chore(quality): real lint coverage, vitest + knip gates, dead-file removal

[PastaPastaPasta]

First PR of the anti-slop cleanup series. This one makes the quality gates real and removes what is provably dead, so the later consolidation PRs land on a tree where lint, typecheck, unit tests and dead-code detection all mean something.

The gate that wasn't

npm run lint was a bare next lint, which only walks pages/ app/ components/ lib/ src/. hooks/ (5.9k LOC) and contexts/ were never linted, locally or in CI. Running ESLint over them surfaced two real errors (no-var-requires in a dead hook) and ~40 warnings. Every rule was also warn, so 115 warnings had accumulated with a green CI.

• lint now names every source directory and runs with --max-warnings 0.
• The previously-warn rules are error. The tree is at zero, so this only bites regressions.
• @next/next/no-img-element is off: under output: 'export' images are unoptimized, next/image adds nothing, and 13 sites already disabled it inline (those inline disables are removed).
• The two remaining no-explicit-any disables are gone: pagination-utils gets a minimal structural SDK interface, the DiceBear style map uses Style<object>.

New gates

Gate	Command	CI job
Unit tests (Vitest)	npm run test	unit
Dead code (knip)	npm run lint:dead	dead-code

Vitest starts with 48 specs over the pure lib/ modules: WIF/hex codecs, AES-GCM round-trip and tamper detection, hash160 known vectors, bloom filter (no false negatives, FP rate at design load, serialization), compression/chunking, slugs, tag and mention extraction. These are the modules the primitive-consolidation PRs will touch next.

knip enforces unused files, unused dependencies and unlisted dependencies now. Unused exports (69) and types (96) are reported but not yet enforced; that backlog is worked down in the following PRs, after which the job goes strict.

Dependencies

@dashevo/wasm-sdk (11 files), @storacha/access and @ucanto/principal were imported directly but only present transitively; they are listed explicitly (wasm-sdk pinned to the same 4.2.0-dev.8 as evo-sdk, one lockfile entry). @radix-ui/react-slider had no importers and is removed.

Dead code removed

Ten files with zero importers: types/sdk.ts, hooks/use-require-encryption-key.ts, hooks/use-platform-detection.ts, components/compose/upload-progress.tsx, components/layout/mobile-header.tsx, components/post/feed-reply-context.tsx, lib/utils/contact-methods.ts, serve.py (superseded by scripts/serve-static.mjs), assets/yappr.png (byte-identical to public/yappr.png), and lib/dash-platform-client.ts.

DashPlatformClient duplicated postService.getTimeline behind an any-typed cache and a third copy of the SDK response normalizer. Its two callers (For You feed, explore search) now call postService.getTimeline, which returns transformed Post objects, so the feed no longer re-transforms documents it already has. The platform-auth clientIdentity port existed only to feed this client and is dropped. Note the per-page 2-minute cache inside the old client is gone; use-feed-data still caches the first page via cacheManager, so this only affects re-scrolling already-seen pages.

The app store carried a currentUser slot seeded from mock data that nothing read; it and the mock user are gone, leaving lib/mock-data.ts as the default-avatar helper it actually is (CLAUDE.md updated to say so).

Lint fixes

Behavior-preserving except where noted:

• Floating promises in hooks/contexts get .catch handlers that log. The enrichment completion tracker uses allSettled.
• Non-null assertions replaced with narrowing. In private-post-content.tsx the three private fields are destructured once per callback; attemptRecovery gains the guard attemptDecryption already had.
• exhaustive-deps: use-blog-follow's toggle now depends on followerCount, which fixes a stale rollback value. fetchReplyChain in use-post-detail is memoized (its only dep, enrich, is stable). The validation hooks depend on the memoized array instead of .join(',').
• any casts: profile maps are typed as UnifiedProfileDocument, dropping 39 dead (profile as any)?.data || profile fallbacks (getProfilesByIdentityIds already returns flat documents). Notification queries go through the typed queryDocuments helper instead of sdk.documents.query(... as any).

Config leftovers

tsconfig target: es5 → es2020. Malformed last .gitignore line (.gitignore worktrees) → worktrees/. Stale ./pages/** tailwind glob and images.unsplash.com domain removed. README no longer names a nonexistent build:gh-pages script or files that do not exist.

Overlap

#369 also touches lib/feed/load-for-you-feed.ts and hooks/use-feed-data.ts. Whichever lands second will need a small rebase; the conflict is confined to the loadForYouFeed call site and the removed forceRefresh option.

Validation

npm run lint (0 warnings), npx tsc --noEmit, npm run test (48/48), npx knip --include files,dependencies,unlisted, npm run build all clean locally.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 77406f55-d298-49d6-a82e-cb7f0ac1f370

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Ready for review — 28 ahead in queue (commit 59554f1)
Queue position: 29/29 · 2 reviews active
ETA: start ~07:43 UTC · complete ~08:45 UTC (median 1h 2m across 30 recent reviews; 2 slots)
Queued 6m ago · Last checked: 2026-09-07 17:10 UTC

[cloudflare-workers-and-pages]

Deploying yappr with    Cloudflare Pages

Latest commit:	59554f1
Status:	✅  Deploy successful!
Preview URL:	https://c4c3c58d.yappr.pages.dev
Branch Preview URL:	https://chore-quality-gates.yappr.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying yappr-v2 with    Cloudflare Pages

Latest commit:	59554f1
Status:	✅  Deploy successful!
Preview URL:	https://e20a0db0.yappr-v2.pages.dev
Branch Preview URL:	https://chore-quality-gates.yappr-v2.pages.dev

View logs