test(core): pin the secret-redaction escape hatch (and compact) to the root barrel

[rejifald]

Why

public-api-surface.spec.ts exists for one reason, stated in its own header: smoke.spec.ts
exercises stitch end-to-end, but nothing pins the export surface itself, so an accidental
removal or rename of a public symbol slips past the suite and is caught only by attw/build, late.

Four documented value exports of the root barrel were never in FUNCTIONS, so the guard did not
cover them.

What this does

Adds them, each with a comment in the file's existing style explaining why the symbol is public —
mirroring what is already written above parseDuration/parseBytes/parseRate.

Export	Why it is public
registerSecretKey	Widens the secret-key denylist so a host's custom credential param name is scrubbed in every trace sink (start.url, OTLP url.full, input.query). The escape hatch for a credential the built-in set/stems don't catch.
isSecretKey	The matching predicate — a host audits which of its query params / body keys the scrubbers already cover.
redactSecretsDeep	Scrubs a plain value with that predicate; what .inspect({ redact }) hands the caller.
compact	The exactOptionalPropertyTypes companion — config authoring under that flag otherwise needs the ...(key !== undefined ? { key } : {}) spread dance at every call site.

The trio is placed after the OTLP block and compact after the parsers, matching src/index.ts
ordering.

Why the secret-redaction trio in particular

Two things make this pin load-bearing rather than hypothetical:

• ADR 0021's export table lists all three
  as stitchapi → stitchapi. Keeping them on the root was an explicit decision when the auth
  surface moved to stitchapi/auth, even though apiKey({ in: 'query', name }) — which lives on
  the subpath now — is what registers into them automatically.
• A real cross-package consumer: @stitchapi/query-core imports isSecretKey from this
  barrel (packages/query-core/src/index.ts:19) to extend
  the denylist with header names, rather than fork a parallel list that would drift. That is the
  same peer-package argument the parsers' comment already makes.

The fourth one — a sweep, not the original ask

The task named three. The defect class is "a public value export on the root barrel with nothing
pinning it", so I diffed every value export of src/index.ts against everything the spec
covers: FUNCTIONS, the systemClock shape test, the error-class test, and the
httpSurface/graphqlSurface id test.

compact (src/index.ts:82) was the fourth gap and had no
dedicated spec either — the compact hits in stream.spec.ts / json-stream-buffer.spec.ts are
the unrelated internal stream-buffer compaction, not this export. Fixed here rather than left
as follow-up work.

Those four were the only gaps; everything on the barrel is now covered.

Reviewer notes

• Test-only change. No source file is touched, so there is no bundle-size or API impact — the
  bundle-advertised-size tether is unaffected.
• The pin is structural, not tautological: expect(typeof api[name]).toBe('function') fails on
  undefined the moment an export is removed or renamed, which is exactly the event this file
  guards.
• A docs gap this surfaced, deliberately not fixed here. These three have no reference page —
  apps/docs/content/docs/reference/helpers.mdx has no "Secret redaction" section (its headings run
  Transport / Tracing & OTLP / Store), and the names appear nowhere under apps/docs/. They are
  public API on ADR 0021's authority and query-core's import, not on the docs site's. That is the
  known root-barrel-exports-without-a-reference-page gap and belongs in its own docs PR.

Verification

• pnpm test in packages/core: 169 files / 1578 tests passed.
• The four new pins confirmed to actually execute (--reporter=verbose), not silently skip.
• Pre-commit gates green: prettier (unchanged), check:lint clean across 37 packages, check:types
  across all 39 workspace projects.

🤖 Generated with Claude Code