Replace pnpm-lock.yaml with package-lock.json. Four of the five overrides move
across unchanged, ranges intact.
postcss needed a different shape: npm rejects an override that disagrees with a
direct dependency (EOVERRIDE), and postcss was a devDependency at ^8.5.15 while
the override floored it at >=8.5.18. The devDependency now sits at the advisory
floor and the override references it as $postcss, so transitive copies follow
the same resolution the pnpm override produced.
brace-expansion is still deliberately not overridden. It resolves to 1.1.18 for
eslint's minimatch 3.x chain and 5.0.9 elsewhere; 1.1.18 is a patched 1.x, which
did not exist when the exception was written, so eslint runs clean and the
advisory is gone.
.npmrc held only pnpm-specific settings (verify-deps-before-run,
ignored-build-scripts-status-warn-only) and is removed. db:push, the Playwright
webServer command, and the secret-leak pathspec all referenced pnpm and would
have broken.
The repo had zero tests despite PLAN §7 mandating them.
- 97 unit tests over the pure logic: checkup/customer/catalog/template Zod
schemas, parseNum, computeAge, and invoice math
- extracted lib/billing/totals.ts (sumLineTotals/formatVnd) so invoice math is
testable, and refactored the invoice route + dashboard to use it
- 16 Playwright smoke tests that need no database: auth gates redirect to
sign-in, VI-default rendering, password-reveal toggle, /en locale, 404
- playwright.config passes placeholder env inline via webServer.env so no
env file is ever needed; pnpm test wired into CI (E2E stays local)
tests/e2e/README.md documents the seeded-data prerequisites for the full
queue -> checkup -> prescription -> paid -> invoice happy path, which is
blocked on a provisioned Supabase project rather than faked with skipped tests.
tiennm99