fix(19): satisfy CI fast-checks + secret scan

Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/tests/routes/admin.test.ts

@@ -30,7 +30,13 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { randomUUID } from 'node:crypto';
 import { eq } from 'drizzle-orm';
 import { db } from '../../src/db/client.js';
-import { users, memberCredentials, calendars, appConfig, localCredentials } from '../../src/db/schema.js';
+import {
+  users,
+  memberCredentials,
+  calendars,
+  appConfig,
+  localCredentials,
+} from '../../src/db/schema.js';
 import { verifyPassword } from '../../src/auth/localCredentials.js';
 
 // ---------------------------------------------------------------------------
@@ -949,7 +955,8 @@ describe('POST /api/admin/members', () => {
 
   it('Test 3: admin can reset any member password without knowing the current one', async () => {
     const adminId = await seedUser('admin-reset-pw', true);
-    const memberId = await seedUser('member-reset-target', false);
+    // Seeded for DB-state parity; this test creates its own member via the admin API below.
+    await seedUser('member-reset-target', false);
     currentDevUserId = adminId;
     const app = await getApp();
 
@@ -1025,7 +1032,9 @@ describe('POST /api/admin/members', () => {
     // GET /members should show hasLocalCredential:true for this member
     const getRes = await app.fetch(jsonRequest('GET', '/api/admin/members'));
     expect(getRes.status).toBe(200);
-    const body = (await getRes.json()) as { members: Array<{ id: number; hasLocalCredential: boolean }> };
+    const body = (await getRes.json()) as {
+      members: Array<{ id: number; hasLocalCredential: boolean }>;
+    };
 
     const memberRow = body.members.find((m) => m.id === newMemberId);
     expect(memberRow).toBeDefined();

apps/api/tests/routes/authMode.test.ts

@@ -47,15 +47,13 @@ vi.mock('@hono/oidc-auth', () => ({
 }));
 
 vi.mock('../../src/auth/devBypass.js', () => ({
-  devAuthBypass:
-    () => async (_c: unknown, next: () => Promise<void>) => next(),
+  devAuthBypass: () => async (_c: unknown, next: () => Promise<void>) => next(),
   // Phase 19 Option C: devSessionCookieMiddleware is a no-op in tests
   devSessionCookieMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
 }));
 
 vi.mock('../../src/auth/localAuthMiddleware.js', () => ({
-  localAuthMiddleware:
-    () => async (_c: unknown, next: () => Promise<void>) => next(),
+  localAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
 }));
 
 // ---------------------------------------------------------------------------

apps/api/tests/routes/localAuth.test.ts

@@ -34,9 +34,9 @@ vi.mock('../../src/db/client.js', () => ({
     select: vi.fn().mockImplementation(() => ({
       from: vi.fn().mockReturnValue({
         where: vi.fn().mockReturnValue({
-          limit: vi.fn().mockImplementation(() =>
-            Promise.resolve(mockCredRow ? [mockCredRow] : [])
-          ),
+          limit: vi
+            .fn()
+            .mockImplementation(() => Promise.resolve(mockCredRow ? [mockCredRow] : [])),
         }),
       }),
     })),
@@ -57,14 +57,12 @@ let issuedUserId: number | null = null;
 let clearSessionCalled = false;
 
 vi.mock('../../src/auth/localSession.js', () => ({
-  issueLocalSessionCookie: vi.fn().mockImplementation(
-    (_c: unknown, userId: number) => {
-      issueSessionCalled = true;
-      issuedUserId = userId;
-      // Simulate setting a cookie on the context
-      return Promise.resolve();
-    }
-  ),
+  issueLocalSessionCookie: vi.fn().mockImplementation((_c: unknown, userId: number) => {
+    issueSessionCalled = true;
+    issuedUserId = userId;
+    // Simulate setting a cookie on the context
+    return Promise.resolve();
+  }),
   clearLocalSessionCookie: vi.fn().mockImplementation((_c: unknown) => {
     clearSessionCalled = true;
   }),
@@ -76,15 +74,13 @@ vi.mock('../../src/auth/localSession.js', () => ({
 // ---------------------------------------------------------------------------
 
 vi.mock('../../src/auth/devBypass.js', () => ({
-  devAuthBypass:
-    () => async (_c: unknown, next: () => Promise<void>) => next(),
+  devAuthBypass: () => async (_c: unknown, next: () => Promise<void>) => next(),
   // Phase 19 Option C: devSessionCookieMiddleware is a no-op in tests
   devSessionCookieMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
 }));
 
 vi.mock('../../src/auth/localAuthMiddleware.js', () => ({
-  localAuthMiddleware:
-    () => async (_c: unknown, next: () => Promise<void>) => next(),
+  localAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
 }));
 
 vi.mock('@hono/oidc-auth', () => ({
@@ -195,7 +191,9 @@ describe('POST /api/auth/local/login', () => {
     mockCredRow = undefined; // No credential row found
 
     const app = await getApp();
-    const res = await app.fetch(makeLoginRequest({ username: 'unknown-user', password: 'anypassword' }));
+    const res = await app.fetch(
+      makeLoginRequest({ username: 'unknown-user', password: 'anypassword' }),
+    );
 
     expect(res.status).toBe(401);
     const body = (await res.json()) as { error: string };
@@ -212,14 +210,14 @@ describe('POST /api/auth/local/login', () => {
     // 5 failures to trigger the rate window
     for (let i = 0; i < 5; i++) {
       const res = await app.fetch(
-        makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.1')
+        makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.1'),
       );
       expect(res.status).toBe(401);
     }
 
     // 6th attempt from same IP → 429
     const res6 = await app.fetch(
-      makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.1')
+      makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.1'),
     );
     expect(res6.status).toBe(429);
     const body = (await res6.json()) as { error: string };
@@ -233,14 +231,12 @@ describe('POST /api/auth/local/login', () => {
 
     // 10 failures from same IP → lockout
     for (let i = 0; i < 10; i++) {
-      await app.fetch(
-        makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.2')
-      );
+      await app.fetch(makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.2'));
     }
 
     // 11th attempt → 423 (locked)
     const res11 = await app.fetch(
-      makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.2')
+      makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.2'),
     );
     expect(res11.status).toBe(423);
     const body = (await res11.json()) as { error: string };
@@ -252,7 +248,7 @@ describe('POST /api/auth/local/login', () => {
     loginAttempts.delete('alice');
 
     const resAfterReset = await app.fetch(
-      makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.2')
+      makeLoginRequest({ username: 'alice', password: 'wrong' }, '10.0.0.2'),
     );
     expect(resAfterReset.status).toBe(401);
   });
@@ -295,7 +291,7 @@ describe('POST /api/auth/local/login', () => {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', 'x-forwarded-for': '1.2.3.4' },
         body: JSON.stringify({ username: 'mysecretusername' }),
-      })
+      }),
     );
 
     expect(res.status).toBe(400);
@@ -319,7 +315,7 @@ describe('POST /api/auth/local/logout', () => {
       new Request('http://localhost/api/auth/local/logout', {
         method: 'POST',
         headers: { 'x-forwarded-for': '1.2.3.4' },
-      })
+      }),
     );
 
     expect(res.status).toBe(200);
@@ -336,7 +332,7 @@ describe('GET /api/auth/local/logout', () => {
       new Request('http://localhost/api/auth/local/logout', {
         method: 'GET',
         headers: { 'x-forwarded-for': '1.2.3.4' },
-      })
+      }),
     );
 
     expect(res.status).toBe(200);

apps/api/tests/routes/me.test.ts

@@ -290,16 +290,20 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
             where: vi.fn().mockReturnValue({
               limit: vi.fn().mockResolvedValue([{ passwordHash: storedHash, userId: 1 }]),
             }),
-            innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
           }),
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
         } as any;
       }
       // fallback for other selects
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;
@@ -346,7 +350,9 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
             where: vi.fn().mockReturnValue({
               limit: vi.fn().mockResolvedValue([{ passwordHash: storedHash, userId: 1 }]),
             }),
-            innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
           }),
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
         } as any;
@@ -354,7 +360,9 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;
@@ -386,13 +394,18 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
   it('Test 3: user with no local_credentials row → 404', async () => {
     const { db } = await import('../../src/db/client.js');
 
-    vi.mocked(db.select).mockImplementation(() => ({
-      from: vi.fn().mockReturnValue({
-        where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }),
-        innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
-      }),
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any));
+    vi.mocked(db.select).mockImplementation(
+      () =>
+        ({
+          from: vi.fn().mockReturnValue({
+            where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }),
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
+          }),
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        }) as any,
+    );
 
     const { app } = await import('../../src/index.js');
     const res = await app.request('/api/me/password', {
@@ -457,7 +470,9 @@ describe('GET /api/me — hasLocalCredential (AUTH-LOCAL-17)', () => {
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue(limitResult) }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;
@@ -483,7 +498,9 @@ describe('GET /api/me — hasLocalCredential (AUTH-LOCAL-17)', () => {
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue(limitResult) }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;
@@ -520,14 +537,14 @@ describe('linkOidcToUser helper (AUTH-LOCAL-10, T-19-08)', () => {
     let deletedLocalCreds = false;
 
     // Mock: SELECT users WHERE oidc_iss = iss AND oidc_sub = sub → no conflict (empty)
-    let txSelectCount = 0;
     const mockTx = {
       select: vi.fn().mockImplementation(() => {
-        txSelectCount++;
         return {
           from: vi.fn().mockReturnValue({
             where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }), // no conflict
-            innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
           }),
         };
       }),
@@ -545,18 +562,25 @@ describe('linkOidcToUser helper (AUTH-LOCAL-10, T-19-08)', () => {
       })),
     };
 
-    vi.mocked(db.select).mockImplementation(() => ({
-      from: vi.fn().mockReturnValue({
-        where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }), // preflight: no conflict
-        innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
-      }),
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any));
+    vi.mocked(db.select).mockImplementation(
+      () =>
+        ({
+          from: vi.fn().mockReturnValue({
+            where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([]) }), // preflight: no conflict
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
+          }),
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        }) as any,
+    );
 
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    vi.mocked(db).transaction = vi.fn().mockImplementation(async (fn: (tx: any) => Promise<void>) => {
-      await fn(mockTx);
-    });
+    vi.mocked(db).transaction = vi
+      .fn()
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      .mockImplementation(async (fn: (tx: any) => Promise<void>) => {
+        await fn(mockTx);
+      });
 
     await linkOidcToUser(42, iss, sub);
 
@@ -574,15 +598,20 @@ describe('linkOidcToUser helper (AUTH-LOCAL-10, T-19-08)', () => {
     let deletedLocalCreds = false;
 
     // Preflight SELECT finds a conflicting user (id=99, different from target=42)
-    vi.mocked(db.select).mockImplementation(() => ({
-      from: vi.fn().mockReturnValue({
-        where: vi.fn().mockReturnValue({
-          limit: vi.fn().mockResolvedValue([{ id: conflictingUserId }]), // conflict!
-        }),
-        innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
-      }),
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any));
+    vi.mocked(db.select).mockImplementation(
+      () =>
+        ({
+          from: vi.fn().mockReturnValue({
+            where: vi.fn().mockReturnValue({
+              limit: vi.fn().mockResolvedValue([{ id: conflictingUserId }]), // conflict!
+            }),
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
+          }),
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        }) as any,
+    );
 
     // Transaction should NEVER be called on conflict
     const mockTx = {
@@ -593,10 +622,12 @@ describe('linkOidcToUser helper (AUTH-LOCAL-10, T-19-08)', () => {
         }),
       })),
     };
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    vi.mocked(db).transaction = vi.fn().mockImplementation(async (fn: (tx: any) => Promise<void>) => {
-      await fn(mockTx);
-    });
+    vi.mocked(db).transaction = vi
+      .fn()
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      .mockImplementation(async (fn: (tx: any) => Promise<void>) => {
+        await fn(mockTx);
+      });
 
     // Should throw OidcLinkConflictError, not proceed to transaction
     await expect(linkOidcToUser(42, iss, sub)).rejects.toThrow(OidcLinkConflictError);
@@ -611,13 +642,20 @@ describe('linkOidcToUser helper (AUTH-LOCAL-10, T-19-08)', () => {
     const { db } = await import('../../src/db/client.js');
 
     // Mock db — not needed for route shape test but avoids errors
-    vi.mocked(db.select).mockImplementation(() => ({
-      from: vi.fn().mockReturnValue({
-        where: vi.fn().mockReturnValue({ limit: vi.fn().mockResolvedValue([{ isAdmin: false }]) }),
-        innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
-      }),
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any));
+    vi.mocked(db.select).mockImplementation(
+      () =>
+        ({
+          from: vi.fn().mockReturnValue({
+            where: vi
+              .fn()
+              .mockReturnValue({ limit: vi.fn().mockResolvedValue([{ isAdmin: false }]) }),
+            innerJoin: vi.fn().mockReturnValue({
+              innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+            }),
+          }),
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        }) as any,
+    );
 
     const { app } = await import('../../src/index.js');
     const res = await app.request('/api/me/link-oidc', {
@@ -630,7 +668,8 @@ describe('linkOidcToUser helper (AUTH-LOCAL-10, T-19-08)', () => {
     const body = (await res.json()) as { authorizationUrl?: string; state?: string };
     // The response must have at minimum a signedState field (or authorizationUrl)
     // — the exact shape depends on implementation; assert it's an object with a useful field
-    const hasInitiationPayload = 'authorizationUrl' in body || 'state' in body || 'signedState' in body;
+    const hasInitiationPayload =
+      'authorizationUrl' in body || 'state' in body || 'signedState' in body;
     expect(hasInitiationPayload).toBe(true);
   });
 });