@npmcli/redact 3.2.2: redactError, redactLog, redactThrow

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/%40npmcli/redact@3.2.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40npmcli/redact@3.2.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:afcb6d1201750fd9333c95b849ca7b403f2c1f22d939fcb3ae3173f4454cb8e1","contract":["redact(value) replaces UUID strings with '***' and npm-prefixed 36..48-char values with 'npm_***', returning non-strings and empty strings unchanged","redactLog(arg) splits strings and string elements of arrays on whitespace and '=' before applying redact() to each token","redact(input) from '@npmcli/redact/server' deeply masks '.headers.cookie' and '.headers.set-cookie' and rewrites '.request' and '.response' objects to allowed keys","redactError(err) and redactThrow(fn) from '@npmcli/redact/server' serialize errors while redacting sensitive patterns in message and preserving errorType, code, and statusCode"],"goal":"verify pkg:npm/%40npmcli/redact@3.2.2","kind":"HOW","packages":["pkg:npm/%40npmcli/redact@3.2.2"],"schemaVersion":1,"symbols":["redact","redactError","redactLog","redactThrow"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","libc":"glibc","libcVersion":"2.39","moduleSystem":"esm","os":"linux","osVersionBucket":"24","packageManager":"npm","runtime":"node","runtimeVersion":"22.23","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40npmcli/redact@3.2.2"],"schemaVersion":1,"subject":"pkg:npm/%40npmcli/redact@3.2.2","symbols":["redact","redactError","redactLog","redactThrow"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample",
      "version": "1.0.0",
      "dependencies": {
        "@npmcli/redact": "3.2.2"
      }
    },
    "node_modules/@npmcli/redact": {
      "version": "3.2.2",
      "resolved": "https://registry.npmjs.org/@npmcli/redact/-/redact-3.2.2.tgz",
      "integrity": "sha512-7VmYAmk4csGv08QzrDKScdzn11jHPFGyqJW39FyPgPuAp3zIaUmuCo1yxw9aGs+NEJuTGQ9Gwqpt93vtJubucg==",
      "license": "ISC",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sample",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "dependencies": {
    "@npmcli/redact": "3.2.2"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/%40npmcli/redact@3.2.2",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40npmcli/redact@3.2.2"
  ]
}

import assert from 'node:assert/strict'
import { redact, redactLog } from '@npmcli/redact'
import {
  redact as serverRedact,
  redactError,
  redactThrow,
} from '@npmcli/redact/server'

const uuid = '00000000-0000-0000-0000-000000000000'
const marker = 'npm_' + '0'.repeat(36)

// 1. Main entry: redact() replaces UUIDs and npm-prefixed 36..48-char values
assert.equal(redact(uuid), '***')
assert.equal(redact(marker), 'npm_***')
assert.equal(redact(42), 42)
assert.equal(redact(''), '')

// 2. Main entry: redactLog() splits strings and string arrays on whitespace and '='
assert.equal(
  redactLog(`--id=${uuid} --tag ${marker}`),
  '--id=*** --tag npm_***'
)
assert.deepEqual(
  redactLog([`id=${uuid}`, marker, 10]),
  ['id=***', 'npm_***', 10]
)

// 3. Subpath '@npmcli/redact/server': deep object redaction of sensitive header paths and request/response shapes
const redactedObj = serverRedact({
  req: {
    headers: {
      cookie: 'c=1',
      'set-cookie': 's=2',
    },
    request: {
      method: 'GET',
      path: '/items',
      headers: {},
      url: 'http://localhost/items',
      extra: 'dropped',
    },
    response: {
      data: 'ok',
      status: 200,
      headers: {},
      raw: 'dropped',
    },
  },
})

assert.equal(redactedObj.req.headers.cookie, '[REDACTED_HEADER_COOKIE]')
assert.equal(redactedObj.req.headers['set-cookie'], '[REDACTED_HEADER_SET_COOKIE]')
assert.deepEqual(redactedObj.req.request, {
  method: 'GET',
  path: '/items',
  headers: {},
  url: 'http://localhost/items',
})
assert.deepEqual(redactedObj.req.response, {
  data: 'ok',
  status: 200,
  headers: {},
})

// 4. redactError and redactThrow wrap Error instances while redacting messages and preserving code/statusCode
const err = Object.assign(new Error(`failed with ${marker}`), {
  code: 'EAUTH',
  status: 401,
  extraField: 'dropped',
})
const safeErr = redactError(err)
assert.ok(safeErr instanceof Error)
assert.equal(safeErr.message, 'failed with [REDACTED_NPM_SECRET]')
assert.equal(safeErr.code, 'EAUTH')
assert.equal(safeErr.statusCode, 401)
assert.equal(safeErr.errorType, 'Error')
assert.equal(safeErr.extraField, undefined)

const wrapped = redactThrow(async () => {
  throw new Error(`boom ${marker}`)
})
await assert.rejects(wrapped(), {
  message: 'boom [REDACTED_NPM_SECRET]',
})