Floot Endpoint Public Error Redaction Guard

GCD-FLOOT-249 · v1.0.0 · Free · MIT · zero runtime dependencies

PRESERVE-WHAT-WORKS

Create a checkpoint first. This package changes only the server-side public error-envelope decision where you explicitly call it. It does not redesign, restyle, reorganize, replace, or materially alter the host design, homepage, navigation, page structure, routes, branding, typography, colors, content hierarchy, working components, mobile or accessibility behavior, SEO, analytics, authentication, authorization, checkout, payments, integrations, databases, APIs, success responses, logging, or unrelated functionality.

Expected touched areas: one server-only helper import, one reviewed policy module, and the targeted endpoint error branch. Apply the smallest complete adapter.

1. Prerequisites and backup

  1. Use Node 18+ and keep this package server-side.
  2. Create a Floot checkpoint or source-control commit.
  3. Record current success, intentional 4xx, and unexpected 5xx response contracts.
  4. Confirm a protected server diagnostic path exists.

2. Test the package

npm test
node examples/basic.mjs

3. Install the smallest boundary

Copy src/index.js and, for TypeScript, src/index.d.ts. Define static reviewed mappings, run auditPublicErrorPolicy, and call redactEndpointError only in the existing server-side error branch. Send only publicResponse. Keep the original protected logger separate.

4. Targeted tests

Test mapped and unmapped failures, invalid correlation IDs, stack traces, SQL, credentials, filesystem paths, provider payloads, private identifiers, exact status/body shape, logger continuity, and production mode.

5. Regression checks

Verify success responses, auth and authorization, validation errors, rate limits, CORS, caching, retry UI, accessibility, translations, TypeScript, and the full project suite.

6. Limits and recovery

The helper evaluates caller-supplied evidence only. It does not catch, log, authorize, transmit, monitor, or prove redaction. Unsafe policy throws. Preserve the existing generic branch until staging passes. See COMPATIBILITY.md, SECURITY.md, and ROLLBACK.md.

PRESERVATION CONFLICT / REVIEW REQUIRED: stop if installation requires an unrelated redesign, route rewrite, auth/payment change, database migration, or broader API-contract change. Prefer a compatible adapter that keeps safe existing fields.

7. Rollback

Restore the checkpointed adapter and policy, run the prior endpoint and regression tests, deploy through the existing host workflow, and verify responses plus protected diagnostics. A rollback does not remediate data already disclosed; use incident response if leakage occurred.

8. Remaining unverified and publish next step

Your endpoint wiring, framework serialization, proxy defaults, logger controls, client compatibility, and production responses remain unverified. After focused and full gates pass, publish through Floot's supported release path, inspect the live response on every domain, and retain the checkpoint.