Remove unused devtool dependencies; fix undeclared phantom deps

[dwertheimer]

Summary

Follow-up to #759. Audited all 115 top-level dependencies for real usage across our own code, npm scripts, and tool config (ESLint plugin/extends shorthand, PostCSS plugin wiring, Jest environment shorthand, peer-dep requirements) and removed everything confirmed dead.

Removed

PostCSS family — autoprefixer, postcss, postcss-calc, postcss-color-function, postcss-custom-properties, postcss-preset-env. None of these are passed into the actual PostCSS pipeline in scripts/rollup.generic.js, which only wires up rollup-plugin-postcss + postcss-prefix-selector directly. A "devDependencies_to_remove" key already sitting in package.json had flagged 4 of these as known-dead but the removal was never finished — completed that here and dropped the placeholder key.

rollup-plugin-styles — zero usage anywhere, and it's the actual package causing the ERESOLVE peer conflict that's forced --legacy-peer-deps on every install. Plain npm install now succeeds with no flag needed.

rollup-plugin-terser — superseded by @rollup/plugin-terser, which is what scripts/rollup.js actually imports.

eslint-plugin-prettier — commented out in .eslintrc since Jan 2025 ("Remove prettier/prettier rule in eslint") after running Prettier through ESLint produced too much formatting noise. Formatting is handled separately by the standalone prettier CLI via npm run format/fix; eslint-config-prettier (disables ESLint's conflicting stylistic rules) stays — only the ESLint-integration package goes.

react-circular-progressbar, vinyl, vinyl-fs, node-domexception — no references anywhere. node-domexception isn't even a transitive dependency of anything else in the tree.

jest-config, jest-resolve, @jest/test-sequencer — Jest's own internal packages, already pulled in transitively by @jest/core at the identical pinned version (^29.7.0). No custom resolver/sequencer config references them.

testing-library (bare, 0.0.2) — not the real Testing Library org package. Looks like a typo from the same commit that added the real @testing-library/* packages.

babel (bare, ^6.23.0) — ancient deprecated Babel 6 meta-package. The project fully uses scoped @babel/* v7 packages now.

babel-plugin-syntax-hermes-parser — zero parents in the dependency tree, not referenced by babel.config.js or @babel/preset-flow. flow check doesn't invoke Babel plugins at all, so this has zero effect on typechecking regardless of whether it's installed — verified via an identical 8059-error count before/after removal (compared with git stash).

Also fixed: 3 undeclared phantom dependencies

Found during the audit — chalk, @codedungeon/messenger, and lodash.debounce are require()'d directly in scripts/rollup.js / scripts/rollup.generic.js but were never declared in package.json. They only worked because something else in the tree happened to install them transitively; pinned to their currently-resolved versions so an unrelated dependency bump can't silently break the build scripts.

Verification

• Plain npm install succeeds with no ERESOLVE error (previously required --legacy-peer-deps)
• Full test suite passes: 198 suites, 4553 tests (npm test)
• flow check error count unchanged: 8059 before and after (confirmed via git stash comparison)
• eslint . output unchanged: pre-existing 207069 problems, confirmed identical via git stash comparison (unrelated repo-wide lint debt, not introduced by this change)
• Built a plain plugin end-to-end via the real npc CLI (np.Templating)
• Built a React-webview plugin end-to-end (jgclark.Dashboard), exercising the postcss/rollup-plugin-postcss path specifically
• node index.js --help (CLI smoke test) still works

🤖 Generated with Claude Code