refactor: trim push infra exports

src/infra/host-env-security-policy.d.ts

@@ -1,4 +1,4 @@
-export type HostEnvSecurityPolicy = Readonly<{
+type HostEnvSecurityPolicy = Readonly<{
   blockedEverywhereKeys: readonly string[];
   blockedOverrideOnlyKeys: readonly string[];
   allowedInheritedOverrideOnlyKeys: readonly string[];

src/infra/push-apns.relay.ts

@@ -12,14 +12,14 @@ import {
 import { formatErrorMessage } from "./errors.js";
 import { normalizeHostname } from "./net/hostname.js";
 
-export type ApnsRelayPushType = "alert" | "background";
+type ApnsRelayPushType = "alert" | "background";
 
 export type ApnsRelayConfig = {
   baseUrl: string;
   timeoutMs: number;
 };
 
-export type ApnsRelayConfigResolution =
+type ApnsRelayConfigResolution =
   | { ok: true; value: ApnsRelayConfig }
   | { ok: false; error: string };
 

src/infra/push-apns.ts

@@ -12,17 +12,16 @@ import { formatErrorMessage } from "./errors.js";
 import { createAsyncLock, readJsonFile, writeJsonAtomic } from "./json-files.js";
 import {
   type ApnsRelayConfig,
-  type ApnsRelayConfigResolution,
   type ApnsRelayPushResponse,
   type ApnsRelayRequestSender,
   resolveApnsRelayConfigFromEnv,
   sendApnsRelayPush,
 } from "./push-apns.relay.js";
 
-export type ApnsEnvironment = "sandbox" | "production";
-export type ApnsTransport = "direct" | "relay";
+type ApnsEnvironment = "sandbox" | "production";
+type ApnsTransport = "direct" | "relay";
 
-export type DirectApnsRegistration = {
+type DirectApnsRegistration = {
   nodeId: string;
   transport: "direct";
   token: string;
@@ -31,7 +30,7 @@ export type DirectApnsRegistration = {
   updatedAtMs: number;
 };
 
-export type RelayApnsRegistration = {
+type RelayApnsRegistration = {
   nodeId: string;
   transport: "relay";
   relayHandle: string;
@@ -52,9 +51,7 @@ export type ApnsAuthConfig = {
   privateKey: string;
 };
 
-export type ApnsAuthConfigResolution =
-  | { ok: true; value: ApnsAuthConfig }
-  | { ok: false; error: string };
+type ApnsAuthConfigResolution = { ok: true; value: ApnsAuthConfig } | { ok: false; error: string };
 
 export type ApnsPushResult = {
   ok: boolean;
@@ -67,8 +64,8 @@ export type ApnsPushResult = {
   transport: ApnsTransport;
 };
 
-export type ApnsPushAlertResult = ApnsPushResult;
-export type ApnsPushWakeResult = ApnsPushResult;
+type ApnsPushAlertResult = ApnsPushResult;
+type ApnsPushWakeResult = ApnsPushResult;
 
 const EXEC_APPROVAL_GENERIC_ALERT_BODY = "Open OpenClaw to review this request.";
 const EXEC_APPROVAL_NOTIFICATION_CATEGORY = "openclaw.exec-approval";
@@ -1155,4 +1152,4 @@ export async function sendApnsExecApprovalResolvedWake(
   });
 }
 
-export { type ApnsRelayConfig, type ApnsRelayConfigResolution, resolveApnsRelayConfigFromEnv };
+export { type ApnsRelayConfig, resolveApnsRelayConfigFromEnv };

src/infra/push-web.ts

@@ -5,7 +5,7 @@ import { createAsyncLock, readJsonFile, writeJsonAtomic } from "./json-files.js"
 
 // --- Types ---
 
-export type WebPushSubscription = {
+type WebPushSubscription = {
   subscriptionId: string;
   endpoint: string;
   keys: { p256dh: string; auth: string };
@@ -13,17 +13,17 @@ export type WebPushSubscription = {
   updatedAtMs: number;
 };
 
-export type WebPushRegistrationState = {
+type WebPushRegistrationState = {
   subscriptionsByEndpointHash: Record<string, WebPushSubscription>;
 };
 
-export type VapidKeyPair = {
+type VapidKeyPair = {
   publicKey: string;
   privateKey: string;
   subject: string;
 };
 
-export type WebPushSendResult = {
+type WebPushSendResult = {
   ok: boolean;
   subscriptionId: string;
   statusCode?: number;
@@ -142,17 +142,17 @@ function resolveVapidSubjectFromEnv(): string {
   return process.env.OPENCLAW_VAPID_SUBJECT || DEFAULT_VAPID_SUBJECT;
 }
 
-export function resolveVapidPublicKeyFromEnv(): string | undefined {
+function resolveVapidPublicKeyFromEnv(): string | undefined {
   return process.env.OPENCLAW_VAPID_PUBLIC_KEY || undefined;
 }
 
-export function resolveVapidPrivateKeyFromEnv(): string | undefined {
+function resolveVapidPrivateKeyFromEnv(): string | undefined {
   return process.env.OPENCLAW_VAPID_PRIVATE_KEY || undefined;
 }
 
 // --- Subscription CRUD ---
 
-export type RegisterWebPushParams = {
+type RegisterWebPushParams = {
   endpoint: string;
   keys: { p256dh: string; auth: string };
   baseDir?: string;
@@ -243,7 +243,7 @@ export async function clearWebPushSubscriptionByEndpoint(
 
 // --- Sending ---
 
-export type WebPushPayload = {
+type WebPushPayload = {
   title: string;
   body?: string;
   tag?: string;

src/infra/resolve-system-bin.ts

@@ -10,7 +10,7 @@ import { getWindowsInstallRoots, getWindowsProgramFilesRoots } from "./windows-i
  *   directories appended after system dirs. Use for tool binaries like
  *   ffmpeg that are rarely available via the OS itself.
  */
-export type SystemBinTrust = "strict" | "standard";
+type SystemBinTrust = "strict" | "standard";
 
 // Unix directories where OS-managed or system-installed binaries live.
 // User-writable or package-manager-managed directories are excluded so that

src/infra/runtime-guard.ts

@@ -1,7 +1,7 @@
 import process from "node:process";
 import { defaultRuntime, type RuntimeEnv } from "../runtime.js";
 
-export type RuntimeKind = "node" | "unknown";
+type RuntimeKind = "node" | "unknown";
 
 type Semver = {
   major: number;

src/infra/safe-open-sync.ts

@@ -3,7 +3,7 @@ import { sameFileIdentity as hasSameFileIdentity } from "./file-identity.js";
 
 export type SafeOpenSyncFailureReason = "path" | "validation" | "io";
 
-export type SafeOpenSyncResult =
+type SafeOpenSyncResult =
   | { ok: true; path: string; fd: number; stat: fs.Stats }
   | { ok: false; reason: SafeOpenSyncFailureReason; error?: unknown };
 
@@ -20,7 +20,7 @@ function isExpectedPathError(error: unknown): boolean {
   return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
 }
 
-export function sameFileIdentity(left: fs.Stats, right: fs.Stats): boolean {
+function sameFileIdentity(left: fs.Stats, right: fs.Stats): boolean {
   return hasSameFileIdentity(left, right);
 }
 

src/infra/safe-package-install.ts

@@ -1,14 +1,14 @@
 import type { NpmProjectInstallEnvOptions } from "./npm-install-env.js";
 import { createNpmProjectInstallEnv } from "./npm-install-env.js";
 
-export type SafeNpmInstallEnvOptions = NpmProjectInstallEnvOptions & {
+type SafeNpmInstallEnvOptions = NpmProjectInstallEnvOptions & {
   ignoreWorkspaces?: boolean;
   legacyPeerDeps?: boolean;
   packageLock?: boolean;
   quiet?: boolean;
 };
 
-export type SafeNpmInstallArgsOptions = {
+type SafeNpmInstallArgsOptions = {
   ignoreWorkspaces?: boolean;
   loglevel?: "error" | "silent";
   noAudit?: boolean;

src/infra/semver-compare.ts

@@ -1,4 +1,4 @@
-export type ComparableSemver = {
+type ComparableSemver = {
   major: number;
   minor: number;
   patch: number;