feat(scripts,components): gate unreferenced source files, and delete the one standing orphan

.changeset/7515-unreferenced-source-gate.md

@@ -0,0 +1,21 @@
+---
+"@object-ui/components": patch
+---
+
+Remove `src/ui/toast.tsx`, an unreferenced primitive, and the dependency only it imported
+
+The file was reachable from nothing: no importer anywhere under
+`packages/components/src`, and `ui/index.ts` never carried it, so the barrel's
+`export * from './ui'` did not reach it either. It shipped all the same —
+`dist/ui/toast.d.ts` was in the published tarball — while contributing nothing to
+`dist/index.js` and nothing to the package's export surface. `ui/sonner.tsx`
+(`Toaster`) is the live implementation and is unaffected.
+
+`@radix-ui/react-toast` is dropped from `dependencies` in the same change: the
+removed file was its only importer anywhere in the repository, so it would
+otherwise have stayed a declared dependency of every install with nothing to
+resolve it.
+
+No exported name changes. A consumer who was resolving `@radix-ui/react-toast`
+through this package's dependency was relying on hoisting rather than on a
+declaration, and should declare it directly.

.github/workflows/ci.yml

@@ -263,6 +263,35 @@ jobs:
         if: steps.relevant.outputs.should_run == 'true'
         run: pnpm check:self-import
 
+      # A source file nothing imports and nothing exports sits in a PUBLISHED
+      # package indefinitely: `check-dist-completeness` asks whether `dist/` holds
+      # what `tsc` emits, `check-readme-exports` compares documented exports
+      # against shipped ones, and neither can see a file that is in the tarball
+      # while being reachable from nothing. Both instances found this week —
+      # objectui#7319 and objectui#7397 — were found by a human reading unrelated
+      # code, which is the detection mechanism this replaces. The hazard is not
+      # the bytes: the file objectui#7319 removed carried the same export name as
+      # a live engine one package over and evaluated no predicate, so
+      # name-completion alone could have wired a silently wrong renderer into a
+      # published package (objectui#7515).
+      #
+      # Reachability here has TWO roots. `packages/components` reaches two live
+      # files — the `use-sync-external-store` shims — only through
+      # `vite.config.ts` `resolve.alias`, whose importer is a bundled dependency
+      # no source file names; a walk that skips that leg reports exactly those two
+      # as dead on its first run, and a gate that cries wolf on live files gets
+      # switched off rather than fixed. Scope is DECLARED per package and the
+      # uncovered remainder is printed as a derived count on every run, because
+      # the alias mechanisms differ per package and a gate that covers one
+      # correctly beats one that covers forty with false positives.
+      #
+      # Parses sources with `typescript` through the sibling gate's scanner and
+      # reads build configs as text, so it needs the install and nothing built —
+      # same placement rationale as the two steps above.
+      - name: Verify no covered package ships a source file nothing reaches
+        if: steps.relevant.outputs.should_run == 'true'
+        run: pnpm check:unreferenced-sources
+
       # A build tsconfig that excludes tooling by FILE NAME (`*.test.ts`) stops
       # the files that happen to be named that way and nothing else. The first
       # shared helper added to a `__tests__/` directory is then a program input,

package.json

@@ -75,6 +75,7 @@
     "check:vi-mock-inherit": "node scripts/check-vi-mock-inherit.mjs",
     "check:shell-escape-residue": "node scripts/check-shell-escape-residue.mjs",
     "check:readme-exports": "node scripts/check-readme-exports.mjs",
+    "check:unreferenced-sources": "node scripts/check-unreferenced-sources.mjs",
     "cli": "node packages/cli/dist/cli.js",
     "objectui": "node packages/cli/dist/cli.js",
     "create-plugin": "node packages/create-plugin/dist/index.js",

packages/components/package.json

@@ -65,7 +65,6 @@
     "@radix-ui/react-slot": "^1.3.3",
     "@radix-ui/react-switch": "^1.3.7",
     "@radix-ui/react-tabs": "^1.1.21",
-    "@radix-ui/react-toast": "^1.2.23",
     "@radix-ui/react-toggle": "^1.1.18",
     "@radix-ui/react-toggle-group": "^1.1.19",
     "@radix-ui/react-tooltip": "^1.2.16",