diff --git a/src/daemon/service-env.ts b/src/daemon/service-env.ts
index 0b89292f723..090140f6eea 100644
--- a/src/daemon/service-env.ts
+++ b/src/daemon/service-env.ts
@@ -25,7 +25,7 @@ import { resolveGatewayStateDir } from "./paths.js";
 
 export { isNodeVersionManagerRuntime, resolveLinuxSystemCaBundle };
 
-export type MinimalServicePathOptions = {
+type MinimalServicePathOptions = {
   platform?: NodeJS.Platform;
   extraDirs?: string[];
   home?: string;
@@ -225,7 +225,7 @@ function resolveSystemPathDirs(platform: NodeJS.Platform): string[] {
  * - fnm: macOS uses ~/Library/Application Support/fnm (not ~/.local/share/fnm)
  * - pnpm: macOS uses ~/Library/pnpm (not ~/.local/share/pnpm)
  */
-export function resolveDarwinUserBinDirs(
+function resolveDarwinUserBinDirs(
   home: string | undefined,
   env?: Record<string, string | undefined>,
   existsSync: (candidate: string) => boolean = fs.existsSync,
@@ -271,7 +271,7 @@ export function resolveDarwinUserBinDirs(
  * Resolve common user bin directories for Linux.
  * These are paths where npm global installs and node version managers typically place binaries.
  */
-export function resolveLinuxUserBinDirs(
+function resolveLinuxUserBinDirs(
   home: string | undefined,
   env?: Record<string, string | undefined>,
   existsSync: (candidate: string) => boolean = fs.existsSync,
diff --git a/src/gateway/agent-list.ts b/src/gateway/agent-list.ts
index 01701e3a11e..ea800948bf6 100644
--- a/src/gateway/agent-list.ts
+++ b/src/gateway/agent-list.ts
@@ -7,7 +7,7 @@ import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { normalizeAgentId, normalizeMainKey } from "../routing/session-key.js";
 import { normalizeOptionalString } from "../shared/string-coerce.js";
 
-export type GatewayAgentListRow = {
+type GatewayAgentListRow = {
   id: string;
   name?: string;
 };
diff --git a/src/gateway/assistant-identity.ts b/src/gateway/assistant-identity.ts
index 35a24408f9a..f448345a2e5 100644
--- a/src/gateway/assistant-identity.ts
+++ b/src/gateway/assistant-identity.ts
@@ -23,7 +23,7 @@ export const DEFAULT_ASSISTANT_IDENTITY: AssistantIdentity = {
   avatar: "A",
 };
 
-export type AssistantIdentity = {
+type AssistantIdentity = {
   agentId: string;
   name: string;
   avatar: string;
diff --git a/src/gateway/auth-rate-limit.ts b/src/gateway/auth-rate-limit.ts
index 0e631c045f9..844f39fd0db 100644
--- a/src/gateway/auth-rate-limit.ts
+++ b/src/gateway/auth-rate-limit.ts
@@ -41,7 +41,7 @@ export const AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN = "device-token";
 export const AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH = "hook-auth";
 const BROWSER_ORIGIN_RATE_LIMIT_KEY_PREFIX = "browser-origin:";
 
-export interface RateLimitEntry {
+interface RateLimitEntry {
   /** Timestamps (epoch ms) of recent failed attempts inside the window. */
   attempts: number[];
   /** If set, requests from this IP are blocked until this epoch-ms instant. */
diff --git a/src/gateway/auth-token-resolution.ts b/src/gateway/auth-token-resolution.ts
index d0bf48196ed..48660779c76 100644
--- a/src/gateway/auth-token-resolution.ts
+++ b/src/gateway/auth-token-resolution.ts
@@ -6,8 +6,8 @@ import {
   type SecretInputUnresolvedReasonStyle,
 } from "./resolve-configured-secret-input-string.js";
 
-export type GatewayAuthTokenResolutionSource = "explicit" | "config" | "secretRef" | "env";
-export type GatewayAuthTokenEnvFallback = "never" | "no-secret-ref" | "always";
+type GatewayAuthTokenResolutionSource = "explicit" | "config" | "secretRef" | "env";
+type GatewayAuthTokenEnvFallback = "never" | "no-secret-ref" | "always";
 
 export async function resolveGatewayAuthToken(params: {
   cfg: OpenClawConfig;