Scope APIs that are currently `pub` and externally visible

[0ax1]

Double check fully public APIs whether they can be scoped to pub(crate) or pub(super) etc.