Safely refactor AI-generated code for production

Vibe-Code Cleanup is a safe, incremental production-hardening workflow for AI-generated (vibe-coded) full-stack apps - Next.js, React, Node.js - built on one rule: "surgery, not demolition," removing only what is provably dead and preserving everything else. It never rewrites working systems for cosmetic reasons, renames indexed routes or API endpoints, changes API contracts/DB schema/auth flow, or deletes an unverified file. It works in seven steps: reconnaissance first (map all routes, run npx tsc --noEmit, npx ts-prune, and grep for console.log/TODO/FIXME without changing anything yet); fix broken imports before anything else, since they cause build failures; identify dead code, removing a file or export only if grep confirms nothing imports it, it is absent from any config/sitemap/route manifest, and it is not a public-facing page or route file; consolidate genuinely repeated logic (SEO metadata blocks, fetch wrappers, slugify/formatDate utilities appearing in 3-plus places) into shared helpers, for example a lib/socialMetadata.js builder function, while leaving one-off business logic and route handlers with different contracts alone; audit environment variables used in code against .env.example, flagging anything missing without ever committing secrets; validate after every batch with typecheck, lint, build, and tests, reverting the last batch immediately if any of them break; and commit each logical change separately - never bundling UI changes, logic changes, and file deletions into one commit.

Use it when a rapidly built app works but has broken imports, duplicated logic, dead code, unclear environment variables, or fragile release hygiene, especially before launch or a handoff. It is not for broad rewrites and treats several areas as off-limits without a verified bug: route slugs and page paths (may be indexed by Google), API route contracts (callers depend on the exact shape), DB schema or Prisma models (needs a migration), auth flow logic, third-party integration configs, and working user-facing tool pages.

Input is the existing codebase. Output is a series of small, reversible commits - each one a single logical unit like fix: remove broken import in app/blog/page.js or refactor: consolidate social metadata into lib/socialMetadata.js - plus a completed checklist covering fixed TypeScript errors, no broken imports, grep-verified dead code removal, shared helpers for repeated patterns, documented env vars, and a passing build, lint, and test run.

TypeScript (tsc --noEmit), ts-prune for unused exports, ESLint, npm run build, and the project's own test runner; grep/ripgrep for verifying that a file or component is genuinely unreferenced before deletion.

Teams turning a fast, AI-generated prototype into a production-ready codebase before launch or handoff, who need dead code and broken references cleaned up without risking the routes, APIs, auth, or integrations that already work.