# Platform โ€” Systematic Audit (cross-workspace) Date: 2026-05-04 Tooling-backed audit (with `GITEA_NPM_TOKEN` available): full `pnpm install`, typecheck, test, and lint run successfully across all 69 workspace packages (`packages/`, `services/`, `dashboards/`). Legend: ๐Ÿ”ด critical ยท ๐ŸŸ  high ยท ๐ŸŸก medium ยท ๐ŸŸข low ยท โฌœ open ยท ๐ŸŸฆ in PR ยท โœ… fixed (commit hash on the right). --- ## 0. Health snapshot | Check | Result | Notes | | ----------------- | ------- | ----------------------------------------------------------------------------------------------- | | `pnpm install -r` | โœ… pass | No warnings when `GITEA_NPM_TOKEN` is exported after sourcing `~/.zshrc`. | | `pnpm typecheck` | โœ… pass | All TS sources compile (`tsc --noEmit`). | | `pnpm test` | โœ… pass | ~2,200 tests across 18+ test suites; one cowork-service `EPIPE` flake cleared on focused rerun. | | `pnpm lint` | โœ… pass | Workspace lint exits 0 with 0 errors / 157 warnings after `1089597`. See section W. | ## A. Lint pipeline blockers (fixed by this audit) | # | Issue | Severity | Status | Fix | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------: | :----: | ----------- | | A1 | `packages/design-tokens/scripts/validate-tokens.cjs` โ€” 45 `no-undef` errors for `process` / `console`. Root eslint config didn't declare a Node-script env, and inline `/* eslint-env node */` is ignored by flat-config. | ๐ŸŸ  | โœ… | this commit | | A2 | `packages/design-tokens/scripts/token-coverage.cjs` โ€” same root cause: 1 unused `e` in catch. | ๐ŸŸข | โœ… | this commit | | A3 | `packages/ui/eslint.config.js` was a _complete override_ (flat config doesn't merge with the root). It declared no parser, so 38 parsing errors fired on `interface`, `import {โ€ฆ}`, and other TS syntax in `src/index.ts` and `src/components/*`. | ๐ŸŸ  | โœ… | this commit | | A4 | `packages/ui` lint also re-included `dist/**/*.d.ts` because the root's `ignores: ['dist/**']` isn't inherited by the package-local override. | ๐ŸŸก | โœ… | this commit | | A5 | `packages/ui/.storybook/preview.ts` not covered by any TS-parser block. | ๐ŸŸก | โœ… | this commit | | A6 | `packages/feedback-client/src/index.ts` โ€” 2 `no-undef` for browser globals `XMLHttpRequest` / `ProgressEvent` (not in root globals list). | ๐ŸŸข | โœ… | this commit | | A7 | `packages/feedback-client/src/index.ts` โ€” `preserve-caught-error` violation in `captureScreen()` (re-throwing without `cause`). | ๐ŸŸก | โœ… | this commit | | A8 | `packages/feedback-client/src/index.ts` โ€” `captureElement()` declares unused params `mimeType`, `quality`. Renamed with `_` prefix and documented why. | ๐ŸŸข | โœ… | this commit | | A9 | `packages/logger/src/__tests__/logger.test.ts` โ€” unused type import `LoggerConfig`. | ๐ŸŸข | โœ… | this commit | | A10 | `services/extraction-service/src/lib/circuit-breaker.test.ts` โ€” unused vitest import `afterEach`. | ๐ŸŸข | โœ… | this commit | | A11 | `services/extraction-service/src/modules/extract/sidecar-monitor.test.ts` โ€” unused type import `HealthCheck`. | ๐ŸŸข | โœ… | this commit | | A12 | `services/extraction-service/src/modules/extract/usage.test.ts` โ€” unused vitest import `beforeEach`. | ๐ŸŸข | โœ… | this commit | | A13 | `dashboards/tracker-web/src/__tests__/tracker-proxy.test.ts` โ€” unused local `url` (renamed to `_url`). | ๐ŸŸข | โœ… | this commit | These all matter because `pnpm -r exec eslint` bails on the first package failure, so the 45-error design-tokens issue was hiding everything below it. Now the pipeline runs to completion and the current workspace has **0 lint errors**. ## P. Pre-existing lint debt cleared Current workspace-wide lint reports no errors: ``` 0 errors ``` The stale handoff note expected 85 pre-existing errors, but a live rerun on 2026-05-04 found none. No P-sweep package commits were needed in this session. ## W. Pre-existing lint warnings Remaining lint output is warnings only. The largest groups are still `no-console` in CLI tools, code generators, and diagnostic/runtime review areas (`create-app`, `keyvault`, `sidecar-monitor`, platform `gen-module`, `migrate-referrals`, push notifications, and diagnostics modules). These are case-by-case judgment calls and not blocking. Follow-up package sweeps on 2026-05-04: - `db4257f` cleared admin feedback page React warnings. - `021f053` typed predictive campaign event dispatch. - `04d2398` cleared tracker-web roadmap console warnings and removed the stale CommonJS ESLint config in favor of the existing `eslint.config.mjs`. - `5fb4921` documented the two intentional `@bytelyst/broadcast-client` deep-link diagnostics with narrow lint justifications. - `1089597` cleared the remaining admin-web React hook/image/unused-symbol warnings. Post-admin sweep verification reran admin-web lint/typecheck/test/build and workspace lint; all pass. Workspace lint remains at **0 errors** with **157 warnings**. ## R. Repo-state observations (not fixed) | # | Observation | Severity | Status | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------: | :----------------: | | R1 | Working tree had 3 uncommitted edits when the audit started: `docker-compose.ecosystem.yml` (removes `nomgap-web` from Docker), `products/nomgap/product.json` (replaces flag set + adds containers), `services/platform-service/src/modules/flags/seed.ts` (+14 lines of flags). These look like an in-progress nomgap-on-Vercel migration. **Not touched** โ€” out of audit scope and missing context. | โ€” | โฌœ | | R2 | Local `main` was 17 commits behind `origin/main` at the start of the session. Backup branch `backup/main-20260504-062733` was taken from `origin/main` (the source of truth) โ€” local stale main was _not_ backed up. | ๐ŸŸข | โœ… (backup exists) | | R3 | `.npmrc` references `${GITEA_NPM_TOKEN}`. On this machine `~/.zshrc` defines the token but does not export it, so use `source ~/.zshrc && export GITEA_NPM_TOKEN` before `pnpm`; this silences the WARN. | ๐ŸŸข | โœ… documented | | R4 | Earlier `pnpm install -r` reported peer warnings for `@azure/core-client@^1.10.0`. A live rerun with the token exported reported no peer warnings. | ๐ŸŸข | โœ… verified | --- ## Ordering of fixes 1. **Section A** (this commit) โ€” structural unblocks so `pnpm lint` runs end-to-end again. 2. **Section P** โ€” no current lint errors; no package sweeps needed. 3. **Section W** โ€” case-by-case warning review (defer; warnings only). 4. **Section R** โ€” housekeeping verified/documented.