Refactor codebase, enhance TypeScript checks, and update tooling

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.github/workflows/ci.yml

@@ -20,22 +20,31 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 24
           cache: npm
 
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Check formatting
+        run: npm run format:check
+
+      - name: Run ESLint
+        run: npm run lint
+
+      - name: Run TypeScript checks
+        run: ./node_modules/.bin/tsc --noEmit
+
       - name: Run unit and integration tests with coverage
         run: npm run test:unit:coverage
 
       - name: Build production bundle
-        run: npm run build
+        run: npm run build:app
 
       - name: Verify packed npm artifact
         run: npm run verify:package
@@ -48,7 +57,7 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: test-reports
           if-no-files-found: ignore

.github/workflows/release.yml

@@ -19,6 +19,7 @@ concurrency:
 
 jobs:
   release:
+    environment: release
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
@@ -27,15 +28,16 @@ jobs:
     steps:
       - name: Create release app token
         id: app-token
-        uses: actions/create-github-app-token@v2.1.4
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
+          permission-contents: write
           repositories: ttdash
 
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           ref: main
@@ -78,7 +80,7 @@ jobs:
           fi
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 24
           cache: npm
@@ -115,11 +117,20 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Check formatting
+        run: npm run format:check
+
+      - name: Run ESLint
+        run: npm run lint
+
+      - name: Run TypeScript checks
+        run: ./node_modules/.bin/tsc --noEmit
+
       - name: Run unit and integration tests with coverage
         run: npm run test:unit:coverage
 
       - name: Build production bundle
-        run: npm run build
+        run: npm run build:app
 
       - name: Verify packed npm artifact
         run: npm run verify:package
@@ -131,9 +142,9 @@ jobs:
         run: npm run test:e2e:ci
 
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: latest
+          bun-version: 1.3.4
 
       - name: Create release commit and tag
         run: |

.prettierignore

@@ -0,0 +1,10 @@
+coverage/
+dist/
+node_modules/
+playwright-report/
+test-results/
+.playwright-mcp/
+.tmp-playwright/
+.tmp-smoke-*/
+package-lock.json
+bun.lock

.prettierrc.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json.schemastore.org/prettierrc",
+  "singleQuote": true,
+  "semi": false,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "overrides": [
+    {
+      "files": ["server.js", "usage-normalizer.js", "scripts/**/*.js", "server/**/*.js"],
+      "options": {
+        "semi": true
+      }
+    }
+  ]
+}

AGENTS.md

@@ -1,27 +1,35 @@
 # Repository Guidelines
 
 ## Project Structure & Module Organization
+
 `src/` contains the Vite frontend. Use `components/` for UI, grouped by `ui/`, `layout/`, `cards/`, `charts/`, `tables/`, and `features/`. Put shared logic in `lib/`, reusable stateful logic in `hooks/`, and TypeScript shapes in `types/`. Static assets live in `public/`. The production bundle is generated into `dist/`. `server.js` serves `dist/`, exposes `/api`, and handles local data import.
 
 ## Build, Test, and Development Commands
+
 Install dependencies with `npm install`.
 
 - `npm run dev`: starts the Vite dev server on port `5173`.
 - `node server.js`: runs the local API/static server on port `3000`.
-- `npm run build`: creates the production bundle in `dist/`.
+- `npm run build`: runs `prettier --check`, `eslint`, and then creates the production bundle in `dist/`.
+- `npm run build:app`: creates the production bundle in `dist/` without the lint/format gate.
+- `npm run verify`: runs the main local quality gate (`format:check`, `lint`, `tsc --noEmit`, unit tests, `build:app`, and `verify:package`).
 - `npm run preview`: serves the built frontend for a production-style check.
 - `npm start`: runs the packaged server entrypoint.
 
 During development, keep `npm run dev` and `node server.js` running in separate terminals so `/api` requests resolve correctly.
 
 ## Coding Style & Naming Conventions
+
 Frontend code is TypeScript + React. Follow the existing style: 2-space indentation, single quotes, trailing commas where the formatter leaves them, and no semicolons in `src/` files. Component, hook, and type filenames use PascalCase or descriptive kebab-free names such as `Dashboard.tsx`, `use-usage-data.ts`, and `formatters.ts`. Keep utilities small and colocate feature-specific UI under `src/components/features/`. In `server.js`, preserve the current CommonJS style and semicolon usage instead of rewriting it to match the frontend.
 
 ## Testing Guidelines
-Automated tests are part of the repo now. Before opening a PR, run `npm run build`, `npm run test:unit`, `npm run verify:package`, and `npm run test:e2e`. If local port `3015` is already in use, run Playwright with `PLAYWRIGHT_TEST_PORT=3016 npm run test:e2e`. Continue to manually verify the main flows affected by the change: dashboard load, auto-import, JSON upload, filtering, and export actions. If you add tests, prefer focused `*.test.ts` or `*.test.tsx` coverage for data transforms, hooks, or complex UI behavior.
+
+Automated tests are part of the repo now. Before opening a PR, run `npm run verify` and `npm run test:e2e`. If you want the same gate the release workflow uses, also run `npm run test:unit:coverage`. If local port `3015` is already in use, run Playwright with `PLAYWRIGHT_TEST_PORT=3016 npm run test:e2e`. Continue to manually verify the main flows affected by the change: dashboard load, auto-import, JSON upload, filtering, and export actions. If you add tests, prefer focused `*.test.ts` or `*.test.tsx` coverage for data transforms, hooks, or complex UI behavior.
 
 ## Commit & Pull Request Guidelines
+
 Recent history favors short, imperative subjects, often with a version prefix, for example `v5.3.1: Fix timezone bug` or `Fix install.sh -e output`. Keep commits narrowly scoped. PRs should explain the user-visible change, note any manual verification performed, link related issues, and include screenshots or GIFs for UI changes.
 
 ## Configuration Tips
+
 Use `PORT=8080 node server.js` to override the default server port. Do not commit generated `dist/` output or local usage data unless the change explicitly requires it.