicies.set(worker, policyState);
         }
         catch (err) {
             traceMaterializerPending.delete(taskId);

package/dist/privacy.js

@@ -11,6 +11,7 @@ const EMPTY_RUNTIME_PRIVACY_POLICY = {
     fingerprint: 'empty',
 };
 const runtimePrivacyStatementIndexes = new WeakMap();
+const comparableTokenCache = new Map();
 const RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES = 2048;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_ENTRIES = 1000;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_SERIALIZED_LENGTH = 200000;
@@ -453,6 +454,7 @@ function buildRuntimePrivacyStatementIndex(statements) {
         functionStatements,
         candidateCache: new Map(),
         hasNumericTargetSegments,
+        scoredCandidateCache: new Map(),
     };
 }
 function getRuntimePrivacyStatementIndex(policy) {
@@ -874,6 +876,8 @@ function rememberSerializedRuntimePrivacyProvenance(value, provenance) {
     }
 }
 function lookupSerializedRuntimePrivacyProvenance(value) {
+    if (serializedRuntimePrivacyProvenance.size === 0)
+        return null;
     for (const serialized of runtimePrivacyProvenanceSerializations(value)) {
         const provenance = serializedRuntimePrivacyProvenance.get(hashRuntimePrivacyProvenance(serialized));
         if (provenance) {
@@ -1228,6 +1232,26 @@ async function transformSerializedStructuredStringAsChildrenAsync(policy, surfac
     return JSON.stringify(transformed);
 }
 function matchStatement(policy, surface, value, context, path) {
+    const index = getRuntimePrivacyStatementIndex(policy);
+    // Scores and non-pattern selectors depend on the context/path, not the
+    // observed value. Preserve numeric positions here even for wildcard rules.
+    const key = JSON.stringify([surface, context.trace?.fn, context.routeKey,
+        context.db?.type, context.db?.collection, context.db?.op, path]);
+    let scored = index.scoredCandidateCache.get(key);
+    if (!scored) {
+        scored = scoreStatementCandidates(policy, surface, context, path);
+        if (index.scoredCandidateCache.size >= RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES) {
+            index.scoredCandidateCache.clear();
+        }
+        index.scoredCandidateCache.set(key, scored);
+    }
+    const leaf = path[path.length - 1] ?? '';
+    const joinedPath = normalizeComparablePath(path);
+    const candidates = scored.filter(({ statement }) => statement.scope !== 'PATTERN'
+        || patternMatches(statement.pattern, leaf, joinedPath, value));
+    return selectStatementCandidate(candidates, surface, value, path);
+}
+function scoreStatementCandidates(policy, surface, context, path) {
     let candidates = [];
     for (const statement of candidateStatementsForMatch(policy, surface, context, path)) {
         if (shouldIgnoreBroadContainerRuleOnDescendant(statement, surface, path)) {
@@ -1240,7 +1264,7 @@ function matchStatement(policy, surface, value, context, path) {
         if (targetScore < 0) {
             continue;
         }
-        if (!matchesScope(statement, surface, value, context, path)) {
+        if (statement.scope !== 'PATTERN' && !matchesScope(statement, surface, undefined, context, path)) {
             continue;
         }
         const selectorScore = matchSelectorSpecificity(statement, surface, context, path);
@@ -1254,10 +1278,9 @@ function matchStatement(policy, surface, value, context, path) {
                 statement.priority,
         });
     }
-    if (!candidates.length) {
-        return null;
-    }
-    candidates = candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+    return candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+}
+function selectStatementCandidate(candidates, surface, value, path) {
     if (!candidates.length) {
         return null;
     }
@@ -1632,7 +1655,10 @@ function normalizeComparablePath(path) {
         .join('.');
 }
 function normalizeComparableToken(value) {
-    return value
+    const cached = comparableTokenCache.get(value);
+    if (cached !== undefined)
+        return cached;
+    const normalized = value
         .trim()
         .replace(/\s+/g, '')
         .replace(/\[\*\]/g, '')
@@ -1641,6 +1667,12 @@ function normalizeComparableToken(value) {
         .replace(/^.*->/, '')
         .replace(/\|/g, '')
         .toLowerCase();
+    if (value.length <= 1024) {
+        if (comparableTokenCache.size >= 2048)
+            comparableTokenCache.clear();
+        comparableTokenCache.set(value, normalized);
+    }
+    return normalized;
 }
 function relaxedFieldTargetMatchScore(statement, surface, path) {
     if (!path.length) {
@@ -2379,7 +2411,9 @@ function partiallyMaskUnknownString(value) {
     return normalizePrivacyReplacementSpacing(output);
 }
 function normalizePrivacyReplacementSpacing(value) {
-    if (!value) {
+    // Most captured strings contain no replacement markers. The token regex
+    // backtracks over long ordinary words even though no token can match.
+    if (!value || (!value.includes('[') && !/_tok_/i.test(value))) {
         return value;
     }
     const bracketMarker = String.raw `(?:\[(?:dropped|secret-token|connection-string|auth-token|session-secret|private-key|basic-auth|jwt|credit-card|phone|person|ssn|masked)\])`;

package/dist/trace-materializer-worker.js

@@ -9,13 +9,24 @@ function isTraceMaterializationWorkerRequest(value) {
     const message = value;
     return Number.isFinite(message.taskId) && message.type === 'materialize-trace-events' && !!message.payload;
 }
+let policyId;
+let privacy;
+let queue = Promise.resolve();
 node_worker_threads_1.parentPort?.on('message', (message) => {
     if (!isTraceMaterializationWorkerRequest(message)) {
         return;
     }
-    void (async () => {
+    // FIFO also isolates the materializer's full-value-capture flag across tasks.
+    queue = queue.then(async () => {
         try {
-            const events = await (0, index_1.__materializePendingTraceEventsForWorker)(message.payload);
+            if (message.payload.privacy !== undefined) {
+                policyId = message.payload.policyId;
+                privacy = message.payload.privacy;
+            }
+            else if (policyId === undefined || policyId !== message.payload.policyId) {
+                throw new Error('trace materialization policy reference is unavailable');
+            }
+            const events = await (0, index_1.__materializePendingTraceEventsForWorker)({ ...message.payload, privacy });
             node_worker_threads_1.parentPort?.postMessage({
                 taskId: message.taskId,
                 ok: true,
@@ -29,5 +40,5 @@ node_worker_threads_1.parentPort?.on('message', (message) => {
                 error: err instanceof Error ? err.message : String(err),
             });
         }
-    })();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reproapp/node-sdk",
-  "version": "0.0.53",
+  "version": "0.0.54",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,6 +9,7 @@
     "node": ">=18"
   },
   "scripts": {
+    "test:throughput": "npm run build && node test/trace-worker-policy-reference.test.js && node test/privacy-policy-index.test.js && node test/trace-throughput.testcontainers.test.js",
     "test:latency": "npm run build && node test/privacy-fetch-timeout.test.js && node test/capture-latency.testcontainers.test.js",
     "test:live-capture": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/live-capture-limits.test.js && node test/ingest-throttle-retention.test.js && node test/live-capture-limits.testcontainers.test.js",
     "test:live-brokers": "npm run build && node test/live-broker-limits.testcontainers.test.js",
@@ -16,7 +17,7 @@
     "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
     "prepublishOnly": "npm run build",
     "test": "npm run build && node test/semantic-serialization.test.js && node test/semantic-serialization-trace.test.js && node test/content-addressed-trace-values.test.js && node test/trace-observation-snapshots.test.js && node test/session-storage-budget.test.js && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/object-id-shapes.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
-    "test:containers": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/background-continuous-traffic.testcontainers.test.js && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
+    "test:containers": "npm run build && node test/trace-worker-policy-reference.test.js && node test/trace-throughput.testcontainers.test.js && node test/twelve-element-capture.testcontainers.test.js && node test/background-continuous-traffic.testcontainers.test.js && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
   },
   "peerDependencies": {
     "express": "^5.1.0",

package/src/index.ts

@@ -445,7 +445,10 @@ type TraceMaterializationWorkerPayload = {
 type TraceMaterializationWorkerRequest = {
     taskId: number;
     type: 'materialize-trace-events';
-    payload: TraceMaterializationWorkerPayload;
+    payload: Omit<TraceMaterializationWorkerPayload, 'privacy'> & {
+        privacy?: NormalizedRuntimePrivacyPolicy | null;
+        policyId: number;
+    };
 };
 
 type TraceMaterializationWorkerResponse =
@@ -1564,6 +1567,10 @@ let traceMaterializerWorkerDisabled = !TRACE_MATERIALIZE_OFFTHREAD_ENABLED;
 let traceMaterializerTaskSeq = 0;
 let traceMaterializerIdleTimer: NodeJS.Timeout | null = null;
 const traceMaterializerExpectedTerminations = new WeakSet<object>();
+const traceMaterializerWorkerPolicies = new WeakMap<object, {
+    policy: NormalizedRuntimePrivacyPolicy | null;
+    id: number;
+}>();
 const traceMaterializerPending = new Map<number, {
     resolve: (events: PendingTraceEventRecord[]) => void;
     reject: (error: Error) => void;
@@ -1771,12 +1778,22 @@ async function materializePendingTraceEventsOffThread(
         });
 
         try {
+            const previousPolicy = traceMaterializerWorkerPolicies.get(worker);
+            const sendPolicy = !previousPolicy || previousPolicy.policy !== payload.privacy;
+            const policyState = sendPolicy ? { policy: payload.privacy, id: taskId } : previousPolicy!;
+            const { policy: _inlinePolicy, ...privacyConfig } = payload.cfg.privacy ?? {};
             const request: TraceMaterializationWorkerRequest = {
                 taskId,
                 type: 'materialize-trace-events',
-                payload,
+                payload: {
+                    ...payload,
+                    cfg: { ...payload.cfg, privacy: privacyConfig },
+                    privacy: sendPolicy ? payload.privacy : undefined,
+                    policyId: policyState.id,
+                },
             };
             worker.postMessage(request);
+            traceMaterializerWorkerPolicies.set(worker, policyState);
         } catch (err) {
             traceMaterializerPending.delete(taskId);
             try { clearTimeout(timeout); } catch {}

package/src/privacy.ts

@@ -97,6 +97,7 @@ type RuntimePrivacyStatementIndex = {
     functionStatements: FunctionStatementTrieNode;
     candidateCache: Map<string, NormalizedStatement[]>;
     hasNumericTargetSegments: boolean;
+    scoredCandidateCache: Map<string, Array<{ statement: NormalizedStatement; targetScore: number; score: number }>>;
 };
 
 type TransformFallback = {
@@ -150,6 +151,7 @@ const EMPTY_RUNTIME_PRIVACY_POLICY: NormalizedRuntimePrivacyPolicy = {
 };
 
 const runtimePrivacyStatementIndexes = new WeakMap<object, RuntimePrivacyStatementIndex>();
+const comparableTokenCache = new Map<string, string>();
 const RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES = 2048;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_ENTRIES = 1000;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_SERIALIZED_LENGTH = 200_000;
@@ -685,6 +687,7 @@ function buildRuntimePrivacyStatementIndex(
         functionStatements,
         candidateCache: new Map<string, NormalizedStatement[]>(),
         hasNumericTargetSegments,
+        scoredCandidateCache: new Map(),
     };
 }
 
@@ -1222,6 +1225,7 @@ function rememberSerializedRuntimePrivacyProvenance(value: any, provenance: Runt
 }
 
 function lookupSerializedRuntimePrivacyProvenance(value: any): TransformFallback {
+    if (serializedRuntimePrivacyProvenance.size === 0) return null;
     for (const serialized of runtimePrivacyProvenanceSerializations(value)) {
         const provenance = serializedRuntimePrivacyProvenance.get(hashRuntimePrivacyProvenance(serialized));
         if (provenance) {
@@ -1691,6 +1695,32 @@ function matchStatement(
     context: RuntimePrivacyApplyContext,
     path: string[],
 ): NormalizedStatement | null {
+    const index = getRuntimePrivacyStatementIndex(policy);
+    // Scores and non-pattern selectors depend on the context/path, not the
+    // observed value. Preserve numeric positions here even for wildcard rules.
+    const key = JSON.stringify([surface, context.trace?.fn, context.routeKey,
+        context.db?.type, context.db?.collection, context.db?.op, path]);
+    let scored = index.scoredCandidateCache.get(key);
+    if (!scored) {
+        scored = scoreStatementCandidates(policy, surface, context, path);
+        if (index.scoredCandidateCache.size >= RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES) {
+            index.scoredCandidateCache.clear();
+        }
+        index.scoredCandidateCache.set(key, scored);
+    }
+    const leaf = path[path.length - 1] ?? '';
+    const joinedPath = normalizeComparablePath(path);
+    const candidates = scored.filter(({ statement }) => statement.scope !== 'PATTERN'
+        || patternMatches(statement.pattern, leaf, joinedPath, value));
+    return selectStatementCandidate(candidates, surface, value, path);
+}
+
+function scoreStatementCandidates(
+    policy: NormalizedRuntimePrivacyPolicy,
+    surface: RuntimePrivacySurface,
+    context: RuntimePrivacyApplyContext,
+    path: string[],
+): Array<{ statement: NormalizedStatement; targetScore: number; score: number }> {
     let candidates: Array<{ statement: NormalizedStatement; targetScore: number; score: number }> = [];
     for (const statement of candidateStatementsForMatch(policy, surface, context, path)) {
         if (shouldIgnoreBroadContainerRuleOnDescendant(statement, surface, path)) {
@@ -1703,7 +1733,7 @@ function matchStatement(
         if (targetScore < 0) {
             continue;
         }
-        if (!matchesScope(statement, surface, value, context, path)) {
+        if (statement.scope !== 'PATTERN' && !matchesScope(statement, surface, undefined, context, path)) {
             continue;
         }
         const selectorScore = matchSelectorSpecificity(statement, surface, context, path);
@@ -1718,11 +1748,15 @@ function matchStatement(
                 statement.priority,
         });
     }
-    if (!candidates.length) {
-        return null;
-    }
+    return candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+}
 
-    candidates = candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+function selectStatementCandidate(
+    candidates: Array<{ statement: NormalizedStatement; targetScore: number; score: number }>,
+    surface: RuntimePrivacySurface,
+    value: any,
+    path: string[],
+): NormalizedStatement | null {
     if (!candidates.length) {
         return null;
     }
@@ -2197,7 +2231,9 @@ function normalizeComparablePath(path: string[]): string {
 }
 
 function normalizeComparableToken(value: string): string {
-    return value
+    const cached = comparableTokenCache.get(value);
+    if (cached !== undefined) return cached;
+    const normalized = value
         .trim()
         .replace(/\s+/g, '')
         .replace(/\[\*\]/g, '')
@@ -2206,6 +2242,11 @@ function normalizeComparableToken(value: string): string {
         .replace(/^.*->/, '')
         .replace(/\|/g, '')
         .toLowerCase();
+    if (value.length <= 1024) {
+        if (comparableTokenCache.size >= 2048) comparableTokenCache.clear();
+        comparableTokenCache.set(value, normalized);
+    }
+    return normalized;
 }
 
 function relaxedFieldTargetMatchScore(
@@ -3082,7 +3123,9 @@ function partiallyMaskUnknownString(value: string): string {
 }
 
 function normalizePrivacyReplacementSpacing(value: string): string {
-    if (!value) {
+    // Most captured strings contain no replacement markers. The token regex
+    // backtracks over long ordinary words even though no token can match.
+    if (!value || (!value.includes('[') && !/_tok_/i.test(value))) {
         return value;
     }
     const bracketMarker = String.raw`(?:\[(?:dropped|secret-token|connection-string|auth-token|session-secret|private-key|basic-auth|jwt|credit-card|phone|person|ssn|masked)\])`;

package/src/trace-materializer-worker.ts

@@ -15,14 +15,24 @@ function isTraceMaterializationWorkerRequest(value: unknown): value is TraceMate
     return Number.isFinite(message.taskId) && message.type === 'materialize-trace-events' && !!message.payload;
 }
 
+let policyId: number | undefined;
+let privacy: any;
+let queue = Promise.resolve();
 parentPort?.on('message', (message: unknown) => {
     if (!isTraceMaterializationWorkerRequest(message)) {
         return;
     }
 
-    void (async () => {
+    // FIFO also isolates the materializer's full-value-capture flag across tasks.
+    queue = queue.then(async () => {
         try {
-            const events = await __materializePendingTraceEventsForWorker(message.payload);
+            if (message.payload.privacy !== undefined) {
+                policyId = message.payload.policyId;
+                privacy = message.payload.privacy;
+            } else if (policyId === undefined || policyId !== message.payload.policyId) {
+                throw new Error('trace materialization policy reference is unavailable');
+            }
+            const events = await __materializePendingTraceEventsForWorker({ ...message.payload, privacy });
             parentPort?.postMessage({
                 taskId: message.taskId,
                 ok: true,
@@ -35,5 +45,5 @@ parentPort?.on('message', (message: unknown) => {
                 error: err instanceof Error ? err.message : String(err),
             });
         }
-    })();
+    });
 });

package/test/capture-latency.testcontainers.test.js

@@ -70,6 +70,7 @@ async function main() {
                             const capture = scoped();
                             const manifest = capture.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest;
                             return manifest && ['backend_request', 'db_change'].every(t => capture.some(e => e.event_type === t))
+                                && capture.flatMap(e => e.payload.db || []).length === manifest.expected.dbChange
                                 && capture.filter(e => e.event_type === 'trace_batch').length >= manifest.expected.traceBatch;
                         };
                         while (!complete() && Date.now() < deadline) await sleep(25);

package/test/fixtures/capture-latency-business.js

@@ -1,7 +1,7 @@
 function observeRows(document) { return document; }
 async function loadRows(Model) {
     const document = await Model.findOne({ reference: 'LATENCY' }).lean().exec();
-    for (let i = 0; i < 12; i++) {
+    for (let i = 0; i < Number(process.env.CAPTURE_TEST_OBSERVATIONS || 12); i++) {
         document.phase = i;
         if (observeRows(document) !== document) throw new Error('return identity changed');
     }

package/test/fixtures/capture-latency-server.js

@@ -1,5 +1,5 @@
 const workerThreads = require('node:worker_threads');
-const metrics = { workers: 0, tasks: 0 };
+const metrics = { workers: 0, tasks: 0, policyTransfers: 0 };
 const RealWorker = workerThreads.Worker;
 workerThreads.Worker = class extends RealWorker {
     constructor(...args) {
@@ -10,13 +10,17 @@ workerThreads.Worker = class extends RealWorker {
         if (String(args[0]).includes('trace-materializer-worker')) {
             metrics.workers++;
             const post = this.postMessage.bind(this);
-            this.postMessage = (...messages) => { metrics.tasks++; return post(...messages); };
+            this.postMessage = (...messages) => {
+                metrics.tasks++;
+                if (messages[0]?.payload?.privacy !== undefined) metrics.policyTransfers++;
+                return post(...messages);
+            };
         }
     }
 };
 const http = require('node:http');
 const mode = process.env.CAPTURE_TEST_MODE;
-const { initRepro, reproMongoosePlugin } = require(process.env.CAPTURE_TEST_SDK || '../../dist');
+const { initRepro } = require(process.env.CAPTURE_TEST_SDK || '../../dist');
 async function main() {
     const config = {
         tenantId: 'TENANT_latency', appId: 'APP_latency', appSecret: 'test-only',
@@ -31,7 +35,6 @@ async function main() {
     const express = require('express');
     const connection = await mongoose.createConnection(process.env.CAPTURE_TEST_MONGO).asPromise();
     const schema = new mongoose.Schema({ reference: String, phase: Number, rows: [Object] });
-    if (mode !== 'off') schema.plugin(reproMongoosePlugin, config);
     const Model = connection.model('Latency', schema);
     await Model.create({ reference: 'LATENCY', phase: -1, rows: Array.from({ length: 120 }, (_, id) => ({
         id, status: 'available', internalSecret: `secret-${id}`, description: 'Operational depot description '.repeat(32),

package/test/privacy-policy-index.test.js

@@ -185,6 +185,21 @@ async function main() {
     );
     assert.match(transformedPositionalTrace[4], /^4_tok_[a-f0-9]{12}$/);
 
+    // Cached selector scores must not cache value-dependent PATTERN decisions,
+    // numeric targets, or leak a previous route/function/database context.
+    const contexts = [
+        { trace: { fn: 'CapturedService.loadNames' }, routeKey: 'GET /api/v1/depots/:id/names' },
+        { trace: { fn: 'OtherService.load' }, routeKey: 'POST /other', db: { type: 'mongo', collection: 'other', op: 'insert' } },
+    ];
+    for (let i = 0; i < 8; i++) {
+        const value = { data: [{ notes: i % 2 ? 'ordinary note' : 'secret-value', privateNote: 'private' }] };
+        const context = { appId: 'APP_test', appSecret: 'secret', ...contexts[i % 2] };
+        const warm = await applyRuntimePrivacyPolicyAsync(policy, 'response.body', value, context);
+        const cold = await applyRuntimePrivacyPolicyAsync(structuredClone(policy), 'response.body', value, context);
+        assert.deepEqual(warm, cold);
+        assert.equal(warm.data[0].notes, i % 2 ? 'ordinary note' : '[dropped]');
+        assert.equal(value.data[0].privateNote, 'private');
+    }
     console.log(`privacy policy index OK (${elapsedMs}ms)`);
 }
 

package/test/trace-throughput.testcontainers.test.js

@@ -0,0 +1,110 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { fork } = require('node:child_process');
+const { once } = require('node:events');
+const { performance } = require('node:perf_hooks');
+const { GenericContainer, Wait } = require('testcontainers');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+const policy = { statements: [
+    ...Array.from({ length: 5000 }, (_, i) => ({ sid: `fn-${i}`, when: {
+        scope: 'FUNCTION', selector: `Service${i}.method`, target: 'trace.args|trace.returnValue',
+    }, apply: { action: 'KEEP_EXACT' } })),
+    ...Array.from({ length: 9 }, (_, i) => ({ sid: `pattern-${i}`, when: {
+        scope: 'PATTERN', selector: `pattern-${i}`, pattern: `sensitive-value-${i}`,
+    }, apply: { action: 'DROP' } })),
+    { sid: 'secret', when: { scope: 'FIELD', selector: 'field:internalSecret' }, apply: { action: 'DROP' } },
+] };
+
+async function main() {
+    let events = [], child, mongo;
+    const sink = http.createServer((req, res) => {
+        const chunks = [];
+        req.on('data', chunk => chunks.push(chunk));
+        req.on('end', () => {
+            events.push(...JSON.parse(Buffer.concat(chunks)).events);
+            setTimeout(() => { res.writeHead(202); res.end('{}'); }, 10);
+        });
+    });
+    await new Promise(resolve => sink.listen(0, '127.0.0.1', resolve));
+    try {
+        mongo = await new GenericContainer('mongo:7').withExposedPorts(27017)
+            .withWaitStrategy(Wait.forListeningPorts()).start();
+        for (const mode of ['live', 'staging']) {
+            events = [];
+            child = fork(require.resolve('./fixtures/capture-latency-server'), [], {
+                env: { ...process.env, CAPTURE_TEST_MODE: mode, CAPTURE_TEST_OBSERVATIONS: '128',
+                    CAPTURE_TEST_MONGO: `mongodb://${mongo.getHost()}:${mongo.getMappedPort(27017)}/throughput_${mode}`,
+                    CAPTURE_TEST_SINK: `http://127.0.0.1:${sink.address().port}`, CAPTURE_TEST_POLICY: JSON.stringify(policy),
+                    REPRO_SDK_BACKGROUND_IDLE_DELAY_MS: '0', REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS: '0',
+                    REPRO_SDK_BACKGROUND_MAX_DEFER_MS: '0', TRACE_IDLE_FLUSH_MS: '10', TRACE_LINGER_AFTER_FINISH_MS: '0',
+                }, stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+            });
+            let stderr = '';
+            child.stderr.on('data', chunk => { stderr += chunk; });
+            const ready = await Promise.race([once(child, 'message').then(([v]) => v),
+                once(child, 'exit').then(() => { throw new Error(stderr); })]);
+            const base = `http://127.0.0.1:${ready.port}`;
+            const sessionIds = [0, 1].map(i => `S_throughput_${mode}_${i}`);
+            const started = performance.now();
+            const responses = await Promise.all(sessionIds.map((sid, i) =>
+                fetch(`${base}/names?__repro_sid=${sid}&__repro_aid=A_${i}&__repro_mode=${mode}`).then(r => r.json())));
+            const responseMs = performance.now() - started;
+            for (const response of responses) {
+                assert.equal(response.phase, 127);
+                assert.equal(response.rows.length, 120);
+                assert.equal(response.rows[0].internalSecret, 'secret-0');
+            }
+            const complete = sid => {
+                const scoped = events.filter(e => e.session_id === sid);
+                const manifest = scoped.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest;
+                return manifest && scoped.filter(e => e.event_type === 'trace_batch').length === manifest.expected.traceBatch
+                    && scoped.filter(e => e.event_type === 'backend_request').length === manifest.expected.backendRequest
+                    && scoped.reduce((sum, e) => sum + (Array.isArray(e.payload.db) ? e.payload.db.length : 0), 0) === manifest.expected.dbChange;
+            };
+            let maxHealthMs = 0;
+            while (!sessionIds.every(complete) && performance.now() - started < 60000) {
+                const t = performance.now();
+                await (await fetch(`${base}/health`)).json();
+                maxHealthMs = Math.max(maxHealthMs, performance.now() - t);
+                await sleep(20);
+            }
+            assert(sessionIds.every(complete), `missing evidence: ${JSON.stringify(sessionIds.map(sid => {
+                const scoped = events.filter(e => e.session_id === sid);
+                return { sid, counts: scoped.reduce((out, e) => { out[e.event_type] = (out[e.event_type] || 0) + 1; return out; }, {}),
+                    manifest: scoped.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest };
+            }))} ${stderr.slice(-2000)}`);
+            const completeMs = performance.now() - started;
+            for (const sid of sessionIds) {
+                const scoped = events.filter(e => e.session_id === sid);
+                const manifest = scoped.find(e => e.event_type === 'request_capture_manifest').payload.requestCaptureManifest;
+                assert.equal(manifest.privacy.status, 'applied');
+                assert(!manifest.captureFailures?.length);
+                const values = new Map(scoped.flatMap(e => [...(e.payload.traceValues || []), ...(e.payload.requestValues || []), ...(e.payload.dbValues || [])]).map(v => [v.id, v.value]));
+                const trace = scoped.flatMap(e => e.payload.trace || []);
+                const observations = [...new Map(trace.filter(e => e.fn === 'observeRows' && e.line === 6 && e.type === 'enter')
+                    .map(e => [e.spanId, e])).values()];
+                assert.equal(observations.length, 128);
+                const args = observations.map(e => values.get(e.argsValueCapture?.valueId) ?? e.args);
+                assert.deepEqual(args.map(v => v[0].phase), Array.from({ length: 128 }, (_, i) => i));
+                for (const [document] of args) {
+                    assert.equal(document.rows.length, mode === 'live' ? 101 : 120);
+                    assert.equal(document.rows[0].internalSecret, '[dropped]');
+                }
+                assert(!JSON.stringify(scoped).includes('secret-0'), 'capture leaked a protected value');
+            }
+            const metrics = await (await fetch(`${base}/health`)).json();
+            assert(metrics.tasks > 4);
+            assert(metrics.policyTransfers <= metrics.workers, 'full policy was transferred again for every trace batch');
+            assert(completeMs < 25000, `${mode}: post-response capture backlog took ${completeMs}ms`);
+            assert(maxHealthMs < 500, `${mode}: background capture blocked HTTP for ${maxHealthMs}ms`);
+            console.log(JSON.stringify({ mode, responseMs: Math.round(responseMs), completeMs: Math.round(completeMs), maxHealthMs: Math.round(maxHealthMs), ...metrics }));
+            const exited = once(child, 'exit'); child.send('stop'); await exited; child = null;
+        }
+    } finally {
+        if (child) { const exited = once(child, 'exit'); child.kill(); await exited; }
+        await new Promise(resolve => sink.close(resolve));
+        if (mongo) await mongo.stop();
+    }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/trace-worker-policy-reference.test.js

@@ -0,0 +1,43 @@
+const assert = require('node:assert/strict');
+const { Worker } = require('node:worker_threads');
+const { normalizeRuntimePrivacyPolicy } = require('../dist/privacy');
+
+async function main() {
+    const worker = new Worker(require.resolve('../dist/trace-materializer-worker'));
+    let taskId = 0;
+    const pending = new Map();
+    worker.on('message', message => { pending.get(message.taskId)(message); pending.delete(message.taskId); });
+    const policy = action => normalizeRuntimePrivacyPolicy({ statements: [
+        { sid: action, when: { scope: 'FIELD', selector: 'field:businessNote' }, apply: { action } },
+    ] });
+    const call = (policyId, privacy, tenant = 'T', raw = false) => new Promise(resolve => {
+        const id = ++taskId;
+        pending.set(id, resolve);
+        worker.postMessage({ taskId: id, type: 'materialize-trace-events', payload: {
+            policyId, privacy, fullValueCaptureEnabled: true,
+            cfg: { tenantId: tenant, appId: tenant, appSecret: tenant, privacy: { captureRaw: raw } },
+            maskReq: { key: 'GET /names' }, masking: null, valueNamespace: tenant,
+            events: [{ type: 'enter', fn: 'load', __reproPending: { argsRaw: [{ businessNote: 'operational-value' }] } }],
+        } });
+    });
+    try {
+        const missing = await call(1);
+        assert.equal(missing.ok, false);
+        assert.match(missing.error, /policy reference/);
+        // Queue interleaved policies before any result arrives. Old references must
+        // not accidentally use the new policy or a concurrent task's raw flag.
+        const responses = await Promise.all([
+            call(1, policy('DROP')), call(1), call(2, policy('KEEP_EXACT'), 'Other'),
+            call(2, undefined, 'Other'), call(1), call(3, null, 'Raw', true),
+            call(4, policy('DROP')), call(4),
+        ]);
+        for (const i of [0, 1, 6, 7]) {
+            assert.equal(responses[i].ok, true);
+            assert.equal(responses[i].events[0].args[0].businessNote, '[dropped]');
+        }
+        for (const i of [2, 3, 5]) assert.equal(responses[i].events[0].args[0].businessNote, 'operational-value');
+        assert.equal(responses[4].ok, false, 'stale reference silently used another policy');
+    } finally { await worker.terminate(); }
+    console.log('trace worker policy references, updates, missing refs, and raw/policy isolation OK');
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });