style: apply prettier to the repo's declared format surface

apps/api/src/infrastructure/database/backup.test.ts

@@ -48,8 +48,7 @@ describe('verified backup, restore, and rollback foundation', () => {
     ]);
     copy.close();
     expect(snapshot.sha256).toMatch(/^[a-f0-9]{64}$/);
-    if (process.platform !== 'win32')
-      expect((await stat(backupPath)).mode & 0o777).toBe(0o600);
+    if (process.platform !== 'win32') expect((await stat(backupPath)).mode & 0o777).toBe(0o600);
   });
 
   // Activation renames a WAL file that a live connection still holds open;

apps/api/src/infrastructure/database/database.test.ts

@@ -363,8 +363,7 @@ describe('database backup and restore', () => {
     const backupPath = join(directory, 'backup.sqlite');
     await backupDatabase(database, backupPath);
     // Windows keeps no POSIX mode bits; the 0600 guarantee is POSIX-only.
-    if (process.platform !== 'win32')
-      expect((await lstat(backupPath)).mode & 0o777).toBe(0o600);
+    if (process.platform !== 'win32') expect((await lstat(backupPath)).mode & 0o777).toBe(0o600);
     database.close();
   });
 

apps/api/src/infrastructure/secrets/keychain-secret-store.ts

@@ -1,9 +1,5 @@
 import { spawn } from 'node:child_process';
-import {
-  accountFor,
-  parseSecretAccount,
-  SecretReferenceError,
-} from './secret-reference.js';
+import { accountFor, parseSecretAccount, SecretReferenceError } from './secret-reference.js';
 import type { SecretKey, SecretStore } from './secret-store.js';
 
 const SECURITY_PATH = '/usr/bin/security';

apps/api/src/infrastructure/secrets/secret-backend.test.ts

@@ -62,8 +62,7 @@ describe('FileSecretStore', () => {
       const path = join(directory, 'nested', 'secrets.json');
       const store = new FileSecretStore(path);
       const reference = await store.set({ instanceId: 'x', purpose: 'p', slot: 's' }, 'secret');
-      if (process.platform !== 'win32')
-        expect((await stat(path)).mode & 0o777).toBe(0o600);
+      if (process.platform !== 'win32') expect((await stat(path)).mode & 0o777).toBe(0o600);
       expect(await readdir(join(directory, 'nested'))).toEqual(['secrets.json']);
       const raw = await readFile(path, 'utf8');
       expect(JSON.parse(raw)).toEqual({
@@ -126,7 +125,11 @@ describe('secret backend selection', () => {
   it('builds the matching store and refuses keychain off macOS', () => {
     const directory = join(tmpdir(), 'msa-backend-selection');
     expect(
-      createDefaultSecretStore({ env: {}, secretFilePath: join(directory, 's.json'), platform: 'linux' }),
+      createDefaultSecretStore({
+        env: {},
+        secretFilePath: join(directory, 's.json'),
+        platform: 'linux',
+      }),
     ).toBeInstanceOf(FileSecretStore);
     expect(
       createDefaultSecretStore({

apps/api/src/infrastructure/secrets/secret-reference.ts

@@ -97,8 +97,8 @@ export function parseSecretReference(reference: string): ParsedSecretReference {
   if (!match?.[1] || !match[2])
     throw new SecretReferenceError('INVALID_REFERENCE', 'Secret reference is invalid');
   const scheme = match[1];
-  const provider = scheme === 'keychain' ? 'macos-keychain' : scheme === 'secret-file' ? 'secret-file' : undefined;
-  if (!provider)
-    throw new SecretReferenceError('INVALID_REFERENCE', 'Secret reference is invalid');
+  const provider =
+    scheme === 'keychain' ? 'macos-keychain' : scheme === 'secret-file' ? 'secret-file' : undefined;
+  if (!provider) throw new SecretReferenceError('INVALID_REFERENCE', 'Secret reference is invalid');
   return parseSecretAccount(match[2], provider);
 }