style(13-03): apply Prettier formatting across repo

Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
@@ -3,7 +3,7 @@ phase: 08-gitea-ci
 plan: 03
 type: execute
 wave: 3
-depends_on: ["08-02"]
+depends_on: ['08-02']
 files_modified:
  - .gitea/workflows/ci.yml
 autonomous: false
@@ -11,22 +11,22 @@ requirements: [CI-01]
 must_haves:
  truths:
    - "On a PR to main, a harness job brings up the full dev stack inside the runner: MariaDB + API dev server (DEV_AUTH_BYPASS=true, :3000) + PWA Vite dev server (:5173, started by Playwright's own webServer)"
-    - "The harness step waits for BOTH the API (:3000/health) and the PWA Vite server (:5173) to accept connections before Playwright launches, so it does not flake on startup races"
-    - "The Phase 7 Playwright specs run UNCHANGED across both device profiles (iPhone 14/WebKit + Pixel 7/Chromium) and a failure blocks merge"
-    - "On harness failure, test-results/ (traces/screenshots/videos) upload as a CI artifact via the gitea-upload-artifact fork"
+    - 'The harness step waits for BOTH the API (:3000/health) and the PWA Vite server (:5173) to accept connections before Playwright launches, so it does not flake on startup races'
+    - 'The Phase 7 Playwright specs run UNCHANGED across both device profiles (iPhone 14/WebKit + Pixel 7/Chromium) and a failure blocks merge'
+    - 'On harness failure, test-results/ (traces/screenshots/videos) upload as a CI artifact via the gitea-upload-artifact fork'
  artifacts:
-    - path: ".gitea/workflows/ci.yml"
-      provides: "PR-triggered harness job running the Phase 7 mobile harness"
-      contains: "test:e2e"
+    - path: '.gitea/workflows/ci.yml'
+      provides: 'PR-triggered harness job running the Phase 7 mobile harness'
+      contains: 'test:e2e'
  key_links:
-    - from: ".gitea/workflows/ci.yml (harness job)"
-      to: "apps/pwa/e2e/global-setup.ts"
-      via: "DEV_AUTH_BYPASS + PLAYWRIGHT_BASE_URL + DB_* env → pnpm test:e2e"
-      pattern: "DEV_AUTH_BYPASS"
-    - from: "harness job"
-      to: "API :3000"
-      via: "background node dist/index.js + curl /health readiness loop"
-      pattern: "localhost:3000/health"
+    - from: '.gitea/workflows/ci.yml (harness job)'
+      to: 'apps/pwa/e2e/global-setup.ts'
+      via: 'DEV_AUTH_BYPASS + PLAYWRIGHT_BASE_URL + DB_* env → pnpm test:e2e'
+      pattern: 'DEV_AUTH_BYPASS'
+    - from: 'harness job'
+      to: 'API :3000'
+      via: 'background node dist/index.js + curl /health readiness loop'
+      pattern: 'localhost:3000/health'
 ---

 <objective>
@@ -57,11 +57,13 @@ The orchestration order in 08-RESEARCH §Dev-Stack Bring-Up is mandatory and SEQ
 </context>

 <artifacts_this_phase_produces>
+
 - `.gitea/workflows/ci.yml` (EXTENDED — adds the harness job; created in Plan 02)
-</artifacts_this_phase_produces>
+  </artifacts_this_phase_produces>

 <interface_context>
 Confirmed harness contract (from playwright.config.ts + global-setup.ts + vite.config.ts — do NOT modify these files):
+
 - `playwright.config.ts`: `reuseExistingServer: !process.env.CI` → with CI=true, Playwright STARTS Vite itself (`pnpm --filter @familysync/pwa dev`, :5173). `retries: 2`, `workers: 1`, `reporter: 'github'` are all gated on `process.env.CI`. Two projects: `iphone` (WebKit) + `pixel` (Chromium), both `serviceWorkers: 'block'`.
 - `reporter: 'github'` likely emits invisible output in Gitea (08-RESEARCH Pitfall 5 / D-06). Override the reporter at the CI invocation: pass `--reporter=list,html` (e.g. `pnpm test:e2e -- --reporter=list,html`) OR confirm from 08-01-SUMMARY whether Gitea rendered annotations; if it did, the override is harmless. Do NOT edit playwright.config.ts.
 - `global-setup.ts`: FAILS CLOSED — throws if `NODE_ENV=production` OR if `DEV_AUTH_BYPASS !== 'true'`. It polls `${PLAYWRIGHT_BASE_URL}/health` (via the Vite proxy → :3000), then gates `/api/me` (must be 200 → proves DEV_AUTH_BYPASS reached the API), then mysql2-seeds calendar id=10 + lists for user 1. It reads DB_HOST/DB_PORT/DB_USER/DB_PASSWORD/DB_NAME (DB_HOST default 127.0.0.1).
@@ -70,7 +72,7 @@ Confirmed harness contract (from playwright.config.ts + global-setup.ts + vite.c
 - API start: `dev` script is `node --watch dist/index.js` and needs a prior build. In CI run `pnpm --filter @familysync/api build` (tsc → dist/index.js) then `node apps/api/dist/index.js &` (no --watch; the watcher is irrelevant in CI — Claude's Discretion in D + 08-RESEARCH Pattern 3). Pass DEV_AUTH_BYPASS=true INLINE on the node line (Pitfall 8 — env inheritance across `&` steps is not guaranteed).
 - `npx playwright install --with-deps webkit chromium` must run from `apps/pwa` (where @playwright/test lives). Playwright explicitly says do NOT cache browser binaries (08-RESEARCH).
 - DEV_AUTH_BYPASS user 1 has no CalDAV credential → harness verifies layout/flows, not live event-create (project memory). Specs already account for this; no change.
-</interface_context>
+  </interface_context>

 <tasks>

@@ -95,6 +97,7 @@ Confirmed harness contract (from playwright.config.ts + global-setup.ts + vite.c
      5. Start API as a background process with DEV_AUTH_BYPASS INLINE:
         `NODE_ENV=development DEV_AUTH_BYPASS=true DB_HOST=$DB_HOST DB_PORT=3306 DB_USER=familysync DB_PASSWORD=testpass DB_NAME=familysync node apps/api/dist/index.js & echo $! > /tmp/api.pid` (Pitfall 8). NODE_ENV must be `development` (not production — global-setup refuses; not test — dev-bypass activation checks development per 08-RESEARCH note).
      6. Wait for API :3000: a curl retry loop `until curl -sf http://localhost:3000/health` with a ~60s deadline; on timeout, `kill $(cat /tmp/api.pid)` and `exit 1`. This step-level wait (D-02) ensures the API is up BEFORE Playwright starts Vite — separate from and earlier than global-setup's own poll.
+
  </action>
  <verify>
    <automated>grep -q "harness" .gitea/workflows/ci.yml && grep -q "node apps/api/dist/index.js" .gitea/workflows/ci.yml && grep -q "DEV_AUTH_BYPASS=true node" .gitea/workflows/ci.yml && grep -q "localhost:3000/health" .gitea/workflows/ci.yml && grep -q "db:migrate" .gitea/workflows/ci.yml && ! grep -q "db:push" .gitea/workflows/ci.yml && echo HARNESS_STACK_OK</automated>
@@ -119,6 +122,7 @@ Confirmed harness contract (from playwright.config.ts + global-setup.ts + vite.c
      9. Upload artifacts on failure: a final step `if: failure()` `uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4` (NEVER actions/upload-artifact@v4 — GHES-blocked on Gitea, Pitfall 6) with `name: playwright-traces-${{ github.run_id }}`, `path: apps/pwa/test-results/`, `retention-days: 14` (D-06). Add a final `if: always()` step to `kill $(cat /tmp/api.pid) 2>/dev/null || true` to clean up the API background process.

    Do NOT modify playwright.config.ts, global-setup.ts, vite.config.ts, or any spec — CI owns bring-up only (D-01/D-02; phase boundary).
+
  </action>
  <verify>
    <automated>grep -q "playwright install --with-deps webkit chromium" .gitea/workflows/ci.yml && grep -q "test:e2e" .gitea/workflows/ci.yml && grep -q "PLAYWRIGHT_BASE_URL: http://localhost:5173" .gitea/workflows/ci.yml && grep -q "ChristopherHX/gitea-upload-artifact@v4" .gitea/workflows/ci.yml && ! grep -q "actions/upload-artifact@v4" .gitea/workflows/ci.yml && git diff --quiet -- apps/pwa/playwright.config.ts apps/pwa/e2e/global-setup.ts apps/pwa/vite.config.ts && echo HARNESS_RUN_OK</automated>
@@ -142,20 +146,22 @@ Confirmed harness contract (from playwright.config.ts + global-setup.ts + vite.c
 </tasks>

 <threat_model>
+
 ## Trust Boundaries

-| Boundary | Description |
-|----------|-------------|
+| Boundary              | Description                                                                       |
+| --------------------- | --------------------------------------------------------------------------------- |
 | DEV_AUTH_BYPASS in CI | Bypass auth flag active in the harness job only; must never reach the publish job |
-| CI test DB → seed | global-setup TRUNCATEs tables; fail-closed guards protect against prod DB |
+| CI test DB → seed     | global-setup TRUNCATEs tables; fail-closed guards protect against prod DB         |

 ## STRIDE Threat Register

-| Threat ID | Category | Component | Disposition | Mitigation Plan |
-|-----------|----------|-----------|-------------|-----------------|
-| T-08-06 | Spoofing | DEV_AUTH_BYPASS=true in harness job | mitigate | Bypass is set ONLY in the harness job env, against throwaway DB creds; it never appears in the publish job (Plan 04). global-setup.ts fails closed on NODE_ENV=production and on missing DEV_AUTH_BYPASS, so it cannot wipe/seed an unconfirmed DB (08-RESEARCH Security Domain). |
-| T-08-07 | Tampering | drizzle migrate against CI DB | mitigate | db:migrate only; db:push forbidden (grep gate). Throwaway creds, ephemeral container. |
-| T-08-08 | Denial of Service | dev-server startup race | mitigate | Explicit :3000/health curl loop before Playwright (D-02) on top of global-setup's :5173/health + /api/me gates; MariaDB healthcheck.sh readiness loop before migrate (Pitfall 11). |
+| Threat ID | Category          | Component                           | Disposition | Mitigation Plan                                                                                                                                                                                                                                                                   |
+| --------- | ----------------- | ----------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| T-08-06   | Spoofing          | DEV_AUTH_BYPASS=true in harness job | mitigate    | Bypass is set ONLY in the harness job env, against throwaway DB creds; it never appears in the publish job (Plan 04). global-setup.ts fails closed on NODE_ENV=production and on missing DEV_AUTH_BYPASS, so it cannot wipe/seed an unconfirmed DB (08-RESEARCH Security Domain). |
+| T-08-07   | Tampering         | drizzle migrate against CI DB       | mitigate    | db:migrate only; db:push forbidden (grep gate). Throwaway creds, ephemeral container.                                                                                                                                                                                             |
+| T-08-08   | Denial of Service | dev-server startup race             | mitigate    | Explicit :3000/health curl loop before Playwright (D-02) on top of global-setup's :5173/health + /api/me gates; MariaDB healthcheck.sh readiness loop before migrate (Pitfall 11).                                                                                                |
+
 </threat_model>

 <verification>
@@ -165,10 +171,11 @@ Confirmed harness contract (from playwright.config.ts + global-setup.ts + vite.c
 </verification>

 <success_criteria>
+
 - CI-01 (harness half): PR to main brings up API + PWA dev servers + MariaDB with DEV_AUTH_BYPASS and runs the Phase 7 specs headlessly; failure gates merge (ROADMAP criterion 3).
 - Readiness: waits for both :3000 and :5173 before Playwright (ROADMAP criterion 4; Pitfall dev-stack races).
 - Phase 7 specs reused UNCHANGED (phase boundary); both device profiles run (D-05); traces upload on failure (D-06).
-</success_criteria>
+  </success_criteria>

 <output>
 Create `.planning/phases/08-gitea-ci/08-03-SUMMARY.md` when done. Record: final API readiness timeout, whether the reporter override was needed, WebKit-deps install outcome on the runner, and confirmation no Phase 7 harness file was modified.