refactor(server): classify runtime exports

[juliusmarminge]

Server runtime, auth, persistence, cloud, and CLI modules had 44 unclassified runtime exports. This marks 16 canonical Effect service constructors as intentional public APIs and narrows or removes 28 implementation-only exports, including unused schema predicates. Exported types and schemas remain unchanged.

This is layer 1 of 9 in the server Knip cleanup stack.

Verification after rebasing onto current main: server typecheck and the server-only Knip export audit pass. Changed-file lint and formatting pass, with one existing lint warning. Focused auth, provider, source-control, preview toolkit, orchestration, and Knip preprocessor tests pass: 90 tests across 9 files. This changes server export visibility and static analysis; screenshots do not apply.

Model: gpt-6 astra. Harness: Codex in T3 Code.

Summary by CodeRabbit

• Documentation

  • Added public API documentation for service-construction entry points, clarifying which interfaces are intended for external use.

• Refactor

  • Restricted numerous internal helpers, constants, configuration values, and implementation utilities to module scope.
  • Removed several exported error-checking helpers and other non-public implementation details.
  • No user-facing behavior, validation, configuration resolution, or runtime functionality changed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The changes are primarily an internal export-visibility cleanup with no apparent product-default or request-path behavior change, but they narrow module APIs and touch authentication implementation files. Authentication-directory changes require human review under the applicable criteria.

No code changes detected at 52679c3. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+44 B (+0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−6 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+50 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.1 KiB	+88 B (+0.2%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	−31 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−28 B (−0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.9 KiB	57.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 11601da · PR result: 52679c3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

All clear

^{Posted via Macroscope — Effect Service Conventions}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: fc9827e0-3785-4118-8bd3-eb8c684ef70d

📥 Commits

Reviewing files that changed from the base of the PR and between 11601da and 52679c3.

📒 Files selected for processing (32)

• apps/server/scripts/t3-sqlite-state.ts
• apps/server/src/attachmentStore.ts
• apps/server/src/auth/EnvironmentAuth.ts
• apps/server/src/auth/EnvironmentAuthPolicy.ts
• apps/server/src/auth/PairingGrantStore.ts
• apps/server/src/auth/ServerSecretStore.ts
• apps/server/src/auth/SessionStore.ts
• apps/server/src/auth/http.ts
• apps/server/src/background/BackgroundPolicy.ts
• apps/server/src/background/HostPowerMonitor.ts
• apps/server/src/checkpointing/CheckpointDiffQuery.ts
• apps/server/src/checkpointing/CheckpointStore.ts
• apps/server/src/checkpointing/Utils.ts
• apps/server/src/cli/app.ts
• apps/server/src/cli/config.ts
• apps/server/src/cli/pair.ts
• apps/server/src/cloud/CliTokenManager.ts
• apps/server/src/cloud/ManagedEndpointRuntime.ts
• apps/server/src/cloud/publicConfig.ts
• apps/server/src/cloud/serviceProtocol.ts
• apps/server/src/environment/RemoteOpenTargets.ts
• apps/server/src/environment/ServerEnvironment.ts
• apps/server/src/imageMime.ts
• apps/server/src/persistence/AuthPairingLinks.ts
• apps/server/src/persistence/AuthSessions.ts
• apps/server/src/persistence/Migrations.ts
• apps/server/src/persistence/ProviderSessionRuntime.ts
• apps/server/src/process/externalLauncher.ts
• apps/server/src/processRunner.ts
• apps/server/src/server.ts
• apps/server/src/serverRuntimeStartup.ts
• apps/server/src/serverSettings.ts

💤 Files with no reviewable changes (2)

• apps/server/src/auth/SessionStore.ts
• apps/server/src/auth/PairingGrantStore.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The change narrows server module exports by making internal helpers and constants private. It removes session credential schema guards and documents canonical Effect service constructors as public APIs. Runtime behavior remains unchanged.

Changes

Server API surface cleanup

Layer / File(s)	Summary
Internalize module helpers and constants apps/server/scripts/t3-sqlite-state.ts, apps/server/src/{attachmentStore,auth,background,checkpointing,cli,cloud, imageMime,persistence,server.ts,serverRuntimeStartup.ts,serverSettings.ts}	Internal helpers, constants, configuration values, migration utilities, and runtime functions are no longer exported.
Narrow credential error APIs apps/server/src/auth/SessionStore.ts	The session credential error union remains unchanged. Its schema guard helpers are removed.
Document public service construction apps/server/src/{auth,background,checkpointing,cloud,environment,persistence,process,serverRuntimeStartup}	JSDoc annotations identify canonical Effect service constructors as public APIs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 52679

This change narrows server module exports and documents canonical service constructors without changing runtime behavior or schemas. No current merge-blocking production risk is identified.

Suggested reviewers: t3dotgg

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 30 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: classifying and narrowing server runtime exports.
Description check	✅ Passed	The description explains what changed, the cleanup purpose, scope, and verification results. It does not use the template headings or checklist, but it provides the required information and states tha…

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cleanup-server/runtime-internals

---

_{Comment @coderabbitai help to get the list of available commands.}