style: apply prettier to the repo's declared format surface

apps/api/src/application/connections/instance-credential-resolver.ts

@@ -24,8 +24,8 @@ export class InstanceCredentialResolver {
         'SELECT external_reference FROM secret_references WHERE instance_id=? AND purpose=? AND provider=?',
       )
       .get(instanceId, PURPOSE, this.options.store.provider) as
-        | { external_reference: string }
+      | { external_reference: string }
-        | undefined;
+      | undefined;
     if (!row) throw new CredentialResolverError('CREDENTIAL_UNAVAILABLE');
     try {
       const parsed = parseSecretReference(row.external_reference);

apps/api/src/application/notifications/central-notification-service.ts

@@ -1232,7 +1232,7 @@ export class CentralNotificationService {
            SET status='pending',updated_at=?
            WHERE status='sending'`,
         )
-        .run(this.#now(), ).changes,
+        .run(this.#now()).changes,
     );
   }
 

apps/api/src/application/system/console-update-service.test.ts

@@ -499,7 +499,10 @@ describe('createSystemdRestartLauncher', () => {
   it('supports the system scope and surfaces systemctl failures', async () => {
     const calls: string[][] = [];
     const launcher = createSystemdRestartLauncher({
-      env: { MULTI_SIMADMIN_SYSTEMD_UNIT: 'multi-simadmin-api.service', MULTI_SIMADMIN_SYSTEMD_SCOPE: 'system' },
+      env: {
+        MULTI_SIMADMIN_SYSTEMD_UNIT: 'multi-simadmin-api.service',
+        MULTI_SIMADMIN_SYSTEMD_SCOPE: 'system',
+      },
       runner: {
         run: async (command, args) => {
           calls.push([command, ...args]);

apps/api/src/application/system/console-update-service.ts

@@ -258,7 +258,11 @@ export function createSystemdRestartLauncher(input: {
     supported,
     async restart() {
       if (!supported)
-        throw new UpdateError('NOT_SUPPORTED', '未配置 systemd 服务单元（MULTI_SIMADMIN_SYSTEMD_UNIT）。', 501);
+        throw new UpdateError(
+          'NOT_SUPPORTED',
+          '未配置 systemd 服务单元（MULTI_SIMADMIN_SYSTEMD_UNIT）。',
+          501,
+        );
       const result = await input.runner.run('systemctl', [scope, 'restart', unit]);
       if (result.code !== 0)
         throw new UpdateError(

apps/api/src/infrastructure/database/backup.test.ts

@@ -48,8 +48,7 @@ describe('verified backup, restore, and rollback foundation', () => {
     ]);
     copy.close();
     expect(snapshot.sha256).toMatch(/^[a-f0-9]{64}$/);
-    if (process.platform !== 'win32')
+    if (process.platform !== 'win32') expect((await stat(backupPath)).mode & 0o777).toBe(0o600);
-      expect((await stat(backupPath)).mode & 0o777).toBe(0o600);
   });
 
   // Activation renames a WAL file that a live connection still holds open;

apps/api/src/infrastructure/database/database.test.ts

@@ -363,8 +363,7 @@ describe('database backup and restore', () => {
     const backupPath = join(directory, 'backup.sqlite');
     await backupDatabase(database, backupPath);
     // Windows keeps no POSIX mode bits; the 0600 guarantee is POSIX-only.
-    if (process.platform !== 'win32')
+    if (process.platform !== 'win32') expect((await lstat(backupPath)).mode & 0o777).toBe(0o600);
-      expect((await lstat(backupPath)).mode & 0o777).toBe(0o600);
     database.close();
   });
 

apps/api/src/infrastructure/secrets/keychain-secret-store.ts

@@ -1,9 +1,5 @@
 import { spawn } from 'node:child_process';
-import {
+import { accountFor, parseSecretAccount, SecretReferenceError } from './secret-reference.js';
-  accountFor,
-  parseSecretAccount,
-  SecretReferenceError,
-} from './secret-reference.js';
 import type { SecretKey, SecretStore } from './secret-store.js';
 
 const SECURITY_PATH = '/usr/bin/security';

apps/api/src/infrastructure/secrets/secret-backend.test.ts

@@ -62,8 +62,7 @@ describe('FileSecretStore', () => {
       const path = join(directory, 'nested', 'secrets.json');
       const store = new FileSecretStore(path);
       const reference = await store.set({ instanceId: 'x', purpose: 'p', slot: 's' }, 'secret');
-      if (process.platform !== 'win32')
+      if (process.platform !== 'win32') expect((await stat(path)).mode & 0o777).toBe(0o600);
-        expect((await stat(path)).mode & 0o777).toBe(0o600);
       expect(await readdir(join(directory, 'nested'))).toEqual(['secrets.json']);
       const raw = await readFile(path, 'utf8');
       expect(JSON.parse(raw)).toEqual({
@@ -126,7 +125,11 @@ describe('secret backend selection', () => {
   it('builds the matching store and refuses keychain off macOS', () => {
     const directory = join(tmpdir(), 'msa-backend-selection');
     expect(
-      createDefaultSecretStore({ env: {}, secretFilePath: join(directory, 's.json'), platform: 'linux' }),
+      createDefaultSecretStore({
+        env: {},
+        secretFilePath: join(directory, 's.json'),
+        platform: 'linux',
+      }),
     ).toBeInstanceOf(FileSecretStore);
     expect(
       createDefaultSecretStore({

apps/api/src/infrastructure/secrets/secret-reference.ts

@@ -97,8 +97,8 @@ export function parseSecretReference(reference: string): ParsedSecretReference {
   if (!match?.[1] || !match[2])
     throw new SecretReferenceError('INVALID_REFERENCE', 'Secret reference is invalid');
   const scheme = match[1];
-  const provider = scheme === 'keychain' ? 'macos-keychain' : scheme === 'secret-file' ? 'secret-file' : undefined;
+  const provider =
-  if (!provider)
+    scheme === 'keychain' ? 'macos-keychain' : scheme === 'secret-file' ? 'secret-file' : undefined;
-    throw new SecretReferenceError('INVALID_REFERENCE', 'Secret reference is invalid');
+  if (!provider) throw new SecretReferenceError('INVALID_REFERENCE', 'Secret reference is invalid');
   return parseSecretAccount(match[2], provider);
 }

apps/api/src/production-control-plane.ts

@@ -10,7 +10,11 @@ import {
 } from './application/system/console-update-service.js';
 import { openDatabase } from './infrastructure/database/database.js';
 import { migrateDatabase } from './infrastructure/database/migrations.js';
-import { createDefaultSecretStore, resolveSecretBackend, defaultSecretFileMetadataCheck } from './infrastructure/secrets/secret-backend.js';
+import {
+  createDefaultSecretStore,
+  resolveSecretBackend,
+  defaultSecretFileMetadataCheck,
+} from './infrastructure/secrets/secret-backend.js';
 import type { SecretStore } from './infrastructure/secrets/secret-store.js';
 import { createProductionUpstream } from './infrastructure/transport/production-upstream.js';
 import { createProductionReadiness, defaultKeychainMetadataCheck } from './production-readiness.js';

apps/api/src/production-gateway.test.ts

@@ -130,8 +130,7 @@ describe('cutover validation and reversible orchestration', () => {
     expect(signals).toEqual([41]);
     expect(starts[0]?.environment?.MULTI_SIMADMIN_GATEWAY_TOKEN).toBe(token);
     const statePath = join(plan.stateDir, 'cutover-state.json');
-    if (process.platform !== 'win32')
+    if (process.platform !== 'win32') expect((await lstat(statePath)).mode & 0o777).toBe(0o600);
-      expect((await lstat(statePath)).mode & 0o777).toBe(0o600);
     expect(await readFile(statePath, 'utf8')).not.toContain(token);
     expect(await rollback(plan, system)).toBe(43);
     expect(signals).toEqual([41, 42]);