style(13-03): apply Prettier formatting across repo

Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
@@ -16,29 +16,29 @@ user_setup: []

 must_haves:
  truths:
-    - "playwright test --list reports exactly two projects: iphone and pixel"
-    - "Vitest does NOT pick up e2e/*.spec.ts files (no glob collision)"
-    - "Both WebKit and Chromium browser engines are installed for @playwright/test"
-    - "tsc --noEmit passes in apps/pwa with the new playwright.config.ts and e2e/ files in scope"
+    - 'playwright test --list reports exactly two projects: iphone and pixel'
+    - 'Vitest does NOT pick up e2e/*.spec.ts files (no glob collision)'
+    - 'Both WebKit and Chromium browser engines are installed for @playwright/test'
+    - 'tsc --noEmit passes in apps/pwa with the new playwright.config.ts and e2e/ files in scope'
  artifacts:
-    - path: "apps/pwa/playwright.config.ts"
-      provides: "Two-project device matrix (iPhone/WebKit, Pixel/Chromium), serviceWorkers block, env baseURL, globalSetup ref, vite-only webServer, trace/artifact config"
+    - path: 'apps/pwa/playwright.config.ts'
+      provides: 'Two-project device matrix (iPhone/WebKit, Pixel/Chromium), serviceWorkers block, env baseURL, globalSetup ref, vite-only webServer, trace/artifact config'
      contains: "devices['iPhone 14']"
-    - path: "apps/pwa/vitest.config.ts"
+    - path: 'apps/pwa/vitest.config.ts'
      provides: "exclude e2e/** so Vitest's default *.spec.ts glob does not collide with Playwright specs"
-      contains: "exclude"
-    - path: "apps/pwa/package.json"
-      provides: "@playwright/test devDependency + test:e2e scripts"
-      contains: "test:e2e"
+      contains: 'exclude'
+    - path: 'apps/pwa/package.json'
+      provides: '@playwright/test devDependency + test:e2e scripts'
+      contains: 'test:e2e'
  key_links:
-    - from: "apps/pwa/playwright.config.ts"
-      to: "apps/pwa/e2e/global-setup.ts"
-      via: "globalSetup config option"
-      pattern: "globalSetup.*global-setup"
-    - from: "apps/pwa/playwright.config.ts"
-      to: "PLAYWRIGHT_BASE_URL env"
-      via: "use.baseURL env-driven"
-      pattern: "PLAYWRIGHT_BASE_URL"
+    - from: 'apps/pwa/playwright.config.ts'
+      to: 'apps/pwa/e2e/global-setup.ts'
+      via: 'globalSetup config option'
+      pattern: 'globalSetup.*global-setup'
+    - from: 'apps/pwa/playwright.config.ts'
+      to: 'PLAYWRIGHT_BASE_URL env'
+      via: 'use.baseURL env-driven'
+      pattern: 'PLAYWRIGHT_BASE_URL'
 ---

 <objective>
@@ -144,20 +144,22 @@ Output: `apps/pwa/playwright.config.ts`, the `@playwright/test` dev dep + instal
 </tasks>

 <threat_model>
+
 ## Trust Boundaries

-| Boundary | Description |
-|----------|-------------|
-| harness → dev API | Playwright drives the PWA which calls the API; the API runs with `DEV_AUTH_BYPASS=true` (dev only) |
-| repo → CI/production | config + scripts checked into the repo; must not leak dev-only auth posture into production |
+| Boundary             | Description                                                                                        |
+| -------------------- | -------------------------------------------------------------------------------------------------- |
+| harness → dev API    | Playwright drives the PWA which calls the API; the API runs with `DEV_AUTH_BYPASS=true` (dev only) |
+| repo → CI/production | config + scripts checked into the repo; must not leak dev-only auth posture into production        |

 ## STRIDE Threat Register

-| Threat ID | Category | Component | Disposition | Mitigation Plan |
-|-----------|----------|-----------|-------------|-----------------|
-| T-07-01 | Elevation of Privilege | `DEV_AUTH_BYPASS=true` reaching production | mitigate | Config sets no auth-bypass itself — bypass is API-side and guarded by `NODE_ENV !== 'production'` (devBypass.ts). This plan documents in the README (Plan 02/04) that production compose MUST NOT set `DEV_AUTH_BYPASS`. The harness config only assumes the dev stack already has it. |
-| T-07-02 | Information Disclosure | checked-in `storageState.json` with a real OIDC session | accept (designed out) | N/A by D-01 — `playwright.config.ts` deliberately omits `storageState`; auth comes from the dev bypass, never a session file. No session cookie is ever serialized into the repo. |
-| T-07-03 | Tampering | `@playwright/test` package install | mitigate | Pinned to 1.60.0 (official Microsoft package, 38.6M wk downloads — RESEARCH.md Package Legitimacy Audit, verdict OK/Approved). No `[ASSUMED]`/`[SUS]`/`[SLOP]` packages introduced; mysql2 (SUS-but-approved) is already a project dep and is not added here. |
+| Threat ID | Category               | Component                                               | Disposition           | Mitigation Plan                                                                                                                                                                                                                                                                        |
+| --------- | ---------------------- | ------------------------------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| T-07-01   | Elevation of Privilege | `DEV_AUTH_BYPASS=true` reaching production              | mitigate              | Config sets no auth-bypass itself — bypass is API-side and guarded by `NODE_ENV !== 'production'` (devBypass.ts). This plan documents in the README (Plan 02/04) that production compose MUST NOT set `DEV_AUTH_BYPASS`. The harness config only assumes the dev stack already has it. |
+| T-07-02   | Information Disclosure | checked-in `storageState.json` with a real OIDC session | accept (designed out) | N/A by D-01 — `playwright.config.ts` deliberately omits `storageState`; auth comes from the dev bypass, never a session file. No session cookie is ever serialized into the repo.                                                                                                      |
+| T-07-03   | Tampering              | `@playwright/test` package install                      | mitigate              | Pinned to 1.60.0 (official Microsoft package, 38.6M wk downloads — RESEARCH.md Package Legitimacy Audit, verdict OK/Approved). No `[ASSUMED]`/`[SUS]`/`[SLOP]` packages introduced; mysql2 (SUS-but-approved) is already a project dep and is not added here.                          |
+
 </threat_model>

 <verification>
@@ -168,11 +170,12 @@ Output: `apps/pwa/playwright.config.ts`, the `@playwright/test` dev dep + instal
 </verification>

 <success_criteria>
+
 - `@playwright/test@1.60.x` installed as a devDependency in apps/pwa with WebKit + Chromium engines available.
 - `playwright.config.ts` defines the iPhone/WebKit + Pixel/Chromium matrix with `serviceWorkers: 'block'`, env baseURL, globalSetup ref, and vite-only webServer.
 - Vitest no longer collides with `*.spec.ts`; typecheck gate covers e2e/.
 - `test:e2e` scripts exposed at apps/pwa and root.
-</success_criteria>
+  </success_criteria>

 <output>
 Create `.planning/phases/07-mobile-test-harness/07-01-SUMMARY.md` when done.