diff --git a/src/cli/container-target.ts b/src/cli/container-target.ts
index 8457b71ccdb..dfde9efae8a 100644
--- a/src/cli/container-target.ts
+++ b/src/cli/container-target.ts
@@ -10,7 +10,7 @@ type CliContainerParseResult =
   | { ok: true; container: string | null; argv: string[] }
   | { ok: false; error: string };
 
-export type CliContainerTargetResult =
+type CliContainerTargetResult =
   | { handled: true; exitCode: number }
   | { handled: false; argv: string[] };
 
diff --git a/src/cli/daemon-cli-compat.ts b/src/cli/daemon-cli-compat.ts
index 81ab9c1b909..5706a6e290d 100644
--- a/src/cli/daemon-cli-compat.ts
+++ b/src/cli/daemon-cli-compat.ts
@@ -1,4 +1,4 @@
-export const LEGACY_DAEMON_CLI_EXPORTS = [
+const LEGACY_DAEMON_CLI_EXPORTS = [
   "registerDaemonCli",
   "runDaemonInstall",
   "runDaemonRestart",
@@ -10,7 +10,7 @@ export const LEGACY_DAEMON_CLI_EXPORTS = [
 
 type LegacyDaemonCliExport = (typeof LEGACY_DAEMON_CLI_EXPORTS)[number];
 type LegacyDaemonCliRunnerExport = Exclude<LegacyDaemonCliExport, "registerDaemonCli">;
-export type LegacyDaemonCliAccessors = {
+type LegacyDaemonCliAccessors = {
   registerDaemonCli: string;
   runDaemonRestart: string;
 } & Partial<
diff --git a/src/cli/debug-timing.ts b/src/cli/debug-timing.ts
index 3bab56920f6..d5970b5ccf7 100644
--- a/src/cli/debug-timing.ts
+++ b/src/cli/debug-timing.ts
@@ -16,7 +16,7 @@ type TimingPayload = {
 type TimingWriter = (line: string) => void;
 type NonPromise<T> = T extends PromiseLike<unknown> ? never : T;
 
-export type CliDebugTiming = {
+type CliDebugTiming = {
   enabled: boolean;
   mark: (phase: string, details?: TimingDetails) => void;
   time: <T>(
diff --git a/src/cli/parse-bytes.ts b/src/cli/parse-bytes.ts
index 5e81628a4e8..3a988839a2b 100644
--- a/src/cli/parse-bytes.ts
+++ b/src/cli/parse-bytes.ts
@@ -3,7 +3,7 @@ import {
   normalizeOptionalString,
 } from "../shared/string-coerce.js";
 
-export type BytesParseOptions = {
+type BytesParseOptions = {
   defaultUnit?: "b" | "kb" | "mb" | "gb" | "tb";
 };
 
diff --git a/src/cli/plugin-install-config-policy.ts b/src/cli/plugin-install-config-policy.ts
index 6066a5b20b1..86c1ba709e4 100644
--- a/src/cli/plugin-install-config-policy.ts
+++ b/src/cli/plugin-install-config-policy.ts
@@ -6,7 +6,7 @@ import { loadPluginManifest } from "../plugins/manifest.js";
 import { resolveUserPath } from "../utils.js";
 import { parseNpmPrefixSpec, resolveFileNpmSpecToLocalPath } from "./plugins-command-helpers.js";
 
-export type PluginInstallInvalidConfigPolicy = "deny" | "allow-bundled-recovery";
+type PluginInstallInvalidConfigPolicy = "deny" | "allow-bundled-recovery";
 
 export type PluginInstallRequestContext = {
   rawSpec: string;
diff --git a/src/cli/profile.ts b/src/cli/profile.ts
index be9b1140107..0532325bebc 100644
--- a/src/cli/profile.ts
+++ b/src/cli/profile.ts
@@ -11,7 +11,7 @@ import { isValidProfileName } from "./profile-utils.js";
 import { scanCliRootOptions } from "./root-option-scan.js";
 import { takeCliRootOptionValue } from "./root-option-value.js";
 
-export type CliProfileParseResult =
+type CliProfileParseResult =
   | { ok: true; profile: string | null; argv: string[] }
   | { ok: false; error: string };
 
diff --git a/src/cli/root-option-scan.ts b/src/cli/root-option-scan.ts
index 509d2962552..5a70e4f014e 100644
--- a/src/cli/root-option-scan.ts
+++ b/src/cli/root-option-scan.ts
@@ -1,7 +1,7 @@
 import { FLAG_TERMINATOR } from "../infra/cli-root-options.js";
 import { forwardConsumedCliRootOption } from "./root-option-forward.js";
 
-export type CliRootOptionScanResult = { ok: true; argv: string[] } | { ok: false; error: string };
+type CliRootOptionScanResult = { ok: true; argv: string[] } | { ok: false; error: string };
 
 type CliRootOptionVisitResult =
   | { kind: "pass" }