Add prettier and wrangler build pre-commit hooks

Add prettier hook for JS/TS/CSS/HTML files (excludes Go-generated
wasm_exec.js). Add wrangler build hook to validate Cloudflare Pages
Functions TypeScript on commit. Format existing web files.

Author: danielewood

.pre-commit-config.yaml

@@ -29,6 +29,23 @@ repos:
         types: [go]
         pass_filenames: false
 
+  - repo: https://github.com/pre-commit/mirrors-prettier
+    rev: v4.0.0-alpha.8
+    hooks:
+      - id: prettier
+        types_or: [javascript, ts, css, html]
+        exclude: wasm_exec\.js$
+
+  - repo: local
+    hooks:
+      - id: wrangler-build
+        name: wrangler build
+        entry: bash -c 'cd web && wrangler pages functions build --outdir /tmp/certkit-fn-check'
+        language: system
+        files: ^web/functions/
+        types: [ts]
+        pass_filenames: false
+
   - repo: https://github.com/igorshubovych/markdownlint-cli
     rev: v0.43.0
     hooks:

CLAUDE.md

@@ -381,7 +381,7 @@ pre-commit install
 pre-commit run --all-files  # Manual run against all files
 ```
 
-Configured hooks: `goimports`, `go vet`, `go build`, `go test`, `markdownlint`.
+Configured hooks: `goimports`, `go vet`, `go build`, `go test`, `prettier`, `wrangler build`, `markdownlint`.
 
 ### Tooling gates
 

web/functions/api/fetch.ts

@@ -10,17 +10,18 @@ const MAX_RESPONSE_SIZE = 256 * 1024; // 256KB — certs are small
 // Allowed origins for CORS. The proxy only serves requests from these origins.
 const ALLOWED_ORIGINS: string[] = [
   "https://certkit.pages.dev",
-  "http://localhost:8080",  // local dev (make wasm-serve)
-  "http://localhost:8788",  // wrangler pages dev
+  "http://localhost:8080", // local dev (make wasm-serve)
+  "http://localhost:8788", // wrangler pages dev
 ];
 
 function corsHeaders(origin: string | null): Record<string, string> {
-  const allowed = origin && ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0];
+  const allowed =
+    origin && ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0];
   return {
     "Access-Control-Allow-Origin": allowed,
     "Access-Control-Allow-Methods": "GET, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type",
-    "Vary": "Origin",
+    Vary: "Origin",
   };
 }
 
@@ -144,7 +145,7 @@ const ALLOWED_DOMAINS: string[] = [
 function isAllowedDomain(hostname: string): boolean {
   const lower = hostname.toLowerCase();
   return ALLOWED_DOMAINS.some(
-    (domain) => lower === domain || lower.endsWith("." + domain)
+    (domain) => lower === domain || lower.endsWith("." + domain),
   );
 }
 
@@ -238,15 +239,19 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
 
   // Block query strings and fragments — AIA URLs are static file paths
   if (parsed.search || parsed.hash) {
-    return errorResponse(400, "Query strings and fragments are not allowed", origin);
+    return errorResponse(
+      400,
+      "Query strings and fragments are not allowed",
+      origin,
+    );
   }
 
   if (!isAllowedDomain(parsed.hostname)) {
     return errorResponse(
       403,
       `Domain '${parsed.hostname}' is not in the allow list. ` +
         "This proxy only fetches from known CA AIA endpoints.",
-      origin
+      origin,
     );
   }
 
@@ -262,7 +267,11 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
     !path.endsWith("/") &&
     !path.endsWith(".crl")
   ) {
-    return errorResponse(403, "URL path does not look like a certificate file", origin);
+    return errorResponse(
+      403,
+      "URL path does not look like a certificate file",
+      origin,
+    );
   }
 
   // Reconstruct from validated components — never forward the raw input URL.
@@ -309,7 +318,10 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
       responseHeaders.set("Content-Length", body.byteLength.toString());
       responseHeaders.set("X-Content-Type-Options", "nosniff");
       // Cache forever — AIA certificates are immutable (same URL = same cert)
-      responseHeaders.set("Cache-Control", "public, max-age=31536000, immutable");
+      responseHeaders.set(
+        "Cache-Control",
+        "public, max-age=31536000, immutable",
+      );
 
       return new Response(body, { status: 200, headers: responseHeaders });
     } catch {
@@ -321,7 +333,11 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
   return errorResponse(lastStatus, lastMessage, origin);
 };
 
-function errorResponse(status: number, message: string, origin: string | null): Response {
+function errorResponse(
+  status: number,
+  message: string,
+  origin: string | null,
+): Response {
   return new Response(JSON.stringify({ error: message }), {
     status,
     headers: { ...corsHeaders(origin), "Content-Type": "application/json" },