From 44a8c40114dcabfae8775a345d925404771be8b5 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 2 May 2026 03:08:26 +0100
Subject: [PATCH] refactor: trim gateway auth canvas exports

---
 src/gateway/auth-config-utils.ts | 16 ++++++++--------
 src/gateway/canvas-capability.ts |  4 ++--
 src/gateway/canvas-documents.ts  | 18 +++++++++---------
 3 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/src/gateway/auth-config-utils.ts b/src/gateway/auth-config-utils.ts
index ad048fd6a37..4654437e867 100644
--- a/src/gateway/auth-config-utils.ts
+++ b/src/gateway/auth-config-utils.ts
@@ -8,12 +8,12 @@ import {
   type SupportedGatewaySecretInputPath,
 } from "./secret-input-paths.js";
 
-export type GatewayAuthSecretInputPath = Extract<
+type GatewayAuthSecretInputPath = Extract<
   SupportedGatewaySecretInputPath,
   "gateway.auth.token" | "gateway.auth.password"
 >;
 
-export type GatewayAuthSecretRefResolutionParams = {
+type GatewayAuthSecretRefResolutionParams = {
   cfg: OpenClawConfig;
   env: NodeJS.ProcessEnv;
   mode?: GatewayAuthConfig["mode"];
@@ -28,7 +28,7 @@ export function hasConfiguredGatewayAuthSecretInput(
   return hasConfiguredSecretInput(readGatewaySecretInputValue(cfg, path), cfg.secrets?.defaults);
 }
 
-export function shouldResolveGatewayAuthSecretRef(params: {
+function shouldResolveGatewayAuthSecretRef(params: {
   mode?: GatewayAuthConfig["mode"];
   path: GatewayAuthSecretInputPath;
   hasPasswordCandidate: boolean;
@@ -51,7 +51,7 @@ export function shouldResolveGatewayAuthSecretRef(params: {
   return isTokenPath ? !params.hasPasswordCandidate : !params.hasTokenCandidate;
 }
 
-export function shouldResolveGatewayTokenSecretRef(
+function shouldResolveGatewayTokenSecretRef(
   params: Omit<GatewayAuthSecretRefResolutionParams, "cfg" | "env">,
 ): boolean {
   return shouldResolveGatewayAuthSecretRef({
@@ -62,7 +62,7 @@ export function shouldResolveGatewayTokenSecretRef(
   });
 }
 
-export function shouldResolveGatewayPasswordSecretRef(
+function shouldResolveGatewayPasswordSecretRef(
   params: Omit<GatewayAuthSecretRefResolutionParams, "cfg" | "env">,
 ): boolean {
   return shouldResolveGatewayAuthSecretRef({
@@ -73,7 +73,7 @@ export function shouldResolveGatewayPasswordSecretRef(
   });
 }
 
-export async function resolveGatewayAuthSecretRefValue(params: {
+async function resolveGatewayAuthSecretRefValue(params: {
   cfg: OpenClawConfig;
   env: NodeJS.ProcessEnv;
   path: GatewayAuthSecretInputPath;
@@ -116,7 +116,7 @@ export async function resolveGatewayPasswordSecretRefValue(
   });
 }
 
-export async function resolveGatewayAuthSecretRef(params: {
+async function resolveGatewayAuthSecretRef(params: {
   cfg: OpenClawConfig;
   env: NodeJS.ProcessEnv;
   path: GatewayAuthSecretInputPath;
@@ -137,7 +137,7 @@ export async function resolveGatewayAuthSecretRef(params: {
   return nextConfig;
 }
 
-export async function resolveGatewayPasswordSecretRef(params: {
+async function resolveGatewayPasswordSecretRef(params: {
   cfg: OpenClawConfig;
   env: NodeJS.ProcessEnv;
   mode?: GatewayAuthConfig["mode"];
diff --git a/src/gateway/canvas-capability.ts b/src/gateway/canvas-capability.ts
index 32c7bff83bf..da49e4325b6 100644
--- a/src/gateway/canvas-capability.ts
+++ b/src/gateway/canvas-capability.ts
@@ -1,10 +1,10 @@
 import { randomBytes } from "node:crypto";
 
 export const CANVAS_CAPABILITY_PATH_PREFIX = "/__openclaw__/cap";
-export const CANVAS_CAPABILITY_QUERY_PARAM = "oc_cap";
+const CANVAS_CAPABILITY_QUERY_PARAM = "oc_cap";
 export const CANVAS_CAPABILITY_TTL_MS = 10 * 60_000;
 
-export type NormalizedCanvasScopedUrl = {
+type NormalizedCanvasScopedUrl = {
   pathname: string;
   capability?: string;
   rewrittenUrl?: string;
diff --git a/src/gateway/canvas-documents.ts b/src/gateway/canvas-documents.ts
index bb307b15236..e220fa96980 100644
--- a/src/gateway/canvas-documents.ts
+++ b/src/gateway/canvas-documents.ts
@@ -5,20 +5,20 @@ import { CANVAS_HOST_PATH } from "../canvas-host/a2ui.js";
 import { resolveStateDir } from "../config/paths.js";
 import { resolveUserPath } from "../utils.js";
 
-export type CanvasDocumentKind = "html_bundle" | "url_embed" | "document" | "image" | "video_asset";
+type CanvasDocumentKind = "html_bundle" | "url_embed" | "document" | "image" | "video_asset";
 
-export type CanvasDocumentAsset = {
+type CanvasDocumentAsset = {
   logicalPath: string;
   sourcePath: string;
   contentType?: string;
 };
 
-export type CanvasDocumentEntrypoint =
+type CanvasDocumentEntrypoint =
   | { type: "html"; value: string }
   | { type: "path"; value: string }
   | { type: "url"; value: string };
 
-export type CanvasDocumentCreateInput = {
+type CanvasDocumentCreateInput = {
   id?: string;
   kind: CanvasDocumentKind;
   title?: string;
@@ -28,7 +28,7 @@ export type CanvasDocumentCreateInput = {
   surface?: "assistant_message" | "tool_card" | "sidebar";
 };
 
-export type CanvasDocumentManifest = {
+type CanvasDocumentManifest = {
   id: string;
   kind: CanvasDocumentKind;
   title?: string;
@@ -44,7 +44,7 @@ export type CanvasDocumentManifest = {
   }>;
 };
 
-export type CanvasDocumentResolvedAsset = {
+type CanvasDocumentResolvedAsset = {
   logicalPath: string;
   contentType?: string;
   url: string;
@@ -97,12 +97,12 @@ function normalizeCanvasDocumentId(value: string): string {
   return normalized;
 }
 
-export function resolveCanvasRootDir(rootDir?: string, stateDir = resolveStateDir()): string {
+function resolveCanvasRootDir(rootDir?: string, stateDir = resolveStateDir()): string {
   const resolved = rootDir?.trim() ? resolveUserPath(rootDir) : path.join(stateDir, "canvas");
   return path.resolve(resolved);
 }
 
-export function resolveCanvasDocumentsDir(rootDir?: string, stateDir = resolveStateDir()): string {
+function resolveCanvasDocumentsDir(rootDir?: string, stateDir = resolveStateDir()): string {
   return path.join(resolveCanvasRootDir(rootDir, stateDir), CANVAS_DOCUMENTS_DIR_NAME);
 }
 
@@ -122,7 +122,7 @@ export function buildCanvasDocumentEntryUrl(documentId: string, entrypoint: stri
   return `${CANVAS_HOST_PATH}/${CANVAS_DOCUMENTS_DIR_NAME}/${encodeURIComponent(documentId)}/${encodedEntrypoint}`;
 }
 
-export function buildCanvasDocumentAssetUrl(documentId: string, logicalPath: string): string {
+function buildCanvasDocumentAssetUrl(documentId: string, logicalPath: string): string {
   return buildCanvasDocumentEntryUrl(documentId, logicalPath);
 }