From ab46848154086fb2435959ec5c2a8507622d8733 Mon Sep 17 00:00:00 2001 From: Oleksandr Zhuravlov Date: Sun, 16 Aug 2026 12:51:16 +0300 Subject: [PATCH] test(core): pin the secret-redaction escape hatch (and `compact`) to the root barrel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `public-api-surface.spec.ts` exists so an accidental removal or rename of a documented value export can't slip past the suite, but four exports it was supposed to cover were never in `FUNCTIONS`: - `registerSecretKey` / `isSecretKey` / `redactSecretsDeep` — the trace-redaction escape hatch. ADR 0021's export table deliberately keeps all three on the ROOT when the auth surface moved to `stitchapi/auth`, and `@stitchapi/query-core` imports `isSecretKey` from this barrel to extend the denylist with header names rather than fork a parallel list that would drift. The pin is load-bearing today, not hypothetical. - `compact` — found by sweeping the same defect class (a public value export on the barrel with nothing pinning it) across every export of `src/index.ts`. The `compact` hits in the stream specs are the unrelated internal stream-buffer compaction, so nothing covered it. Each entry carries a comment explaining why the symbol is public, mirroring what's already written above the `duration`/`size`/`rate` token grammars. Diffed all root value exports against `FUNCTIONS`, the `systemClock` shape test, the error-class test and the surface-id test: those four were the only gaps, and everything on the barrel is now covered. Co-Authored-By: Claude Opus 5 --- packages/core/test/public-api-surface.spec.ts | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/packages/core/test/public-api-surface.spec.ts b/packages/core/test/public-api-surface.spec.ts index fc86f0d4..3ffc6665 100644 --- a/packages/core/test/public-api-surface.spec.ts +++ b/packages/core/test/public-api-surface.spec.ts @@ -23,11 +23,26 @@ const FUNCTIONS = [ 'otlpSink', 'otlpHttpExporter', 'toOtlpJson', + // The trace-redaction escape hatch (ADR 0018; ADR 0021's export table deliberately keeps all + // three on the ROOT rather than moving them to `stitchapi/auth` with the strategies that + // register into them). Public for the one credential the built-in denylist/stems don't catch: + // `registerSecretKey` widens the denylist so that param name is scrubbed in every trace sink, + // `isSecretKey` is the matching predicate — public for the same reason as the token grammars below, + // `@stitchapi/query-core` imports it from this barrel to extend the denylist with header names + // instead of forking a parallel list that would drift — and `redactSecretsDeep` scrubs a plain + // value with it, which is what `.inspect({ redact })` hands the caller. + 'registerSecretKey', + 'isSecretKey', + 'redactSecretsDeep', 'memoryStore', 'validate', 'compile', 'isStitch', 'isSeam', + // The `exactOptionalPropertyTypes` companion: public because config authoring under that flag + // otherwise needs the `...(key !== undefined ? { key } : {})` spread dance at every call site, + // and a peer package building a `StitchConfig` hits it as often as core does. + 'compact', // The verdict (ADR 0022 Decision 2), public because a surface author must compose it: an // `interpret` hook REPLACES the default rather than layering on it, so a surface with its own // body rules needs this to keep the caller's `verdict` config working. The one composition