improvement(packages): resolve the private-package exports the entry-export check exposed

- Delete exports nothing uses: RadarChart, ChipModalPromptBody, InputOTPSeparator,
  DropdownMenuGroup/Portal, legacy terminal tool names, and dead types and helpers
- Drop `export` from declarations used only in their own file, and remove barrel
  re-exports no consumer imports
- Tag getOAuthClientCapabilityFields and generateRandomBytes `@public`: generate-docs
  loads the first by file path, and check:utils names the second
- Trim the workflow-authz mock to the module's remaining exports
- The unused-exports baseline gains no entries and drops one

Author: waleedlatif1

.claude/rules/emcn-components.md

@@ -12,7 +12,7 @@ Import components, `cn`, and tokens from the `@sim/emcn` barrel; icons come from
 
 Never hand-roll the chip pill from raw class strings (they go stale). Compose from the canonical sources:
 
-- **Surface, typography + content tokens:** `chip/chip-chrome.ts` — `chipFilledSurfaceTokens`, `chipFieldSurfaceClass`, `chipFieldTextClass` (text fields and the dropdown search box build on these), plus the chip-content chrome `chipContentGap`, `chipGeometryClass`, `chipContentIconClass`, `chipContentLabelClass`, `cellIconNodeClass` (non-chip surfaces that must visually match chip content, e.g. resource table cells), and the row-state pair `chipHoverSurfaceClass` / `chipActiveSurfaceClass` (hover vs. selected — mutually exclusive, so a selected row holds its surface through hover; every hand-rolled row imports these rather than restating the literals). All are re-exported from the `@sim/emcn` barrel — no subpath import needed.
+- **Surface, typography + content tokens:** `chip/chip-chrome.ts` — `chipFieldSurfaceClass`, `chipFieldTextClass` (text fields and the dropdown search box build on these), plus the chip-content chrome `chipContentGap`, `chipGeometryClass`, `chipContentIconClass`, `chipContentLabelClass`, `cellIconNodeClass` (non-chip surfaces that must visually match chip content, e.g. resource table cells), and the row-state pair `chipHoverSurfaceClass` / `chipActiveSurfaceClass` (hover vs. selected — mutually exclusive, so a selected row holds its surface through hover; every hand-rolled row imports these rather than restating the literals). All are re-exported from the `@sim/emcn` barrel — no subpath import needed.
 - **Pill geometry:** `chip/chip.tsx` — `chipVariants` (30px tall, `rounded-lg`, `px-2`, icon↔text `gap-1.5`). Every pill-shaped trigger (`ChipDropdown`, `ChipSelect`, `ChipSwitch`) reuses it for visual parity.
 
 Canonical look: normal font-weight (never `font-medium`/`font-semibold`), value text `--text-body`, icons `--text-icon` at `size-[14px]`, placeholder `--text-muted`, `transition-colors`, **no focus ring** (the caret marks focus). Filled surface is `--surface-5` light / `--surface-4` dark with a `--border` border (`chip-chrome.ts` still spells it through the legacy alias `--border-1`; new code writes `--border`).

.cursor/rules/emcn-components.mdc

@@ -13,7 +13,7 @@ Import components, `cn`, and tokens from the `@sim/emcn` barrel; icons come from
 
 Never hand-roll the chip pill from raw class strings (they go stale). Compose from the canonical sources:
 
-- **Surface, typography + content tokens:** `chip/chip-chrome.ts` — `chipFilledSurfaceTokens`, `chipFieldSurfaceClass`, `chipFieldTextClass` (text fields and the dropdown search box build on these), plus the chip-content chrome `chipContentGap`, `chipGeometryClass`, `chipContentIconClass`, `chipContentLabelClass`, `cellIconNodeClass` (non-chip surfaces that must visually match chip content, e.g. resource table cells), and the row-state pair `chipHoverSurfaceClass` / `chipActiveSurfaceClass` (hover vs. selected — mutually exclusive, so a selected row holds its surface through hover; every hand-rolled row imports these rather than restating the literals). All are re-exported from the `@sim/emcn` barrel — no subpath import needed.
+- **Surface, typography + content tokens:** `chip/chip-chrome.ts` — `chipFieldSurfaceClass`, `chipFieldTextClass` (text fields and the dropdown search box build on these), plus the chip-content chrome `chipContentGap`, `chipGeometryClass`, `chipContentIconClass`, `chipContentLabelClass`, `cellIconNodeClass` (non-chip surfaces that must visually match chip content, e.g. resource table cells), and the row-state pair `chipHoverSurfaceClass` / `chipActiveSurfaceClass` (hover vs. selected — mutually exclusive, so a selected row holds its surface through hover; every hand-rolled row imports these rather than restating the literals). All are re-exported from the `@sim/emcn` barrel — no subpath import needed.
 - **Pill geometry:** `chip/chip.tsx` — `chipVariants` (30px tall, `rounded-lg`, `px-2`, icon↔text `gap-1.5`). Every pill-shaped trigger (`ChipDropdown`, `ChipSelect`, `ChipSwitch`) reuses it for visual parity.
 
 Canonical look: normal font-weight (never `font-medium`/`font-semibold`), value text `--text-body`, icons `--text-icon` at `size-[14px]`, placeholder `--text-muted`, `transition-colors`, **no focus ring** (the caret marks focus). Filled surface is `--surface-5` light / `--surface-4` dark with a `--border` border (`chip-chrome.ts` still spells it through the legacy alias `--border-1`; new code writes `--border`).

apps/sim/stores/workflows/workflow/types.ts

@@ -38,7 +38,7 @@ export type {
   Variable,
   WorkflowState,
 }
-export { isValidSubflowType, SUBFLOW_TYPES } from '@sim/workflow-types/workflow'
+export { SUBFLOW_TYPES } from '@sim/workflow-types/workflow'
 
 export interface WorkflowActions {
   updateNodeDimensions: (id: string, dimensions: { width: number; height: number }) => void

packages/auth/src/principal.ts

@@ -12,7 +12,7 @@ export type Principal =
   | SlackAppPrincipal
 
 /** Verified app-wide ingress authority; installation lookup grants no human access. */
-export interface SlackAppPrincipal {
+interface SlackAppPrincipal {
   kind: 'slack_app'
   appId: string
   appRevision: string
@@ -94,7 +94,7 @@ export interface ExternalUserSubject {
 }
 
 /** Email address proven by a deployment's OTP or SSO authentication gate. */
-export interface AuthenticatedEmailSubject {
+interface AuthenticatedEmailSubject {
   kind: 'authenticated_email'
   email: string
 }
@@ -106,7 +106,7 @@ interface ActorlessSystemPrincipal {
   workflowId: string
 }
 
-export interface ChatSystemPrincipal {
+interface ChatSystemPrincipal {
   kind: 'system'
   serviceId: 'chat'
   workspaceId: string
@@ -124,10 +124,7 @@ export interface WebhookSystemPrincipal {
   subject?: ExternalUserSubject
 }
 
-export type SystemPrincipal =
-  | ActorlessSystemPrincipal
-  | ChatSystemPrincipal
-  | WebhookSystemPrincipal
+type SystemPrincipal = ActorlessSystemPrincipal | ChatSystemPrincipal | WebhookSystemPrincipal
 
 interface DelegatedPrincipalBase {
   kind: 'delegated'
@@ -153,7 +150,7 @@ export interface SubjectDelegatedPrincipal extends DelegatedPrincipalBase {
   subjectUserId: string
 }
 
-export interface WorkflowExecutionDelegationContext {
+interface WorkflowExecutionDelegationContext {
   kind: 'workflow_execution'
   workflowId: string
   executionId?: string

packages/auth/src/verify.ts

@@ -16,7 +16,7 @@ export interface VerifyAuthOptions {
  * created by `apps/sim`'s full auth config, so it can carry plugin fields
  * (e.g. `activeOrganizationId`) this minimal instance does not configure.
  */
-export interface VerifiedOneTimeTokenSession {
+interface VerifiedOneTimeTokenSession {
   user: {
     id: string
     name: string | null

packages/browser-protocol/src/index.ts

@@ -57,23 +57,20 @@ export const CURRENT_BROWSER_TOOL_NAMES = [
 
 export type CurrentBrowserToolName = (typeof CURRENT_BROWSER_TOOL_NAMES)[number]
 
-export const RETIRED_BROWSER_TOOL_NAMES = ['browser_request_takeover'] as const
+const RETIRED_BROWSER_TOOL_NAMES = ['browser_request_takeover'] as const
 
-export const BROWSER_TOOL_NAMES = [
-  ...CURRENT_BROWSER_TOOL_NAMES,
-  ...RETIRED_BROWSER_TOOL_NAMES,
-] as const
+const BROWSER_TOOL_NAMES = [...CURRENT_BROWSER_TOOL_NAMES, ...RETIRED_BROWSER_TOOL_NAMES] as const
 
 export type BrowserToolName = (typeof BROWSER_TOOL_NAMES)[number]
 
-export const BROWSER_WAIT_FOR_DEFAULT_TIMEOUT_MS = 10_000
-export const BROWSER_WAIT_FOR_MAX_TIMEOUT_MS = 120_000
-export const BROWSER_WAIT_FOR_RENDERER_GRACE_MS = 15_000
+const BROWSER_WAIT_FOR_DEFAULT_TIMEOUT_MS = 10_000
+const BROWSER_WAIT_FOR_MAX_TIMEOUT_MS = 120_000
+const BROWSER_WAIT_FOR_RENDERER_GRACE_MS = 15_000
 export const BROWSER_TOOL_AUTHORIZATION_TIMEOUT_MS = 8_000
 export const BROWSER_NAVIGATION_NATIVE_WATCHDOG_MS = 60_000
 export const BROWSER_TOOL_QUEUE_WAIT_TIMEOUT_MS = BROWSER_NAVIGATION_NATIVE_WATCHDOG_MS
 const BROWSER_RENDERER_TRANSPORT_GRACE_MS = 2_000
-export const BROWSER_NAVIGATION_RENDERER_TIMEOUT_MS =
+const BROWSER_NAVIGATION_RENDERER_TIMEOUT_MS =
   BROWSER_TOOL_AUTHORIZATION_TIMEOUT_MS +
   BROWSER_TOOL_QUEUE_WAIT_TIMEOUT_MS +
   BROWSER_NAVIGATION_NATIVE_WATCHDOG_MS +
@@ -132,7 +129,7 @@ export function browserToolRendererTimeoutMs(
   }
 }
 
-export const BROWSER_THEMES = ['system', 'light', 'dark'] as const
+const BROWSER_THEMES = ['system', 'light', 'dark'] as const
 
 /** Sim appearance preference mirrored into browser-tab media queries. */
 export type BrowserTheme = (typeof BROWSER_THEMES)[number]

packages/deployment-config/src/env-capabilities.ts

@@ -28,7 +28,7 @@ export type EnvCapabilityValues =
   | ReadonlyMap<string, EnvCapabilityValue>
   | Readonly<Record<string, EnvCapabilityValue>>
 
-export type EnvValueValidation =
+type EnvValueValidation =
   | {
       kind: 'integer'
       min?: number
@@ -79,13 +79,13 @@ export interface AnyOfRequirement {
   requirements: readonly EnvRequirement[]
 }
 
-export type EnvRequirement = EnvFieldRequirement | AllOfRequirement | AnyOfRequirement
+type EnvRequirement = EnvFieldRequirement | AllOfRequirement | AnyOfRequirement
 
-export type EnvProviderActivation =
+type EnvProviderActivation =
   | { mode: 'any-present'; keys: readonly string[] }
   | { mode: 'enabled'; key: string }
 
-export interface EnvProviderValidationIssue {
+interface EnvProviderValidationIssue {
   kind: 'missing' | 'invalid'
   fields: readonly string[]
   message: string
@@ -119,7 +119,7 @@ export interface FallbackCapabilityDefinition<
   providers: readonly TProvider[]
 }
 
-export type EnvDefaultProviderDefinition =
+type EnvDefaultProviderDefinition =
   | { id: string; kind: 'built-in'; label: string }
   | { id: string; kind: 'provider' }
 
@@ -180,11 +180,6 @@ export interface SelectedCapabilityInspection<
   error: EnvCapabilityConfigurationError | null
 }
 
-export type CapabilityInspection<TDefinition extends CapabilityDefinition> =
-  TDefinition extends SelectedCapabilityDefinition
-    ? SelectedCapabilityInspection<ProviderId<TDefinition>, DeclaredProviderId<TDefinition>>
-    : FallbackCapabilityInspection<DeclaredProviderId<TDefinition>>
-
 export class EnvCapabilityConfigurationError extends Error {
   constructor(
     readonly capabilityId: string,
@@ -237,11 +232,11 @@ export function envField(
   return { type: 'field', key, ...options }
 }
 
-export function allOf(...requirements: readonly EnvRequirement[]): AllOfRequirement {
+function allOf(...requirements: readonly EnvRequirement[]): AllOfRequirement {
   return { type: 'allOf', requirements }
 }
 
-export function anyOf(...requirements: readonly EnvRequirement[]): AnyOfRequirement {
+function anyOf(...requirements: readonly EnvRequirement[]): AnyOfRequirement {
   return { type: 'anyOf', requirements }
 }
 
@@ -352,7 +347,7 @@ export function defineCapability<const TDefinition extends CapabilityDefinition>
 }
 
 /** Returns the canonical command for configuring a runtime capability. */
-export function getCapabilitySetupCommand(definition: CapabilityDefinition): string {
+function getCapabilitySetupCommand(definition: CapabilityDefinition): string {
   return `npx sim-setup add ${definition.id}`
 }
 
@@ -540,7 +535,7 @@ function inspectRequiredProvider<const TProvider extends EnvProviderDefinition>(
   }
 }
 
-export function inspectProvider<const TProvider extends EnvProviderDefinition>(
+function inspectProvider<const TProvider extends EnvProviderDefinition>(
   provider: TProvider,
   values: EnvCapabilityValues
 ): ProviderInspection<TProvider['id']> {
@@ -1637,6 +1632,11 @@ export function resolveOAuthClientCapabilityId(serviceId: string): OAuthClientCa
   return normalized in OAUTH_CLIENT_CAPABILITIES ? (normalized as OAuthClientCapabilityId) : null
 }
 
+/**
+ * Env fields that configure a service's OAuth client.
+ *
+ * @public scripts/generate-docs.ts loads this module by file path, which knip cannot trace.
+ */
 export function getOAuthClientCapabilityFields(serviceId: string): readonly string[] | null {
   const providerId = resolveOAuthClientCapabilityId(serviceId)
   return providerId ? OAUTH_CLIENT_CAPABILITIES[providerId] : null

packages/desktop-bridge/src/index.ts

@@ -33,7 +33,7 @@ import type {
   TerminalToolResponse,
 } from '@sim/terminal-protocol'
 
-export const PENDING_DESKTOP_SCOPE_PREFIX = 'pending:' as const
+const PENDING_DESKTOP_SCOPE_PREFIX = 'pending:' as const
 
 /** Boolean results preserve compatibility with older installed desktop shells. */
 export type TerminalPasteResult = boolean | 'too-large'
@@ -305,7 +305,7 @@ export interface SimDesktopBrowserAgentApi {
   onScopeSuspended(callback: (scopeId: string) => void): () => void
 }
 
-export type BrowserDownloadState = 'progressing' | 'completed' | 'interrupted' | 'cancelled'
+type BrowserDownloadState = 'progressing' | 'completed' | 'interrupted' | 'cancelled'
 
 /** Safe renderer metadata for a native browser download; host paths never cross the bridge. */
 export interface BrowserDownloadInfo {
@@ -409,7 +409,7 @@ export interface BrowserSiteInfo {
   importedAt?: string
 }
 
-export interface SimDesktopBrowserImportApi {
+interface SimDesktopBrowserImportApi {
   /** Chrome profiles detected on this device; empty when none are readable. */
   listChromeProfiles(): Promise<BrowserImportProfile[]>
   /**
@@ -507,7 +507,7 @@ export interface BrowserFillAvailability {
  * management calls require the Sim app origin, filling additionally requires
  * a real user gesture, and no browser tool maps to these channels.
  */
-export interface SimDesktopBrowserCredentialsApi {
+interface SimDesktopBrowserCredentialsApi {
   /** False when OS-backed encryption is unavailable and passwords are disabled. */
   isAvailable(): Promise<boolean>
   /** Saved credentials, without passwords. */
@@ -575,15 +575,15 @@ export interface LocalFilesystemEntry {
   modifiedAt?: string
 }
 
-export interface LocalFilesystemStat {
+interface LocalFilesystemStat {
   name: string
   uri: string
   kind: LocalFilesystemEntryKind
   size: number
   modifiedAt: string
 }
 
-export interface LocalFilesystemReadResult {
+interface LocalFilesystemReadResult {
   uri: string
   content: string
   startLine: number
@@ -785,7 +785,7 @@ export const TERMINAL_DARK_THEME = {
   brightWhite: '#f0f6fc',
 } as const satisfies TerminalThemePalette
 
-export type TerminalThemeSource = 'terminal' | 'iterm2'
+type TerminalThemeSource = 'terminal' | 'iterm2'
 
 export interface TerminalSelectedProfile {
   /** Stable source profile id used to restore this selection. */
@@ -928,7 +928,7 @@ export function resolveDesktopZoom(
   return Math.min(bounds.max, Math.max(bounds.min, next))
 }
 
-export const DESKTOP_APPEARANCE_THEMES = ['app', 'light', 'dark'] as const
+const DESKTOP_APPEARANCE_THEMES = ['app', 'light', 'dark'] as const
 
 export type DesktopAppearanceTheme = (typeof DESKTOP_APPEARANCE_THEMES)[number]
 
@@ -957,7 +957,7 @@ export interface DesktopNotificationPayload {
 }
 
 /** Device-level settings owned by the desktop shell. */
-export interface SimDesktopSettingsApi {
+interface SimDesktopSettingsApi {
   getPreferences(): Promise<DesktopPreferences>
   setPreference<K extends DesktopPreferenceKey>(
     key: K,
@@ -981,7 +981,7 @@ export interface SimDesktopSettingsApi {
   setTerminalDefaultZoom(zoom: DesktopZoomPercent): Promise<DesktopPreferences>
 }
 
-export interface SimDesktopTerminalThemesApi {
+interface SimDesktopTerminalThemesApi {
   listProfiles(): Promise<TerminalThemeProfile[]>
   selectProfile(profileId: string): Promise<DesktopPreferences | null>
 }
@@ -991,13 +991,7 @@ export interface SimDesktopTerminalThemesApi {
  * automatic downloads are disabled or the shell requires a manual installer;
  * self-updating shells with automatic downloads enabled move to `downloading`.
  */
-export type DesktopUpdateStatus =
-  | 'idle'
-  | 'checking'
-  | 'available'
-  | 'downloading'
-  | 'ready'
-  | 'error'
+type DesktopUpdateStatus = 'idle' | 'checking' | 'available' | 'downloading' | 'ready' | 'error'
 
 export interface DesktopUpdateState {
   status: DesktopUpdateStatus
@@ -1014,7 +1008,7 @@ export interface DesktopUpdateState {
 }
 
 /** The shell updater surface. */
-export interface SimDesktopUpdatesApi {
+interface SimDesktopUpdatesApi {
   getState(): Promise<DesktopUpdateState>
   /**
    * Advances the pipeline: checks for an update, downloads an available
@@ -1067,7 +1061,7 @@ export type DesktopServerChangeResult =
  * to must stay reachable when that server cannot be reached at all, and must
  * never be drivable by a page the current server serves.
  */
-export interface SimDesktopServerApi {
+interface SimDesktopServerApi {
   /** Opens the shell's native server-selection window. */
   open(): void
   getConfiguration(): Promise<DesktopServerConfiguration>

packages/emcn/src/components/avatar/avatar.tsx

@@ -213,11 +213,4 @@ const AvatarFallback = React.forwardRef<
 })
 AvatarFallback.displayName = 'AvatarFallback'
 
-export {
-  Avatar,
-  AvatarImage,
-  AvatarFallback,
-  avatarVariants,
-  avatarStatusVariants,
-  avatarFallbackVariants,
-}
+export { Avatar, AvatarImage, AvatarFallback }

packages/emcn/src/components/bulk-action-button/bulk-action-button.tsx

@@ -5,7 +5,7 @@ import { Button, type ButtonProps } from '../button/button'
 import { chipFilledFillTokens, chipRadiusClass } from '../chip/chip-chrome'
 
 /** The shared 28px geometry and brand-hover treatment of selection action bars. */
-export const bulkActionButtonVariants = cva(
+const bulkActionButtonVariants = cva(
   `${chipRadiusClass} size-[28px] p-0 hover-hover:bg-[var(--brand-secondary)] hover-hover:text-[var(--text-inverse)]!`,
   {
     variants: {