(janitor/dependencies) chore(deps): remove unused js-cookie from apps/web

[kilo-code-bot]

Summary

Removes js-cookie and its type companion @types/js-cookie from apps/web, both confirmed unused.

Dependencies removed

• js-cookie (apps/web dependency)
• @types/js-cookie (apps/web devDependency)

Evidence each was unused

• knip (already configured in apps/web/knip.ts) flagged both under "Unused dependencies" / "Unused devDependencies" (apps/web/package.json:110 and :145).
• Repo-wide search for js-cookie (import statements, require(), string literals) across apps/web/src and config files returned zero matches.
• The candidate call sites that superficially matched a "Cookies" search (getExtensionUrl.ts, verify-turnstile-jwt.ts, server.ts, verify-turnstile/route.ts) all use Next.js's built-in next/headers cookies() API, not the js-cookie package.
• No other workspace package.json declares js-cookie or @types/js-cookie (checked via grep across all package.json files), so this isn't a duplicate left in the wrong package and nothing else in the monorepo depends on it.

Dynamic, configuration, and tooling references checked

• apps/web/next.config.mjs (webpack config, serverExternalPackages): no reference.
• No script in any package.json invokes js-cookie.
• No tsconfig.json, jest/vitest config, or build tooling references it.
• Not used for side effects, code generation, or CLI usage.

Package publication and peer-dependency considerations

• apps/web is a private Next.js application, not a published package, so there are no downstream consumers relying on js-cookie as part of a public contract.
• js-cookie is not declared as a peer dependency anywhere in the workspace.
• Removing it does not expose any transitive-dependency reliance: nothing else in apps/web's dependency tree requires js-cookie to be hoisted for its own use.

Validation performed

• Investigated other knip-flagged candidates (@ai-sdk/mistral, @slack/oauth, discord-api-types, vaul, several @kilocode/* workspace packages) but did not remove them in this PR — some had ambiguous evidence (e.g. @octokit/graphql-schema was flagged unused by knip but is actually read via a filesystem path in a test, confirming static analysis alone isn't proof) or warrant a separately scoped change. Only the single highest-confidence, tightly related pair (js-cookie + @types/js-cookie) was removed here.
• Regenerated the lockfile with pnpm remove js-cookie @types/js-cookie --filter web --lockfile-only (a targeted removal, not a full monorepo re-resolution) to minimize unrelated lockfile churn.
• Performed a clean install for the affected workspace (CI=1 pnpm install --filter web --frozen-lockfile), confirming js-cookie/@types/js-cookie are no longer linked into apps/web/node_modules.
• Re-ran knip for apps/web after the change: unused dependency count dropped from 40 to 38, with js-cookie/@types/js-cookie no longer appearing anywhere in the report and no new items introduced.
• Inspected the lockfile diff: aside from removing the two package entries, it contains two small pre-existing dedup-key normalizations (an @types/node peer suffix on one jest resolution, and a react/typescript peer suffix on one expo resolution) that point to version strings already present elsewhere in the lockfile — these are pnpm resolution-graph housekeeping, not new dependency versions, and they disappear entirely when re-running the same command against an unmodified package.json (verified with a stash-and-rerun control).

Uncertainty / not run

• Full repository pnpm typecheck / tsgo --noEmit and the web build could not be completed in this sandboxed environment: the container has 2 CPUs / 6GB RAM, and both the monorepo prepare hook (rollup/tsgo build of @kilocode/trpc) and a direct tsgo --noEmit run over apps/web were killed without a clear error under this resource ceiling, independent of this change. pnpm test for apps/web (which needs Postgres) was also not run, per this environment's documented resource constraints (no Postgres/Redis available here).
• As a substitute, verification relied on: static grep evidence of zero usage, knip's before/after dependency report, and confirming node_modules linkage no longer includes the removed packages after a clean install.
• CI (which has the resources for a full pnpm validate) should confirm typecheck/lint/tests pass before merging.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/package.json
• pnpm-lock.yaml

---

_{Reviewed by grok-4.6 · Input: 81.1K · Output: 4.5K · Cached: 149.2K}

_{Review guidance: REVIEW.md from base branch main}