@se-studio/skills 1.5.7 → 1.5.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # @se-studio/skills
2
2
 
3
+ ## 1.5.8
4
+
5
+ ### Patch Changes
6
+
7
+ - Add `site-workflows-stale-files-cleanup` skill and `references/stale-files-cleanup/` (checklist, false positives, monorepo/single-app layouts, Brightline case study) for repository hygiene audits on SE Studio marketing sites.
8
+
3
9
  ## 1.5.7
4
10
 
5
11
  ### Patch Changes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@se-studio/skills",
3
- "version": "1.5.7",
3
+ "version": "1.5.8",
4
4
  "description": "SE Studio agent skills for marketing site development with Contentful CMS",
5
5
  "repository": {
6
6
  "type": "git",
@@ -0,0 +1,90 @@
1
+ # Case study — Brightline Sites stale-files cleanup (Jul 2026)
2
+
3
+ Reference implementation for `site-workflows-stale-files-cleanup`. Repo: `brightline-sites` on `develop`.
4
+
5
+ ---
6
+
7
+ ## User choices
8
+
9
+ | Decision | Choice |
10
+ |----------|--------|
11
+ | Doc disposition | Hard delete (git history as backup) |
12
+ | BLK Contentful migration | Complete — migration scripts safe to remove |
13
+ | Dependabot | Investigate only; fix when asked separately |
14
+
15
+ ---
16
+
17
+ ## Commits
18
+
19
+ | SHA | Summary | Scale |
20
+ |-----|---------|-------|
21
+ | `783a329` | Remove stale scripts, docs, migration tooling | ~58 files, ~57k lines |
22
+ | `558fc56` | Fix A/B test, cms-guidelines paths, `.env.example` | 11 files |
23
+ | `e09da45` | Remove orphan `xlsx` devDependency | 2 files; cleared 4 Dependabot alerts |
24
+
25
+ ---
26
+
27
+ ## Removed categories (783a329)
28
+
29
+ **Broken npm scripts** (missing targets):
30
+
31
+ - `docs:screenshots`, `docs:pdf` (Brightline)
32
+ - `setup:footer-nav`, `audit:site` (BLK)
33
+
34
+ **Orphan scripts:**
35
+
36
+ - `update-leadership-linkedin.mjs`, Vercel env ops scripts, media workbook builder, pilot batch scripts, `run-cms-screenshots-all.mjs` (both apps), unreferenced schema patch scripts
37
+
38
+ **BLK migration (confirmed complete):**
39
+
40
+ - `migrate-blk.ts`, `blk-master-schema.json`, `enable-locales-migration.js`
41
+
42
+ **Stale docs:**
43
+
44
+ - `REPO_ORIENTATION.md`, app `AGENTS.md`, "Moved" stubs, Mar 2026 audit reports, migration runbooks, schema audit snapshots, dated xlsx/json deliverables
45
+
46
+ **Infra:**
47
+
48
+ - Per-app `.husky/` + `husky` devDependencies
49
+
50
+ ---
51
+
52
+ ## Follow-up fixes (558fc56)
53
+
54
+ - `ab-test-page.test.ts` — assert against active `home-parents` test in `abTests.ts`, not removed Long Island test
55
+ - cms-guidelines: `example-brightline` → `brightline` filter + `apps/brightline-website` paths
56
+ - `.env.example`: `CTM_ENABLED`, `STICKY_PHONE_ENABLED` (BL); `PREVIEW_SECRET` (BLK)
57
+
58
+ ---
59
+
60
+ ## Dependency hygiene (e09da45)
61
+
62
+ - `xlsx@0.18.5` root devDep — zero imports after workbook script removal
63
+ - `pnpm why xlsx` confirmed orphan; removed from `package.json` + lockfile
64
+
65
+ ---
66
+
67
+ ## Reference updates required
68
+
69
+ Deleting without grep caught stragglers in:
70
+
71
+ - `ACTION-PLAN.md`, `VERCEL-ENV-INVENTORY.md` (deleted script names)
72
+ - `docs/media/CUSTOMER-REVIEW-BRIEF.md`, `BLK-PILOT-REVIEW-PACKET.md`
73
+ - `MKTG-4804-fbp-explanation.md` (superseded Formstack audit link)
74
+ - `AGENTS.md` (non-existent `deploy-cms-edit-host.sh`)
75
+
76
+ ---
77
+
78
+ ## Kept intentionally
79
+
80
+ See [`FALSE_POSITIVES.md`](./FALSE_POSITIVES.md) — cms-editor, editor-pack, env-inventory, Formstack playbooks, wired schema scripts, screaming-frog configs.
81
+
82
+ ---
83
+
84
+ ## Lessons for future runs
85
+
86
+ 1. **Plan mode + AskQuestion** before bulk doc deletes
87
+ 2. **Grep after each phase** — playbook and action-plan refs linger
88
+ 3. **Revert validate side-effects** — `validate:routes` regenerated `abTests.ts`
89
+ 4. **Doc drift** can remain after file deletes (BLK README "standalone app" wording)
90
+ 5. **Dependabot investigate** separate from cleanup unless user conflates them
@@ -0,0 +1,145 @@
1
+ # Stale files cleanup — discovery checklist
2
+
3
+ Run these checks in parallel at the start of every hygiene audit. Adapt paths for monorepo vs single-app (see `MONOREPO.md` / `SINGLE_APP.md`).
4
+
5
+ ---
6
+
7
+ ## 1. Broken npm scripts
8
+
9
+ For each `package.json` with a `scripts` section (root + `apps/*/` in monorepos):
10
+
11
+ 1. Extract script commands that invoke local files (`tsx scripts/…`, `node scripts/…`, `bash scripts/…`).
12
+ 2. Verify each target file exists on disk.
13
+ 3. Flag scripts pointing at missing files — **High** risk.
14
+
15
+ ```bash
16
+ # Quick scan: list script files referenced from package.json
17
+ rg '"(tsx|node|bash) scripts/' package.json apps/*/package.json
18
+ ```
19
+
20
+ ---
21
+
22
+ ## 2. Orphan scripts
23
+
24
+ List runnable files under:
25
+
26
+ - `scripts/` (repo root)
27
+ - `apps/*/scripts/`
28
+ - `docs/*/scripts/`
29
+
30
+ For each file not referenced in any `package.json` script:
31
+
32
+ ```bash
33
+ rg -l '<basename>' --glob '!node_modules' --glob '!.next'
34
+ ```
35
+
36
+ Zero inbound refs → candidate for removal (**Low**), unless cited as an active re-run playbook in docs.
37
+
38
+ ---
39
+
40
+ ## 3. Stale documentation
41
+
42
+ Search for:
43
+
44
+ | Pattern | Typical meaning |
45
+ |---------|-----------------|
46
+ | `REPO_ORIENTATION`, `implementation-checklist-*` | Pre-monorepo or historical checklists |
47
+ | `# Moved`, `Moved to monorepo` | Stub redirects — safe to delete if canonical doc exists |
48
+ | `*-REPORT.md`, `*-audit.md` (dated) | Point-in-time reports |
49
+ | `example-brightline`, `apps/example-*` | Legacy template paths — update, not always delete |
50
+ | `deploy-cms-edit-host.sh` | Often referenced in AGENTS.md but file never existed |
51
+
52
+ ```bash
53
+ rg -l 'example-brightline|apps/example-|REPO_ORIENTATION|# Moved' docs apps
54
+ ```
55
+
56
+ ---
57
+
58
+ ## 4. Audit artifacts and deliverables
59
+
60
+ | Pattern | Notes |
61
+ |---------|-------|
62
+ | `docs/media-review-*.xlsx`, `media-review-*.json` | Regenerable via media-review playbooks |
63
+ | `docs/schema/audit/` | Point-in-time schema audit outputs |
64
+ | `docs/archive/` | Superseded snapshots — ask disposition |
65
+ | `*.xlsx` under `docs/` | Source spreadsheets when templates exist elsewhere |
66
+
67
+ Cross-check `.gitignore`: gitignored generated reports under `docs/seo/*-screaming-frog-*` are **local only** — do not treat as tracked stale files.
68
+
69
+ ```bash
70
+ git ls-files 'docs/**/*.xlsx' 'docs/**/*-audit*' 'docs/archive/'
71
+ ```
72
+
73
+ ---
74
+
75
+ ## 5. Duplicate infrastructure (monorepo)
76
+
77
+ ```bash
78
+ ls -la .husky/pre-commit apps/*/.husky/pre-commit 2>/dev/null
79
+ rg '"husky"' package.json apps/*/package.json
80
+ ```
81
+
82
+ Flag when root hook runs typecheck but app hooks only run `lint-staged`.
83
+
84
+ ---
85
+
86
+ ## 6. Orphan npm dependencies
87
+
88
+ Root and app `devDependencies` with no imports:
89
+
90
+ ```bash
91
+ # For each suspicious package name from package.json:
92
+ pnpm why <package>
93
+ rg "from '<package>'|require\\('<package>'\\)|import.*'<package>'" . \
94
+ --glob '!node_modules' --glob '!pnpm-lock.yaml'
95
+ ```
96
+
97
+ Common orphans after script removal: `xlsx`, one-off CLI helpers.
98
+
99
+ ---
100
+
101
+ ## 7. Env template drift
102
+
103
+ Compare README tables and `docs/VERCEL-ENV-VARS.md` against `.env.example` (root or per-app):
104
+
105
+ ```bash
106
+ rg '^\| `[A-Z_]+`' apps/*/README.md docs/VERCEL-ENV-VARS.md
107
+ rg '^[A-Z_]+=' apps/*/.env.example .env.example 2>/dev/null
108
+ ```
109
+
110
+ Flag vars documented for humans but missing from `.env.example`.
111
+
112
+ ---
113
+
114
+ ## 8. Fragile tests tied to generated CMS state
115
+
116
+ After cleanup touching A/B tests or generated files:
117
+
118
+ - `src/generated/abTests.ts` — regenerated on `prebuild` / `generate:ab-tests`
119
+ - Tests importing `generatedTestsByPath` must assert against **current** CMS entries, not removed page tests
120
+
121
+ ```bash
122
+ pnpm --filter <app> test
123
+ ```
124
+
125
+ Revert unrelated codegen diffs before commit (`git diff src/generated/`).
126
+
127
+ ---
128
+
129
+ ## 9. Untracked files
130
+
131
+ ```bash
132
+ git status --short
133
+ ```
134
+
135
+ Orphan untracked audits (e.g. `docs/*-setup-audit.md`) — ask commit vs delete.
136
+
137
+ ---
138
+
139
+ ## Output format
140
+
141
+ Present findings as a table:
142
+
143
+ | Path | Why stale | Evidence | Risk | Proposed action |
144
+
145
+ Then proceed to user confirmation before any `git rm`.
@@ -0,0 +1,88 @@
1
+ # Stale files cleanup — false positives (do not delete)
2
+
3
+ Agents routinely mistake these for clutter. **Keep** unless the user explicitly requests removal.
4
+
5
+ ---
6
+
7
+ ## CMS editor and hosted MCP
8
+
9
+ | Path | Why keep |
10
+ |------|----------|
11
+ | `docs/cms-editor/**` | Source playbooks for `cms-edit editor-pack generate` |
12
+ | `cms-edit/<site>/editor-pack/**` | Committed MCP resources deployed via git push |
13
+ | `cms-edit/host/` staging (gitignored `.env.*`) | Local cms-edit host dev |
14
+
15
+ Overlap between `docs/cms-editor` and `editor-pack` is pipeline duplication, not accidental redundancy.
16
+
17
+ ---
18
+
19
+ ## Active operations documentation
20
+
21
+ | Path | Why keep |
22
+ |------|----------|
23
+ | `docs/STATUS.md`, `docs/ACTION-PLAN.md` | Live workload docs (customer monorepos) |
24
+ | `docs/env-inventory/`, `docs/VERCEL-ENV-*.md` | Env documentation pipeline |
25
+ | `docs/PAGE_VARIANTS_AND_TESTS.md` | A/B test runbooks |
26
+ | `docs/media/*.md` (briefs, not dated xlsx) | Active media-review workflow |
27
+
28
+ ---
29
+
30
+ ## Schema and SEO tooling (wired)
31
+
32
+ | Path | Why keep |
33
+ |------|----------|
34
+ | `docs/schema/templates/` | Mustache templates for schema.org |
35
+ | `docs/schema/page-inventory.json`, `PAGE-INVENTORY.md` | Referenced by schema recommendations |
36
+ | `docs/schema/scripts/validate-json-ld.mjs` | Wired in root `schema:validate` |
37
+ | `docs/schema/scripts/audit-localhost-schema.mjs` | Wired in `schema:audit:localhost*` |
38
+ | `apps/*/seo/screaming-frog.json` | Crawl manifest config (not generated crawl reports) |
39
+
40
+ ---
41
+
42
+ ## Re-run playbooks and audit baselines
43
+
44
+ | Path | Why keep |
45
+ |------|----------|
46
+ | `apps/*/scripts/formstack-spike.ts` (+ paired embed `.js`) | Cited by Formstack audit docs for re-runs |
47
+ | `packages/*/docs/*-audit.md` (current, not superseded) | Active audit baselines |
48
+ | `docs/alt-drafts/*.json` | Active pilot content batches |
49
+
50
+ ---
51
+
52
+ ## Agent skills and references
53
+
54
+ | Path | Why keep |
55
+ |------|----------|
56
+ | `.agents/skills/`, `.cursor/skills/` (symlinks) | Synced from `@se-studio/skills` / `skills-npm` |
57
+ | `.agents/references/` | Support docs for skills |
58
+ | Customer-specific skills (e.g. `brightline-status-refresh`) | Site-local workflows |
59
+
60
+ ---
61
+
62
+ ## CI and deployment config
63
+
64
+ | Path | Why keep |
65
+ |------|----------|
66
+ | `.github/workflows/*.yml` | Active CI (validate, deployment-smoke) |
67
+ | `apps/*/scripts/vercel-deployment-smoke-check.json` | Vercel Deployment Checks registration |
68
+ | Root `cms-edit:deploy:*` scripts | Emergency manual deploy (discouraged but intentional) |
69
+
70
+ ---
71
+
72
+ ## Generated outputs (regenerate, do not delete source)
73
+
74
+ | Path | Notes |
75
+ |------|-------|
76
+ | `src/generated/abTests.ts` | CMS-generated — update tests, do not hand-delete |
77
+ | `src/generated/cms-discovery/` | Regenerated by codegen scripts |
78
+ | `docs/cms-guidelines/COMPONENT_GUIDELINES_FOR_LLM.md` | Merged output — regenerate via merge script |
79
+
80
+ ---
81
+
82
+ ## Package names vs folder names
83
+
84
+ | Pattern | Notes |
85
+ |---------|-------|
86
+ | `example-brightlifekids` filter name | May differ from `apps/brightlife-kids-website/` — intentional for `pnpm --filter`; update **docs**, do not rename package without user request |
87
+
88
+ When in doubt, grep for inbound references before proposing deletion.
@@ -0,0 +1,85 @@
1
+ # Stale files cleanup — monorepo layout
2
+
3
+ For repos like `brightline-sites` with multiple apps under `apps/` and shared `packages/`.
4
+
5
+ ---
6
+
7
+ ## Detection
8
+
9
+ | Signal | Monorepo |
10
+ |--------|----------|
11
+ | Root `pnpm-workspace.yaml` | Yes |
12
+ | `apps/*/` with separate `package.json` | Yes |
13
+ | Root `AGENTS.md` + optional per-app docs | Common |
14
+
15
+ ---
16
+
17
+ ## package.json scripts
18
+
19
+ Audit **both**:
20
+
21
+ - Root `package.json` — monorepo-wide (`validate`, `cms-edit:*`, `schema:*`)
22
+ - Each `apps/<site>/package.json` — app dev/build/test scripts
23
+
24
+ Broken script entries in **either** file fail when invoked from that package context.
25
+
26
+ ---
27
+
28
+ ## Husky duplication
29
+
30
+ Canonical pattern (Brightline):
31
+
32
+ - **Root** `.husky/pre-commit` → `lint-staged` + `scripts/pre-commit-typecheck.sh`
33
+ - **App** `.husky/pre-commit` → only `lint-staged` (legacy)
34
+
35
+ Cleanup: remove `apps/*/.husky/` and `husky` from app `devDependencies` when root `prepare` owns hooks.
36
+
37
+ ---
38
+
39
+ ## AGENTS.md
40
+
41
+ | File | Role |
42
+ |------|------|
43
+ | Root `AGENTS.md` | Canonical agent rules |
44
+ | `apps/*/AGENTS.md` | Often generic template leftovers — candidate for deletion if root doc exists |
45
+
46
+ ---
47
+
48
+ ## Filter names vs directory names
49
+
50
+ | Folder | Package name (filter) |
51
+ |--------|----------------------|
52
+ | `apps/brightline-website` | `brightline` |
53
+ | `apps/brightlife-kids-website` | `example-brightlifekids` |
54
+
55
+ Docs may still say `example-brightline` or `apps/example-brightline` — update paths to real folder names and correct `pnpm --filter` names.
56
+
57
+ ---
58
+
59
+ ## Shared packages
60
+
61
+ `packages/<shared>/` — do not delete shared docs/scripts referenced by both apps. Audit imports from apps before removing shared tooling.
62
+
63
+ ---
64
+
65
+ ## cms-edit multi-site
66
+
67
+ | Path | Site |
68
+ |------|------|
69
+ | `cms-edit/brightline/project.json` | Brightline |
70
+ | `cms-edit/brightlifekids/project.json` | BrightLife Kids |
71
+ | `docs/cms-editor/<site>/` | Playbook source per site |
72
+
73
+ Never delete one site's editor-pack thinking the other is redundant.
74
+
75
+ ---
76
+
77
+ ## Validate command
78
+
79
+ Typically root:
80
+
81
+ ```bash
82
+ pnpm validate
83
+ ```
84
+
85
+ Runs `pnpm -r validate` across workspace packages. Pre-commit typecheck may only touch affected apps when paths are staged.
@@ -0,0 +1,66 @@
1
+ # Stale files cleanup — single-app layout
2
+
3
+ For standalone SE Studio customer sites (one Next.js app at repo root or under a single `apps/` entry).
4
+
5
+ ---
6
+
7
+ ## Detection
8
+
9
+ | Signal | Single-app |
10
+ |--------|------------|
11
+ | One primary `package.json` for the site | Yes |
12
+ | No `apps/` sibling sites | Typical |
13
+ | `cms-edit/project.json` at `cms-edit/` (not `cms-edit/<site>/`) | Common |
14
+
15
+ ---
16
+
17
+ ## Script locations
18
+
19
+ | Location | Scope |
20
+ |----------|-------|
21
+ | `scripts/` | App tooling |
22
+ | `docs/schema/scripts/` | Schema validation (if present) |
23
+
24
+ Same orphan/broken-script rules as monorepos — only one `package.json` to audit.
25
+
26
+ ---
27
+
28
+ ## Husky
29
+
30
+ Single `.husky/pre-commit` at repo root. No app-level duplicate to remove.
31
+
32
+ ---
33
+
34
+ ## Documentation paths
35
+
36
+ | Path | Notes |
37
+ |------|-------|
38
+ | `docs/cms-guidelines/` | Per-component guidelines |
39
+ | `docs/cms-editor/` | Editor playbooks (if hosted MCP enabled) |
40
+ | `REPO_ORIENTATION.md` | Sometimes accurate — verify against current layout before deleting |
41
+
42
+ Legacy `example-*` naming is less common in mature single-app repos but may persist in cms-guidelines from template copy.
43
+
44
+ ---
45
+
46
+ ## cms-edit
47
+
48
+ | Path | Role |
49
+ |------|------|
50
+ | `cms-edit/project.json` | Project config |
51
+ | `cms-edit/editor-pack/` | Generated MCP pack |
52
+ | `docs/cms-editor/` | Playbook source |
53
+
54
+ See [`FALSE_POSITIVES.md`](./FALSE_POSITIVES.md).
55
+
56
+ ---
57
+
58
+ ## Validate
59
+
60
+ Usually from repo root:
61
+
62
+ ```bash
63
+ pnpm validate
64
+ ```
65
+
66
+ Or `pnpm check && pnpm type-check` per project `package.json`.
@@ -0,0 +1,165 @@
1
+ ---
2
+ name: site-workflows-stale-files-cleanup
3
+ description: "Audit and remove stale scripts, broken package.json entries, orphan docs, and duplicate tooling on SE Studio marketing sites. Supports single-app and monorepo layouts. Use for repo cleanup, stale files audit, hygiene audit, or pruning dead code. Always ask before deleting historical docs or deliverables."
4
+ ---
5
+
6
+ # Stale files cleanup (repository hygiene)
7
+
8
+ Remove **dead weight** from an SE Studio site repo without changing product behavior. This is **not** [`site-workflows-project-cleanup`](../site-workflows-project-cleanup/SKILL.md) (which strips a site to a bare template).
9
+
10
+ **References:**
11
+
12
+ | File | Purpose |
13
+ |------|---------|
14
+ | [`CHECKLIST.md`](../../references/stale-files-cleanup/CHECKLIST.md) | Discovery commands and grep patterns |
15
+ | [`FALSE_POSITIVES.md`](../../references/stale-files-cleanup/FALSE_POSITIVES.md) | Paths agents must not delete |
16
+ | [`MONOREPO.md`](../../references/stale-files-cleanup/MONOREPO.md) | Multi-app layout rules |
17
+ | [`SINGLE_APP.md`](../../references/stale-files-cleanup/SINGLE_APP.md) | Single-app layout rules |
18
+ | [`BRIGHTLINE_RUNBOOK.md`](../../references/stale-files-cleanup/BRIGHTLINE_RUNBOOK.md) | Case study (Jul 2026) |
19
+
20
+ **Default:** Plan mode first — present a classified audit table before deleting anything.
21
+
22
+ **Never:** push to `main`/`master`; delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
23
+
24
+ ---
25
+
26
+ ## When to use
27
+
28
+ | Situation | Action |
29
+ |-----------|--------|
30
+ | User asks for repo cleanup, stale files, orphan scripts, dead docs | Run full workflow |
31
+ | Broken `pnpm` scripts fail with missing file paths | Phase 1 only (broken tooling) |
32
+ | Post-migration or post-monorepo consolidation | Phases 2–4 with migration confirmation |
33
+ | Dependabot noise | Optional investigate phase only |
34
+
35
+ ## When not to use
36
+
37
+ - Stripping a customer site to a reusable template → **`site-workflows-project-cleanup`**
38
+ - CMS content edits → **`contentful-cms-*`** skills
39
+ - Dependency version bumps → **`site-workflows-deps-update`**
40
+
41
+ ---
42
+
43
+ ## Step 1 — Preflight
44
+
45
+ 1. Read repo `AGENTS.md`, root `README.md`, and `.gitignore`.
46
+ 2. Detect layout — see [`MONOREPO.md`](../../references/stale-files-cleanup/MONOREPO.md) vs [`SINGLE_APP.md`](../../references/stale-files-cleanup/SINGLE_APP.md).
47
+ 3. Confirm integration branch (`develop` for customer sites, `dev` for se-core-product). Working tree clean or user approves.
48
+ 4. Run parallel discovery per [`CHECKLIST.md`](../../references/stale-files-cleanup/CHECKLIST.md).
49
+
50
+ ---
51
+
52
+ ## Step 2 — Classify findings
53
+
54
+ Group every candidate into a table for the user:
55
+
56
+ | Risk | Examples | Default action |
57
+ |------|----------|----------------|
58
+ | **High** | `package.json` script → missing file; doc links to non-existent path | Fix script entry or restore file; fix doc |
59
+ | **Medium** | Completed migration scripts; dated audit deliverables; duplicate Husky | Delete after user confirms |
60
+ | **Low** | Orphan scripts with zero refs; stub "Moved" docs; legacy path names in docs | Delete or update refs |
61
+
62
+ Cross-check [`FALSE_POSITIVES.md`](../../references/stale-files-cleanup/FALSE_POSITIVES.md) before listing any path as deletable.
63
+
64
+ ---
65
+
66
+ ## Step 3 — Confirm with user
67
+
68
+ Use `AskQuestion` (or equivalent) before bulk deletes:
69
+
70
+ 1. **Historical docs and deliverables** — archive vs hard delete vs keep (default: **ask**; do not assume).
71
+ 2. **Migration / one-off ops scripts** — only remove when user confirms work is complete (e.g. Contentful locale migration, Vercel env rotation runbooks marked done).
72
+ 3. **Dependabot** — offer investigation summary; do not bump packages unless user explicitly asks.
73
+
74
+ ---
75
+
76
+ ## Step 4 — Execute (ordered phases)
77
+
78
+ ### Phase 1 — Broken tooling
79
+
80
+ - Remove or fix `package.json` script entries whose target files do not exist (root + `apps/*/package.json` in monorepos).
81
+ - Highest signal — these fail when invoked.
82
+
83
+ ### Phase 2 — Orphan scripts
84
+
85
+ - Delete scripts under `scripts/`, `apps/*/scripts/`, `docs/*/scripts/` with no `package.json` wiring and no inbound references.
86
+ - Keep scripts cited as re-run playbooks in active docs (e.g. Formstack audit spikes).
87
+
88
+ ### Phase 3 — Completed one-offs
89
+
90
+ - Migration tooling (`migrate-*.ts`, `enable-*-migration.js`, schema dumps) after user confirms migration done.
91
+ - Ops runbooks marked complete in `ACTION-PLAN.md` / env inventory docs.
92
+
93
+ ### Phase 4 — Stale docs and artifacts
94
+
95
+ - Pre-monorepo orientation docs, "Moved" stubs, one-off session reports, dated `.xlsx`/`.json` audit outputs.
96
+ - Untracked orphan audits at repo root — delete or commit per user choice.
97
+
98
+ ### Phase 5 — Duplicate infrastructure (monorepo)
99
+
100
+ - Per-app `.husky/` when root `.husky/pre-commit` runs `lint-staged` + typecheck.
101
+ - Remove `husky` from app `devDependencies` when root `prepare` owns hooks.
102
+
103
+ ### Phase 6 — Doc drift and env templates
104
+
105
+ - Legacy package/filter names (`example-brightline` → `apps/<app>/` paths and real filter name).
106
+ - Broken references in `AGENTS.md`, README, playbooks, `ACTION-PLAN.md`.
107
+ - Vars documented in README / `VERCEL-ENV-VARS.md` but missing from `.env.example`.
108
+
109
+ ### Phase 7 — Orphan npm dependencies (optional)
110
+
111
+ ```bash
112
+ pnpm why <package>
113
+ rg "from '<pkg>'|require\\('<pkg>'\\)" .
114
+ ```
115
+
116
+ Remove root or app devDependencies with zero imports (e.g. leftover `xlsx` after workbook script removal).
117
+
118
+ ---
119
+
120
+ ## Step 5 — Reference repair
121
+
122
+ After each deletion phase, grep for deleted basenames:
123
+
124
+ ```bash
125
+ rg '<basename-or-path>' --glob '!node_modules' --glob '!.next'
126
+ ```
127
+
128
+ Update inbound links in README, `AGENTS.md`, media briefs, editor playbooks, and superseded-doc cross-references.
129
+
130
+ ---
131
+
132
+ ## Step 6 — Optional Dependabot investigate
133
+
134
+ When the repo is on GitHub and `gh` is available:
135
+
136
+ ```bash
137
+ gh api repos/<org>/<repo>/dependabot/alerts --jq \
138
+ '.[] | select(.state=="open") | {number, package: .security_vulnerability.package.name, severity: .security_advisory.severity, manifest: .dependency.manifest_path, summary: .security_advisory.summary}'
139
+ ```
140
+
141
+ For each alert: `pnpm why <package>` — classify as direct vs transitive, runtime vs dev-only. Summarize fix paths; **do not** bump unless user asks.
142
+
143
+ ---
144
+
145
+ ## Step 7 — Validate and commit
146
+
147
+ ```bash
148
+ pnpm validate # or repo-specific validate from AGENTS.md
149
+ ```
150
+
151
+ - Revert unrelated diffs from validate side-effects (e.g. regenerated `abTests.ts`, biome trailing-newline fixes) before commit.
152
+ - Pre-existing test failures: call out explicitly; do not blame cleanup.
153
+
154
+ Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
155
+
156
+ Hand off production promotion to the human — never push `main`.
157
+
158
+ ---
159
+
160
+ ## Success criteria
161
+
162
+ - Classified audit presented before deletes
163
+ - No false-positive paths from [`FALSE_POSITIVES.md`](../../references/stale-files-cleanup/FALSE_POSITIVES.md) removed
164
+ - `rg` pass clean for deleted paths (or intentional stubs updated)
165
+ - `pnpm validate` passes or pre-existing failures documented