refactor: trim node host exports

src/node-host/config.ts

@@ -11,7 +11,7 @@ export type NodeHostGatewayConfig = {
   tlsFingerprint?: string;
 };
 
-export type NodeHostConfig = {
+type NodeHostConfig = {
   version: 1;
   nodeId: string;
   token?: string;

src/node-host/exec-policy.ts

@@ -1,8 +1,8 @@
 import { requiresExecApproval, type ExecAsk, type ExecSecurity } from "../infra/exec-approvals.js";
 
-export type ExecApprovalDecision = "allow-once" | "allow-always" | null;
+type ExecApprovalDecision = "allow-once" | "allow-always" | null;
 
-export type SystemRunPolicyDecision = {
+type SystemRunPolicyDecision = {
   analysisOk: boolean;
   allowlistSatisfied: boolean;
   shellWrapperBlocked: boolean;

src/node-host/invoke-system-run-allowlist.ts

@@ -12,7 +12,7 @@ import {
 import { resolveExecSafeBinRuntimePolicy } from "../infra/exec-safe-bin-runtime-policy.js";
 import type { RunResult } from "./invoke-types.js";
 
-export type SystemRunAllowlistAnalysis = {
+type SystemRunAllowlistAnalysis = {
   analysisOk: boolean;
   allowlistMatches: ExecAllowlistEntry[];
   allowlistSatisfied: boolean;

src/node-host/invoke.ts

@@ -60,7 +60,7 @@ type ExecApprovalsSnapshot = {
   file: ExecApprovalsFile;
 };
 
-export type NodeInvokeRequestPayload = {
+type NodeInvokeRequestPayload = {
   id: string;
   nodeId: string;
   command: string;

src/node-host/runner.ts

@@ -57,7 +57,7 @@ export function shouldExitNodeHostOnReconnectPaused(detailCode: string | null):
   return detailCode !== null && NODE_HOST_EXIT_ON_RECONNECT_PAUSE_CODES.has(detailCode);
 }
 
-export function formatNodeHostReconnectPausedMessage(
+function formatNodeHostReconnectPausedMessage(
   info: GatewayReconnectPausedInfo,
   params?: { exiting?: boolean },
 ): string {