style(13-03): apply Prettier formatting across repo

Mechanical reformat — no logic changes. 398 files changed, 19125
insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc
(singleQuote:true, semi:true, tabWidth:2, trailingComma:all,
printWidth:100). Isolated per D-13-08 for reviewability.

.planning/intel/api-map.json

@@ -38,10 +38,7 @@
       "method": "GET",
       "path": "/api/events",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "start (YYYY-MM-DD, required)",
-        "end (YYYY-MM-DD, required)"
-      ],
+      "params": ["start (YYYY-MM-DD, required)", "end (YYYY-MM-DD, required)"],
       "file": "apps/api/src/routes/events.ts",
       "response": "{ occurrences: CalendarOccurrence[] }",
       "description": "Windowed calendar events. Max 90-day window. Reads only from MariaDB cache; never hits Fastmail. Expands RRULEs server-side."
@@ -59,9 +56,7 @@
       "method": "PATCH",
       "path": "/api/events/:uid/edit",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "uid (path)"
-      ],
+      "params": ["uid (path)"],
       "body": "CreateEventPayload",
       "file": "apps/api/src/routes/events.ts",
       "response": "202 { uid: string }",
@@ -71,9 +66,7 @@
       "method": "DELETE",
       "path": "/api/events/:uid",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "uid (path)"
-      ],
+      "params": ["uid (path)"],
       "file": "apps/api/src/routes/events.ts",
       "response": "202 { uid: string }",
       "description": "Enqueues delete to calendarOutbox with cached etag (If-Match). Async write-back."
@@ -82,9 +75,7 @@
       "method": "GET",
       "path": "/api/events/sync-status",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "uid (query, required)"
-      ],
+      "params": ["uid (query, required)"],
       "file": "apps/api/src/routes/events.ts",
       "response": "{ uid: string, status: 'pending'|'done'|'failed'|'dead', error?: string }",
       "description": "Outbox status poll for a given event UID, scoped to current member. Used by SyncStateToast."
@@ -134,9 +125,7 @@
       "method": "PATCH",
       "path": "/api/lists/:id",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "id (path)"
-      ],
+      "params": ["id (path)"],
       "body": "{ name?: string, isShared?: boolean } — at least one field required",
       "file": "apps/api/src/routes/lists.ts",
       "response": "{ id, name, isShared, ownerId, createdAt, updatedAt }",
@@ -146,9 +135,7 @@
       "method": "DELETE",
       "path": "/api/lists/:id",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "id (path)"
-      ],
+      "params": ["id (path)"],
       "file": "apps/api/src/routes/lists.ts",
       "response": "{ id }",
       "description": "Owner-only delete. Cascade via FK onDelete:cascade removes items and shares. Non-owner sharees receive 403."
@@ -157,9 +144,7 @@
       "method": "GET",
       "path": "/api/lists/:id/items",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "id (path)"
-      ],
+      "params": ["id (path)"],
       "file": "apps/api/src/routes/lists.ts",
       "response": "{ items: [{ id, listId, text, checked, rank, createdAt, updatedAt }] }",
       "description": "Returns all items for the list ordered by rank ASC. Access-gated: owner or sharee only (T-04-05)."
@@ -168,9 +153,7 @@
       "method": "POST",
       "path": "/api/lists/:id/items",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "id (path)"
-      ],
+      "params": ["id (path)"],
       "body": "{ text: string (1..500) }",
       "file": "apps/api/src/routes/lists.ts",
       "response": "201 { id, listId, text, checked, rank, createdAt, updatedAt }",
@@ -180,9 +163,7 @@
       "method": "PATCH",
       "path": "/api/list-items/:itemId",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "itemId (path)"
-      ],
+      "params": ["itemId (path)"],
       "body": "exactly one of: { checked: boolean } | { text: string } | { position: string }",
       "file": "apps/api/src/routes/lists.ts",
       "response": "{ id, listId, text, checked, rank, createdAt, updatedAt }",
@@ -192,9 +173,7 @@
       "method": "DELETE",
       "path": "/api/list-items/:itemId",
       "auth": "oidcAuthMiddleware",
-      "params": [
-        "itemId (path)"
-      ],
+      "params": ["itemId (path)"],
       "file": "apps/api/src/routes/lists.ts",
       "response": "{ id }",
       "description": "Delete item instantly (D-06). Delete-wins semantics (D-09): no rollback path. Access-gated: owner or sharee. publishListEvent item:deleted fan-out."

.planning/intel/arch-decisions.json

@@ -17,103 +17,67 @@
     "write-broker-boundary": {
       "title": "Write-broker boundary invariant",
       "decision": "No route file imports tsdav or createFastmailClient; no broker file handles HTTP requests. Routes enqueue calendar_outbox rows and return 202 (optimistic-accept); the outbox worker performs the Fastmail write asynchronously.",
-      "files": [
-        "apps/api/src/routes/events.ts",
-        "apps/api/src/broker/write.ts"
-      ]
+      "files": ["apps/api/src/routes/events.ts", "apps/api/src/broker/write.ts"]
     },
     "identity-keying": {
       "title": "Identity keyed on oidc_iss + oidc_sub",
       "decision": "Users are keyed on oidc_iss + oidc_sub (never email). A hex color from the palette is auto-assigned on first login.",
-      "files": [
-        "apps/api/src/routes/me.ts",
-        "apps/api/src/auth/middleware.ts"
-      ]
+      "files": ["apps/api/src/routes/me.ts", "apps/api/src/auth/middleware.ts"]
     },
     "D-03-writable-set": {
       "title": "D-03 calendar ownership / writable-set predicate",
       "decision": "Every writable-set query uses WHERE userId = currentUser.id OR isShared = true. Another member's personal calendar is a read-only overlay.",
-      "files": [
-        "apps/api/src/routes/events.ts"
-      ]
+      "files": ["apps/api/src/routes/events.ts"]
     },
     "D-13-dual-field-dtstart": {
       "title": "D-13 all-day vs timed events (dual dtstart fields)",
       "decision": "dtstart_utc is NULL for all-day events; dtstart_date is NULL for timed events. Never coerce DATE to DATETIME.",
-      "files": [
-        "apps/api/src/db/schema.ts"
-      ]
+      "files": ["apps/api/src/db/schema.ts"]
     },
     "D-16-shared-fastmail-account": {
       "title": "D-16 shared Fastmail account, per-member credentials",
       "decision": "Both members share one Fastmail account. Calendar identity in DB is (userId, url) — the same collection URL appears once per member credential. CalDAV credential per member is stored AES-256-GCM encrypted in member_credentials.",
-      "files": [
-        "apps/api/src/db/schema.ts",
-        "apps/api/src/broker/poller.ts"
-      ]
+      "files": ["apps/api/src/db/schema.ts", "apps/api/src/broker/poller.ts"]
     },
     "outbox-status-machine": {
       "title": "Outbox status machine",
       "decision": "calendar_outbox rows transition pending -> done | failed | dead. failed rows retry up to a limit; dead is terminal. The sync-status endpoint surfaces worst-status-first per uid.",
-      "files": [
-        "apps/api/src/broker/outboxWorker.ts",
-        "apps/api/src/routes/events.ts"
-      ]
+      "files": ["apps/api/src/broker/outboxWorker.ts", "apps/api/src/routes/events.ts"]
     },
     "oidc-behind-pangolin": {
       "title": "OIDC behind Pangolin requires OIDC_AUTH_EXTERNAL_URL",
       "decision": "OIDC_AUTH_EXTERNAL_URL must be set to the public HTTPS URL to construct a correct redirect_uri; without it the callback resolves to the internal container address.",
-      "files": [
-        "apps/api/src/auth/middleware.ts",
-        "apps/api/src/index.ts"
-      ]
+      "files": ["apps/api/src/auth/middleware.ts", "apps/api/src/index.ts"]
     },
     "dev-auth-bypass": {
       "title": "Dev auth bypass",
       "decision": "DEV_AUTH_BYPASS=true with NODE_ENV!=production injects DEV_USER via Hono context; OIDC middleware is never mounted in this mode.",
-      "files": [
-        "apps/api/src/auth/devBypass.js",
-        "apps/api/src/index.ts"
-      ]
+      "files": ["apps/api/src/auth/devBypass.js", "apps/api/src/index.ts"]
     },
     "pwa-static-serving": {
       "title": "PWA static serving + SPA fallback",
       "decision": "Hono serveStatic serves ./public (Vite build output); SPA routes fall through to an index.html catch-all registered after /health, /api/*, and /callback so those win.",
-      "files": [
-        "apps/api/src/index.ts"
-      ]
+      "files": ["apps/api/src/index.ts"]
     },
     "schedule-x-routing": {
       "title": "Schedule-X calendar routing",
       "decision": "Events are routed to Schedule-X calendars by isShared ? 'shared' : String(ownerUserId) — never by calendarId. hydrateEvents.ts enforces this.",
-      "files": [
-        "apps/pwa/src/lib/hydrateEvents.ts",
-        "apps/pwa/src/components/CalendarShell.tsx"
-      ]
+      "files": ["apps/pwa/src/lib/hydrateEvents.ts", "apps/pwa/src/components/CalendarShell.tsx"]
     },
     "state-ownership": {
       "title": "Client state ownership split",
       "decision": "Server state is owned by TanStack Query; UI-only state (selected range, color map, drawer) by Zustand. Schedule-X renders the calendar UI.",
-      "files": [
-        "apps/pwa/src/store/calendarStore.ts",
-        "apps/pwa/src/components/CalendarShell.tsx"
-      ]
+      "files": ["apps/pwa/src/store/calendarStore.ts", "apps/pwa/src/components/CalendarShell.tsx"]
     },
     "lists-storage-mariadb-not-caldav": {
       "title": "Lists stored in MariaDB, not CalDAV (Phase 4)",
       "decision": "Named lists and items are app-owned data in MariaDB (lists, list_items, list_shares tables), not pushed to Fastmail. CalDAV is exclusively for calendar events.",
-      "files": [
-        "apps/api/src/db/schema.ts",
-        "apps/api/src/routes/lists.ts"
-      ]
+      "files": ["apps/api/src/db/schema.ts", "apps/api/src/routes/lists.ts"]
     },
     "D-01-D-02-list-sharing": {
       "title": "D-01/D-02 list sharing via join table (member-count-agnostic)",
       "decision": "isShared=true (default) triggers auto-insert of list_shares rows for all other users at create/patch time. Shares are server-managed only — no client-writable shares endpoint (T-04-08). list_shares join table is member-count-agnostic for future N-member expansion.",
-      "files": [
-        "apps/api/src/routes/lists.ts",
-        "apps/api/src/db/schema.ts"
-      ]
+      "files": ["apps/api/src/routes/lists.ts", "apps/api/src/db/schema.ts"]
     },
     "D-04-scoped-sse-fan-out": {
       "title": "D-04 scoped SSE fan-out — per-list channels, not global",
@@ -127,9 +91,7 @@
     "D-08-per-field-lww-patch": {
       "title": "D-08 per-field last-write-wins PATCH for list items",
       "decision": "PATCH /api/list-items/:itemId accepts exactly one field (checked | text | position). Zod enforces single-field constraint. Prevents one client's stale read overwriting concurrent updates to other fields.",
-      "files": [
-        "apps/api/src/routes/lists.ts"
-      ]
+      "files": ["apps/api/src/routes/lists.ts"]
     },
     "D-13-fractional-rank": {
       "title": "D-13 fractional-indexing rank for list item ordering",
@@ -143,18 +105,12 @@
     "D-10-D-11-D-12-sse-resilience": {
       "title": "D-10/D-11/D-12 SSE resilience: invalidate-not-patch, bounded backoff, polling fallback",
       "decision": "D-10: SSE events carry minimal { type, listId } payload; client full-refetches via TanStack Query invalidation rather than patching cache from event payload. D-11: useListSSE implements bounded backoff (250ms→8s cap, MAX_ATTEMPTS then give-up). D-12: 30s polling fallback always active in ListDetail as safety net.",
-      "files": [
-        "apps/pwa/src/hooks/useListSSE.ts",
-        "apps/pwa/src/routes/ListDetail.tsx"
-      ]
+      "files": ["apps/pwa/src/hooks/useListSSE.ts", "apps/pwa/src/routes/ListDetail.tsx"]
     },
     "react-router-spa-shell": {
       "title": "react-router BrowserRouter SPA shell with BottomTabBar",
       "decision": "App.tsx wraps routes in BrowserRouter with declarative Routes. BottomTabBar is a sibling of Routes (not inside) so it persists across navigation. SW navigateFallback covers /lists/* deep-links.",
-      "files": [
-        "apps/pwa/src/App.tsx",
-        "apps/pwa/src/components/BottomTabBar.tsx"
-      ]
+      "files": ["apps/pwa/src/App.tsx", "apps/pwa/src/components/BottomTabBar.tsx"]
     }
   }
 }

.planning/intel/dependency-graph.json

@@ -10,38 +10,28 @@
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/index.ts",
-        "apps/api/src/routes/"
-      ]
+      "used_by": ["apps/api/src/index.ts", "apps/api/src/routes/"]
     },
     "@hono/node-server": {
       "version": "2.0.4",
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/index.ts"
-      ]
+      "used_by": ["apps/api/src/index.ts"]
     },
     "@hono/oidc-auth": {
       "version": "1.8.3",
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/auth/middleware.ts"
-      ]
+      "used_by": ["apps/api/src/auth/middleware.ts"]
     },
     "@hono/zod-validator": {
       "version": "0.8.0",
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/routes/events.ts",
-        "apps/api/src/routes/lists.ts"
-      ]
+      "used_by": ["apps/api/src/routes/events.ts", "apps/api/src/routes/lists.ts"]
     },
     "drizzle-orm": {
       "version": "0.45.2",
@@ -60,19 +50,14 @@
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/db/client.ts"
-      ]
+      "used_by": ["apps/api/src/db/client.ts"]
     },
     "tsdav": {
       "version": "2.2.2",
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/broker/client.ts",
-        "apps/api/src/broker/write.ts"
-      ]
+      "used_by": ["apps/api/src/broker/client.ts", "apps/api/src/broker/write.ts"]
     },
     "ical.js": {
       "version": "2.2.1",
@@ -90,60 +75,42 @@
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/routes/events.ts",
-        "apps/api/src/routes/lists.ts"
-      ]
+      "used_by": ["apps/api/src/routes/events.ts", "apps/api/src/routes/lists.ts"]
     },
     "fractional-indexing": {
       "version": "^3.2.0",
       "type": "production",
       "workspace": "both (@familysync/api + @familysync/pwa)",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/lib/rank.ts",
-        "apps/pwa/src/routes/ListDetail.tsx"
-      ]
+      "used_by": ["apps/api/src/lib/rank.ts", "apps/pwa/src/routes/ListDetail.tsx"]
     },
     "node-cron": {
       "version": "^4.2.1",
       "type": "production",
       "workspace": "@familysync/api",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/broker/poller.ts",
-        "apps/api/src/broker/outboxWorker.ts"
-      ]
+      "used_by": ["apps/api/src/broker/poller.ts", "apps/api/src/broker/outboxWorker.ts"]
     },
     "drizzle-kit": {
       "version": "0.31.10",
       "type": "development",
       "workspace": "@familysync/api",
       "invocation": "npm run db:generate / npm run db:migrate",
-      "used_by": [
-        "npm run db:generate",
-        "npm run db:migrate",
-        "npm run db:push"
-      ]
+      "used_by": ["npm run db:generate", "npm run db:migrate", "npm run db:push"]
     },
     "temporal-polyfill": {
       "version": "0.3.2",
       "type": "production",
       "workspace": "both",
       "invocation": "require",
-      "used_by": [
-        "apps/api/src/broker/expand.ts",
-        "apps/pwa/src/lib/eventDateTime.ts"
-      ]
+      "used_by": ["apps/api/src/broker/expand.ts", "apps/pwa/src/lib/eventDateTime.ts"]
     },
     "react": {
       "version": "^19.0.0",
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/"
-      ]
+      "used_by": ["apps/pwa/src/"]
     },
     "react-router": {
       "version": "^7.17.0",
@@ -161,37 +128,28 @@
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/routes/ListDetail.tsx"
-      ]
+      "used_by": ["apps/pwa/src/routes/ListDetail.tsx"]
     },
     "@dnd-kit/sortable": {
       "version": "^10.0.0",
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/routes/ListDetail.tsx"
-      ]
+      "used_by": ["apps/pwa/src/routes/ListDetail.tsx"]
     },
     "vite": {
       "version": "8.0.16",
       "type": "development",
       "workspace": "@familysync/pwa",
       "invocation": "npm run dev / npm run build",
-      "used_by": [
-        "npm run dev",
-        "npm run build"
-      ]
+      "used_by": ["npm run dev", "npm run build"]
     },
     "vite-plugin-pwa": {
       "version": "^1.3.0",
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "implicit",
-      "used_by": [
-        "apps/pwa/vite.config.ts"
-      ]
+      "used_by": ["apps/pwa/vite.config.ts"]
     },
     "@tanstack/react-query": {
       "version": "5.101.0",
@@ -211,48 +169,35 @@
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/store/calendarStore.ts",
-        "apps/pwa/src/store/listsStore.ts"
-      ]
+      "used_by": ["apps/pwa/src/store/calendarStore.ts", "apps/pwa/src/store/listsStore.ts"]
     },
     "@schedule-x/calendar": {
       "version": "4.6.0",
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/components/CalendarShell.tsx",
-        "apps/pwa/src/lib/calendarConfig.ts"
-      ]
+      "used_by": ["apps/pwa/src/components/CalendarShell.tsx", "apps/pwa/src/lib/calendarConfig.ts"]
     },
     "@schedule-x/react": {
       "version": "4.1.0",
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/components/CalendarShell.tsx"
-      ]
+      "used_by": ["apps/pwa/src/components/CalendarShell.tsx"]
     },
     "lucide-react": {
       "version": "1.17.0",
       "type": "production",
       "workspace": "@familysync/pwa",
       "invocation": "require",
-      "used_by": [
-        "apps/pwa/src/components/"
-      ]
+      "used_by": ["apps/pwa/src/components/"]
     },
     "vitest": {
       "version": "^4.1.8",
       "type": "development",
       "workspace": "both",
       "invocation": "npm test",
-      "used_by": [
-        "npm test",
-        "npm run test:watch"
-      ]
+      "used_by": ["npm test", "npm run test:watch"]
     }
   }
 }

.planning/intel/file-roles.json

@@ -6,9 +6,7 @@
   },
   "entries": {
     "apps/api/src/index.ts": {
-      "exports": [
-        "app"
-      ],
+      "exports": ["app"],
       "imports": [
         "@hono/node-server",
         "@hono/node-server/serve-static",
@@ -27,9 +25,7 @@
       "notes": "Hono app factory + HTTP server; mounts routes, OIDC guard, static PWA assets. Broker workers started only when isMainModule()."
     },
     "apps/api/src/routes/events.ts": {
-      "exports": [
-        "eventsRouter"
-      ],
+      "exports": ["eventsRouter"],
       "imports": [
         "node:crypto",
         "hono",
@@ -48,10 +44,7 @@
       "notes": "GET /api/events (windowed), POST /api/events/create, PATCH /api/events/:uid/edit, DELETE /api/events/:uid, GET /api/events/sync-status, GET /api/events/writable-calendars. Writes enqueue to calendarOutbox only — never calls Fastmail directly."
     },
     "apps/api/src/routes/lists.ts": {
-      "exports": [
-        "listsRouter",
-        "listItemsRouter"
-      ],
+      "exports": ["listsRouter", "listItemsRouter"],
       "imports": [
         "hono",
         "@hono/zod-validator",
@@ -69,9 +62,7 @@
       "notes": "listsRouter: GET/POST /api/lists, PATCH/DELETE /api/lists/:id, POST/GET /api/lists/:id/items. listItemsRouter: PATCH/DELETE /api/list-items/:itemId. Owner-guard on isShared mutations (T-04-07/T-04-08). Auto-populates list_shares on isShared=true creation (D-01/D-02). publishListEvent fan-out after every mutation."
     },
     "apps/api/src/routes/sse.ts": {
-      "exports": [
-        "sseRouter"
-      ],
+      "exports": ["sseRouter"],
       "imports": [
         "hono",
         "hono/streaming",
@@ -85,27 +76,14 @@
       "notes": "GET /api/sse/heartbeat — 10s interval smoke-test. GET /api/sse/lists — scoped live-list fan-out (LIST-04, D-04); subscribes per-accessible-list via subscribeListEvents; 30s keepalive heartbeat."
     },
     "apps/api/src/routes/me.ts": {
-      "exports": [
-        "meRouter"
-      ],
-      "imports": [
-        "hono",
-        "../auth/middleware.js",
-        "../auth/user.js",
-        "../auth/devBypass.js"
-      ],
+      "exports": ["meRouter"],
+      "imports": ["hono", "../auth/middleware.js", "../auth/user.js", "../auth/devBypass.js"],
       "type": "module",
       "notes": "GET /api/me — returns { user: { id, displayName, color } }. Upserts user on first login."
     },
     "apps/api/src/routes/health.ts": {
-      "exports": [
-        "healthRouter"
-      ],
-      "imports": [
-        "hono",
-        "../db/client.js",
-        "drizzle-orm"
-      ],
+      "exports": ["healthRouter"],
+      "imports": ["hono", "../db/client.js", "drizzle-orm"],
       "type": "module",
       "notes": "GET /health — unauthenticated. Runs SELECT 1 against DB; returns { ok, db }."
     },
@@ -120,207 +98,108 @@
         "listShares",
         "listItems"
       ],
-      "imports": [
-        "drizzle-orm/mysql-core"
-      ],
+      "imports": ["drizzle-orm/mysql-core"],
       "type": "config",
       "notes": "Drizzle schema for all 8 MariaDB tables. Phase 4 adds lists, list_shares, list_items. list_items.rank uses varcharBin (COLLATE utf8mb4_bin) for fractional-indexing sort correctness. calendarOutbox status enum: pending|done|failed|dead."
     },
     "apps/api/src/db/client.ts": {
-      "exports": [
-        "db"
-      ],
-      "imports": [
-        "drizzle-orm/mysql2",
-        "mysql2/promise"
-      ],
+      "exports": ["db"],
+      "imports": ["drizzle-orm/mysql2", "mysql2/promise"],
       "type": "module",
       "notes": "Drizzle client bound to mysql2 pool. Reads DB_HOST/DB_PORT/DB_USER/DB_PASSWORD/DB_NAME from env."
     },
     "apps/api/src/lib/listEmitter.ts": {
-      "exports": [
-        "publishListEvent",
-        "subscribeListEvents",
-        "ListEvent"
-      ],
-      "imports": [
-        "node:events"
-      ],
+      "exports": ["publishListEvent", "subscribeListEvents", "ListEvent"],
+      "imports": ["node:events"],
       "type": "module",
       "notes": "In-process singleton EventEmitter for list change fan-out (D-18). Per-list channels keyed as list:${listId}. publishListEvent broadcasts; subscribeListEvents returns an unsubscribe fn. Max 200 listeners (T-04-04). Redis swap seam: abstraction boundary is inside this module."
     },
     "apps/api/src/lib/listAccess.ts": {
-      "exports": [
-        "getAccessibleListIds"
-      ],
-      "imports": [
-        "drizzle-orm",
-        "../db/client.js",
-        "../db/schema.js"
-      ],
+      "exports": ["getAccessibleListIds"],
+      "imports": ["drizzle-orm", "../db/client.js", "../db/schema.js"],
       "type": "module",
       "notes": "getAccessibleListIds(userId): returns deduped list IDs the user owns OR has a list_shares row for. Gate used by SSE endpoint to scope subscriptions (D-04, T-04-02, T-04-03)."
     },
     "apps/api/src/lib/rank.ts": {
-      "exports": [
-        "rankForAppend",
-        "rankBetween"
-      ],
-      "imports": [
-        "fractional-indexing"
-      ],
+      "exports": ["rankForAppend", "rankBetween"],
+      "imports": ["fractional-indexing"],
       "type": "module",
       "notes": "Pure helpers wrapping fractional-indexing generateKeyBetween. rankForAppend(lastRank) → rank after last active item. rankBetween(prev, next) → rank between two items. No DB access."
     },
     "apps/api/src/auth/middleware.ts": {
-      "exports": [
-        "oidcAuthMiddleware",
-        "processOAuthCallback",
-        "getAuth"
-      ],
-      "imports": [
-        "@hono/oidc-auth",
-        "hono"
-      ],
+      "exports": ["oidcAuthMiddleware", "processOAuthCallback", "getAuth"],
+      "imports": ["@hono/oidc-auth", "hono"],
       "type": "module",
       "notes": "OIDC middleware for Hono. Reads OIDC_AUTH_EXTERNAL_URL (mandatory behind Pangolin), OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_ISSUER from env."
     },
     "apps/api/src/auth/devBypass.ts": {
-      "exports": [
-        "devAuthBypass",
-        "DEV_USER"
-      ],
-      "imports": [
-        "hono"
-      ],
+      "exports": ["devAuthBypass", "DEV_USER"],
+      "imports": ["hono"],
       "type": "module",
       "notes": "Dev-only auth bypass middleware. Active only when DEV_AUTH_BYPASS=true AND NODE_ENV!=production. Augments Hono ContextVariableMap with 'user' key."
     },
     "apps/api/src/auth/user.ts": {
-      "exports": [
-        "upsertUser",
-        "deriveDisplayName"
-      ],
-      "imports": [
-        "../db/client.js",
-        "../db/schema.js",
-        "drizzle-orm"
-      ],
+      "exports": ["upsertUser", "deriveDisplayName"],
+      "imports": ["../db/client.js", "../db/schema.js", "drizzle-orm"],
       "type": "module",
       "notes": "User upsert keyed on oidc_iss + oidc_sub. deriveDisplayName: name → preferred_username → email → sub."
     },
     "apps/api/src/broker/poller.ts": {
-      "exports": [
-        "startBrokerPoller"
-      ],
-      "imports": [
-        "node-cron",
-        "./sync.js",
-        "../db/client.js",
-        "../db/schema.js"
-      ],
+      "exports": ["startBrokerPoller"],
+      "imports": ["node-cron", "./sync.js", "../db/client.js", "../db/schema.js"],
       "type": "module",
       "notes": "5-minute cron that polls Fastmail CalDAV for each member credential. ctag change-detection (D-13)."
     },
     "apps/api/src/broker/outboxWorker.ts": {
-      "exports": [
-        "startOutboxWorker"
-      ],
-      "imports": [
-        "node-cron",
-        "./write.js",
-        "../db/client.js",
-        "../db/schema.js"
-      ],
+      "exports": ["startOutboxWorker"],
+      "imports": ["node-cron", "./write.js", "../db/client.js", "../db/schema.js"],
       "type": "module",
       "notes": "15-second cron that drains pending calendarOutbox rows. Dispatches create/update/delete to Fastmail. Status machine: pending → done|failed|dead."
     },
     "apps/api/src/broker/sync.ts": {
-      "exports": [
-        "syncCalendarsForCredential"
-      ],
-      "imports": [
-        "./client.js",
-        "./expand.js",
-        "../db/client.js",
-        "../db/schema.js",
-        "ical.js"
-      ],
+      "exports": ["syncCalendarsForCredential"],
+      "imports": ["./client.js", "./expand.js", "../db/client.js", "../db/schema.js", "ical.js"],
       "type": "module",
       "notes": "CalDAV PROPFIND + REPORT → upserts calendars and calendarEvents rows."
     },
     "apps/api/src/broker/write.ts": {
-      "exports": [
-        "executeOutboxRow"
-      ],
-      "imports": [
-        "./client.js",
-        "./vevent.js",
-        "../db/client.js",
-        "../db/schema.js"
-      ],
+      "exports": ["executeOutboxRow"],
+      "imports": ["./client.js", "./vevent.js", "../db/client.js", "../db/schema.js"],
       "type": "module",
       "notes": "Executes a single outbox row: builds VEVENT, calls tsdav PUT/DELETE with If-Match etag."
     },
     "apps/api/src/broker/client.ts": {
-      "exports": [
-        "createFastmailClient"
-      ],
-      "imports": [
-        "tsdav",
-        "./crypto.js",
-        "../db/client.js",
-        "../db/schema.js"
-      ],
+      "exports": ["createFastmailClient"],
+      "imports": ["tsdav", "./crypto.js", "../db/client.js", "../db/schema.js"],
       "type": "module",
       "notes": "Creates a tsdav DAVClient per member credential (decrypted AES-256-GCM)."
     },
     "apps/api/src/broker/crypto.ts": {
-      "exports": [
-        "encrypt",
-        "decrypt"
-      ],
-      "imports": [
-        "node:crypto"
-      ],
+      "exports": ["encrypt", "decrypt"],
+      "imports": ["node:crypto"],
       "type": "module",
       "notes": "AES-256-GCM encrypt/decrypt for Fastmail app passwords stored in memberCredentials."
     },
     "apps/api/src/broker/expand.ts": {
-      "exports": [
-        "expandOccurrences"
-      ],
-      "imports": [
-        "ical.js",
-        "temporal-polyfill"
-      ],
+      "exports": ["expandOccurrences"],
+      "imports": ["ical.js", "temporal-polyfill"],
       "type": "module",
       "notes": "Expands raw VCALENDAR string into CalendarOccurrence[] for a [start, end) window. Handles RRULE, EXDATE, DST via ical.js + Temporal."
     },
     "apps/api/src/broker/vevent.ts": {
-      "exports": [
-        "buildVevent",
-        "extractRruleString"
-      ],
-      "imports": [
-        "ical.js"
-      ],
+      "exports": ["buildVevent", "extractRruleString"],
+      "imports": ["ical.js"],
       "type": "module",
       "notes": "Builds VCALENDAR/VEVENT strings from CreateEventPayload. extractRruleString preserves RRULE on calendar-move edits."
     },
     "apps/pwa/src/main.tsx": {
       "exports": [],
-      "imports": [
-        "react-dom/client",
-        "./App.tsx"
-      ],
+      "imports": ["react-dom/client", "./App.tsx"],
       "type": "entry-point",
       "notes": "React root mount."
     },
     "apps/pwa/src/App.tsx": {
-      "exports": [
-        "default"
-      ],
+      "exports": ["default"],
       "imports": [
         "react-router",
         "./components/CalendarShell.js",
@@ -332,22 +211,13 @@
       "notes": "BrowserRouter shell. Routes: / → /calendar redirect, /calendar → CalendarShell, /lists → ListsIndex, /lists/:listId → ListDetail. BottomTabBar rendered as persistent sibling of Routes."
     },
     "apps/pwa/src/routes/ListsIndex.tsx": {
-      "exports": [
-        "ListsIndex"
-      ],
-      "imports": [
-        "react",
-        "@tanstack/react-query",
-        "../api/listsClient.js",
-        "../components/"
-      ],
+      "exports": ["ListsIndex"],
+      "imports": ["react", "@tanstack/react-query", "../api/listsClient.js", "../components/"],
       "type": "module",
       "notes": "Lists overview route (/lists). TanStack Query ['lists'] → fetchLists. Renders ListCard per list, ListsEmptyState when empty, CreateListSheet for new list, ListDeleteDialog for delete confirmation. Optimistic delete with rollback."
     },
     "apps/pwa/src/routes/ListDetail.tsx": {
-      "exports": [
-        "ListDetail"
-      ],
+      "exports": ["ListDetail"],
       "imports": [
         "react",
         "@tanstack/react-query",
@@ -395,20 +265,13 @@
       "notes": "Typed fetch wrappers for all calendar API endpoints. Uses credentials: 'include' + redirect: 'manual' for OIDC opaqueredirect detection."
     },
     "apps/pwa/src/hooks/useListSSE.ts": {
-      "exports": [
-        "useListSSE"
-      ],
-      "imports": [
-        "react",
-        "@tanstack/react-query"
-      ],
+      "exports": ["useListSSE"],
+      "imports": ["react", "@tanstack/react-query"],
       "type": "module",
       "notes": "Bounded-backoff EventSource hook for /api/sse/lists (D-11). Backoff: 250ms→500ms→1s→2s→4s→cap 8s; stops after MAX_ATTEMPTS. withCredentials: true (T-04-01). On open: invalidates ['list', listId] for full refetch (D-10). On event: invalidates relevant query. Polling fallback (D-12) lives in ListDetail."
     },
     "apps/pwa/src/components/CalendarShell.tsx": {
-      "exports": [
-        "CalendarShell"
-      ],
+      "exports": ["CalendarShell"],
       "imports": [
         "react",
         "@tanstack/react-query",
@@ -429,78 +292,49 @@
       "notes": "Top-level calendar view. Orchestrates TanStack Query fetches, Schedule-X calendar, event create/edit/delete flows, sync toasts."
     },
     "apps/pwa/src/components/BottomTabBar.tsx": {
-      "exports": [
-        "BottomTabBar"
-      ],
-      "imports": [
-        "react",
-        "react-router",
-        "../store/listsStore.js"
-      ],
+      "exports": ["BottomTabBar"],
+      "imports": ["react", "react-router", "../store/listsStore.js"],
       "type": "module",
       "notes": "Phone-only bottom navigation tab bar. Tabs: Calendar (/calendar) and Lists (/lists). Persistent across route changes (rendered outside <Routes>). Visibility controlled by CSS at ≥768px."
     },
     "apps/pwa/src/store/listsStore.ts": {
-      "exports": [
-        "useListsStore"
-      ],
-      "imports": [
-        "zustand"
-      ],
+      "exports": ["useListsStore"],
+      "imports": ["zustand"],
       "type": "module",
       "notes": "Zustand UI-only state for lists surface: activeTab, createListSheetOpen. No server data. Follows calendarStore.ts pattern — no persist, no immer."
     },
     "apps/pwa/src/store/calendarStore.ts": {
-      "exports": [
-        "useCalendarStore"
-      ],
-      "imports": [
-        "zustand"
-      ],
+      "exports": ["useCalendarStore"],
+      "imports": ["zustand"],
       "type": "module",
       "notes": "Zustand store for UI-only state: selectedDateRange, calendarId→color map, drawer open/closed. No server state."
     },
     "apps/pwa/src/lib/calendarConfig.ts": {
-      "exports": [
-        "buildCalendarConfig"
-      ],
+      "exports": ["buildCalendarConfig"],
       "imports": [],
       "type": "module",
       "notes": "Builds Schedule-X calendar config from member color map and MeUser."
     },
     "apps/pwa/src/lib/hydrateEvents.ts": {
-      "exports": [
-        "hydrateEvents"
-      ],
-      "imports": [
-        "../api/client.ts"
-      ],
+      "exports": ["hydrateEvents"],
+      "imports": ["../api/client.ts"],
       "type": "module",
       "notes": "Maps CalendarOccurrence[] → Schedule-X event objects. Routes by isShared/ownerUserId (never calendarId)."
     },
     "apps/pwa/src/lib/eventDateTime.ts": {
-      "exports": [
-        "formatEventDateTime",
-        "toScheduleXDateTime"
-      ],
-      "imports": [
-        "temporal-polyfill"
-      ],
+      "exports": ["formatEventDateTime", "toScheduleXDateTime"],
+      "imports": ["temporal-polyfill"],
       "type": "module",
       "notes": "Date/time formatting helpers for Schedule-X event start/end fields."
     },
     "apps/pwa/src/lib/loginRedirect.ts": {
-      "exports": [
-        "maybeRedirectToLogin"
-      ],
+      "exports": ["maybeRedirectToLogin"],
       "imports": [],
       "type": "module",
       "notes": "Top-level navigation to /api/login when OIDC 302/opaqueredirect detected. CORS-bypass strategy."
     },
     "apps/pwa/src/lib/colorUtils.ts": {
-      "exports": [
-        "assignMemberColors"
-      ],
+      "exports": ["assignMemberColors"],
       "imports": [],
       "type": "module",
       "notes": "Assigns hex colors from palette to members deterministically."

.planning/intel/stack.json

@@ -4,15 +4,8 @@
     "commit": "99f59c3999f4ef992f01ef8f8a38c1d86d2f2a0f",
     "version": 3
   },
-  "languages": [
-    "TypeScript",
-    "SQL"
-  ],
-  "frameworks": [
-    "Hono 4.12.23",
-    "React 19",
-    "Drizzle ORM 0.45.2"
-  ],
+  "languages": ["TypeScript", "SQL"],
+  "frameworks": ["Hono 4.12.23", "React 19", "Drizzle ORM 0.45.2"],
   "tools": [
     "Vite 8.0.16",
     "vite-plugin-pwa 1.3.0",