(janitor/dependencies): remove unused vaul dependency from web

[kilo-code-bot]

Dependencies removed

• vaul@1.1.2 (removed from apps/web dependencies)

Evidence that each was unused

vaul is the shadcn-style drawer/sheet component library. It was declared as a
direct dependency of apps/web but has no consumer anywhere in that package:

• No import ... from "vaul", require("vaul"), or dynamic import("vaul")
  anywhere in apps/web/src, scripts/, or test files. A repo-wide search for
  the vaul identifier only matched unrelated "vault" substrings (1Password
  vault copy) and the @expo/ui transitive dependency in apps/mobile.
• knip (already configured in apps/web) reports vaul under "Unused
  dependencies" pointing at apps/web/package.json:174.

Dynamic, configuration, and tooling references checked

• Imports/requires/dynamic imports/type references: none in apps/web
  (searched *.ts, *.tsx, *.js, *.mjs, *.jsx).
• Package scripts: no apps/web script invokes vaul.
• Configuration/plugins/loaders/codegen: not referenced in
  next.config.mjs, postcss.config.mjs, jest.config.ts, sentry.*.config.ts,
  playwright*.config.ts, Tailwind config, or any CSS @plugin/@import.
• Side effects / naming-convention discovery: none; vaul is a React
  component library imported explicitly, not a side-effectful or
  convention-discovered package.

Package publication and peer-dependency considerations

• apps/web is "private": true and is not published, so removing a direct
  dependency cannot break a published-package contract.
• vaul has only peer dependencies (react, react-dom), which are already
  declared separately in apps/web.
• vaul is not removed from the monorepo lockfile: @expo/ui@57.0.17 (used
  by apps/mobile) depends on vaul, so the vaul snapshot and its
  @expo/ui reference remain in pnpm-lock.yaml. Only the apps/web importer
  entry is dropped.

Validation performed

• pnpm install --lockfile-only --frozen-lockfile passes (lockfile is
  consistent with the edited package.json).
• pnpm --filter web lint passes (0 warnings, 0 errors).
• pnpm --filter web typecheck passes.
• git diff --check clean.
• Lockfile diff inspected: exactly the 3-line vaul importer entry removed; no
  unrelated changes.

Uncertainty

• Full pnpm --filter web test was not run: the test suite requires
  PostgreSQL/Redis, which cannot be started in this resource-constrained
  environment. Since no source files changed (dependency removal only) and
  typecheck/lint passed, this is low-risk, but it is documented here for
  completeness.
• The initial pnpm install --no-frozen-lockfile run in this environment
  re-resolved unrelated peer dependencies (e.g. @types/node resolution and
  Storybook peer-dep sets) and OOM'd once. The final lockfile edit was therefore
  applied by hand and verified with --frozen-lockfile rather than trusting that
  install run.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Verified at HEAD f70f91c4 that removing the unused vaul direct dependency from apps/web is safe: no source, config, or script in apps/web imports it, and the lockfile still retains the vaul snapshot for its remaining @expo/ui / expo-router consumers.

Files Reviewed (2 files)

• apps/web/package.json
• pnpm-lock.yaml

Verification Notes

• Repo-wide search for vaul found no import/require/dynamic-import/type references in any source file; only "vault" substring matches (1Password copy) and lockfile snapshot entries.
• The lockfile edit removes exactly the apps/web importer entry; vaul@1.1.2 snapshots remain referenced by @expo/ui@57.0.17 and expo-router@57.0.20 (lines 22655/22670 and 31424/31471).
• PR is self-contained (2 files, 4 deletions) and declares no unrelated changes; mergeable: MERGEABLE at HEAD.

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}