feat(audit): ScadaBridge C2 — ScadaBridgeAuditRedactor/SafeDefaultAuditRedactor : IAuditRedactor on canonical record (Task 2.5)

src/ZB.MOM.WW.ScadaBridge.AuditLog/Payload/AuditRedactionPrimitives.cs

@@ -0,0 +1,310 @@
+using System.Text;
+using System.Text.Encodings.Web;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using Microsoft.Extensions.Logging;
+
+namespace ZB.MOM.WW.ScadaBridge.AuditLog.Payload;
+
+/// <summary>
+/// Pure, stateless redaction + truncation primitives shared by the legacy
+/// <see cref="DefaultAuditPayloadFilter"/> (which operates on the
+/// <see cref="ZB.MOM.WW.ScadaBridge.Commons.Entities.Audit.AuditEvent"/> entity)
+/// and the canonical <see cref="ScadaBridgeAuditRedactor"/> (which operates on
+/// <c>ZB.MOM.WW.Audit.AuditEvent</c> + its <c>DetailsJson</c>). Extracted in
+/// ScadaBridge audit re-architecture stage C2 (Task 2.5) so the byte-exact
+/// redaction logic lives in ONE place and the two code paths can never drift.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Each stage method is a pure function of its inputs (no instance state). The
+/// only side effects are diagnostics-only: a warning log line and an
+/// <paramref name="onFailure"/> callback invocation when a redactor faults, so
+/// the caller can bump its redaction-failure health counter. The callbacks are
+/// passed in (rather than the counter interface) to keep this helper free of
+/// any DI / health-metric coupling.
+/// </para>
+/// <para>
+/// The regex CACHE and per-call options resolution deliberately stay in
+/// <see cref="DefaultAuditPayloadFilter"/> — they carry per-instance state
+/// (lazy compile, 100 ms compile budget, sentinel entries) that the safety-net
+/// tests pin to that class. This helper only holds the stateless stages that
+/// operate once the compiled regex set / redact list / cap has already been
+/// resolved.
+/// </para>
+/// </remarks>
+internal static class AuditRedactionPrimitives
+{
+    /// <summary>Marker replacing redacted header values, body matches, and SQL parameter values.</summary>
+    public const string RedactedMarker = "<redacted>";
+
+    /// <summary>Over-redaction marker emitted when a redactor stage itself faults.</summary>
+    public const string RedactorErrorMarker = "<redacted: redactor error>";
+
+    /// <summary>
+    /// JSON serializer options used to re-emit redacted summaries. The
+    /// UnsafeRelaxedJsonEscaping encoder is required so the redaction marker
+    /// (which contains <c>&lt;</c> / <c>&gt;</c>) survives unescaped — matching
+    /// the legacy filter's output byte-for-byte.
+    /// </summary>
+    public static readonly JsonSerializerOptions RedactedSummaryJsonOptions = new()
+    {
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
+    };
+
+    /// <summary>
+    /// Parse <paramref name="json"/> as the documented
+    /// <c>{"headers": {...}, "body": ...}</c> shape and replace values whose
+    /// header NAME (case-insensitive) is in <paramref name="redactList"/> with
+    /// <see cref="RedactedMarker"/>. Re-serialises and returns the result.
+    /// No-op pass-through for inputs that are not JSON-object-shaped or do not
+    /// carry a top-level <c>headers</c> object. On any unexpected fault the
+    /// field is over-redacted with <see cref="RedactorErrorMarker"/> and
+    /// <paramref name="onFailure"/> is invoked.
+    /// </summary>
+    public static string? RedactHeaders(
+        string? json,
+        IList<string> redactList,
+        ILogger logger,
+        Action onFailure)
+    {
+        if (json is null)
+        {
+            return null;
+        }
+
+        // Cheap structural pre-check: only attempt JSON parsing when the input
+        // actually looks like a JSON object. Saves the JsonDocument allocation
+        // on the (very common) non-JSON ErrorDetail / Extra fields.
+        var trimmed = json.AsSpan().TrimStart();
+        if (trimmed.Length == 0 || trimmed[0] != '{')
+        {
+            return json;
+        }
+
+        try
+        {
+            JsonNode? root;
+            try
+            {
+                root = JsonNode.Parse(json);
+            }
+            catch (JsonException)
+            {
+                // Not parseable JSON — leave the field alone (no error, no
+                // redaction). Emitters not yet using the documented shape get
+                // a transparent pass.
+                return json;
+            }
+
+            if (root is not JsonObject obj || obj["headers"] is not JsonObject headers)
+            {
+                // No "headers" object at the top level — nothing to redact.
+                return json;
+            }
+
+            // Build a case-insensitive lookup of the redact list so we can do
+            // one O(1) check per header name without an inner Any() loop.
+            var redactSet = new HashSet<string>(redactList, StringComparer.OrdinalIgnoreCase);
+
+            // Take a snapshot of names first — we cannot mutate while
+            // enumerating the JsonObject.
+            var names = new List<string>(headers.Count);
+            foreach (var kvp in headers)
+            {
+                names.Add(kvp.Key);
+            }
+            foreach (var name in names)
+            {
+                if (redactSet.Contains(name))
+                {
+                    headers[name] = JsonValue.Create(RedactedMarker);
+                }
+            }
+
+            return obj.ToJsonString(RedactedSummaryJsonOptions);
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(
+                ex,
+                "Header redactor faulted; over-redacting field with '{Marker}'",
+                RedactorErrorMarker);
+            try { onFailure(); } catch { /* swallow per §7 */ }
+            return RedactorErrorMarker;
+        }
+    }
+
+    /// <summary>
+    /// Apply each compiled body-redactor regex to <paramref name="value"/> in
+    /// turn, replacing every match with <see cref="RedactedMarker"/>. If any
+    /// single regex match throws (most commonly
+    /// <see cref="RegexMatchTimeoutException"/>) the field is over-redacted
+    /// with <see cref="RedactorErrorMarker"/> and <paramref name="onFailure"/>
+    /// is invoked — the user-facing action is never aborted.
+    /// </summary>
+    public static string? RedactBody(
+        string? value,
+        IReadOnlyList<Regex> regexes,
+        ILogger logger,
+        Action onFailure)
+    {
+        if (value is null)
+        {
+            return null;
+        }
+        var current = value;
+        foreach (var rx in regexes)
+        {
+            try
+            {
+                current = rx.Replace(current, RedactedMarker);
+            }
+            catch (Exception ex)
+            {
+                logger.LogWarning(
+                    ex,
+                    "Body redactor '{Pattern}' faulted; over-redacting field with '{Marker}'",
+                    rx.ToString(), RedactorErrorMarker);
+                try { onFailure(); } catch { /* swallow per §7 */ }
+                return RedactorErrorMarker;
+            }
+        }
+        return current;
+    }
+
+    /// <summary>
+    /// Walk the M4 <c>{"sql":"...","parameters":{...}}</c> RequestSummary
+    /// shape; for each parameter whose NAME matches
+    /// <paramref name="paramNameRegex"/>, replace its value with
+    /// <see cref="RedactedMarker"/>. Re-serialise. No-op pass-through when the
+    /// input is not parseable JSON, is not a JSON object, or does not carry a
+    /// top-level <c>"parameters"</c> object. On any unexpected fault the field
+    /// is over-redacted with <see cref="RedactorErrorMarker"/> and
+    /// <paramref name="onFailure"/> is invoked.
+    /// </summary>
+    public static string? RedactSqlParameters(
+        string? json,
+        Regex paramNameRegex,
+        ILogger logger,
+        Action onFailure)
+    {
+        if (json is null)
+        {
+            return null;
+        }
+
+        var trimmed = json.AsSpan().TrimStart();
+        if (trimmed.Length == 0 || trimmed[0] != '{')
+        {
+            return json;
+        }
+
+        try
+        {
+            JsonNode? root;
+            try
+            {
+                root = JsonNode.Parse(json);
+            }
+            catch (JsonException)
+            {
+                return json;
+            }
+
+            if (root is not JsonObject obj || obj["parameters"] is not JsonObject parameters)
+            {
+                return json;
+            }
+
+            // Snapshot the names — mutating during enumeration is unsupported.
+            var names = new List<string>(parameters.Count);
+            foreach (var kvp in parameters)
+            {
+                names.Add(kvp.Key);
+            }
+            var anyChanged = false;
+            foreach (var name in names)
+            {
+                bool matched;
+                try
+                {
+                    matched = paramNameRegex.IsMatch(name);
+                }
+                catch (Exception ex)
+                {
+                    logger.LogWarning(
+                        ex,
+                        "SQL parameter redactor faulted; over-redacting field with '{Marker}'",
+                        RedactorErrorMarker);
+                    try { onFailure(); } catch { /* swallow per §7 */ }
+                    return RedactorErrorMarker;
+                }
+                if (matched)
+                {
+                    parameters[name] = JsonValue.Create(RedactedMarker);
+                    anyChanged = true;
+                }
+            }
+
+            // Avoid re-serialising (which would normalise whitespace / order)
+            // when no parameter matched — keeps the on-disk row byte-identical
+            // to the emitter's output on the no-match path.
+            return anyChanged ? obj.ToJsonString(RedactedSummaryJsonOptions) : json;
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(
+                ex,
+                "SQL parameter redactor faulted; over-redacting field with '{Marker}'",
+                RedactorErrorMarker);
+            try { onFailure(); } catch { /* swallow per §7 */ }
+            return RedactorErrorMarker;
+        }
+    }
+
+    /// <summary>
+    /// Truncate <paramref name="value"/> to <paramref name="cap"/> UTF-8 bytes,
+    /// setting <paramref name="truncated"/> to <c>true</c> when the value was
+    /// shortened. Null passes through as null.
+    /// </summary>
+    public static string? TruncateField(string? value, int cap, ref bool truncated)
+    {
+        if (value is null)
+        {
+            return null;
+        }
+        var result = TruncateUtf8(value, cap);
+        if (result.Length != value.Length)
+        {
+            truncated = true;
+        }
+        return result;
+    }
+
+    /// <summary>
+    /// UTF-8 byte-safe truncation. Encodes the input to UTF-8, walks back from
+    /// the cap position until the byte is NOT a continuation byte
+    /// (<c>byte &amp; 0xC0 == 0x80</c>), and decodes the resulting prefix —
+    /// guaranteeing the returned string never splits a multi-byte sequence.
+    /// </summary>
+    public static string TruncateUtf8(string value, int capBytes)
+    {
+        if (string.IsNullOrEmpty(value))
+        {
+            return value;
+        }
+        var bytes = Encoding.UTF8.GetBytes(value);
+        if (bytes.Length <= capBytes)
+        {
+            return value;
+        }
+        var boundary = capBytes;
+        while (boundary > 0 && (bytes[boundary] & 0xC0) == 0x80)
+        {
+            boundary--;
+        }
+        return Encoding.UTF8.GetString(bytes, 0, boundary);
+    }
+}

src/ZB.MOM.WW.ScadaBridge.AuditLog/Payload/AuditRegexCache.cs

@@ -0,0 +1,96 @@
+using System.Collections.Concurrent;
+using System.Text.RegularExpressions;
+using Microsoft.Extensions.Logging;
+
+namespace ZB.MOM.WW.ScadaBridge.AuditLog.Payload;
+
+/// <summary>
+/// Per-instance compiled-regex cache for audit body / SQL-parameter redactors.
+/// Extracted in ScadaBridge audit re-architecture stage C2 (Task 2.5) so the
+/// legacy <see cref="DefaultAuditPayloadFilter"/> and the canonical
+/// <see cref="ZB.MOM.WW.ScadaBridge.AuditLog.Redaction.ScadaBridgeAuditRedactor"/>
+/// share the SAME compile rules (50 ms per-match timeout, 100 ms compile budget,
+/// invalid-pattern sentinel) rather than duplicating the logic.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Lazy population keyed by pattern string: each pattern is compiled on first
+/// use and cached forever. A failed compile (or a compile slower than 100 ms)
+/// caches a sentinel so the failing compile is not retried on every event. The
+/// failure is logged once on first encounter. <see cref="ConcurrentDictionary{TKey,TValue}"/>
+/// is the right primitive because the owning redactor is a DI singleton on the
+/// audit hot-path.
+/// </para>
+/// </remarks>
+internal sealed class AuditRegexCache
+{
+    /// <summary>
+    /// Per-match regex timeout. Catastrophic-backtracking patterns trip a
+    /// <see cref="RegexMatchTimeoutException"/> when a single match takes longer
+    /// than this; the caller then over-redacts the offending field. 50 ms is
+    /// generous for normal patterns yet short enough that the audit hot-path is
+    /// not held up by a misconfigured regex.
+    /// </summary>
+    private static readonly TimeSpan RegexMatchTimeout = TimeSpan.FromMilliseconds(50);
+
+    private readonly ConcurrentDictionary<string, CompiledRegex> _cache = new();
+    private readonly ILogger _logger;
+
+    public AuditRegexCache(ILogger logger) => _logger = logger;
+
+    /// <summary>
+    /// Resolve a compiled regex from the cache, compiling it on first use.
+    /// Returns <c>false</c> for patterns that are invalid OR whose compile took
+    /// longer than 100 ms (the spec calls catastrophic-backtracking guesses at
+    /// compile time "invalid"); the failure is logged once and the sentinel
+    /// cache entry prevents repeat compile attempts.
+    /// </summary>
+    public bool TryGet(string pattern, out Regex? regex)
+    {
+        var entry = _cache.GetOrAdd(pattern, Compile);
+        regex = entry.Regex;
+        return entry.Regex != null;
+    }
+
+    private CompiledRegex Compile(string pattern)
+    {
+        try
+        {
+            var swStart = System.Diagnostics.Stopwatch.GetTimestamp();
+            var rx = new Regex(pattern, RegexOptions.Compiled, RegexMatchTimeout);
+            var elapsedMs = (System.Diagnostics.Stopwatch.GetTimestamp() - swStart)
+                * 1000d / System.Diagnostics.Stopwatch.Frequency;
+            if (elapsedMs > 100)
+            {
+                _logger.LogWarning(
+                    "Body redactor pattern compiled in {Elapsed}ms (> 100ms cap); rejecting '{Pattern}'",
+                    elapsedMs, pattern);
+                return CompiledRegex.Invalid;
+            }
+            return new CompiledRegex(rx);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(
+                ex,
+                "Body redactor pattern '{Pattern}' failed to compile; skipping",
+                pattern);
+            return CompiledRegex.Invalid;
+        }
+    }
+
+    /// <summary>
+    /// Cache entry for a body-redactor pattern. Carries the working
+    /// <see cref="Regex"/> on the success path, or the <see cref="Invalid"/>
+    /// sentinel for patterns that failed to compile (or exceeded the 100 ms
+    /// compile budget).
+    /// </summary>
+    private readonly struct CompiledRegex
+    {
+        public static readonly CompiledRegex Invalid = new(null);
+
+        public Regex? Regex { get; }
+
+        public CompiledRegex(Regex? regex) => Regex = regex;
+    }
+}

src/ZB.MOM.WW.ScadaBridge.AuditLog/Payload/DefaultAuditPayloadFilter.cs

@@ -1,8 +1,3 @@
-using System.Collections.Concurrent;
-using System.Text;
-using System.Text.Encodings.Web;
-using System.Text.Json;
-using System.Text.Json.Nodes;
 using System.Text.RegularExpressions;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -55,48 +50,15 @@ namespace ZB.MOM.WW.ScadaBridge.AuditLog.Payload;
 /// </remarks>
 public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
 {
-    private const string RedactedMarker = "<redacted>";
-    private const string RedactorErrorMarker = "<redacted: redactor error>";
-
-    /// <summary>
-    /// Per-match regex timeout. Catastrophic-backtracking patterns trip a
-    /// <see cref="RegexMatchTimeoutException"/> when a single match takes
-    /// longer than this; the offending field is then over-redacted with
-    /// <see cref="RedactorErrorMarker"/> and the failure counter is bumped.
-    /// 50 ms is generous for normal patterns yet short enough that the
-    /// audit hot-path isn't held up by a misconfigured regex.
-    /// </summary>
-    private static readonly TimeSpan RegexMatchTimeout = TimeSpan.FromMilliseconds(50);
-
-    /// <summary>
-    /// JSON serializer options used to re-emit redacted summaries. The
-    /// UnsafeRelaxedJsonEscaping encoder is required so the redaction marker
-    /// (which contains <c>&lt;</c> / <c>&gt;</c>) survives unescaped — the
-    /// header-redaction tests grep for the literal marker, and the downstream
-    /// UI / log readers would rather see <c>&lt;redacted&gt;</c> than
-    /// <c><redacted></c>. The summaries are persisted to the audit
-    /// table and rendered in trusted-internal contexts only, so the relaxed
-    /// HTML-escaping rules do not introduce an XSS surface.
-    /// </summary>
-    private static readonly JsonSerializerOptions RedactedSummaryJsonOptions = new()
-    {
-        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
-    };
-
+    // Redaction markers + the relaxed-escaping JSON options live in
+    // AuditRedactionPrimitives, and the compiled-regex cache (50 ms match
+    // timeout, 100 ms compile budget, invalid-pattern sentinel) lives in
+    // AuditRegexCache — both shared C2 helpers so the legacy filter and the
+    // canonical ScadaBridgeAuditRedactor emit byte-identical output.
     private readonly IOptionsMonitor<AuditLogOptions> _options;
     private readonly ILogger<DefaultAuditPayloadFilter> _logger;
     private readonly IAuditRedactionFailureCounter _failureCounter;
-
-    /// <summary>
-    /// Compiled-regex cache keyed by pattern string. Lazy population: each
-    /// pattern is compiled on first use and cached forever (the entry's
-    /// <see cref="CompiledRegex"/> carries either the working <see cref="Regex"/>
-    /// or a sentinel marking the pattern as invalid so we don't retry the
-    /// failing compile on every call). ConcurrentDictionary is the right
-    /// thread-safety primitive here because the filter is a DI singleton
-    /// shared across the audit hot-path.
-    /// </summary>
-    private readonly ConcurrentDictionary<string, CompiledRegex> _regexCache = new();
+    private readonly AuditRegexCache _regexCache;
 
     /// <summary>
     /// Primary constructor used by DI — pulls the optional redaction-failure
@@ -114,6 +76,7 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
         _options = options ?? throw new ArgumentNullException(nameof(options));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
         _failureCounter = failureCounter ?? new NoOpAuditRedactionFailureCounter();
+        _regexCache = new AuditRegexCache(_logger);
     }
 
     /// <inheritdoc />
@@ -198,83 +161,18 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
     /// Parse <paramref name="json"/> as the documented
     /// <c>{"headers": {...}, "body": ...}</c> shape and replace values whose
     /// header NAME (case-insensitive) is in <paramref name="redactList"/> with
-    /// <see cref="RedactedMarker"/>. Re-serialises and returns the result.
+    /// the redaction marker. Re-serialises and returns the result. Delegates to
+    /// <see cref="AuditRedactionPrimitives.RedactHeaders"/>.
     /// </summary>
     /// <remarks>
     /// No-op pass-through for inputs that aren't JSON-shaped — emitters that
     /// have not yet adopted the convention (the M2 site emitters today, which
     /// leave RequestSummary null on outbound API calls) get a transparent
     /// pass. If the redactor itself throws, we over-redact the whole field
-    /// with <see cref="RedactorErrorMarker"/> and bump the failure counter.
+    /// with the redactor-error marker and bump the failure counter.
     /// </remarks>
     private string? RedactHeaders(string? json, IList<string> redactList)
-    {
-        if (json is null)
-        {
-            return null;
-        }
-
-        // Cheap structural pre-check: only attempt JSON parsing when the input
-        // actually looks like a JSON object. Saves the JsonDocument allocation
-        // on the (very common) non-JSON ErrorDetail / Extra fields.
-        var trimmed = json.AsSpan().TrimStart();
-        if (trimmed.Length == 0 || trimmed[0] != '{')
-        {
-            return json;
-        }
-
-        try
-        {
-            JsonNode? root;
-            try
-            {
-                root = JsonNode.Parse(json);
-            }
-            catch (JsonException)
-            {
-                // Not parseable JSON — leave the field alone (no error, no
-                // redaction). Emitters not yet using the documented shape get
-                // a transparent pass; Bundle C will update them.
-                return json;
-            }
-
-            if (root is not JsonObject obj || obj["headers"] is not JsonObject headers)
-            {
-                // No "headers" object at the top level — nothing to redact.
-                return json;
-            }
-
-            // Build a case-insensitive lookup of the redact list so we can do
-            // one O(1) check per header name without an inner Any() loop.
-            var redactSet = new HashSet<string>(redactList, StringComparer.OrdinalIgnoreCase);
-
-            // Take a snapshot of names first — we cannot mutate while
-            // enumerating the JsonObject.
-            var names = new List<string>(headers.Count);
-            foreach (var kvp in headers)
-            {
-                names.Add(kvp.Key);
-            }
-            foreach (var name in names)
-            {
-                if (redactSet.Contains(name))
-                {
-                    headers[name] = JsonValue.Create(RedactedMarker);
-                }
-            }
-
-            return obj.ToJsonString(RedactedSummaryJsonOptions);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogWarning(
-                ex,
-                "Header redactor faulted; over-redacting field with '{Marker}'",
-                RedactorErrorMarker);
-            try { _failureCounter.Increment(); } catch { /* swallow per §7 */ }
-            return RedactorErrorMarker;
-        }
-    }
+        => AuditRedactionPrimitives.RedactHeaders(json, redactList, _logger, IncrementFailureCounter);
 
     /// <summary>
     /// Combine the global and per-target body-redactor lists for a single
@@ -301,7 +199,7 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
         {
             foreach (var pattern in opts.GlobalBodyRedactors)
             {
-                if (TryGetCompiledRegex(pattern, out var rx))
+                if (_regexCache.TryGet(pattern, out var rx))
                 {
                     result.Add(rx!);
                 }
@@ -311,7 +209,7 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
         {
             foreach (var pattern in perTargetAdditions)
             {
-                if (TryGetCompiledRegex(pattern, out var rx))
+                if (_regexCache.TryGet(pattern, out var rx))
                 {
                     result.Add(rx!);
                 }
@@ -320,80 +218,17 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
         return result;
     }
 
-    /// <summary>
-    /// Resolve a compiled regex from the cache, compiling it on first use.
-    /// Returns <c>false</c> for patterns that are invalid OR whose compile
-    /// took longer than 100 ms (the spec calls catastrophic-backtracking
-    /// guesses at compile time "invalid"); the failure is logged once and
-    /// the sentinel cache entry prevents repeat compile attempts.
-    /// </summary>
-    private bool TryGetCompiledRegex(string pattern, out Regex? regex)
-    {
-        var entry = _regexCache.GetOrAdd(pattern, CompileRegex);
-        regex = entry.Regex;
-        return entry.Regex != null;
-    }
-
-    private CompiledRegex CompileRegex(string pattern)
-    {
-        try
-        {
-            var swStart = System.Diagnostics.Stopwatch.GetTimestamp();
-            var rx = new Regex(pattern, RegexOptions.Compiled, RegexMatchTimeout);
-            var elapsedMs = (System.Diagnostics.Stopwatch.GetTimestamp() - swStart)
-                * 1000d / System.Diagnostics.Stopwatch.Frequency;
-            if (elapsedMs > 100)
-            {
-                _logger.LogWarning(
-                    "Body redactor pattern compiled in {Elapsed}ms (> 100ms cap); rejecting '{Pattern}'",
-                    elapsedMs, pattern);
-                return CompiledRegex.Invalid;
-            }
-            return new CompiledRegex(rx);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogWarning(
-                ex,
-                "Body redactor pattern '{Pattern}' failed to compile; skipping",
-                pattern);
-            return CompiledRegex.Invalid;
-        }
-    }
-
     /// <summary>
     /// Apply each compiled body-redactor regex to <paramref name="value"/> in
-    /// turn, replacing every match with <see cref="RedactedMarker"/>. If any
-    /// single regex match throws (most commonly
-    /// <see cref="RegexMatchTimeoutException"/>) the field is over-redacted
-    /// with <see cref="RedactorErrorMarker"/> and the failure counter is
-    /// incremented — the user-facing action is never aborted.
+    /// turn, replacing every match with the redaction marker. If any single
+    /// regex match throws (most commonly
+    /// <see cref="RegexMatchTimeoutException"/>) the field is over-redacted with
+    /// the redactor-error marker and the failure counter is incremented — the
+    /// user-facing action is never aborted. Delegates to
+    /// <see cref="AuditRedactionPrimitives.RedactBody"/>.
     /// </summary>
     private string? RedactBody(string? value, IReadOnlyList<Regex> regexes)
-    {
-        if (value is null)
-        {
-            return null;
-        }
-        var current = value;
-        foreach (var rx in regexes)
-        {
-            try
-            {
-                current = rx.Replace(current, RedactedMarker);
-            }
-            catch (Exception ex)
-            {
-                _logger.LogWarning(
-                    ex,
-                    "Body redactor '{Pattern}' faulted; over-redacting field with '{Marker}'",
-                    rx.ToString(), RedactorErrorMarker);
-                try { _failureCounter.Increment(); } catch { /* swallow per §7 */ }
-                return RedactorErrorMarker;
-            }
-        }
-        return current;
-    }
+        => AuditRedactionPrimitives.RedactBody(value, regexes, _logger, IncrementFailureCounter);
 
     /// <summary>
     /// Resolve the per-connection SQL parameter redaction regex for the given
@@ -425,7 +260,7 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
         // the pattern without an IgnoreCase flag. The compile cache key folds
         // the option to keep the entries unambiguous.
         var cacheKey = "(?i)" + over.RedactSqlParamsMatching;
-        if (!TryGetCompiledRegex(cacheKey, out regex))
+        if (!_regexCache.TryGet(cacheKey, out regex))
         {
             return false;
         }
@@ -435,128 +270,30 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
     /// <summary>
     /// Walk the M4 <c>{"sql":"...","parameters":{...}}</c> RequestSummary
     /// shape; for each parameter whose NAME matches
-    /// <paramref name="paramNameRegex"/>, replace its value with
-    /// <see cref="RedactedMarker"/>. Re-serialise.
+    /// <paramref name="paramNameRegex"/>, replace its value with the redaction
+    /// marker. Re-serialise. Delegates to
+    /// <see cref="AuditRedactionPrimitives.RedactSqlParameters"/>.
     /// </summary>
     /// <remarks>
     /// No-op pass-through when the input isn't parseable JSON, isn't a JSON
     /// object, or doesn't carry a top-level <c>"parameters"</c> object. On
-    /// any unexpected fault the field is over-redacted with
-    /// <see cref="RedactorErrorMarker"/> and the failure counter is bumped.
+    /// any unexpected fault the field is over-redacted and the failure counter
+    /// is bumped.
     /// </remarks>
     private string? RedactSqlParameters(string? json, Regex paramNameRegex)
-    {
-        if (json is null)
-        {
-            return null;
-        }
-
-        var trimmed = json.AsSpan().TrimStart();
-        if (trimmed.Length == 0 || trimmed[0] != '{')
-        {
-            return json;
-        }
-
-        try
-        {
-            JsonNode? root;
-            try
-            {
-                root = JsonNode.Parse(json);
-            }
-            catch (JsonException)
-            {
-                return json;
-            }
-
-            if (root is not JsonObject obj || obj["parameters"] is not JsonObject parameters)
-            {
-                return json;
-            }
-
-            // Snapshot the names — mutating during enumeration is unsupported.
-            var names = new List<string>(parameters.Count);
-            foreach (var kvp in parameters)
-            {
-                names.Add(kvp.Key);
-            }
-            var anyChanged = false;
-            foreach (var name in names)
-            {
-                bool matched;
-                try
-                {
-                    matched = paramNameRegex.IsMatch(name);
-                }
-                catch (Exception ex)
-                {
-                    _logger.LogWarning(
-                        ex,
-                        "SQL parameter redactor faulted; over-redacting field with '{Marker}'",
-                        RedactorErrorMarker);
-                    try { _failureCounter.Increment(); } catch { /* swallow per §7 */ }
-                    return RedactorErrorMarker;
-                }
-                if (matched)
-                {
-                    parameters[name] = JsonValue.Create(RedactedMarker);
-                    anyChanged = true;
-                }
-            }
-
-            // Avoid re-serialising (which would normalise whitespace / order)
-            // when no parameter matched — keeps the on-disk row byte-identical
-            // to the emitter's output on the no-match path.
-            return anyChanged ? obj.ToJsonString(RedactedSummaryJsonOptions) : json;
-        }
-        catch (Exception ex)
-        {
-            _logger.LogWarning(
-                ex,
-                "SQL parameter redactor faulted; over-redacting field with '{Marker}'",
-                RedactorErrorMarker);
-            try { _failureCounter.Increment(); } catch { /* swallow per §7 */ }
-            return RedactorErrorMarker;
-        }
-    }
+        => AuditRedactionPrimitives.RedactSqlParameters(json, paramNameRegex, _logger, IncrementFailureCounter);
 
     private static string? TruncateField(string? value, int cap, ref bool truncated)
-    {
-        if (value is null)
-        {
-            return null;
-        }
-        var result = TruncateUtf8(value, cap);
-        if (result.Length != value.Length)
-        {
-            truncated = true;
-        }
-        return result;
-    }
+        => AuditRedactionPrimitives.TruncateField(value, cap, ref truncated);
 
     /// <summary>
-    /// UTF-8 byte-safe truncation. Encodes the input to UTF-8, walks back from
-    /// the cap position until the byte is NOT a continuation byte
-    /// (<c>byte &amp; 0xC0 == 0x80</c>), and decodes the resulting prefix —
-    /// guaranteeing the returned string never splits a multi-byte sequence.
+    /// Bumps the injected redaction-failure counter, swallowing any fault per
+    /// alog.md §7 (a counter failure must never abort the audited action).
+    /// Passed as the <c>onFailure</c> callback to the shared primitives.
     /// </summary>
-    private static string TruncateUtf8(string value, int capBytes)
+    private void IncrementFailureCounter()
     {
-        if (string.IsNullOrEmpty(value))
-        {
-            return value;
-        }
-        var bytes = Encoding.UTF8.GetBytes(value);
-        if (bytes.Length <= capBytes)
-        {
-            return value;
-        }
-        var boundary = capBytes;
-        while (boundary > 0 && (bytes[boundary] & 0xC0) == 0x80)
-        {
-            boundary--;
-        }
-        return Encoding.UTF8.GetString(bytes, 0, boundary);
+        try { _failureCounter.Increment(); } catch { /* swallow per §7 */ }
     }
 
     private static bool IsErrorStatus(AuditStatus status) => status switch
@@ -564,24 +301,4 @@ public sealed class DefaultAuditPayloadFilter : IAuditPayloadFilter
         AuditStatus.Delivered or AuditStatus.Submitted or AuditStatus.Forwarded => false,
         _ => true,
     };
-
-    /// <summary>
-    /// Cache entry for a body-redactor pattern. Carries the working
-    /// <see cref="Regex"/> on the success path, or the
-    /// <see cref="Invalid"/> sentinel for patterns that failed to compile
-    /// (or exceeded the 100 ms compile budget). The sentinel lets us skip
-    /// repeat compile attempts on every event without re-throwing on the
-    /// hot-path.
-    /// </summary>
-    private readonly struct CompiledRegex
-    {
-        public static readonly CompiledRegex Invalid = new(null);
-
-        /// <summary>Gets the compiled <see cref="System.Text.RegularExpressions.Regex"/>, or <c>null</c> when the pattern was invalid.</summary>
-        public Regex? Regex { get; }
-
-        /// <summary>Initializes a new <see cref="CompiledRegex"/> wrapping the given compiled regex instance.</summary>
-        /// <param name="regex">The pre-compiled regex, or <c>null</c> to represent an invalid pattern.</param>
-        public CompiledRegex(Regex? regex) => Regex = regex;
-    }
 }