[sphilipse]

Summary

An idle-server require-graph analysis showed ~1,985 modules of browser-only libraries loaded at Kibana server startup: @elastic/eui (1,125 modules), refractor/prismjs (~300), react-intl, react-use, react-redux, @elastic/apm-rum. A single from '@elastic/eui' barrel import loads all 1,125 EUI modules, so every server-reachable chain is severed in this PR (the commit message lists each chain; highlights below):

• kbn-discover-utils: an internal constants module no longer round-trips through the package barrel; 13 server/common importers (saved_search, discover, canvas, observability, logs_shared) use pure subpath modules.
• kbn-search-connectors: root barrel no longer re-exports ./components; 22 browser files import components from the subpath.
• kbn-coloring / kbn-palettes / chart-expressions-common / kbn-visualizations-common: server/common importers switched to pure subpaths; isColorDark inlined (EUI ships no d.ts for deep lib paths); the 18 palette files deep-import eui_palettes with an ambient declaration, and kbn-ui-shared-deps exposes that path so browser bundles keep sharing the vis-color singleton. Flagging for @elastic/kibana-visualizations: please sanity-check the deep-import + shared-deps approach.
• kbn-cases-components / kbn-user-profile-components: server importers use pure subpaths; VISUALIZATION_COLORS rebuilt from @elastic/eui-theme-borealis colorVis (verified byte-identical), likewise in security common/model and the infra/observability_shared color palettes.
• ml: anomaly_utils barrel no longer re-exports the severity-color hooks (15 browser consumers moved to subpaths); aiops_log_rate_analysis moves its useEuiTheme hook out of constants.ts.
• kbn-ebt-tools server consumers (core analytics, core root, files, home) use the pure performance_metric_events module (drops react-use); kibana_utils common barrels no longer re-export the React state-container helpers (public API unchanged); kbn-streamlang replaces htmlIdGenerator with an equivalent uuid factory.

Measured impact (idle server, allocation-tracking preload, GC-forced heap snapshot + full require graph)

	modules in require.cache	heap snapshot self size
dev, before	31,188	692.3 MB
dev, after this PR	29,231 (−1,957)	654.5 MB (−37.8 MB)

On a production source build, this PR combined with the GenAI lazy-loading PR measures −120 MB idle heap (697.4 → 577.4 MB) and −3,893 modules; roughly half of that is attributable to this PR based on the dev split.

After this PR the server's require graph contains 3 @elastic/eui modules (the deep palette path) and zero refractor/prismjs/apm-rum. Known remaining, flagged for owners rather than changed here: fleet agent_policy_settings.tsx keeps @kbn/i18n-react (render-function descriptions), share url_service keeps react-use useMountedState, aiops keeps one @reduxjs/toolkit slice.

Testing

• node scripts/check.js --scope=local: tsc, eslint, and 16,045 jest tests across 20 configs pass
• Booted and verified via runtime require-graph dump (counts above)
• A full production build (node scripts/build) succeeds with the ui-shared-deps/ambient-d.ts changes

Related: #300785, #300786 (independent; measurements above were taken on top of them).

🤖 Generated with Claude Code

Production measurements (cumulative)

Idle production source builds (node scripts/build, bin/kibana against a local ES, allocation-tracking preload, 2 min idle, GC-forced heap snapshot + full require graph; same machine and protocol for every row):

Build	Modules in require.cache	Heap snapshot self size	Idle heap_used	Δ self size
main (63948de)	31,175	698.4 MB	~629 MB	—
+ #300785 (swc fs-cache)	no production effect — dev-only tooling	698.4 MB	—	0
+ #300786 (closed; langchain entry points folded into #300921)	30,885	697.4 MB	~632 MB	−1.0 MB
+ #300920 (EUI off the server)	28,932	614.7 MB	~580 MB	−82.7 MB
+ #300921 (GenAI stack lazy)	26,992	577.4 MB	~545 MB	−37.3 MB
total	−4,183	−121.0 MB	≈ −84 MB

Single-run samples; heap_used has ±10 MB run noise, snapshot self size is GC-forced and stabler.

Status: on hold pending elastic/eui#10247

The deep-import + ambient-d.ts workaround for the 18 kbn-palettes files exists only because the palette functions aren't individually importable from EUI today. elastic/eui#10247 moves them to @elastic/eui-theme-common; once that lands and Kibana upgrades EUI, the palette portion of this PR becomes a clean typed import (from '@elastic/eui-theme-common') and the ambient declaration + shared-deps entry for the deep path can be dropped. Holding merge until then.

[sphilipse]

Split into smaller, independently mergeable PRs per review feedback:

• Split React/EUI exports of kbn-discover-utils into a components entry point #302019 kbn-discover-utils subpaths (Data Discovery)
• Stop re-exporting React components from the kbn-search-connectors barrel #302020 kbn-search-connectors barrel (Search)
• Keep visualization color and constant imports EUI-free in server-reachable code #302021 visualization color/constants — on hold pending Move color palette functions to @elastic/eui-theme-common to make them individually importable eui#10247 (Visualizations)
• Import CaseStatuses from the pure kbn-cases-components subpath #302022 kbn-cases-components subpath (Cases)
• Use pure user-profile subpaths and theme tokens in security server code #302023 user-profile subpaths + theme tokens (Security)
• Remove color code from Kibana server in Observability code #302024 observability color palettes + common barrel (Observability)
• Split EUI-dependent severity helpers out of the ml anomaly_utils barrel #302025 ml anomaly_utils barrel split (ML)
• Split React code out of @kbn/ebt-tools and @kbn/ingest-pipelines-shared barrels for server consumers #302026 platform consumers: ebt-tools, kibana_utils, streamlang, ingest_pipelines
• Lint-ban browser UI library imports in Kibana server code #302027 the lint rule banning direct browser-lib imports in server code

The union of the eight splits equals this PR's diff (130 files, validated together: full check.js run + runtime require-graph verification). Measurements and chain analysis remain in this PR's description; the end state is enforced by the runtime gate in #302010, which stays unmerged until every part plus the GenAI PR (#300921) and the three flagged residue follow-ups land.