test(config): cover raw redaction helper invariants

src/config/redact-snapshot.raw.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { REDACTED_SENTINEL } from "./redact-snapshot.js";
+import { replaceSensitiveValuesInRaw } from "./redact-snapshot.raw.js";
+
+describe("replaceSensitiveValuesInRaw", () => {
+  it("ignores empty string replacement tokens", () => {
+    const raw = '{ "gateway": { "auth": { "token": "" } }, "other": "" }';
+
+    const result = replaceSensitiveValuesInRaw({
+      raw,
+      sensitiveValues: [""],
+      redactedSentinel: REDACTED_SENTINEL,
+    });
+
+    expect(result).toBe(raw);
+  });
+
+  it("redacts non-empty values while preserving blank strings", () => {
+    const raw = '{ "token": "", "secret": "abc123", "other": "" }';
+
+    const result = replaceSensitiveValuesInRaw({
+      raw,
+      sensitiveValues: ["", "abc123"],
+      redactedSentinel: REDACTED_SENTINEL,
+    });
+
+    expect(result).toContain('"token": ""');
+    expect(result).toContain('"other": ""');
+    expect(result).not.toContain("abc123");
+    expect(result).toContain(REDACTED_SENTINEL);
+  });
+
+  it("replaces longest values first for overlapping matches", () => {
+    const raw = '{ "token": "abcd", "prefix": "ab" }';
+
+    const result = replaceSensitiveValuesInRaw({
+      raw,
+      sensitiveValues: ["ab", "abcd", "abcd"],
+      redactedSentinel: REDACTED_SENTINEL,
+    });
+
+    expect(result).toBe(`{ "token": "${REDACTED_SENTINEL}", "prefix": "${REDACTED_SENTINEL}" }`);
+  });
+});