chore: keep internal helpers out of the public surface

apps/server/src/mcp/McpHttpServer.ts

@@ -606,7 +606,7 @@ export const PreviewToolkitRegistrationLive = Layer.mergeAll(
   PreviewSnapshotRegistrationLive,
 );
 
-export const ThreadsToolkitRegistrationLive = McpServer.toolkit(ThreadsToolkit).pipe(
+const ThreadsToolkitRegistrationLive = McpServer.toolkit(ThreadsToolkit).pipe(
   Layer.provide(ThreadsToolkitHandlersLive),
 );
 

apps/server/src/mcp/toolkits/threads/tools.ts

@@ -28,7 +28,7 @@ const dependencies = [
   GitWorkflowService.GitWorkflowService,
 ];
 
-export const SpawnThreadTool = Tool.make("spawn_thread", {
+const SpawnThreadTool = Tool.make("spawn_thread", {
   description: `Spawn a subagent as a new thread in the current project and start it on the given prompt. The subagent runs independently with its own context; use await_thread to collect its result. Children default to an isolated git worktree (envMode "worktree"); pass envMode "local" for read-only tasks that can share the current checkout. Provider, model, and runtime mode default to this thread's. Limits: subagents may spawn their own subagents up to ${SUBAGENT_MAX_DEPTH} levels deep, and at most ${SUBAGENT_MAX_RUNNING_PER_TREE} subagents may run at once across a tree.`,
   parameters: SpawnThreadInput,
   success: SpawnThreadResult,
@@ -39,7 +39,7 @@ export const SpawnThreadTool = Tool.make("spawn_thread", {
   .annotate(Tool.Destructive, false)
   .annotate(Tool.OpenWorld, false);
 
-export const AwaitThreadTool = Tool.make("await_thread", {
+const AwaitThreadTool = Tool.make("await_thread", {
   description: `Wait for a spawned subagent thread to finish its current turn and return its final message. Only threads spawned by this thread can be awaited. Waits up to timeoutSeconds (default ${SUBAGENT_AWAIT_DEFAULT_TIMEOUT_SECONDS}); on timeout the subagent keeps running and can be awaited again.`,
   parameters: AwaitThreadInput,
   success: AwaitThreadResult,

apps/server/src/persistence/ForkMigrations.ts

@@ -1,5 +1,5 @@
 /**
- * ForkMigrationsLive - fork-only migration runner with its own ledger
+ * Fork-only migration runner with its own ledger
  *
  * Fork-only schema (TrogonStack additions that do not exist upstream) lives
  * in this second migration chain, tracked in its own migrations table
@@ -18,19 +18,18 @@
  */
 
 import * as Migrator from "effect/unstable/sql/Migrator";
-import * as Layer from "effect/Layer";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 
 import { migrationManifest } from "./Migrations.ts";
 import Migration0001 from "./Migrations/fork/001_ProjectionThreadParent.ts";
 
-export const FORK_MIGRATIONS_TABLE = "trogonstack_fork_migrations";
+const FORK_MIGRATIONS_TABLE = "trogonstack_fork_migrations";
 
 export const forkMigrationEntries = [[1, "ProjectionThreadParent", Migration0001]] as const;
 
-export const makeForkMigrationLoader = (throughId?: number) =>
+const makeForkMigrationLoader = (throughId?: number) =>
   Migrator.fromRecord(
     Object.fromEntries(
       forkMigrationEntries
@@ -195,8 +194,3 @@ export const realignSharedMigrationLedger = Effect.fn("realignSharedMigrationLed
 
   yield* Effect.log("Realigned shared migration ledger to upstream numbering");
 });
-
-/**
- * Layer that runs fork migrations when the layer is built.
- */
-export const ForkMigrationsLive = Layer.effectDiscard(runForkMigrations());

apps/server/src/provider/Layers/ClaudeProvider.ts

@@ -183,7 +183,7 @@ function apiProviderAuthMetadata(
  * `apiKeySource` is only ever set when a key was actually found, so it has no
  * "no key" sentinel to confuse with one.
  */
-export function claudeAuthStatus(
+function claudeAuthStatus(
   capabilities: Pick<
     ClaudeCapabilitiesProbe,
     "email" | "subscriptionType" | "tokenSource" | "apiKeySource" | "apiProvider"

apps/server/src/provider/ProviderSecretReference.ts

@@ -16,7 +16,7 @@
 import type { ProviderInstanceEnvironment } from "@t3tools/contracts";
 
 /** URI scheme 1Password uses for secret references; `op read` consumes these. */
-export const PROVIDER_SECRET_REFERENCE_PREFIX = "op://";
+const PROVIDER_SECRET_REFERENCE_PREFIX = "op://";
 
 /**
  * The secret reference an environment value names, or `undefined` when the

apps/server/src/provider/Services/ProviderSecretResolver.ts

@@ -71,7 +71,7 @@ export class ProviderSecretResolver extends Context.Service<
  * they are testing resolution itself: an `op://` value stays an `op://`
  * value, and the provider reports whatever the CLI makes of it.
  */
-export const passthroughProviderSecretResolver: ProviderSecretResolverShape = {
+const passthroughProviderSecretResolver: ProviderSecretResolverShape = {
   resolve: (environment) => Effect.succeed({ variables: environment, unresolved: [] }),
   prime: () => Effect.void,
   invalidate: Effect.void,

apps/server/src/server.ts

@@ -647,7 +647,7 @@ const _assertMcpToolkitDependenciesExposed: [McpToolkitDependency] extends [
   ? true
   : never = true;
 
-export const makeRoutesLayer = makeRoutesLayerWith(McpToolkitDependenciesLive);
+const makeRoutesLayer = makeRoutesLayerWith(McpToolkitDependenciesLive);
 
 const makeServerLayer = Layer.unwrap(
   Effect.gen(function* () {

apps/web/src/components/ChatView.logic.ts

@@ -554,7 +554,7 @@ export function buildThreadTurnInterruptInput(thread: Pick<Thread, "id" | "sessi
   };
 }
 
-export const BACKGROUND_WORK_LABEL_LIMIT = 2;
+const BACKGROUND_WORK_LABEL_LIMIT = 2;
 
 function pluralize(count: number, singular: string, plural: string): string {
   return `${count} ${count === 1 ? singular : plural}`;
@@ -564,7 +564,7 @@ function pluralize(count: number, singular: string, plural: string): string {
  * One line naming the live background work, listing what fits and counting the
  * rest. The banner has a single line, and the popover carries the full list.
  */
-export function formatBackgroundWorkLabels(
+function formatBackgroundWorkLabels(
   labels: ReadonlyArray<string>,
   limit = BACKGROUND_WORK_LABEL_LIMIT,
 ): string | null {

apps/web/src/observability/clientTracing.ts

@@ -121,17 +121,3 @@ async function disposeTracerRuntime(
   await settleAsyncResult(() => runtime.runPromiseExit(Scope.close(scope, Exit.void)));
   runtime.dispose();
 }
-
-export async function __resetClientTracingForTests() {
-  configurationGeneration++;
-  activeConfigKey = null;
-  setClientTracerDelegate(null);
-  pendingConfiguration = Promise.resolve();
-
-  const runtime = activeRuntime;
-  const scope = activeScope;
-  activeRuntime = null;
-  activeScope = null;
-
-  await disposeTracerRuntime(runtime, scope);
-}