fix: remove unused exports from public API surface (batch 2)

src/commands/subcommands.ts

@@ -9,17 +9,17 @@ import { OutputFormat } from '../types';
  * @param validFormats - Array of valid format options
  * @throws Exits process with error if format is invalid
  */
-export function validateFormat(format: string, validFormats: string[]): void {
+function validateFormat(format: string, validFormats: string[]): void {
   if (!validFormats.includes(format)) {
     logger.error(`Invalid format: ${format}. Must be one of: ${validFormats.join(', ')}`);
     process.exit(1);
   }
 }
 
 /**
- * Predownload action handler — exported for testing.
+ * Module-internal action handler for the `predownload` subcommand.
  */
-export async function handlePredownloadAction(options: {
+async function handlePredownloadAction(options: {
   imageRegistry: string;
   imageTag: string;
   agentImage: string;

src/config-file.ts

@@ -3,7 +3,8 @@ import * as path from 'path';
 import * as yaml from 'js-yaml';
 import { validateWithSchema } from './schema-validator';
 
-export interface AwfFileConfig {
+/** @internal Used only within config-file.ts — not part of public API */
+interface AwfFileConfig {
   $schema?: string;
   network?: {
     allowDomains?: string[];

src/host-iptables-network.test.ts

@@ -1,8 +1,10 @@
 import { execaResult, mockedExeca, setupHostIptablesTestSuite } from './test-helpers/host-iptables-test-setup';
-import { cleanupFirewallNetwork } from './host-iptables-network';
+import { testHelpers as networkTestHelpers } from './host-iptables-network';
 import { ensureFirewallNetwork } from './host-iptables';
 import { testHelpers } from './host-iptables-shared';
 
+const { cleanupFirewallNetwork } = networkTestHelpers;
+
 describe('host-iptables (network)', () => {
   setupHostIptablesTestSuite(testHelpers.resetIpv6State);
 

src/host-iptables-network.ts

@@ -51,7 +51,7 @@ export async function ensureFirewallNetwork(): Promise<{
 /**
  * Removes the firewall network
  */
-export async function cleanupFirewallNetwork(): Promise<void> {
+async function cleanupFirewallNetwork(): Promise<void> {
   logger.debug(`Removing firewall network '${NETWORK_NAME}'...`);
 
   try {
@@ -62,3 +62,6 @@ export async function cleanupFirewallNetwork(): Promise<void> {
     // Don't throw - cleanup should be best-effort
   }
 }
+
+/** @internal Exposed for testing only */
+export const testHelpers = { cleanupFirewallNetwork };