style(13-03): apply Prettier formatting across repo

Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
@@ -3,30 +3,30 @@ phase: 08-gitea-ci
 plan: 02
 type: execute
 wave: 2
-depends_on: ["08-01"]
+depends_on: ['08-01']
 files_modified:
  - .gitea/workflows/ci.yml
 autonomous: false
 requirements: [CI-01]
 must_haves:
  truths:
-    - "Opening or updating a PR targeting main triggers ci.yml"
-    - "A fast-checks job runs lint + typecheck (both apps) + PWA unit tests in parallel with the API job"
-    - "An API job stands up a MariaDB 11 service container (or docker-run fallback), waits for real readiness via healthcheck.sh --connect --innodb_initialized, runs drizzle-kit migrate, then runs the DB-backed API test suite"
-    - "Both jobs gate the PR — a failure in either blocks merge once required-checks branch protection is configured"
+    - 'Opening or updating a PR targeting main triggers ci.yml'
+    - 'A fast-checks job runs lint + typecheck (both apps) + PWA unit tests in parallel with the API job'
+    - 'An API job stands up a MariaDB 11 service container (or docker-run fallback), waits for real readiness via healthcheck.sh --connect --innodb_initialized, runs drizzle-kit migrate, then runs the DB-backed API test suite'
+    - 'Both jobs gate the PR — a failure in either blocks merge once required-checks branch protection is configured'
  artifacts:
-    - path: ".gitea/workflows/ci.yml"
-      provides: "PR-triggered fast-checks + API-integration jobs"
-      contains: "pull_request"
+    - path: '.gitea/workflows/ci.yml'
+      provides: 'PR-triggered fast-checks + API-integration jobs'
+      contains: 'pull_request'
  key_links:
-    - from: ".gitea/workflows/ci.yml (api job)"
-      to: "mariadb:11 service"
-      via: "DB_HOST + drizzle-kit migrate + vitest"
-      pattern: "healthcheck.sh --connect --innodb_initialized"
-    - from: ".gitea/workflows/ci.yml (fast-checks job)"
-      to: "pnpm scripts"
-      via: "run: pnpm lint / typecheck / pwa test"
-      pattern: "pnpm (-r )?(lint|typecheck)"
+    - from: '.gitea/workflows/ci.yml (api job)'
+      to: 'mariadb:11 service'
+      via: 'DB_HOST + drizzle-kit migrate + vitest'
+      pattern: 'healthcheck.sh --connect --innodb_initialized'
+    - from: '.gitea/workflows/ci.yml (fast-checks job)'
+      to: 'pnpm scripts'
+      via: 'run: pnpm lint / typecheck / pwa test'
+      pattern: 'pnpm (-r )?(lint|typecheck)'
 ---

 <objective>
@@ -37,9 +37,10 @@ Purpose: Fast PR feedback (D-03 — a lint failure does not wait behind the heav
 Output: `.gitea/workflows/ci.yml` containing `fast-checks` and `api` jobs gated on `pull_request → main`.

 CRITICAL CONTEXT — read 08-01-SUMMARY first for the runner-mode fork:
+
 - If 08-01 found DOCKER-executor mode: use `services: mariadb:` with `DB_HOST: mariadb` (08-RESEARCH Pattern 1).
 - If 08-01 found HOST-executor mode: use a `docker run -d mariadb:11 -p 3306:3306` step + explicit readiness loop with `DB_HOST: 127.0.0.1` (08-RESEARCH Pattern 2). Service containers do NOT work in host mode (nektos/act#2711).
-</objective>
+  </objective>

 <execution_context>
@$HOME/.claude/gsd-core/workflows/execute-plan.md
@@ -56,11 +57,13 @@ CRITICAL CONTEXT — read 08-01-SUMMARY first for the runner-mode fork:
 </context>

 <artifacts_this_phase_produces>
+
 - `.gitea/workflows/ci.yml` (NEW — this plan creates it; Plans 03/04 extend it)
-</artifacts_this_phase_produces>
+  </artifacts_this_phase_produces>

 <interface_context>
 Confirmed repo facts the executor MUST honor (do not re-derive):
+
 - Root scripts: `lint` = `pnpm -r lint`, `typecheck` = `pnpm -r typecheck`, `test` = `pnpm --filter @familysync/api test` (= `vitest run`), PWA unit = `pnpm --filter @familysync/pwa test`.
 - IMPORTANT — lint is currently a NO-OP: no package defines a `lint` script and ESLint is not installed, so `pnpm lint` (`pnpm -r lint`) prints `ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT` but EXITS 0 and passes. Run `pnpm lint` as the documented command (satisfies CI-01's "lint" gate literally); do NOT add ESLint config — wiring lint is out of this phase's scope (CI-plumbing-only boundary). Note this in the SUMMARY so it is not mistaken for a bug.
 - ALL `apps/api` tests live in `apps/api/tests/` and `apps/api/test/setup.ts` truncates DB tables in an `afterEach` (it swallows errors if no DB). So `pnpm --filter @familysync/api test` REQUIRES a real MariaDB — the API "unit" and "integration" tests are one DB-backed command. The fast-checks job therefore runs only the PWA unit tests (no DB); the API job owns all API tests (with DB).
@@ -68,7 +71,7 @@ Confirmed repo facts the executor MUST honor (do not re-derive):
 - DB env var names (from apps/api/src/db/client.ts + drizzle.config.ts): DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME. Migrations: `pnpm --filter @familysync/api db:migrate` (= drizzle-kit migrate). NEVER db:push (unsafe on MariaDB — project memory).
 - packageManager is `pnpm@11.5.1`; no .nvmrc/engines pin → pin Node 22 via `actions/setup-node@v4` + `corepack enable pnpm`.
 - Workspace is `apps/*` only (no packages/shared despite CLAUDE.md mention) — `pnpm -r` spans 2 packages.
-</interface_context>
+  </interface_context>

 <tasks>

@@ -96,6 +99,7 @@ Confirmed repo facts the executor MUST honor (do not re-derive):
      7. `run: pnpm typecheck` (= `pnpm -r typecheck` → tsc --noEmit in both apps incl. pwa tsconfig.e2e.json)
      8. `run: pnpm --filter @familysync/pwa test` (PWA unit tests — no DB needed)
    Do NOT run `pnpm test` here (that is the DB-backed API suite — it belongs in the api job).
+
  </action>
  <verify>
    <automated>test -f .gitea/workflows/ci.yml && grep -q "pull_request" .gitea/workflows/ci.yml && grep -q "node-version: '22'" .gitea/workflows/ci.yml && grep -q "pnpm typecheck" .gitea/workflows/ci.yml && grep -q "@familysync/pwa test" .gitea/workflows/ci.yml && echo FASTCHECKS_OK</automated>
@@ -129,6 +133,7 @@ Confirmed repo facts the executor MUST honor (do not re-derive):
      - `run: pnpm --filter @familysync/api test` (the full DB-backed API suite). Pass DB_* env.

    Reuse the same cache decision as Task 1 (include only if 08-01 confirmed cache works).
+
  </action>
  <verify>
    <automated>grep -q "mariadb:11" .gitea/workflows/ci.yml && grep -q "healthcheck.sh --connect --innodb_initialized" .gitea/workflows/ci.yml && ! grep -q "mysqladmin" .gitea/workflows/ci.yml && grep -q "db:migrate" .gitea/workflows/ci.yml && ! grep -q "db:push" .gitea/workflows/ci.yml && grep -q "@familysync/api test" .gitea/workflows/ci.yml && echo APIJOB_OK</automated>
@@ -152,20 +157,22 @@ Confirmed repo facts the executor MUST honor (do not re-derive):
 </tasks>

 <threat_model>
+
 ## Trust Boundaries

-| Boundary | Description |
-|----------|-------------|
-| PR head → CI runner | PR-triggered job runs untrusted branch content on operator infra |
-| Test DB creds → job env | Throwaway creds in CI env; must not be production secrets |
+| Boundary                | Description                                                      |
+| ----------------------- | ---------------------------------------------------------------- |
+| PR head → CI runner     | PR-triggered job runs untrusted branch content on operator infra |
+| Test DB creds → job env | Throwaway creds in CI env; must not be production secrets        |

 ## STRIDE Threat Register

-| Threat ID | Category | Component | Disposition | Mitigation Plan |
-|-----------|----------|-----------|-------------|-----------------|
-| T-08-03 | Information Disclosure | MariaDB creds in job env | mitigate | Use throwaway creds (familysync/testpass, root/root) scoped to the ephemeral service container only; NEVER reference production DB_PASSWORD or any repo secret in these jobs (08-RESEARCH Security Domain). |
-| T-08-04 | Tampering | drizzle-kit against CI DB | mitigate | Use `db:migrate` (applies committed SQL) exclusively; `db:push` is forbidden (emits destructive TRUNCATE diff on MariaDB — project memory drizzle-mariadb-push-unsafe). Verified by grep gate (`! grep db:push`). |
-| T-08-05 | Denial of Service | cold-start readiness race | mitigate | Explicit healthcheck.sh readiness loop before migrate (Pitfall 11) so the gate is reliable on first run, not flaky. |
+| Threat ID | Category               | Component                 | Disposition | Mitigation Plan                                                                                                                                                                                                   |
+| --------- | ---------------------- | ------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| T-08-03   | Information Disclosure | MariaDB creds in job env  | mitigate    | Use throwaway creds (familysync/testpass, root/root) scoped to the ephemeral service container only; NEVER reference production DB_PASSWORD or any repo secret in these jobs (08-RESEARCH Security Domain).       |
+| T-08-04   | Tampering              | drizzle-kit against CI DB | mitigate    | Use `db:migrate` (applies committed SQL) exclusively; `db:push` is forbidden (emits destructive TRUNCATE diff on MariaDB — project memory drizzle-mariadb-push-unsafe). Verified by grep gate (`! grep db:push`). |
+| T-08-05   | Denial of Service      | cold-start readiness race | mitigate    | Explicit healthcheck.sh readiness loop before migrate (Pitfall 11) so the gate is reliable on first run, not flaky.                                                                                               |
+
 </threat_model>

 <verification>
@@ -175,10 +182,11 @@ Confirmed repo facts the executor MUST honor (do not re-derive):
 </verification>

 <success_criteria>
+
 - CI-01 (non-harness half): PR to main runs lint + typecheck (both apps) + unit tests + API integration vs MariaDB service container; failures gate merge (ROADMAP criteria 1 + 2).
 - Pitfall 11 honored: healthcheck.sh --connect --innodb_initialized readiness, never mysqladmin; reliable cold-start.
 - One workflow file (D-03), parallel event-gated jobs.
-</success_criteria>
+  </success_criteria>

 <output>
 Create `.planning/phases/08-gitea-ci/08-02-SUMMARY.md` when done. Record: the chosen DB bring-up path (services vs docker-run), final readiness timeout values, whether cache was enabled, and the lint-is-a-no-op note.