refactor: narrow pub(crate) items to private

Porting mapped every PHP `protected` member onto `pub(crate)`, which is
wider than nearly all of them need. Each item demoted here is reached
only from the module that defines it, so the crate-wide visibility
conveyed nothing.

Every `pub(crate)` that survives has at least one reader in another
module of the same crate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

8 files changed, 60 insertions, 72 deletions

diff --git a/crates/shirabe/src/util/auth_helper.rs b/crates/shirabe/src/util/auth_helper.rs
index ac7caa35..2c2ee725 100644
--- a/crates/shirabe/src/util/auth_helper.rs
+++ b/crates/shirabe/src/util/auth_helper.rs
@@ -18,8 +18,8 @@ use shirabe_php_shim::{
 
 #[derive(Debug)]
 pub struct AuthHelper {
-    pub(crate) io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
-    pub(crate) config: std::rc::Rc<std::cell::RefCell<Config>>,
+    io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
+    config: std::rc::Rc<std::cell::RefCell<Config>>,
     /// @var array<string, string> Map of origins to message displayed
     displayed_origin_authentications: IndexMap<String, String>,
     /// @var array<string, bool> Map of URLs and whether they already retried with authentication from Bitbucket
diff --git a/crates/shirabe/src/util/filesystem.rs b/crates/shirabe/src/util/filesystem.rs
index 066b1981..532c96dd 100644
--- a/crates/shirabe/src/util/filesystem.rs
+++ b/crates/shirabe/src/util/filesystem.rs
@@ -848,7 +848,7 @@ impl Filesystem {
         false
     }
 
-    pub(crate) fn directory_size(&self, directory: &Path) -> anyhow::Result<i64> {
+    fn directory_size(&self, directory: &Path) -> anyhow::Result<i64> {
         let it =
             shirabe_php_shim::recursive_directory_iterator(directory, shirabe_php_shim::SKIP_DOTS)?;
         let ri = shirabe_php_shim::recursive_iterator_iterator(it, shirabe_php_shim::CHILD_FIRST);
@@ -863,7 +863,7 @@ impl Filesystem {
         Ok(size)
     }
 
-    pub(crate) fn get_process(&mut self) -> std::cell::RefMut<'_, ProcessExecutor> {
+    fn get_process(&mut self) -> std::cell::RefMut<'_, ProcessExecutor> {
         self.get_process_handle();
 
         self.process_executor.as_ref().unwrap().borrow_mut()
@@ -871,9 +871,7 @@ impl Filesystem {
 
     /// Hands out the executor handle itself so async callers can hold only a shared borrow
     /// across their awaits (a RefMut held across an await panics once calls overlap).
-    pub(crate) fn get_process_handle(
-        &mut self,
-    ) -> std::rc::Rc<std::cell::RefCell<ProcessExecutor>> {
+    fn get_process_handle(&mut self) -> std::rc::Rc<std::cell::RefCell<ProcessExecutor>> {
         if self.process_executor.is_none() {
             self.process_executor = Some(std::rc::Rc::new(std::cell::RefCell::new(
                 ProcessExecutor::new(None),
diff --git a/crates/shirabe/src/util/git.rs b/crates/shirabe/src/util/git.rs
index 26ea1898..f8fea562 100644
--- a/crates/shirabe/src/util/git.rs
+++ b/crates/shirabe/src/util/git.rs
@@ -25,11 +25,11 @@ use std::sync::Mutex;
 
 #[derive(Debug)]
 pub struct Git {
-    pub(crate) io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
-    pub(crate) config: std::rc::Rc<std::cell::RefCell<Config>>,
-    pub(crate) process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
-    pub(crate) filesystem: std::rc::Rc<std::cell::RefCell<Filesystem>>,
-    pub(crate) http_downloader: Option<std::rc::Rc<std::cell::RefCell<HttpDownloader>>>,
+    io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
+    config: std::rc::Rc<std::cell::RefCell<Config>>,
+    process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
+    filesystem: std::rc::Rc<std::cell::RefCell<Filesystem>>,
+    http_downloader: Option<std::rc::Rc<std::cell::RefCell<HttpDownloader>>>,
 }
 
 /// @var string|false|null
diff --git a/crates/shirabe/src/util/gitlab.rs b/crates/shirabe/src/util/gitlab.rs
index 3d1fb2be..ef68c82f 100644
--- a/crates/shirabe/src/util/gitlab.rs
+++ b/crates/shirabe/src/util/gitlab.rs
@@ -17,10 +17,10 @@ use shirabe_php_shim::{
 
 #[derive(Debug)]
 pub struct GitLab {
-    pub(crate) io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
-    pub(crate) config: std::rc::Rc<std::cell::RefCell<Config>>,
-    pub(crate) process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
-    pub(crate) http_downloader: std::rc::Rc<std::cell::RefCell<HttpDownloader>>,
+    io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
+    config: std::rc::Rc<std::cell::RefCell<Config>>,
+    process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
+    http_downloader: std::rc::Rc<std::cell::RefCell<HttpDownloader>>,
 }
 
 impl GitLab {
diff --git a/crates/shirabe/src/util/no_proxy_pattern.rs b/crates/shirabe/src/util/no_proxy_pattern.rs
index 7d4d7b84..6d19637a 100644
--- a/crates/shirabe/src/util/no_proxy_pattern.rs
+++ b/crates/shirabe/src/util/no_proxy_pattern.rs
@@ -12,11 +12,11 @@ use shirabe_php_shim::{
 #[derive(Debug)]
 pub struct NoProxyPattern {
     /// @var string[]
-    pub(crate) host_names: Vec<String>,
+    host_names: Vec<String>,
     /// @var (null|object)[]
-    pub(crate) rules: IndexMap<i64, Option<UrlData>>,
+    rules: IndexMap<i64, Option<UrlData>>,
     /// @var bool
-    pub(crate) noproxy: bool,
+    noproxy: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -69,7 +69,7 @@ impl NoProxyPattern {
     }
 
     /// Returns false is the url cannot be parsed, otherwise a data object
-    pub(crate) fn get_url_data(&self, url: &str) -> anyhow::Result<Option<UrlData>> {
+    fn get_url_data(&self, url: &str) -> anyhow::Result<Option<UrlData>> {
         let host = parse_url(url, PHP_URL_HOST);
         if empty(&host) {
             return Ok(None);
@@ -107,12 +107,7 @@ impl NoProxyPattern {
     }
 
     /// Returns true if the url is matched by a rule
-    pub(crate) fn r#match(
-        &mut self,
-        index: i64,
-        host_name: &str,
-        url: &UrlData,
-    ) -> anyhow::Result<bool> {
+    fn r#match(&mut self, index: i64, host_name: &str, url: &UrlData) -> anyhow::Result<bool> {
         let rule = match self.get_rule(index, host_name)? {
             Some(r) => r,
             None => {
@@ -148,7 +143,7 @@ impl NoProxyPattern {
     }
 
     /// Returns true if the target ip is in the network range
-    pub(crate) fn match_range(&self, network: &IpData, target: &IpData) -> anyhow::Result<bool> {
+    fn match_range(&self, network: &IpData, target: &IpData) -> anyhow::Result<bool> {
         let net = network.ip.as_slice();
         let mask = network.netmask.as_deref().unwrap_or_default();
         let ip = target.ip.as_slice();
diff --git a/crates/shirabe/src/util/perforce.rs b/crates/shirabe/src/util/perforce.rs
index 246e37f5..fbab6889 100644
--- a/crates/shirabe/src/util/perforce.rs
+++ b/crates/shirabe/src/util/perforce.rs
@@ -18,22 +18,22 @@ use shirabe_symfony_process::Process;
 /// @phpstan-type RepoConfig array{unique_perforce_client_name?: string, depot?: string, branch?: string, p4user?: string, p4password?: string}
 #[derive(Debug)]
 pub struct Perforce {
-    pub(crate) path: String,
-    pub(crate) p4_depot: Option<String>,
-    pub(crate) p4_client: Option<String>,
-    pub(crate) p4_user: Option<String>,
-    pub(crate) p4_password: Option<String>,
-    pub(crate) p4_port: String,
-    pub(crate) p4_stream: Option<String>,
-    pub(crate) p4_client_spec: String,
-    pub(crate) p4_depot_type: Option<String>,
-    pub(crate) p4_branch: Option<String>,
-    pub(crate) process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
-    pub(crate) unique_perforce_client_name: String,
-    pub(crate) windows_flag: bool,
-    pub(crate) command_result: String,
-    pub(crate) io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
-    pub(crate) filesystem: Option<std::rc::Rc<std::cell::RefCell<Filesystem>>>,
+    path: String,
+    p4_depot: Option<String>,
+    p4_client: Option<String>,
+    p4_user: Option<String>,
+    p4_password: Option<String>,
+    p4_port: String,
+    p4_stream: Option<String>,
+    p4_client_spec: String,
+    p4_depot_type: Option<String>,
+    p4_branch: Option<String>,
+    process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
+    unique_perforce_client_name: String,
+    windows_flag: bool,
+    command_result: String,
+    io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
+    filesystem: Option<std::rc::Rc<std::cell::RefCell<Filesystem>>>,
 }
 
 impl Perforce {
@@ -147,7 +147,7 @@ impl Perforce {
         file_system.borrow_mut().remove(&client_spec);
     }
 
-    pub(crate) fn execute_command(&mut self, command: PhpMixed) -> i64 {
+    fn execute_command(&mut self, command: PhpMixed) -> i64 {
         self.command_result = String::new();
 
         let cmd_vec: Vec<String> = match &command {
@@ -180,7 +180,7 @@ impl Perforce {
         self.p4_client.clone().unwrap_or_default()
     }
 
-    pub(crate) fn get_path(&self) -> &str {
+    fn get_path(&self) -> &str {
         &self.path
     }
 
@@ -190,7 +190,7 @@ impl Perforce {
         fs.borrow_mut().ensure_directory_exists(path);
     }
 
-    pub(crate) fn get_port(&self) -> &str {
+    fn get_port(&self) -> &str {
         &self.p4_port
     }
 
@@ -278,7 +278,7 @@ impl Perforce {
         Ok(())
     }
 
-    pub(crate) fn get_p4_variable(&mut self, name: &str) -> Option<String> {
+    fn get_p4_variable(&mut self, name: &str) -> Option<String> {
         if self.windows_flag {
             let command = format!("{} set", Self::get_p4_executable());
             self.execute_command(PhpMixed::String(command));
@@ -507,7 +507,7 @@ impl Perforce {
         Ok(())
     }
 
-    pub(crate) fn read(&self, pipe: &PhpResource, _name: PhpMixed) {
+    fn read(&self, pipe: &PhpResource, _name: PhpMixed) {
         if feof(pipe) {
             return;
         }
@@ -743,7 +743,7 @@ impl Perforce {
         false
     }
 
-    pub(crate) fn get_change_list(&mut self, reference: &str) -> Option<String> {
+    fn get_change_list(&mut self, reference: &str) -> Option<String> {
         let index = strpos(reference, "@")?;
         let label = substr(reference, index as i64, None);
         let command =
diff --git a/crates/shirabe/src/util/process_executor.rs b/crates/shirabe/src/util/process_executor.rs
index 3f300317..00091029 100644
--- a/crates/shirabe/src/util/process_executor.rs
+++ b/crates/shirabe/src/util/process_executor.rs
@@ -30,11 +30,11 @@ static TIMEOUT: LazyLock<Mutex<i64>> = LazyLock::new(|| Mutex::new(300));
 #[derive(Debug)]
 pub struct ProcessExecutor {
     /// @var bool
-    pub(crate) capture_output: bool,
+    capture_output: bool,
     /// @var string
-    pub(crate) error_output: String,
+    error_output: String,
     /// @var ?IOInterface
-    pub(crate) io: Option<std::rc::Rc<std::cell::RefCell<dyn IOInterface>>>,
+    io: Option<std::rc::Rc<std::cell::RefCell<dyn IOInterface>>>,
     /// @var int
     max_jobs: i64,
     /// PHP throttles async jobs through the $jobs queue and $maxJobs; here concurrent
diff --git a/crates/shirabe/src/util/svn.rs b/crates/shirabe/src/util/svn.rs
index 395f176f..bde2583d 100644
--- a/crates/shirabe/src/util/svn.rs
+++ b/crates/shirabe/src/util/svn.rs
@@ -23,21 +23,21 @@ pub struct SvnCredentials {
 #[derive(Debug)]
 pub struct Svn {
     /// @var ?array{username: string, password: string}
-    pub(crate) credentials: Option<SvnCredentials>,
+    credentials: Option<SvnCredentials>,
     /// @var bool
-    pub(crate) has_auth: Option<bool>,
+    has_auth: Option<bool>,
     /// @var IOInterface
-    pub(crate) io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
+    io: std::rc::Rc<std::cell::RefCell<dyn IOInterface>>,
     /// @var string
-    pub(crate) url: String,
+    url: String,
     /// @var bool
-    pub(crate) cache_credentials: bool,
+    cache_credentials: bool,
     /// @var ProcessExecutor
-    pub(crate) process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
+    process: std::rc::Rc<std::cell::RefCell<ProcessExecutor>>,
     /// @var int
-    pub(crate) qty_auth_tries: i64,
+    qty_auth_tries: i64,
     /// @var Config
-    pub(crate) config: std::rc::Rc<std::cell::RefCell<Config>>,
+    config: std::rc::Rc<std::cell::RefCell<Config>>,
 }
 
 /// @var string|null
@@ -202,7 +202,7 @@ impl Svn {
     /// Repositories requests credentials, let's put them in.
     ///
     /// @throws \RuntimeException
-    pub(crate) fn do_auth_dance(&mut self) -> anyhow::Result<&mut Self> {
+    fn do_auth_dance(&mut self) -> anyhow::Result<&mut Self> {
         // cannot ask for credentials in non interactive mode
         if !self.io.is_interactive() {
             return Err(RuntimeException::new(
@@ -247,12 +247,7 @@ impl Svn {
     /// @param non-empty-list<string> $cmd  Usually 'svn ls' or something like that.
     /// @param string $url  Repo URL.
     /// @param string $path Target for a checkout
-    pub(crate) fn get_command(
-        &mut self,
-        mut cmd: Vec<String>,
-        url: &str,
-        path: Option<&str>,
-    ) -> Vec<String> {
+    fn get_command(&mut self, mut cmd: Vec<String>, url: &str, path: Option<&str>) -> Vec<String> {
         cmd.push("--non-interactive".to_string());
         cmd.extend(self.get_credential_args());
         cmd.push("--".to_string());
@@ -268,7 +263,7 @@ impl Svn {
     /// Return the credential string for the svn command.
     ///
     /// Adds --no-auth-cache when credentials are present.
-    pub(crate) fn get_credential_args(&mut self) -> Vec<String> {
+    fn get_credential_args(&mut self) -> Vec<String> {
         if !self.has_auth() {
             return vec![];
         }
@@ -299,7 +294,7 @@ impl Svn {
     /// Get the password for the svn command. Can be empty.
     ///
     /// @throws \LogicException
-    pub(crate) fn get_password(&self) -> anyhow::Result<String> {
+    fn get_password(&self) -> anyhow::Result<String> {
         if self.credentials.is_none() {
             return Err(LogicException::new("No svn auth detected.".to_string()).into());
         }
@@ -310,7 +305,7 @@ impl Svn {
     /// Get the username for the svn command.
     ///
     /// @throws \LogicException
-    pub(crate) fn get_username(&self) -> anyhow::Result<String> {
+    fn get_username(&self) -> anyhow::Result<String> {
         if self.credentials.is_none() {
             return Err(LogicException::new("No svn auth detected.".to_string()).into());
         }
@@ -319,7 +314,7 @@ impl Svn {
     }
 
     /// Detect Svn Auth.
-    pub(crate) fn has_auth(&mut self) -> bool {
+    fn has_auth(&mut self) -> bool {
         if let Some(has_auth) = self.has_auth {
             return has_auth;
         }
@@ -332,7 +327,7 @@ impl Svn {
     }
 
     /// Return the no-auth-cache switch.
-    pub(crate) fn get_auth_cache_args(&self) -> Vec<String> {
+    fn get_auth_cache_args(&self) -> Vec<String> {
         if self.cache_credentials {
             vec![]
         } else {