improvement(knip): check entry exports of private packages and delete their dead barrels

- knip.jsonc: includeEntryExports on for every private package except db
- delete the bare @sim/utils and @sim/workflow-persistence barrels and their "." exports
- drop unused re-exports from the workflow-renderer and desktop-bridge barrels; un-export symbols only used in-file
- delete 7 unreferenced emcn icons
- baseline the remaining 262 entry-export findings (one-time rule expansion via --update --init)

Author: waleedlatif1

CLAUDE.md

@@ -8,7 +8,7 @@ This file (also `AGENTS.md`) holds the repo-wide rules. Area detail lives in `.c
 - **Logging**: `createLogger` from `@sim/logger`; `logger.info` / `logger.warn` / `logger.error`, never `console.log`. Inside `withRouteHandler` the logger already carries the request ID — no manual `withMetadata({ requestId })`.
 - **Comments**: name things so the code explains itself. TSDoc documents exported APIs and non-obvious modules. An inline `//` is only for a terse, non-obvious *why*, or for a script-enforced `// <tag>: <reason>` annotation (`boundary-raw-fetch`, `double-cast-allowed`, `boundary-raw-json`, `untyped-response`, `rq-lint-allow`, `client-boundary-allow`, `utils-lint-allow`, …). History belongs in the commit message. No `====` separators or commented-out code (`check:comment-hygiene` enforces this). The `/you-might-not-need-a-comment` skill applies this to a diff.
 - **ID generation**: `generateId()` (UUID v4, the default) or `generateShortId(size?)` (URL-safe, 21 chars by default) from `@sim/utils/id` — never `crypto.randomUUID()`, `nanoid`, or `uuid`. Both use `crypto.getRandomValues()`, so they also work in non-secure (HTTP) browsers.
-- **Common utilities**: use the shared helpers from `@sim/utils` instead of inline implementations (`check:utils` bans most of the inline forms below):
+- **Common utilities**: use the shared helpers from the `@sim/utils/<module>` subpaths instead of inline implementations (`check:utils` bans most of the inline forms below):
   - `sleep(ms)` from `@sim/utils/helpers` — never `new Promise(resolve => setTimeout(resolve, ms))`
   - `toError(e)` from `@sim/utils/errors` — normalize caught values to `Error`; never `e instanceof Error ? e : new Error(String(e))`
   - `getErrorMessage(e, fallback?)` from `@sim/utils/errors` — never `e instanceof Error ? e.message : 'fallback'`

apps/sim/lib/credentials/application/discover-managed-mcp-tools.test.ts

@@ -42,7 +42,7 @@ vi.mock('@/lib/mcp/application/use-cases', () => mcpUseCasesMock)
 vi.mock('@/lib/workspaces/application/workspace-context', () => workspaceContextMock)
 vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
 vi.mock('@/lib/workflows/application/context', () => workflowContextMock)
-vi.mock('@sim/workflow-persistence', () => ({
+vi.mock('@sim/workflow-persistence/load', () => ({
   loadWorkflowFromNormalizedTablesRaw: hoisted.loadWorkflow,
 }))
 

apps/sim/lib/mcp/application/execute-managed-tool.test.ts

@@ -18,7 +18,7 @@ const hoisted = vi.hoisted(() => ({
   saveToolSnapshot: vi.fn(),
 }))
 
-vi.mock('@sim/workflow-persistence', () => ({
+vi.mock('@sim/workflow-persistence/load', () => ({
   loadWorkflowFromNormalizedTablesRaw: hoisted.loadWorkflow,
 }))
 

apps/sim/lib/mcp/application/execute-tool.test.ts

@@ -25,7 +25,7 @@ const hoisted = vi.hoisted(() => ({
   getServer: vi.fn(),
 }))
 
-vi.mock('@sim/workflow-persistence', () => ({
+vi.mock('@sim/workflow-persistence/load', () => ({
   loadWorkflowFromNormalizedTablesRaw: hoisted.loadWorkflow,
 }))
 

apps/sim/lib/mcp/application/operation-access.test.ts

@@ -3,7 +3,9 @@ import { queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { loadWorkflow } = vi.hoisted(() => ({ loadWorkflow: vi.fn() }))
-vi.mock('@sim/workflow-persistence', () => ({ loadWorkflowFromNormalizedTablesRaw: loadWorkflow }))
+vi.mock('@sim/workflow-persistence/load', () => ({
+  loadWorkflowFromNormalizedTablesRaw: loadWorkflow,
+}))
 
 import {
   loadMcpOperationAccess,

apps/sim/lib/mcp/application/operation-access.ts

@@ -2,7 +2,7 @@ import type { Principal } from '@sim/auth/principal'
 import { db } from '@sim/db'
 import { workflowDeploymentVersion } from '@sim/db/schema'
 import { isPlainRecord } from '@sim/utils/object'
-import { loadWorkflowFromNormalizedTablesRaw } from '@sim/workflow-persistence'
+import { loadWorkflowFromNormalizedTablesRaw } from '@sim/workflow-persistence/load'
 import { and, eq } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {

knip.jsonc

@@ -4,19 +4,22 @@
   // Unused exports, types, and duplicates are ratcheted by check:unused-exports,
   // which reuses this config in the same knip pass.
   "include": ["files", "dependencies", "unlisted", "unresolved"],
-  // knip's default, stated so it is a decision: no entry file's exports are reported.
-  // That keeps package `exports`/`main`/`bin` contracts (ts-sdk, emcn, cli, …) and framework
-  // entries (Next routes, Trigger tasks) public, and also exempts the other configured entries
-  // (scripts, `*.integration.ts`, `background/**`, desktop and SDK examples).
-  "includeEntryExports": false,
+  // On by default: every workspace's `exports` map serves only this monorepo, so an entry export
+  // no workspace imports is dead. The workspaces below turn it off because their entries are
+  // public or standalone: the apps (framework entries such as Next routes and Trigger tasks), the
+  // published packages (cli, sim-cli, sim-setup, ts-sdk), db (standalone scripts), and the root
+  // (scripts). A new private package is checked without opting in.
+  "includeEntryExports": true,
   "workspaces": {
     ".": {
+      "includeEntryExports": false,
       "entry": ["scripts/**/*.{ts,tsx}", "vitest.shared.ts"],
       "paths": { "@/*": ["./apps/sim/*"] },
       // This alias selects the native tsc binary; see check-native-typecheck.ts.
       "ignoreDependencies": ["@typescript/native"]
     },
     "apps/sim": {
+      "includeEntryExports": false,
       "entry": [
         // Container bootstrap and Trigger's directory-discovered task graph.
         "bootstrap.ts",
@@ -69,8 +72,9 @@
       // Live test spawns this path with cwd=MSHIP_WORKER_ROOT (a sibling repo).
       "ignoreUnresolved": ["tools/probes/src/controller-run-read.ts"]
     },
-    "apps/realtime": { "entry": ["src/bootstrap.ts"] },
+    "apps/realtime": { "includeEntryExports": false, "entry": ["src/bootstrap.ts"] },
     "apps/desktop": {
+      "includeEntryExports": false,
       // scripts/build.ts and e2e/updater.spec.ts supply these to esbuild by path.
       "entry": [
         "src/main/index.ts",
@@ -83,24 +87,30 @@
       // ensure-pty-prebuilds.ts assembles these package names for universal builds.
       "ignoreDependencies": ["@lydell/node-pty-darwin-arm64", "@lydell/node-pty-darwin-x64"]
     },
+    "apps/docs": { "includeEntryExports": false },
+    "apps/pii": { "includeEntryExports": false },
+    "packages/cli": { "includeEntryExports": false },
     "packages/db": {
+      "includeEntryExports": false,
       "entry": [
         "scripts/*.ts",
         "script-migrations/*.ts",
         "**/*.integration.ts",
         "vitest.integration.setup.ts"
       ]
     },
-    "packages/sim-cli": {
-      "entry": ["src/index.ts", "src/runtime.ts", "scripts/*.ts"]
-    },
-    "packages/ts-sdk": { "entry": ["examples/*.ts"] },
     // The contract audit reads this snapshot by filename.
     // Generated, so its export surface is not ratcheted either.
     "packages/desktop-bridge": {
       "entry": ["contract-snapshot.ts"],
       "ignoreIssues": { "contract-snapshot.ts": ["exports", "types", "duplicates"] }
     },
+    "packages/sim-cli": {
+      "includeEntryExports": false,
+      "entry": ["src/index.ts", "src/runtime.ts", "scripts/*.ts"]
+    },
+    "packages/sim-setup": { "includeEntryExports": false },
+    "packages/ts-sdk": { "includeEntryExports": false, "entry": ["examples/*.ts"] },
     // This shared config is consumed by apps that own the Next dependency.
     "packages/tsconfig": { "ignoreUnresolved": ["next"] }
   }

packages/desktop-bridge/src/index.ts

@@ -1132,5 +1132,4 @@ export {
   DESKTOP_TITLE_BAR_ATTRIBUTE,
   type DesktopTitleBarMode,
   observeDesktopTitleBar,
-  supportsDesktopTitleBar,
 } from './title-bar'

packages/desktop-bridge/src/title-bar.ts

@@ -3,7 +3,7 @@ import type { SimDesktopWindowStateApi } from '@sim/desktop-bridge'
 export type DesktopTitleBarMode = 'fullscreen' | 'inset' | null
 export const DESKTOP_TITLE_BAR_ATTRIBUTE = 'data-sim-desktop-title-bar'
 
-export function supportsDesktopTitleBar(userAgent: string, hasDesktopBridge: boolean): boolean {
+function supportsDesktopTitleBar(userAgent: string, hasDesktopBridge: boolean): boolean {
   return hasDesktopBridge && /Mac/i.test(userAgent)
 }