Repo cleanup consolidation: Repomix, Knip, generated drift, Supabase linked lint

[njrini99-code]

Summary

Package the current HelmV3 cleanup work into one fix-ready tracking issue. This combines findings from the repo freshness audit, the follow-up agent handoff, and the latest Codex session work.

The repo is buildable/testable, but not yet a clean maintenance baseline. Work should proceed as small PRs, not one mega cleanup.

Hard guardrails

• Do not mutate linked Supabase during discovery/planning.
• Do not close GitHub issues/PRs automatically from this issue.
• Do not delete source files from the first Knip pass.
• Do not run npm audit fix or npm audit fix --force.
• Do not run broad destructive cleanup like git clean -Xdf.
• Do not treat npm run db:types:check as read-only; it runs npm run db:types first and can rewrite src/lib/types/database.ts.
• Keep generated-file/audit-output cleanup separate from app behavior changes.

Repomix status

Fresh context generation was run successfully on 2026-07-03:

npm run fresh:context

Generated packs, all gitignored under .repomix/:

• .repomix/helmv3-compressed.xml — 4,377 files, 5,202,055 tokens, security check passed
• .repomix/changed-files-context.xml — 24 changed files, 69,150 tokens, includes diffs/logs, security check passed
• .repomix/helmv3-db-context.xml — 218 DB/schema files, 1,018,810 tokens, security check passed

Repomix wrapper/config/docs are present locally:

• repomix.config.json
• scripts/context/repomix.sh
• docs/operations/REPOMIX_CONTEXT_PACKS.md
• docs/prompts/repomix/repo-cleanup.md
• docs/prompts/repomix/db-audit.md
• docs/prompts/repomix/changed-files-review.md

Use these prompts with the packs above when assigning the fix work.

Local work already prepared

A prior Codex session created/updated these cleanup docs and helpers:

• docs/audits/REPO_FRESHNESS_BASELINE_2026-07-03.md
• docs/audits/CLEANUP_PR_SEQUENCE_2026-07-03.md
• docs/audits/SUPABASE_LINKED_LINT_FIX_PLAN_2026-07-03.md
• docs/audits/KNIP_TRIAGE_2026-07-03.md
• docs/audits/AGENT_HANDOFF_CLEANUP_KNIP_SUPABASE_2026-07-03.md
• scripts/git/audit.sh
• scripts/git/clean-dry.sh
• scripts/git/stash-audit.sh
• package scripts: git:audit, git:clean:dry, git:stash:audit, knip:*, ctx:*, fresh:context, arch helpers

Latest Codex tuning updated knip.json so that:

• CRM migration scripts are modeled as Knip entrypoints, so postgres is no longer a false unused-devDependency finding.
• native Capacitor packages are ignored because iOS SPM references them under ios/App/CapApp-SPM/Package.swift.
• admin security/test fixture files are ignored as intentional fixtures.
• the redundant next.config.mjs Knip entry pattern was removed.

Current local repo state to be aware of

Working tree was already dirty before this issue packaging. Current notable local changes include:

• generated drift: next-env.d.ts, public/sw.js
• cleanup/config docs: audit docs, Repomix docs/prompts/config, Git helper scripts
• package/package-lock changes adding tooling/scripts already present locally
• .gitignore, .repomixignore, .dependency-cruiser.cjs, .github/workflows/repomix-context.yml, CLAUDE.md

Do not blindly revert unrelated dirty files; split intentional work into small PRs.

Findings to track

1. Generated file drift

• next-env.d.ts changed route types import from ./.next/dev/types/routes.d.ts to ./.next/types/routes.d.ts.
• public/sw.js cache version changed from golfhelm-v48d739cec to golfhelm-v8b9986e1a.
• public/sw.js is stamped by scripts/stamp-sw.mjs during prebuild.

Decision needed:

• commit these generated outputs in a narrow generated-file PR, or
• stop tracking one/both and generate reliably in CI/deploy.

2. db:types:check audit correction

The freshness baseline must not say npm run db:types:check passed. It was skipped/deferred because it regenerates src/lib/types/database.ts before diffing it.

Read-only drift check is npm run check:types-drift, but it requires SUPABASE_ACCESS_TOKEN.

3. Local Git hygiene

Freshness baseline found:

• local git fsck --full failed due to commit-graph parse failures, likely local metadata
• 24 stashes
• 6 merged local non-main branches tracking gone upstreams
• large ignored artifact set

Safe prepared helpers:

npm run git:audit
npm run git:clean:dry
npm run git:stash:audit

Do not run broad destructive cleanup. Branch deletions, if approved, should use git branch -d, not -D.

4. Knip tuned baseline

After latest tuning:

npm run knip:files

reports 6 unused-file candidates:

• src/components/baseball/dashboard/dashboard-types.ts
• src/components/baseball/recruiting-philosophy/MatchScoreBadge.tsx
• src/components/products/golf-mockups/index.tsx
• src/lib/mapbox/client.ts
• src/lib/recruiting/match-calculator.ts
• src/lib/types/table.ts

npm run knip:deps

reports 5 unlisted direct imports:

• postcss-load-config from postcss.config.mjs
• @radix-ui/react-compose-refs from src/components/fairway/controls/tabs.tsx
• fflate from src/lib/baseball/__tests__/import-formats.test.ts
• fflate from src/lib/baseball/adapters/pdf-reader.ts
• fflate from src/lib/baseball/adapters/xlsx-reader.ts

npm run knip still exits 1 because it includes the 6 files, 5 unlisted deps, and 695 unused exports. Do not act on the 695 export findings in bulk.

5. Supabase linked lint follow-up

Linked lint reported two real public-function errors:

• public.can_manage_baseball_lift_group references missing relation public.baseball_strength_groups.
• public.baseball_accept_staff_invite references missing record field v_invitation.invitee_email.

Plan only until live definitions are fetched.

For can_manage_baseball_lift_group:

• local migration 20260624000050_baseball_rls_helpers_and_policies.sql defines can_manage_baseball_lift_group(p_team_id uuid, p_player_id uuid) without baseball_strength_groups
• likely production has an older function body while legacy Lift Lab tables were moved to graveyard
• do not restore public.baseball_strength_groups

For baseball_accept_staff_invite:

• local superseding migration 20260624000081_baseball_staff_roles_scope_audit.sql uses v_invite.email, not v_invitation.invitee_email
• likely production has an older/manual function body or stale table column reference
• do not add invitee_email without confirming current writers/product intent

Read-only discovery needed:

select pg_get_functiondef('public.can_manage_baseball_lift_group(uuid, uuid)'::regprocedure);
select pg_get_functiondef('public.baseball_accept_staff_invite(text)'::regprocedure);
select column_name, data_type
from information_schema.columns
where table_schema = 'public'
  and table_name = 'baseball_staff_invitations'
order by ordinal_position;

6. Dependency/security cleanup

Open Dependabot PR set was dependency-only. Recommended order from audit:

1. #735 tar 7.5.19
2. #741 Anthropic SDK
3. then grouped Actions/dev/prod dependency PRs separately

Do not run npm audit fix --force. Security audit needs small dependency buckets.

7. Issue cleanup ledger

Open issue cleanup should be evidence-backed. Do not bulk close. Create/update an issue ledger with each issue classified as:

• still valid
• fixed but needs evidence comment
• duplicate/superseded
• blocked by DB/admin access
• backlog/product decision

Recommended PR sequence

1. Audit correction + generated-file policy
2. Repomix/context tooling + local Git hygiene helpers
3. Knip config/tuning baseline
4. Add direct dependencies or refactor imports for postcss-load-config, @radix-ui/react-compose-refs, fflate
5. Dead-file deletion batch 1, only after per-file source/route/test review
6. Supabase linked lint live-definition discovery doc, no mutation
7. Supabase additive migration fix for the two confirmed lint errors
8. Small dependency security PRs, starting with tar
9. Issue cleanup ledger
10. Evidence-comment/close issues in batches after human review

Validation already run successfully

From local Codex work:

npm run typecheck
npm run lint:ratchet
npm run test:run
npm run docs:check
npm run knowledge:check
npm run fresh:context

npm run test:run result from prior pass: 4,398 passed, 39 skipped.

Knip commands intentionally exit 1 with the tuned baseline findings above.

Acceptance criteria for this tracking issue

• One PR lands the docs/generated-file policy and audit correction.
• One PR lands Repomix/context + Git hygiene helpers or confirms they should be kept local only.
• One PR lands Knip tuning and documents the current 6-file / 5-dep baseline.
• One PR resolves the 5 unlisted direct dependencies or removes the direct imports.
• One PR handles the first safe dead-file deletion batch with tests.
• Supabase live function bodies and invitation columns are captured read-only.
• Supabase lint errors are fixed by an additive reviewed migration.
• Dependency security patches are handled in small PRs, not by npm audit fix --force.
• Issue ledger is created/updated before any bulk issue comments or closures.

[coderabbitai]

🔗 Related PRs

#94 - fix: Codex 2026-05-26 — RLS gaps, broken inserts, LLM gov, autosave [merged]
#327 - fix(golf): Wave A — DB/security hardening (IDOR + RLS + anon grants) [merged]
#420 - ci: unify PR checks and CodeRabbit gates [merged]
#727 - Helm Bridge — unified /admin command center + total feature instrumentation (single deploy) [merged]
#733 - chore(db): advisors hardening — anon RPC revoke, initplan RLS rewrite, index/search_path cleanup [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

✅ Successfully generated implementation plan.

💡 Use @coderabbitai <feedback> to replan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Summary

• Recognize that the "already prepared" tooling does not exist and author it fresh, delivered as small, single-purpose PRs matching the ticket's sequence.
• Correct the written baseline (notably that db:types:check is not read-only) and settle the generated-file policy (gitignore next-env.d.ts; stabilize public/sw.js stamping) as a behavior-neutral change.
• Fix confirmed hygiene issues cleanly: tune knip.json to a documented baseline, promote three phantom deps to direct, and delete six confirmed-dead files after review.
• Resolve the Supabase linked-lint errors via read-only discovery followed by an additive CREATE OR REPLACE migration that re-aligns production with the already-correct local function bodies.

Design Choices

Design Choice 1: The "already prepared" prior-session tooling does not exist in the repo.

Options Considered:

1. Assume the files exist and only reconcile/align them.
2. Create the tooling from scratch to match the ticket's specification.

Chosen Option: 2

Rationale: Exploration confirmed the audit docs, git scripts, repomix config/docs/workflow, package scripts, and described knip tuning are all absent. The plan therefore treats these as net-new artifacts to author to match the ticket's described end-state. The files genuinely do not exist, so they must be authored fresh (still split across small PRs as the ticket mandates).

Design Choice 2: Generated-file drift policy for `next-env.d.ts` and `public/sw.js`.

Options Considered:

1. Commit the regenerated outputs as-is in a narrow generated-file PR.
2. Stop tracking both and generate reliably in dev/CI/deploy.
3. Mixed: gitignore next-env.d.ts (Next.js-managed, standard practice) and keep public/sw.js tracked with a stable placeholder version, stamping only during Vercel build.

Chosen Option: 3

Rationale: Both are tracked yet regenerated by tooling, causing routine working-tree dirtiness. next-env.d.ts is Next.js-owned and safe to ignore per Next docs; public/sw.js is genuine source that must stay tracked, so commit a canonical placeholder CACHE_VERSION and let stamp-sw.mjs stamp only in the deploy build, documenting the expected behavior.

Design Choice 3: Whether Repomix/context and Git-hygiene tooling is committed or kept local-only.

Options Considered:

1. Commit the config/scripts/docs and package scripts into the repo.
2. Keep them local-only and document that decision.

Chosen Option: 1

Rationale: The acceptance criteria allow either outcome. Committing makes the context packs and hygiene helpers reproducible for other agents/CI and matches the ticket's detailed file list; all generated packs remain gitignored under .repomix/.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Audit correction & generated-file drift policy

Establish the corrected written baseline and settle the generated-file tracking policy. This phase produces documentation plus a narrow, behavior-neutral change to how build/dev-generated files are tracked, deliberately kept separate from any app behavior change per the ticket guardrail.

Task 1: Author the corrected freshness baseline and cleanup-sequence docs

Create the audit documentation set, corrected for the real repo state.

• Create docs/audits/REPO_FRESHNESS_BASELINE_2026-07-03.md following the REPO_UNTANGLE_AND_CLEAN_BASE.md template (bold metadata header, one-paragraph verdict, numbered H2 sections, verification-command appendix).
• Explicitly record the audit correction: npm run db:types:check is NOT read-only (it runs db:types first and can rewrite src/lib/types/database.ts); the read-only drift check is npm run check:types-drift, which requires SUPABASE_ACCESS_TOKEN.
• Create docs/audits/CLEANUP_PR_SEQUENCE_2026-07-03.md capturing the small-PR sequence, and docs/audits/AGENT_HANDOFF_CLEANUP_KNIP_SUPABASE_2026-07-03.md in the emoji-scannable handoff style, including a "Settled — do not re-raise" callout for owner guardrails.
• Record local Git-hygiene findings (fsck commit-graph parse failure as local metadata, 24 stashes, 6 merged branches) as advisory only, with the explicit rule that branch deletions use git branch -d, not -D, and no git clean -Xdf.

Task 2: Implement the generated-file drift policy

Reduce routine working-tree drift from generated files without changing app behavior.

• Add next-env.d.ts to .gitignore (consistent with the existing "Repo hygiene" ignore block and Next.js convention) and stop tracking it.
• For public/sw.js: keep it tracked but normalize its committed CACHE_VERSION to a stable placeholder, and adjust scripts/stamp-sw.mjs/prebuild expectations so stamping is a deploy-time concern (document that local builds may show a transient diff that should not be committed).
• Document both decisions in the freshness baseline doc so the policy is discoverable.

Task 3: Seed the issue-cleanup ledger scaffold

Provide the evidence-backed ledger structure before any issue triage.

• Create an issue-ledger doc under docs/audits/ with a table classifying each open issue as: still valid / fixed-needs-evidence / duplicate-superseded / blocked-by-DB-or-admin / backlog-product-decision.
• Include an explicit "no bulk close, no auto-comment" guardrail note; leave rows to be populated during human-reviewed triage (out of scope to close/comment here).

🤖 Prompt for AI agents

Implement Phase 1: establish the corrected audit documentation baseline and a
behavior-neutral generated-file drift policy. This phase is documentation-first
plus one narrow tracking-policy change; do not touch app behavior.

- Create `docs/audits/REPO_FRESHNESS_BASELINE_2026-07-03.md` following the
`REPO_UNTANGLE_AND_CLEAN_BASE.md` template style (bold metadata header,
one-paragraph verdict, numbered H2 sections, verification-command appendix).
Explicitly record the audit correction that `npm run db:types:check` is NOT
read-only (it runs `db:types` first and can rewrite
`src/lib/types/database.ts`), while `npm run check:types-drift` is the actual
read-only drift check requiring `SUPABASE_ACCESS_TOKEN`.
- Create `docs/audits/CLEANUP_PR_SEQUENCE_2026-07-03.md` documenting the
small-PR sequence.
- Create `docs/audits/AGENT_HANDOFF_CLEANUP_KNIP_SUPABASE_2026-07-03.md` in an
emoji-scannable handoff style, including a "Settled — do not re-raise" callout
for owner guardrails.
- In these docs, record local Git-hygiene findings (fsck commit-graph parse
failure as local metadata, 24 stashes, 6 merged branches) as advisory only, and
state the explicit rule: branch deletions must use `git branch -d` (never `-D`),
and never run `git clean -Xdf`.
- Add `next-env.d.ts` to `.gitignore` (consistent with the existing "Repo
hygiene" ignore block) and stop tracking it (Next.js-managed file).
- For `public/sw.js`: keep it tracked, normalize its committed `CACHE_VERSION`
to a stable placeholder value, and adjust `scripts/stamp-sw.mjs`/`prebuild` so
stamping is treated as a deploy-time concern only; document that local builds
may show a transient diff that should not be committed.
- Document both the `next-env.d.ts` and `public/sw.js` policy decisions inside
the freshness baseline doc.
- Create an issue-ledger doc under `docs/audits/` with a table classifying each
open issue as: still valid / fixed-needs-evidence / duplicate-superseded /
blocked-by-DB-or-admin / backlog-product-decision. Include an explicit "no bulk
close, no auto-comment" guardrail note; leave rows unpopulated pending
human-reviewed triage — do not close or comment on issues in this task.

Phase 2: Repomix/context tooling & Git-hygiene helpers

Create the reproducible context-generation and safe Git-audit tooling described in the ticket. All heavy generated packs stay gitignored under .repomix/; only config, wrapper scripts, prompts, docs, and package scripts are committed.

Task 1: Add Repomix configuration, wrapper, and ignore rules

Establish reproducible context-pack generation.

• Create repomix.config.json (output paths under .repomix/, ignore patterns) and .repomixignore.
• Create scripts/context/repomix.sh as the wrapper that produces the compressed, changed-files, and DB-context packs.
• Ensure .gitignore ignores .repomix/ output while keeping config/scripts tracked.

Task 2: Add Repomix operations docs and prompt library

Document how to use the context packs.

• Create docs/operations/REPOMIX_CONTEXT_PACKS.md mirroring the docs/operations/context/MISSION_CONTROL_CONTEXT_INDEX.md index style (table of packs, primary readers, freshness note).
• Create the prompt files docs/prompts/repomix/repo-cleanup.md, db-audit.md, and changed-files-review.md.

Task 3: Add safe Git-hygiene helper scripts

Provide non-destructive audit helpers.

• Create scripts/git/audit.sh, scripts/git/clean-dry.sh (dry-run only), and scripts/git/stash-audit.sh — all read-only/dry-run, never invoking destructive operations.
• Keep behavior strictly advisory (report stashes, merged branches tracking gone upstreams, ignored artifact sizes).

Task 4: Wire package scripts and optional CI workflow

Expose the tooling via npm scripts.

• Add fresh:context, ctx:*, git:audit, git:clean:dry, git:stash:audit (and any arch helpers referenced) to package.json scripts, pointing at the new wrappers.
• Add .github/workflows/repomix-context.yml to generate packs on demand/schedule (non-gating), consistent with existing workflow structure.

🤖 Prompt for AI agents

Implement Phase 2: build the reproducible Repomix context-generation tooling and
safe, read-only Git-hygiene helper scripts. Only config, wrapper scripts,
prompts, docs, and package scripts should be committed — generated packs must
remain gitignored under `.repomix/`.

- Create `repomix.config.json` with output paths under `.repomix/` and
appropriate ignore patterns, plus a `.repomixignore` file.
- Create `scripts/context/repomix.sh` as the wrapper script that produces the
compressed pack, the changed-files pack, and the DB-context pack.
- Update `.gitignore` so `.repomix/` output is ignored while the config and
scripts themselves remain tracked.
- Create `docs/operations/REPOMIX_CONTEXT_PACKS.md`, mirroring the index style
of `docs/operations/context/MISSION_CONTROL_CONTEXT_INDEX.md` (table of packs,
primary readers, freshness note).
- Create prompt files: `docs/prompts/repomix/repo-cleanup.md`,
`docs/prompts/repomix/db-audit.md`, and
`docs/prompts/repomix/changed-files-review.md`.
- Create Git-hygiene helper scripts: `scripts/git/audit.sh`,
`scripts/git/clean-dry.sh` (dry-run only), and `scripts/git/stash-audit.sh`. All
must be strictly read-only/dry-run and never invoke destructive git operations;
they should report stashes, merged branches tracking gone upstreams, and ignored
artifact sizes advisory-only.
- Add npm scripts to `package.json`: `fresh:context`, `ctx:*`, `git:audit`,
`git:clean:dry`, `git:stash:audit` (and any additional arch helper scripts
referenced), all pointing at the new wrapper scripts.
- Add `.github/workflows/repomix-context.yml` to generate context packs on
demand/schedule as a non-gating workflow, following the structure of existing
workflows in `.github/workflows/`.

Phase 3: Knip config tuning and baseline documentation

Tune knip.json to the intended configuration and document the resulting, expected 6-file / 5-dep baseline.

Task 1: Update knip.json to the tuned baseline

Eliminate known false positives.

• Update knip.json to: model CRM migration scripts as entrypoints (so postgres is no longer flagged), ignore native Capacitor packages (referenced by ios/App/CapApp-SPM/Package.swift), ignore admin security/test fixture files as intentional fixtures, and remove the redundant next.config.mjs entry pattern.

Task 2: Add knip scripts and document the baseline

Make knip runnable and its baseline explicit.

• Add knip, knip:files, and knip:deps scripts to package.json.
• Create docs/audits/KNIP_TRIAGE_2026-07-03.md (DB-table-audit triage style) documenting the expected 6 unused-file candidates and 5 unlisted-dependency findings, and explicitly noting the 695 unused-export findings are NOT to be acted on in bulk.
• Document that npm run knip intentionally exits 1 at this baseline (do not add it as a hard CI gate in this phase).

🤖 Prompt for AI agents

Implement Phase 3: tune the `knip.json` configuration to eliminate known false
positives, expose knip via npm scripts, and document the resulting baseline.

- Update `knip.json` to: model CRM migration scripts as entrypoints so
`postgres` is no longer flagged as unused; ignore native Capacitor packages
referenced by `ios/App/CapApp-SPM/Package.swift`; ignore admin security/test
fixture files as intentional fixtures; and remove the redundant
`next.config.mjs` entry pattern.
- Add `knip`, `knip:files`, and `knip:deps` scripts to `package.json`.
- Create `docs/audits/KNIP_TRIAGE_2026-07-03.md` in a DB-table-audit triage
style documenting the expected 6 unused-file candidates and 5
unlisted-dependency findings.
- Explicitly note in that doc that the 695 unused-export findings are NOT to be
acted on in bulk.
- Document that `npm run knip` intentionally exits with status 1 at this
baseline, and do not add it as a hard CI gate in this phase.

Phase 4: Resolve unlisted direct dependencies

Promote the three confirmed phantom (transitive-only) dependencies to explicit direct dependencies.

Add the three phantom packages to package.json dependencies

Make the dependency contract explicit for code that already imports these.

• Add to dependencies (alphabetical placement, caret ranges matching already-resolved lockfile versions): @radix-ui/react-compose-refs (used in src/components/fairway/controls/tabs.tsx), fflate (used in src/lib/baseball/adapters/xlsx-reader.ts, pdf-reader.ts, and the import-formats test), and postcss-load-config (type reference in postcss.config.mjs).
• Run npm install to update package-lock.json manifest linkage; resolved versions should not change since all three are already present transitively.
• Remove the misleading "already a dependency" comments in the fflate adapters if they conflict with the now-explicit declaration.

🤖 Prompt for AI agents

Implement Phase 4: promote three confirmed phantom (transitive-only)
dependencies to explicit direct dependencies in `package.json`.

- Add to the `dependencies` block, in alphabetical placement, using caret ranges
matching the already-resolved lockfile versions: `@radix-ui/react-compose-refs`
(used in `src/components/fairway/controls/tabs.tsx`), `fflate` (used in
`src/lib/baseball/adapters/xlsx-reader.ts`, `pdf-reader.ts`, and the
import-formats test), and `postcss-load-config` (type reference used in
`postcss.config.mjs`).
- Run `npm install` to update `package-lock.json` manifest linkage; note that
resolved versions should not change since all three packages are already present
transitively.
- Remove the misleading "already a dependency" comments in the fflate adapters
(`src/lib/baseball/adapters/pdf-reader.ts` and `xlsx-reader.ts`) if they
conflict with the now-explicit dependency declaration.

Phase 5: Dead-file deletion batch 1

Delete the six confirmed-dead files after per-file review, keeping deletions isolated from other changes.

Remove the confirmed dead files

Delete files with no live importers/routes/tests.

• Delete src/components/baseball/dashboard/dashboard-types.ts, src/components/baseball/recruiting-philosophy/MatchScoreBadge.tsx, src/components/products/golf-mockups/index.tsx, src/lib/mapbox/client.ts, src/lib/recruiting/match-calculator.ts, and src/lib/types/table.ts.
• In the PR description, note the resolution-shadowing nuance for golf-mockups/index.tsx (index.ts barrel wins over index.tsx) and the transitive-dead chain (match-calculator.ts only consumed by the dead MatchScoreBadge.tsx).
• Verify no residual references remain (including the filesystem-pattern test scripts/__tests__/badge-consolidation.test.mjs) and run typecheck/test:run to confirm no regressions.

🤖 Prompt for AI agents

Implement Phase 5: delete the six confirmed-dead files with no live
importers/routes/tests, keeping this deletion batch isolated from other changes.

- Delete the following files:
`src/components/baseball/dashboard/dashboard-types.ts`,
`src/components/baseball/recruiting-philosophy/MatchScoreBadge.tsx`,
`src/components/products/golf-mockups/index.tsx`, `src/lib/mapbox/client.ts`,
`src/lib/recruiting/match-calculator.ts`, and `src/lib/types/table.ts`.
- In the PR description, document the resolution-shadowing nuance for
`golf-mockups/index.tsx` (the sibling `index.ts` barrel wins over `index.tsx`)
and the transitive-dead chain (`match-calculator.ts` is only consumed by the
also-dead `MatchScoreBadge.tsx`).
- Verify no residual references remain anywhere in the codebase, including in
the filesystem-pattern test `scripts/__tests__/badge-consolidation.test.mjs`.
- Run `typecheck` and `test:run` to confirm no regressions after deletion.

Phase 6: Supabase linked-lint discovery and additive migration fix

Capture live function definitions read-only, then land an additive, forward-only migration that re-emits the two functions to match the corrected local definitions. Discovery must not mutate the linked database.

Task 1: Read-only discovery of live definitions

Capture the authoritative production state before any change.

• Create docs/audits/SUPABASE_LINKED_LINT_FIX_PLAN_2026-07-03.md (runbook style with - [ ] steps and inline SQL) that records the read-only queries for pg_get_functiondef of can_manage_baseball_lift_group(uuid,uuid) and baseball_accept_staff_invite(text), plus the information_schema.columns listing for baseball_staff_invitations.
• Document the finding that local migrations are already correct (no baseball_strength_groups; uses v_invite.email), so the mismatch is a production-vs-migration drift, and record the guardrails: do NOT restore public.baseball_strength_groups, and do NOT add invitee_email without confirming writers/product intent.

Task 2: Author the additive migration fix

Re-align production with the corrected function bodies.

• After discovery confirms the drift, add a new forward-only migration under supabase/migrations/ that re-emits both functions via CREATE OR REPLACE using the current, correct bodies (matching 20260624000050 for can_manage_baseball_lift_group and 20260624000081 for baseball_accept_staff_invite).
• Keep it purely additive on existing objects (no new tables, no table drops), so migration-lockdown.yml (pre-baseline edit guard) does not apply.
• Include verification pgTAP/RLS notes consistent with the existing supabase CI job.

🤖 Prompt for AI agents

Implement Phase 6: perform read-only discovery of the live Supabase function
definitions, then author an additive, forward-only migration to re-align
production. Discovery must never mutate the linked database.

- Create `docs/audits/SUPABASE_LINKED_LINT_FIX_PLAN_2026-07-03.md` as a
runbook-style doc with `- [ ]` checklist steps and inline SQL, recording
read-only queries using `pg_get_functiondef` for
`can_manage_baseball_lift_group(uuid,uuid)` and
`baseball_accept_staff_invite(text)`, plus an `information_schema.columns`
listing for `baseball_staff_invitations`.
- Document the finding that local migrations are already correct (no
`baseball_strength_groups` table; code uses `v_invite.email`), establishing that
the mismatch is production-vs-migration drift.
- Record the guardrails explicitly: do NOT restore
`public.baseball_strength_groups`, and do NOT add an `invitee_email` column
without first confirming writers/product intent.
- Only after discovery confirms the drift, add a new forward-only migration file
under `supabase/migrations/` that re-emits both functions using `CREATE OR
REPLACE`, matching the current correct bodies from migrations `20260624000050`
(`can_manage_baseball_lift_group`) and `20260624000081`
(`baseball_accept_staff_invite`).
- Keep the migration purely additive on existing objects — no new tables, no
table drops — so the `migration-lockdown.yml` pre-baseline edit guard does not
apply.
- Include verification pgTAP/RLS notes consistent with the existing `supabase`
CI job.

Research

This is a Next.js + Supabase (Postgres/RLS) application ("golfhelm"/HelmV3) with a large migration history under supabase/migrations/, generated type output in src/lib/types/database.ts, a service worker at public/sw.js stamped by scripts/stamp-sw.mjs during prebuild, and a CI pipeline (.github/workflows/ci.yml) whose all job gates required checks. A minimal knip.json exists; knip is a devDependency but is never invoked from a script. Notably, exploration confirmed that most of the "already-prepared" tooling the ticket references (five 2026-07-03 audit docs, scripts/git/*, repomix.config.json, repomix docs/prompts, the repomix workflow, and the described knip tuning and package scripts) does not currently exist and must be created, while next-env.d.ts/public/sw.js drift, the three phantom dependencies, the six dead files, and the two Supabase function/production mismatches are all confirmed real.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement Phase 1: establish the corrected audit documentation baseline and a
behavior-neutral generated-file drift policy. This phase is documentation-first
plus one narrow tracking-policy change; do not touch app behavior.

- Create `docs/audits/REPO_FRESHNESS_BASELINE_2026-07-03.md` following the
`REPO_UNTANGLE_AND_CLEAN_BASE.md` template style (bold metadata header,
one-paragraph verdict, numbered H2 sections, verification-command appendix).
Explicitly record the audit correction that `npm run db:types:check` is NOT
read-only (it runs `db:types` first and can rewrite
`src/lib/types/database.ts`), while `npm run check:types-drift` is the actual
read-only drift check requiring `SUPABASE_ACCESS_TOKEN`.
- Create `docs/audits/CLEANUP_PR_SEQUENCE_2026-07-03.md` documenting the
small-PR sequence.
- Create `docs/audits/AGENT_HANDOFF_CLEANUP_KNIP_SUPABASE_2026-07-03.md` in an
emoji-scannable handoff style, including a "Settled — do not re-raise" callout
for owner guardrails.
- In these docs, record local Git-hygiene findings (fsck commit-graph parse
failure as local metadata, 24 stashes, 6 merged branches) as advisory only, and
state the explicit rule: branch deletions must use `git branch -d` (never `-D`),
and never run `git clean -Xdf`.
- Add `next-env.d.ts` to `.gitignore` (consistent with the existing "Repo
hygiene" ignore block) and stop tracking it (Next.js-managed file).
- For `public/sw.js`: keep it tracked, normalize its committed `CACHE_VERSION`
to a stable placeholder value, and adjust `scripts/stamp-sw.mjs`/`prebuild` so
stamping is treated as a deploy-time concern only; document that local builds
may show a transient diff that should not be committed.
- Document both the `next-env.d.ts` and `public/sw.js` policy decisions inside
the freshness baseline doc.
- Create an issue-ledger doc under `docs/audits/` with a table classifying each
open issue as: still valid / fixed-needs-evidence / duplicate-superseded /
blocked-by-DB-or-admin / backlog-product-decision. Include an explicit "no bulk
close, no auto-comment" guardrail note; leave rows unpopulated pending
human-reviewed triage — do not close or comment on issues in this task.
===============================================================================

Task: 2

Implement Phase 2: build the reproducible Repomix context-generation tooling and
safe, read-only Git-hygiene helper scripts. Only config, wrapper scripts,
prompts, docs, and package scripts should be committed — generated packs must
remain gitignored under `.repomix/`.

- Create `repomix.config.json` with output paths under `.repomix/` and
appropriate ignore patterns, plus a `.repomixignore` file.
- Create `scripts/context/repomix.sh` as the wrapper script that produces the
compressed pack, the changed-files pack, and the DB-context pack.
- Update `.gitignore` so `.repomix/` output is ignored while the config and
scripts themselves remain tracked.
- Create `docs/operations/REPOMIX_CONTEXT_PACKS.md`, mirroring the index style
of `docs/operations/context/MISSION_CONTROL_CONTEXT_INDEX.md` (table of packs,
primary readers, freshness note).
- Create prompt files: `docs/prompts/repomix/repo-cleanup.md`,
`docs/prompts/repomix/db-audit.md`, and
`docs/prompts/repomix/changed-files-review.md`.
- Create Git-hygiene helper scripts: `scripts/git/audit.sh`,
`scripts/git/clean-dry.sh` (dry-run only), and `scripts/git/stash-audit.sh`. All
must be strictly read-only/dry-run and never invoke destructive git operations;
they should report stashes, merged branches tracking gone upstreams, and ignored
artifact sizes advisory-only.
- Add npm scripts to `package.json`: `fresh:context`, `ctx:*`, `git:audit`,
`git:clean:dry`, `git:stash:audit` (and any additional arch helper scripts
referenced), all pointing at the new wrapper scripts.
- Add `.github/workflows/repomix-context.yml` to generate context packs on
demand/schedule as a non-gating workflow, following the structure of existing
workflows in `.github/workflows/`.
===============================================================================

Task: 3

Implement Phase 3: tune the `knip.json` configuration to eliminate known false
positives, expose knip via npm scripts, and document the resulting baseline.

- Update `knip.json` to: model CRM migration scripts as entrypoints so
`postgres` is no longer flagged as unused; ignore native Capacitor packages
referenced by `ios/App/CapApp-SPM/Package.swift`; ignore admin security/test
fixture files as intentional fixtures; and remove the redundant
`next.config.mjs` entry pattern.
- Add `knip`, `knip:files`, and `knip:deps` scripts to `package.json`.
- Create `docs/audits/KNIP_TRIAGE_2026-07-03.md` in a DB-table-audit triage
style documenting the expected 6 unused-file candidates and 5
unlisted-dependency findings.
- Explicitly note in that doc that the 695 unused-export findings are NOT to be
acted on in bulk.
- Document that `npm run knip` intentionally exits with status 1 at this
baseline, and do not add it as a hard CI gate in this phase.
===============================================================================

Task: 4

Implement Phase 4: promote three confirmed phantom (transitive-only)
dependencies to explicit direct dependencies in `package.json`.

- Add to the `dependencies` block, in alphabetical placement, using caret ranges
matching the already-resolved lockfile versions: `@radix-ui/react-compose-refs`
(used in `src/components/fairway/controls/tabs.tsx`), `fflate` (used in
`src/lib/baseball/adapters/xlsx-reader.ts`, `pdf-reader.ts`, and the
import-formats test), and `postcss-load-config` (type reference used in
`postcss.config.mjs`).
- Run `npm install` to update `package-lock.json` manifest linkage; note that
resolved versions should not change since all three packages are already present
transitively.
- Remove the misleading "already a dependency" comments in the fflate adapters
(`src/lib/baseball/adapters/pdf-reader.ts` and `xlsx-reader.ts`) if they
conflict with the now-explicit dependency declaration.
===============================================================================

Task: 5

Implement Phase 5: delete the six confirmed-dead files with no live
importers/routes/tests, keeping this deletion batch isolated from other changes.

- Delete the following files:
`src/components/baseball/dashboard/dashboard-types.ts`,
`src/components/baseball/recruiting-philosophy/MatchScoreBadge.tsx`,
`src/components/products/golf-mockups/index.tsx`, `src/lib/mapbox/client.ts`,
`src/lib/recruiting/match-calculator.ts`, and `src/lib/types/table.ts`.
- In the PR description, document the resolution-shadowing nuance for
`golf-mockups/index.tsx` (the sibling `index.ts` barrel wins over `index.tsx`)
and the transitive-dead chain (`match-calculator.ts` is only consumed by the
also-dead `MatchScoreBadge.tsx`).
- Verify no residual references remain anywhere in the codebase, including in
the filesystem-pattern test `scripts/__tests__/badge-consolidation.test.mjs`.
- Run `typecheck` and `test:run` to confirm no regressions after deletion.
===============================================================================

Task: 6

Implement Phase 6: perform read-only discovery of the live Supabase function
definitions, then author an additive, forward-only migration to re-align
production. Discovery must never mutate the linked database.

- Create `docs/audits/SUPABASE_LINKED_LINT_FIX_PLAN_2026-07-03.md` as a
runbook-style doc with `- [ ]` checklist steps and inline SQL, recording
read-only queries using `pg_get_functiondef` for
`can_manage_baseball_lift_group(uuid,uuid)` and
`baseball_accept_staff_invite(text)`, plus an `information_schema.columns`
listing for `baseball_staff_invitations`.
- Document the finding that local migrations are already correct (no
`baseball_strength_groups` table; code uses `v_invite.email`), establishing that
the mismatch is production-vs-migration drift.
- Record the guardrails explicitly: do NOT restore
`public.baseball_strength_groups`, and do NOT add an `invitee_email` column
without first confirming writers/product intent.
- Only after discovery confirms the drift, add a new forward-only migration file
under `supabase/migrations/` that re-emits both functions using `CREATE OR
REPLACE`, matching the current correct bodies from migrations `20260624000050`
(`can_manage_baseball_lift_group`) and `20260624000081`
(`baseball_accept_staff_invite`).
- Keep the migration purely additive on existing objects — no new tables, no
table drops — so the `migration-lockdown.yml` pre-baseline edit guard does not
apply.
- Include verification pgTAP/RLS notes consistent with the existing `supabase`
CI job.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[njrini99-code]

Review/fix status as of commit 130bd232 on PR #773.

Collected context from:

• Issue Repo cleanup consolidation: Repomix, Knip, generated drift, Supabase linked lint #772 body and CodeRabbit issue plan/prompts.
• PR chore(repo): package cleanup audit and context tooling #773 body, comments, Qodo review, Greptile review, CodeRabbit review, and inline prompts.

Applied in this follow-up commit:

• Added Repomix workflow concurrency so superseded PR runs cancel.
• Skipped Repomix context generation for forked PRs to avoid running PR-controlled scripts and uploading PR-controlled artifacts.
• Kept persist-credentials: false and env-based BASE_REF hardening already present from the prior fix.
• Made scripts/git/audit.sh detect the default branch/baseline instead of hard-coding main.
• Made scripts/git/stash-audit.sh idempotent by clearing stale stash-*-stat.txt files before regenerating.
• Removed floating Repomix $schema: latest from repomix.config.json while the wrapper pins repomix@1.16.0.
• Renamed misleading ctx:repo:npx to ctx:repo:no-top-files and documented all context-pack scripts, including budgeted packs.
• Clarified the Node 22 requirement is enforced by the Repomix wrapper, not by raising the app-wide engines.node floor.
• Corrected the baseline doc so it no longer records or encourages npm audit fix --dry-run.
• Reverted the pure public/sw.js cache stamp drift out of this PR.
• Ignored local .codebase-memory/ graph artifacts so the new MCP index is not accidentally committed.
• Renamed the PR title to Conventional Commit format.

Validation run locally:

• npm run typecheck
• npm run docs:check
• npm run ctx:docs
• npm run git:audit
• npm run git:stash:audit
• git diff --check
• JSON parse check for package.json and repomix.config.json
• bash -n for touched shell scripts

Notes/deferred:

• next-env.d.ts import removal remains because it fixes the clean-checkout TypeScript risk called out in review.
• Supabase live-function discovery/migration, unlisted dependency promotion, dead-file deletion, and dependency security PRs remain follow-up phases from Repo cleanup consolidation: Repomix, Knip, generated drift, Supabase linked lint #772, not part of this PR.