style(13-03): apply Prettier formatting across repo

Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
@@ -3,7 +3,7 @@ phase: 07-mobile-test-harness
 plan: 02
 type: execute
 wave: 2
-depends_on: ["07-01"]
+depends_on: ['07-01']
 files_modified:
  - apps/pwa/e2e/global-setup.ts
  - apps/pwa/e2e/README.md
@@ -13,26 +13,26 @@ user_setup: []

 must_haves:
  truths:
-    - "global-setup polls baseURL+/health and only proceeds once it returns 200 (fails fast with a clear message on timeout)"
-    - "global-setup deterministically resets (TRUNCATE) then seeds: >=1 calendar_event on calendar_id=10, >=1 list owned by user 1, >=2 list_items, >=1 list_shares row for user 1 (D-05 populated half / D-07 seeding in global-setup)"
-    - "Seeding is idempotent run-over-run (a second run produces the same row counts, no stale rows, no duplicate-key errors)"
-    - "calendar_id=10 is guaranteed present via INSERT IGNORE INTO calendars before the event insert (works on a fresh CI DB and a populated dev DB)"
+    - 'global-setup polls baseURL+/health and only proceeds once it returns 200 (fails fast with a clear message on timeout)'
+    - 'global-setup deterministically resets (TRUNCATE) then seeds: >=1 calendar_event on calendar_id=10, >=1 list owned by user 1, >=2 list_items, >=1 list_shares row for user 1 (D-05 populated half / D-07 seeding in global-setup)'
+    - 'Seeding is idempotent run-over-run (a second run produces the same row counts, no stale rows, no duplicate-key errors)'
+    - 'calendar_id=10 is guaranteed present via INSERT IGNORE INTO calendars before the event insert (works on a fresh CI DB and a populated dev DB)'
  artifacts:
-    - path: "apps/pwa/e2e/global-setup.ts"
-      provides: "Playwright globalSetup: /health readiness poll + mysql2 reset-and-seed against dev MariaDB"
-      contains: "TRUNCATE"
-    - path: "apps/pwa/e2e/README.md"
-      provides: "Operator/CI run instructions + the DEV_AUTH_BYPASS / NODE_ENV production guardrail documentation"
-      contains: "DEV_AUTH_BYPASS"
+    - path: 'apps/pwa/e2e/global-setup.ts'
+      provides: 'Playwright globalSetup: /health readiness poll + mysql2 reset-and-seed against dev MariaDB'
+      contains: 'TRUNCATE'
+    - path: 'apps/pwa/e2e/README.md'
+      provides: 'Operator/CI run instructions + the DEV_AUTH_BYPASS / NODE_ENV production guardrail documentation'
+      contains: 'DEV_AUTH_BYPASS'
  key_links:
-    - from: "apps/pwa/e2e/global-setup.ts"
-      to: "dev MariaDB :3306"
-      via: "mysql2 createConnection with DB_* env vars"
-      pattern: "mysql.*createConnection"
-    - from: "apps/pwa/e2e/global-setup.ts"
-      to: "calendar_events.calendar_id=10"
-      via: "INSERT IGNORE calendars guard then INSERT calendar_events"
-      pattern: "INSERT IGNORE INTO calendars"
+    - from: 'apps/pwa/e2e/global-setup.ts'
+      to: 'dev MariaDB :3306'
+      via: 'mysql2 createConnection with DB_* env vars'
+      pattern: 'mysql.*createConnection'
+    - from: 'apps/pwa/e2e/global-setup.ts'
+      to: 'calendar_events.calendar_id=10'
+      via: 'INSERT IGNORE calendars guard then INSERT calendar_events'
+      pattern: 'INSERT IGNORE INTO calendars'
 ---

 <objective>
@@ -116,21 +116,23 @@ Output: `apps/pwa/e2e/global-setup.ts` and `apps/pwa/e2e/README.md`.
 </tasks>

 <threat_model>
+
 ## Trust Boundaries

-| Boundary | Description |
-|----------|-------------|
-| global-setup → dev MariaDB | direct mysql2 connection writes seed rows; credentials cross this boundary |
-| harness → dev API | the API runs with `DEV_AUTH_BYPASS=true`; the bypass must never be active in production |
-| repo → production | README + seed code checked into the repo; must not normalize the dev-bypass posture for production |
+| Boundary                   | Description                                                                                        |
+| -------------------------- | -------------------------------------------------------------------------------------------------- |
+| global-setup → dev MariaDB | direct mysql2 connection writes seed rows; credentials cross this boundary                         |
+| harness → dev API          | the API runs with `DEV_AUTH_BYPASS=true`; the bypass must never be active in production            |
+| repo → production          | README + seed code checked into the repo; must not normalize the dev-bypass posture for production |

 ## STRIDE Threat Register

-| Threat ID | Category | Component | Disposition | Mitigation Plan |
-|-----------|----------|-----------|-------------|-----------------|
-| T-07-04 | Elevation of Privilege | `DEV_AUTH_BYPASS=true` leaking to production | mitigate | README documents that the bypass is dev-only and guarded by `NODE_ENV !== 'production'` (devBypass.ts); production compose MUST NOT set `DEV_AUTH_BYPASS`. global-setup does not set it (it cannot — it must already be active on the API). |
-| T-07-05 | Information Disclosure | DB seed credentials | mitigate | global-setup reads `DB_HOST`/`DB_PORT`/`DB_USER`/`DB_PASSWORD`/`DB_NAME` from env exclusively (mirrors db/client.ts); no credential is hardcoded in the seed script or README. |
-| T-07-06 | Information Disclosure | checked-in OIDC session state | accept (designed out) | N/A by D-01 — no `storageState.json` is written; the seed touches only fixture rows, never an auth artifact. README states this explicitly. |
+| Threat ID | Category               | Component                                    | Disposition           | Mitigation Plan                                                                                                                                                                                                                             |
+| --------- | ---------------------- | -------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| T-07-04   | Elevation of Privilege | `DEV_AUTH_BYPASS=true` leaking to production | mitigate              | README documents that the bypass is dev-only and guarded by `NODE_ENV !== 'production'` (devBypass.ts); production compose MUST NOT set `DEV_AUTH_BYPASS`. global-setup does not set it (it cannot — it must already be active on the API). |
+| T-07-05   | Information Disclosure | DB seed credentials                          | mitigate              | global-setup reads `DB_HOST`/`DB_PORT`/`DB_USER`/`DB_PASSWORD`/`DB_NAME` from env exclusively (mirrors db/client.ts); no credential is hardcoded in the seed script or README.                                                              |
+| T-07-06   | Information Disclosure | checked-in OIDC session state                | accept (designed out) | N/A by D-01 — no `storageState.json` is written; the seed touches only fixture rows, never an auth artifact. README states this explicitly.                                                                                                 |
+
 </threat_model>

 <verification>
@@ -141,10 +143,11 @@ Output: `apps/pwa/e2e/global-setup.ts` and `apps/pwa/e2e/README.md`.
 </verification>

 <success_criteria>
+
 - `apps/pwa/e2e/global-setup.ts` provides a readiness gate + deterministic reset-and-seed using only plain Node (fetch + mysql2), targeting user 1 / calendar 10.
 - Seeding is repeatable run-over-run with no stale rows or duplicate-key failures.
 - `apps/pwa/e2e/README.md` documents run, env, and security guardrails.
-</success_criteria>
+  </success_criteria>

 <output>
 Create `.planning/phases/07-mobile-test-harness/07-02-SUMMARY.md` when done.