improvement(audits): ratchet knip unused exports, types, and duplicates

check:unused-exports runs knip once with the dead-code issue types gated at
zero plus exports/types/duplicates compared against a shrink-only baseline
of path#symbol entries. Package entry exports stay public surface via an
explicit includeEntryExports: false. run-audits skips check:dead-code since
this pass covers it.

Author: waleedlatif1

knip.jsonc

@@ -1,8 +1,12 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
-  // Gate reachability and dependency ownership. Export/type pruning needs review
-  // of public package contracts and test-only consumers, not a blanket threshold.
+  // Plain `knip` (check:dead-code) gates reachability and dependency ownership.
+  // Unused exports, types, and duplicates are ratcheted by check:unused-exports,
+  // which reuses this config in the same knip pass.
   "include": ["files", "dependencies", "unlisted", "unresolved"],
+  // Package `exports`/`main`/`bin` targets are entries; their exports are public
+  // contracts (ts-sdk, emcn, cli, …), so knip must never report them as unused.
+  "includeEntryExports": false,
   "workspaces": {
     ".": {
       "entry": ["scripts/**/*.{ts,tsx}", "vitest.shared.ts"],

package.json

@@ -81,6 +81,7 @@
     "check:desktop-bridge": "bun run scripts/check-desktop-bridge-contract.ts --check",
     "check:desktop-ipc": "bun run scripts/check-desktop-ipc-contract.ts",
     "check:route-verbs": "bun run scripts/check-route-verbs.ts",
+    "check:unused-exports": "bun run scripts/check-unused-exports.ts",
     "desktop-bridge-contract:update": "bun run scripts/check-desktop-bridge-contract.ts --update",
     "mship-contracts:generate": "bun run scripts/sync-mothership-stream-contract.ts",
     "mship-contracts:check": "bun run scripts/sync-mothership-stream-contract.ts --check",