DataViews: remove all private API usage

[youknowriad]

@wordpress/dataviews is a bundled package — it declares neither wpScript nor wpModuleExports in its package.json. Per AGENTS.md:

Avoid using private APIs in bundled packages (packages without wpScript or wpModuleExports). Private APIs are intended for Core usage; bundled packages may also be imported via npm into plugin scripts, causing incompatibilities.

Concretely: lockedData is a module-scoped WeakMap and __private is a plain Symbol() — not Symbol.for() (implementation.ts#L187-L193). Two copies of @wordpress/private-apis in one runtime cannot unlock each other's objects, so a plugin that loads wp.components from the WP global alongside a bundled DataViews throws Cannot unlock an object that was not locked before at module-eval time, before anything renders.

Secondary cost: unlock() is typed <T = any>( object: unknown ): T, so every unlocked symbol lands as any. All 23 call sites below are effectively unchecked by TypeScript — swapping any of them for a public equivalent tends to surface pre-existing type mismatches.

@wordpress/components

18 of the 25 symbols in components/src/private-apis.ts, across 21 production files:

Symbol	Where	Why it's private
Menu	add-filter.tsx:22, dataviews-view-config/index.tsx:37, dataviews-item-actions/index.tsx:27, column-header-menu.tsx:33, list/index.tsx:62	Ariakit-based menu; no public replacement exists yet — @wordpress/ui has no menu
Badge	picker-grid/index.tsx:36, composite-grid.tsx:45	A public Badge already ships in @wordpress/ui and DataViews uses it in validation-badge.tsx — this one is a stale holdout
kebabCase	dataviews-item-actions/index.tsx:27	String util, private to avoid committing to a public utils surface
DateCalendar, DateRangeCalendar	date.tsx:57, datetime.tsx:24	New calendar components still stabilizing
withIgnoreIMEEvents	richtext/control.tsx:47	IME keydown wrapper
Validated* × 12	one per control in dataform-controls/ — InputControl, Checkbox, Combobox, Number, Select, Radio, ContentEditable, Textarea, Toggle, ToggleGroup, FormTokenField (+Text in a story)	The whole validated-form-controls layer is private; DataForm is its only real consumer

@wordpress/rich-text

5 of the 9 symbols in rich-text/src/private-apis.js, all in one file — dataform-controls/richtext/control.tsx:

Symbol	Where	Why it's private
useRichText	richtext/control.tsx:61	Core editing hook; the public surface is RichText in @wordpress/block-editor, which DataViews can't depend on
KeyboardShortcutContext, InputEventContext	richtext/control.tsx:61	The same context objects that format types' RichTextShortcut / RichTextInputEvent read
shortcutsListener, inputEventsListener	richtext/control.tsx:61	Dispatch the registered callbacks from the editable element's own events

Exposed by DataViews

Symbol	Where	Notes
RichTextControl	locked in dataviews/src/private-apis.ts, unlocked by editor note-form.js:28	DataViews' own private export — one symbol, one consumer. Needs to become a public export or move to the consumer

Todo

Ordered by effort — the first three are unblocked today.

• Badge — DataViews: Use the public @wordpress/ui Badge instead of the private one #81236
• kebabCase — DataViews: remove kebabCase private import by inlining it #81284 and New kebab-case package: extract utility and migrate private API calls #81294
• withIgnoreIMEEvents — Keycodes: Make withIgnoreIMEEvents a public API #81343
• Validated* — @mirka
  • Move Spinner component to wp-ui UI: Add Spinner component #81358
  • Remove ValidatedTextControl Components: Remove ValidatedTextControl private API #80680
  • Move ControlWithError and ValidityIndicator to wp-ui (depends on Spinner)
  • Build TextareaControl in wp-ui UI: Add TextareaControl component #81359
  • Build ValidatedInputControl and ValidatedTextareaControl in wp-ui (with new components)
  • Move all other validated components to keep internal in wp-dataviews
    • DataViews: vendor ValidatedNumberControl #81433
    • DataViews: vendor ValidatedCheckboxControl #81435
    • DataViews: vendor ValidatedSelectControl #81391
    • DataViews: vendor ValidatedRadioControl #81434
    • DataViews: vendor ValidatedComboboxControl #81449
    • DataViews: vendor ValidatedToggleGroupControl #81450
    • DataViews: vendor ValidatedFormTokenField #81451
    • ValidatedContentEditableControl: no longer necessary, richtext dependency removed.
  • Could keep a copy of ValidatedToggleControl as a private API in wp-components for wp-content-types usage, to be replaced later by a new version in wp-ui
• DateCalendar / DateRangeCalendar — UI: Add Calendar and RangeCalendar, moved from components private APIs #81337
• Menu (5 sites) — @ciampo Menu: Add UI component #79560
• rich-text × 5 (1 site) — needs a public way to build a rich-text field outside @wordpress/block-editor. The largest single item; likely its own issue once the shape is known.
• RichTextControl — make it a public DataViews export, or move it into @wordpress/editor alongside its only consumer.
• Once all of the above land, drop @wordpress/private-apis from packages/dataviews/package.json and delete lock-unlock.ts and private-apis.ts.
• Add a lint rule (or any other mechanism) for preventing the wordpress/dataviews package to use private APIs. DataViews: Add a lint rule preventing private API imports #81478

[ciampo]

@wordpress/ui will soon have a Menu component :) #79560.