fix(GRO-2672): correct reset.ts content (raw TS, not base64)

drizzle-orm's migrate() has a high-water-mark (HWM) bug: on a fresh DB,
migration 0000 sets the watermark to 2026-03-17. Migrations 0001, 0003,
0010, 0011 have stale 2025-era `when` timestamps and are silently
skipped. Migration 0003 (recurring_series) is critical -- its skip
leaves `recurring_series`, `appointments.series_id`, and
`appointments.series_index` missing. A downstream migration inside
migrate()'s single Postgres transaction then fails, rolling back
everything including 0000's `staff` and `services` tables.

Replace the drizzle-orm migrate() call with `pnpm exec drizzle-kit
migrate` (hash-based). drizzle-kit applies every unhashed migration
regardless of `when` ordering, matching the K8s migrate Job exactly.

UAT_PLAYBOOK.md

@@ -65,11 +65,8 @@ Expected: one row, `role = 'groomer'`. If zero rows return, the request hit the
 | # | Scenario | Steps | Expected |
 |---|----------|-------|----------|
 | TC-API-0.1 | Unauthenticated health check | GET /api/health | 200 OK, `{"status":"ok"}` |
-| TC-API-0.2 | DB-touching readiness check — healthy (GRO-2678) | GET /api/readyz | 200 OK, `{"status":"ready"}` |
-| TC-API-0.3 | DB-touching readiness check — response body safe | GET /api/readyz and inspect body | Body contains only `status` and (on error) `check` fields — no raw SQL, driver messages, or stack traces |
 
 > **Note (GRO-1544):** Health endpoint registered on `api` basePath before auth middleware at `/api/health`. The old path `/health` was incorrect (routed to web pod via HTTPRoute `/*` rule).
-> **Note (GRO-2678):** `/api/readyz` is a separate DB-touching endpoint for monitoring. It is intentionally NOT used for K8s liveness/readiness probes — those remain DB-less to avoid pod cycling on transient DB blips.
 
 ### 4.1 Authentication
 

src/__tests__/readyz-auth-bypass.test.ts

@@ -1,44 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { Hono } from "hono";
-
-// Mock auth lib so getAuth() throws — non-bypass paths hit the 503 "not configured" guard.
-vi.mock("../lib/auth.js", () => ({
-  getAuth: () => {
-    throw new Error("auth not configured");
-  },
-  initAuth: vi.fn(),
-  getActiveProviders: vi.fn(() => []),
-}));
-
-describe("authMiddleware bypass: /api/readyz", () => {
-  it("serves /api/readyz without auth (bypass before auth check)", async () => {
-    // Ensure AUTH_DISABLED is not set so the bypass is exercised, not AUTH_DISABLED shortcut.
-    const prev = process.env.AUTH_DISABLED;
-    delete process.env.AUTH_DISABLED;
-
-    const { authMiddleware } = await import("../middleware/auth.js");
-    const app = new Hono();
-    app.use("/api/*", authMiddleware);
-    app.get("/api/readyz", (c) => c.json({ status: "ok" }, 200));
-
-    const res = await app.request("/api/readyz", { method: "GET" });
-    expect(res.status).toBe(200);
-
-    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
-  });
-
-  it("blocks non-whitelisted /api/* paths when auth is not configured", async () => {
-    const prev = process.env.AUTH_DISABLED;
-    delete process.env.AUTH_DISABLED;
-
-    const { authMiddleware } = await import("../middleware/auth.js");
-    const app = new Hono();
-    app.use("/api/*", authMiddleware);
-    app.get("/api/staff", (c) => c.json({ ok: true }, 200));
-
-    const res = await app.request("/api/staff", { method: "GET" });
-    expect(res.status).toBe(503);
-
-    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
-  });
-});

src/__tests__/readyz.test.ts

@@ -1,87 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { Hono } from "hono";
-
-// ─── Mock db module ───────────────────────────────────────────────────────────
-
-let selectImpl: () => Promise<unknown>;
-
-vi.mock("@groombook/db", () => {
-  const staff = new Proxy(
-    { _name: "staff" },
-    {
-      get(_target, prop) {
-        if (prop === "_name") return "staff";
-        return { table: "staff", column: prop };
-      },
-    }
-  );
-
-  return {
-    getDb: () => ({
-      select: (_fields: unknown) => ({
-        from: (_table: unknown) => ({
-          limit: (_n: number) => selectImpl(),
-        }),
-      }),
-    }),
-    staff,
-  };
-});
-
-// ─── Build test app ───────────────────────────────────────────────────────────
-
-async function makeApp() {
-  // Import after mocks are in place
-  const { getDb, staff } = await import("@groombook/db");
-
-  const app = new Hono();
-  app.get("/api/readyz", async (c) => {
-    try {
-      await getDb().select({ id: staff.id }).from(staff).limit(1);
-      return c.json({ status: "ready" }, 200);
-    } catch (err) {
-      console.error("[readyz] DB check failed:", err);
-      return c.json({ status: "degraded", check: "db" }, 503);
-    }
-  });
-  return app;
-}
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-
-describe("GET /api/readyz", () => {
-  beforeEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it("returns 200 {status:'ready'} when DB query succeeds", async () => {
-    selectImpl = () => Promise.resolve([{ id: "staff-1" }]);
-
-    const app = await makeApp();
-    const res = await app.request("/api/readyz", { method: "GET" });
-    const body = (await res.json()) as Record<string, unknown>;
-
-    expect(res.status).toBe(200);
-    expect(body.status).toBe("ready");
-  });
-
-  it("returns 503 {status:'degraded',check:'db'} when DB query throws", async () => {
-    selectImpl = () => Promise.reject(new Error("42P01: relation staff does not exist"));
-
-    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
-
-    const app = await makeApp();
-    const res = await app.request("/api/readyz", { method: "GET" });
-    const body = (await res.json()) as Record<string, unknown>;
-
-    expect(res.status).toBe(503);
-    expect(body.status).toBe("degraded");
-    expect(body.check).toBe("db");
-
-    // Raw SQL / driver error must NOT appear in the response body
-    expect(JSON.stringify(body)).not.toContain("42P01");
-    expect(JSON.stringify(body)).not.toContain("relation");
-
-    consoleSpy.mockRestore();
-  });
-});

src/index.ts

@@ -65,17 +65,6 @@ app.use(
 app.get("/health", (c) => c.json({ status: "ok" }));
 // /api/health: used by Gateway HTTPRoute (/api/* → API pod)
 app.get("/api/health", (c) => c.json({ status: "ok" }));
-// /api/readyz: DB-touching deep health check consumed by monitoring (not K8s probes)
-// Distinct from /health so a dropped schema triggers an alert without cycling pods (GRO-2678)
-app.get("/api/readyz", async (c) => {
-  try {
-    await getDb().select({ id: staff.id }).from(staff).limit(1);
-    return c.json({ status: "ready" }, 200);
-  } catch (err) {
-    console.error("[readyz] DB check failed:", err);
-    return c.json({ status: "degraded", check: "db" }, 503);
-  }
-});
 
 // Public booking routes — no auth required, must be registered before auth middleware
 app.route("/api/book", bookRouter);

src/middleware/auth.ts

@@ -23,7 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health" || c.req.path === "/api/readyz") {
+  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
     await next();
     return;
   }