## 1) Prioritized debt list

1. Monolithic `actions/index.js` (over-coupled “god module”)
2. Inconsistent API error handling/response contracts across `pages/api/**`
3. Sensitive/verbose logging in app + API paths
4. Endpoint sprawl and duplicated proxy patterns (`pages/api/endpoint/*_api.js`)
5. i18n routing complexity in large rewrite maps
6. Sparse automated test coverage for high-risk flows
7. Legacy/stale commented patterns in critical files

## 2) Impact of each item

- **1) `actions/index.js` monolith**
    - High blast radius for any change; weak modularity and hard ownership boundaries.
    - Evidence: ~100+ exports mixing search, auth, account, file, PDF, notify, CRM concerns.

- **2) API contract inconsistency**
    - Clients must handle errors inconsistently; reliability and observability suffer.
    - Evidence: many handlers return raw `res.status(400).json(error)` while others shape custom outputs.

- **3) Verbose/sensitive logging**
    - Privacy/security risk plus noisy telemetry.
    - Evidence: 300+ `console.log` occurrences, including auth/email/upload-related contexts.

- **4) Endpoint duplication**
    - Maintenance cost and drift risk (validation/auth/error semantics diverge over time).
    - Evidence: repeated patterns across many `_api.js` proxy handlers.

- **5) i18n rewrite complexity**
    - Higher risk of EN/CY divergence as routes evolve.
    - Evidence: large manual rewrite map + separate i18n page namespace config.

- **6) Sparse tests**
    - Release confidence depends heavily on manual checks; slower, riskier change cadence.

- **7) Stale patterns**
    - Increased cognitive load and unclear source-of-truth behavior in some modules.

## 3) Recommended next cleanup targets

1. **Decompose `actions/index.js` by domain** (structure-only first, keep barrel exports).
2. **Add shared API handler utilities** for validation/error envelope; migrate top sensitive endpoints first.
3. **Implement logging redaction wrapper + policy** and remove direct logs in auth/email/file paths.
4. **Create high-risk smoke tests** (auth callback, search endpoint, upload negative-path, email failure-path).
5. **Extract proxy/integration helpers** (token/hash/header/retry) to reduce endpoint duplication.
6. **Add EN/CY parity CI checks** for route and locale key consistency.

## 4) Runtime note (updated)

- `server.js` and `server/server.js` exist in the repository but are **not the active production concern** for the current refactor stream.
- Current baseline runtime for this debt plan is the standard Next runtime path (`npm start`).
- Runtime canonicalization is therefore removed from the active prioritized debt list unless deployment evidence changes.

If you want, I can convert this into a sprint-ready debt register (ID, owner, effort, risk reduction, target milestone).