> The important point is to be able to recognize that and not coerce users into using your project only how you envisioned it and only like that. Some projects are failure on that count having switched on dictatorial direction on that aspect.

There is certainly a balance there. If every function inside your code is now considered part of your API contract, almost anything is a breaking change and you can basically forget about ever meaningfully refactoring that codebase.

Many times making things private or marking them as internal-only is the right call.

I'm not really intimate enough with libsodium to judge if they made the right cut there or not in hindsight.