diff --git a/lib/crates/fabro-cli/src/commands/doctor.rs b/lib/crates/fabro-cli/src/commands/doctor.rs
index 37c284826..6e8d2de61 100644
--- a/lib/crates/fabro-cli/src/commands/doctor.rs
+++ b/lib/crates/fabro-cli/src/commands/doctor.rs
@@ -25,7 +25,7 @@ use crate::user_config::load_user_settings;
 // System dependency types and parsers (server mode only)
 // ---------------------------------------------------------------------------
 
-pub struct DepSpec {
+pub(crate) struct DepSpec {
     pub name: &'static str,
     command: &'static [&'static str],
     pub required: bool,
@@ -34,7 +34,7 @@ pub struct DepSpec {
 }
 
 #[derive(Debug, Clone, PartialEq)]
-pub enum ProbeOutcome {
+pub(crate) enum ProbeOutcome {
     NotFound,
     Failed,
     Ok { version: Option<Version> },
@@ -55,7 +55,7 @@ fn parse_version(re: &Regex, output: &str) -> Option<Version> {
     ))
 }
 
-pub const DEP_SPECS: &[DepSpec] = &[
+pub(crate) const DEP_SPECS: &[DepSpec] = &[
     DepSpec {
         name: "openssl",
         command: &["openssl", "version"],
@@ -79,7 +79,7 @@ pub const DEP_SPECS: &[DepSpec] = &[
     },
 ];
 
-pub fn probe_system_deps() -> Vec<ProbeOutcome> {
+pub(crate) fn probe_system_deps() -> Vec<ProbeOutcome> {
     DEP_SPECS
         .iter()
         .map(|spec| {
@@ -113,7 +113,7 @@ fn dep_issue(name: &str, issue: &str, required: bool) -> (CheckStatus, String) {
     (status, format!("{name}: {issue} ({severity})"))
 }
 
-pub fn check_system_deps(specs: &[DepSpec], outcomes: &[ProbeOutcome]) -> CheckResult {
+pub(crate) fn check_system_deps(specs: &[DepSpec], outcomes: &[ProbeOutcome]) -> CheckResult {
     let mut details = Vec::new();
     let mut worst_status = CheckStatus::Pass;
 
@@ -526,7 +526,7 @@ pub(crate) fn check_github_app(status: &GithubAppStatus) -> CheckResult {
     }
 }
 
-pub struct ApiStatus {
+pub(crate) struct ApiStatus {
     pub base_url: String,
     pub authentication_strategies: Vec<ApiAuthStrategy>,
 }
@@ -542,7 +542,10 @@ fn format_auth_strategies(strategies: &[ApiAuthStrategy]) -> String {
         .join(", ")
 }
 
-pub fn check_api(status: &ApiStatus, live_result: Option<&Result<(), String>>) -> CheckResult {
+pub(crate) fn check_api(
+    status: &ApiStatus,
+    live_result: Option<&Result<(), String>>,
+) -> CheckResult {
     let mut details = vec![
         CheckDetail::new(format!("Base URL: {}", status.base_url)),
         CheckDetail::new(format!(
@@ -566,7 +569,7 @@ pub fn check_api(status: &ApiStatus, live_result: Option<&Result<(), String>>) -
     }
 }
 
-pub struct WebStatus {
+pub(crate) struct WebStatus {
     pub url: String,
     pub auth_provider: AuthProvider,
     pub allowed_usernames_count: usize,
@@ -579,7 +582,10 @@ fn format_auth_provider(provider: &AuthProvider) -> &'static str {
     }
 }
 
-pub fn check_web(status: &WebStatus, live_result: Option<&Result<(), String>>) -> CheckResult {
+pub(crate) fn check_web(
+    status: &WebStatus,
+    live_result: Option<&Result<(), String>>,
+) -> CheckResult {
     let mut details = vec![
         CheckDetail::new(format!("URL: {}", status.url)),
         CheckDetail::new(format!(
@@ -611,13 +617,13 @@ pub fn check_web(status: &WebStatus, live_result: Option<&Result<(), String>>) -
 // Cryptographic key validation
 // ---------------------------------------------------------------------------
 
-pub struct TlsCheckInput {
+pub(crate) struct TlsCheckInput {
     pub cert_pem: String,
     pub key_pem: String,
     pub ca_pem: String,
 }
 
-pub struct CryptoInput {
+pub(crate) struct CryptoInput {
     pub auth_strategies: Vec<ApiAuthStrategy>,
     pub tls_files: Option<Result<TlsCheckInput, String>>,
     pub jwt_public_key: Option<String>,
@@ -732,7 +738,7 @@ impl CryptoCheckState {
     }
 }
 
-pub fn check_crypto(input: &CryptoInput) -> CheckResult {
+pub(crate) fn check_crypto(input: &CryptoInput) -> CheckResult {
     let has_jwt = input.auth_strategies.contains(&ApiAuthStrategy::Jwt);
     let has_mtls = input.auth_strategies.contains(&ApiAuthStrategy::Mtls);
 
diff --git a/lib/crates/fabro-cli/src/commands/install.rs b/lib/crates/fabro-cli/src/commands/install.rs
index 0d894dacb..68b1627df 100644
--- a/lib/crates/fabro-cli/src/commands/install.rs
+++ b/lib/crates/fabro-cli/src/commands/install.rs
@@ -765,7 +765,7 @@ pub(crate) async fn run_install(web_url: &str, globals: &GlobalArgs) -> Result<(
 // ---------------------------------------------------------------------------
 
 mod hex {
-    pub fn encode(bytes: &[u8]) -> String {
+    pub(super) fn encode(bytes: &[u8]) -> String {
         bytes.iter().map(|b| format!("{b:02x}")).collect()
     }
 }