@almadar/orb 16.9.1 → 17.0.0

package/README.md

@@ -14,6 +14,11 @@ Or use the curl installer:
 curl -fsSL https://orb.almadar.io/install.sh | sh
 ```
 
+The installer populates the user store (`~/.orb`) with `@almadar/std` so `orb validate`/`orb verify`
+resolve std behaviors right away; a project can pin its own std instead with
+`orb behaviors install @almadar/std`. Offline, install from a tarball:
+`orb behaviors install --global ./almadar-std-<v>.tgz`.
+
 ## Usage
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/orb",
-  "version": "16.9.1",
+  "version": "17.0.0",
   "description": "Orb CLI - deterministic when it can be, intelligent when it needs to be",
   "license": "BSL-1.1",
   "repository": {
@@ -49,10 +49,13 @@
     "node": ">=16.0.0"
   },
   "optionalDependencies": {
-    "@almadar/orb-darwin-x64": "16.9.1",
-    "@almadar/orb-darwin-arm64": "16.9.1",
-    "@almadar/orb-linux-x64": "16.9.1",
-    "@almadar/orb-linux-arm64": "16.9.1",
-    "@almadar/orb-windows-x64": "16.9.1"
+    "@almadar/orb-darwin-x64": "17.0.0",
+    "@almadar/orb-darwin-arm64": "17.0.0",
+    "@almadar/orb-linux-x64": "17.0.0",
+    "@almadar/orb-linux-arm64": "17.0.0",
+    "@almadar/orb-windows-x64": "17.0.0"
+  },
+  "almadar": {
+    "stdRange": "^16"
   }
 }

package/scripts/postinstall.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
 const platform = process.platform;
 const arch = process.arch;
@@ -49,3 +50,40 @@ console.log(`Orb CLI installed for ${platform}-${arch}:`);
 console.log(`  Binary:  ${hasBinary ? 'ok' : 'missing'}`);
 console.log(`  Bun:     ${hasBun ? 'ok' : 'not bundled (agent features require bun on PATH)'}`);
 console.log(`  Agent:   ${hasAgent ? 'ok' : 'not bundled (agent features unavailable)'}`);
+
+// Behaviors are installed packages, not baked into the binary (Phase 2): populate
+// the user store (~/.orb) with @almadar/std so `orb validate`/`orb verify` resolve
+// std behaviors out of the box. `stdRange` is `^<major>` of the std this release
+// was built against (almadar.stdRange in package.json, written by build-orb-cli.yml
+// from the orbital-rust pin) so a later std major never silently swaps underneath
+// an already-installed CLI.
+const stdRange = (require('../package.json').almadar || {}).stdRange;
+
+if (hasBinary && hasBun && stdRange) {
+  const binaryPath = path.join(platformDir, binaryName);
+  const bunPath = path.join(platformDir, bunName);
+  const manualCommand = 'orb behaviors install --global @almadar/std';
+
+  let result;
+  try {
+    result = spawnSync(binaryPath, ['behaviors', 'install', '--global', `@almadar/std@${stdRange}`], {
+      env: { ...process.env, ORB_BUN_PATH: bunPath },
+      stdio: 'inherit',
+      timeout: 600000,
+    });
+  } catch (err) {
+    console.warn(`\n  Orb CLI: failed to install @almadar/std (${err.message})`);
+    console.warn(`  Run manually: ${manualCommand}\n`);
+    process.exit(0);
+  }
+
+  if (!result || result.status !== 0) {
+    console.warn('\n  Orb CLI: @almadar/std install did not complete');
+    console.warn(`  Run manually: ${manualCommand}\n`);
+  }
+} else if (hasBinary && !hasBun) {
+  console.warn('\n  Orb CLI: bun not bundled, skipping @almadar/std install');
+  console.warn('  Run manually once bun is available: orb behaviors install --global @almadar/std\n');
+}
+
+process.exit(0);

package/shells/almadar-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/shell",
-  "version": "2.15.0",
+  "version": "2.115.0",
   "private": false,
   "description": "Minimal full-stack shell template for Almadar applications",
   "packageManager": "pnpm@10.30.3",
@@ -9,6 +9,7 @@
     "build": "pnpm run -r build",
     "typecheck": "turbo run typecheck",
     "lint": "turbo run lint",
+    "prepack": "node -e \"const fs=require('fs');if(fs.existsSync('packages'))for(const p of fs.readdirSync('packages'))for(const j of ['.turbo','package-lock.json']){const t='packages/'+p+'/'+j;if(fs.existsSync(t))fs.rmSync(t,{recursive:true,force:true});}\"",
     "prepare": "git rev-parse --git-dir > /dev/null 2>&1 && git config core.hooksPath .githooks || true"
   },
   "devDependencies": {
@@ -19,11 +20,24 @@
     "overrides": {
       "@tootallnate/once": "^3.0.1",
       "esbuild": "^0.25.0",
-      "flatted": "^3.4.1"
+      "flatted": "^3.4.1",
+      "protobufjs": ">=7.5.8 <8",
+      "node-forge": "^1.4.0",
+      "fast-xml-parser": "^5.7.0",
+      "fast-xml-builder": ">=1.1.7",
+      "express>path-to-regexp": "0.1.13",
+      "qs": "^6.15.2",
+      "lodash-es": "^4.18.0"
     }
   },
   "files": [
-    "dist"
+    "packages",
+    "locales",
+    "pnpm-workspace.yaml",
+    "turbo.json",
+    "pnpm-lock.yaml",
+    ".env.example",
+    ".gitignore"
   ],
   "repository": {
     "type": "git",

package/shells/almadar-shell/packages/client/package.json

@@ -13,12 +13,12 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/core": "^7.14.3",
-    "@almadar/evaluator": "^2.11.2",
-    "@almadar/logger": "^1.3.0",
-    "@almadar/patterns": "^2.30.2",
-    "@almadar/syntax": "^1.4.0",
-    "@almadar/ui": "^4.55.0",
+    "@almadar/core": "^10.99.0",
+    "@almadar/evaluator": "^2.47.0",
+    "@almadar/logger": "^1.12.0",
+    "@almadar/patterns": "^2.101.0",
+    "@almadar/syntax": "^1.17.0",
+    "@almadar/ui": "^6.31.0",
     "@monaco-editor/react": "^4.7.0",
     "@react-three/drei": "^9.92.0",
     "@react-three/fiber": "^9.0.0",
@@ -43,7 +43,7 @@
     "zustand": "^5.0.3"
   },
   "devDependencies": {
-    "@almadar/eslint-plugin": "^2.8.1",
+    "@almadar/eslint-plugin": "^2.18.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.1.0",
     "@types/react": "^19.0.0",

package/shells/almadar-shell/packages/client/src/App.tsx

@@ -11,14 +11,19 @@
  * - react-router is optional for URL bookmarkability
  */
 
+import React from 'react';
 import { BrowserRouter, Routes, Route } from 'react-router-dom';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { ThemeProvider, UISlotProvider } from '@almadar/ui/context';
-import { UISlotComponent, NotifyListener } from '@almadar/ui/components';
+import { UISlotComponent } from '@almadar/ui/components';
 import {
   EventBusProvider,
+  UserProvider,
   VerificationProvider,
 } from '@almadar/ui/providers';
+import { normalizeUserContext } from '@almadar/core';
+import { AuthProvider, useAuthContext } from './features/auth';
+import { PersonaSwitcher } from './features/auth/components/PersonaSwitcher';
 import { NavigationProvider } from '@almadar/ui/renderer';
 import { I18nProvider, createTranslate } from '@almadar/ui/hooks';
 import defaultLocale from '@almadar/ui/locales/en.json';
@@ -43,11 +48,25 @@ const queryClient = new QueryClient({
   },
 });
 
+/**
+ * Bridges the signed-in viewer into `UserProvider`. Generated trait hooks read
+ * `@user.x` through `useUser()`, so without this every role gate takes its
+ * negative branch and every "only mine" list renders empty — with no error, since
+ * `useUser()` falls back to anonymous. `normalizeUserContext` maps the provider's
+ * `uid`/`displayName` onto the `id`/`name` the behaviors read.
+ */
+function ViewerProvider({ children }: { children: React.ReactNode }) {
+  const { user } = useAuthContext();
+  return <UserProvider user={normalizeUserContext(user) ?? null}>{children}</UserProvider>;
+}
+
 function App() {
   return (
     <I18nProvider value={i18nValue}>
     <QueryClientProvider client={queryClient}>
       <ThemeProvider defaultTheme="minimalist">
+       <AuthProvider>
+        <ViewerProvider>
         <EventBusProvider>
           <VerificationProvider>
             <UISlotProvider>
@@ -66,12 +85,14 @@ function App() {
                   {/* Portal slots rendered by compiled trait views via CompiledPortal */}
                   {/* Toast notifications (non-overlapping, always safe to render here) */}
                   <UISlotComponent slot="toast" portal />
-                  <NotifyListener />
+                  <PersonaSwitcher />
                 </BrowserRouter>
               </NavigationProvider>
             </UISlotProvider>
           </VerificationProvider>
         </EventBusProvider>
+        </ViewerProvider>
+       </AuthProvider>
       </ThemeProvider>
     </QueryClientProvider>
     </I18nProvider>

package/shells/almadar-shell/packages/client/src/config/firebase.ts

@@ -1,8 +1,8 @@
 import { initializeApp, getApps, getApp, FirebaseApp } from 'firebase/app';
 import { getAuth, Auth } from 'firebase/auth';
 
-let app: FirebaseApp;
-let auth: Auth;
+let app: FirebaseApp | undefined;
+let auth: Auth | undefined;
 
 export async function initializeFirebase(): Promise<void> {
   if (getApps().length > 0) {
@@ -30,8 +30,29 @@ export async function initializeFirebase(): Promise<void> {
     };
   }
 
+  // No credentials anywhere — auth stays disabled instead of crashing
+  // the app boot with auth/invalid-api-key.
+  if (!config.apiKey) {
+    console.warn('Firebase not configured — auth disabled (set VITE_APP_FIREBASE_* env vars)');
+    return;
+  }
+
   app = initializeApp(config);
   auth = getAuth(app);
 }
 
+export function requireAuth(): Auth {
+  if (!auth) {
+    throw new Error('Firebase auth is not configured — set VITE_APP_FIREBASE_* env vars');
+  }
+  return auth;
+}
+
+// True once Firebase initialized with real credentials. When false the
+// app runs in auth-disabled mode: route guards pass through and sign-in
+// actions report the missing config instead of crashing the boot.
+export function isAuthEnabled(): boolean {
+  return auth !== undefined;
+}
+
 export { auth, app };

package/shells/almadar-shell/packages/client/src/config/mockAuth.ts

@@ -0,0 +1,257 @@
+/**
+ * Mock auth — a working sign-up / sign-in when Firebase is not configured.
+ *
+ * Without credentials `requireAuth()` throws and every sign-in reports "not
+ * configured", so a generated app cannot be signed into at all. That matters
+ * beyond convenience: `@user.id` and `@user.role` are what ownership scoping and
+ * role gates resolve against, so with no viewer every "only mine" list is empty
+ * and every role gate takes its negative branch — the app can only be seen as
+ * nobody. Bypassed the moment real Firebase credentials are present.
+ */
+
+import {
+  DEFAULT_VIEWER,
+  encodeDevIdentityToken,
+  findPersonaInRoster,
+  isFieldValue,
+  type FieldValue,
+  type UserContext,
+} from '@almadar/core';
+
+export interface MockUser {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  photoURL: string | null;
+  role?: string;
+  getIdToken(): Promise<string>;
+}
+
+type Listener = (user: MockUser | null) => void;
+
+const STORAGE_KEY = 'almadar.mockAuth.session';
+const REGISTERED_KEY = 'almadar.mockAuth.registered';
+
+/** The role a brand-new or unknown account gets — never `admin`. */
+const DEFAULT_ROLE = 'member';
+
+/** Empty in dev (the Vite proxy forwards /api); the full server URL in prod. */
+const API_BASE: string =
+  typeof import.meta.env.VITE_API_URL === 'string' ? import.meta.env.VITE_API_URL : '';
+
+const listeners = new Set<Listener>();
+const rosterListeners = new Set<() => void>();
+let current: MockUser | null = null;
+let registered: UserContext[] = [];
+let roster: UserContext[] = [];
+
+function toMockUser(p: UserContext): MockUser {
+  return {
+    uid: p.id,
+    email: typeof p.email === 'string' ? p.email : null,
+    displayName: typeof p.name === 'string' ? p.name : null,
+    photoURL: null,
+    role: typeof p.role === 'string' ? p.role : undefined,
+    // The server trusts this only under ALLOW_DEV_AUTH_BYPASS; it carries the
+    // whole persona so server-side `@user.role` matches the client's.
+    getIdToken: () => Promise.resolve(encodeDevIdentityToken(p)),
+  };
+}
+
+/** A stored account, validated field by field — never trust localStorage shape. */
+function readPersona(raw: FieldValue | undefined): UserContext | null {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw) || raw instanceof Date) {
+    return null;
+  }
+  const record: { [key: string]: FieldValue | undefined } = { ...raw };
+  const id = record['id'];
+  if (typeof id !== 'string' || id.length === 0) return null;
+  const persona: UserContext = { id };
+  for (const key of ['email', 'name', 'role'] as const) {
+    const value = record[key];
+    if (typeof value === 'string' && isFieldValue(value)) persona[key] = value;
+  }
+  return persona;
+}
+
+function readRegistered(): UserContext[] {
+  try {
+    const raw = localStorage.getItem(REGISTERED_KEY);
+    if (!raw) return [];
+    const parsed: FieldValue = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.map(readPersona).filter((p): p is UserContext => p !== null);
+  } catch {
+    return [];
+  }
+}
+
+function writeRegistered(list: UserContext[]): void {
+  registered = list;
+  try {
+    localStorage.setItem(REGISTERED_KEY, JSON.stringify(list));
+  } catch {
+    /* storage unavailable — the session stays in memory for this tab */
+  }
+}
+
+/**
+ * The app's personas, fetched from its own server.
+ *
+ * They are the LIVE seeded rows of the app's `[identity]` entity, not a
+ * hardcoded list and not a re-derivation: `@user.id` is what ownership scoping
+ * compares against, so a persona whose id is not literally one of those rows
+ * owns nothing and every "only mine" list renders empty — indistinguishable
+ * from a working filter over no data.
+ *
+ * An app that declares no `[identity]` entity has no roster to serve, so the
+ * shell's own default viewer stands in and sign-in still works.
+ */
+async function loadRoster(): Promise<void> {
+  try {
+    const response = await fetch(`${API_BASE}/api/personas`);
+    if (response.ok) {
+      const data = (await response.json()) as { personas?: UserContext[] };
+      roster = Array.isArray(data.personas) ? data.personas : [];
+    }
+  } catch {
+    /* server unreachable — fall through to the default viewer */
+  }
+  if (roster.length === 0) roster = [DEFAULT_VIEWER];
+  for (const fn of rosterListeners) fn();
+}
+
+function allAccounts(): UserContext[] {
+  return [...roster, ...registered];
+}
+
+function emit(): void {
+  for (const fn of listeners) fn(current);
+}
+
+function persist(user: MockUser | null): void {
+  try {
+    if (user) localStorage.setItem(STORAGE_KEY, JSON.stringify({ uid: user.uid }));
+    else localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* storage unavailable */
+  }
+}
+
+/**
+ * Load the app's roster, then restore a persisted session. Safe to call more
+ * than once.
+ *
+ * The roster is awaited first because a restored session names a persona by id:
+ * resolved before the rows arrive, every stored session would silently fail to
+ * restore and the app would open signed out.
+ */
+export async function initMockAuth(): Promise<void> {
+  registered = readRegistered();
+  await loadRoster();
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return;
+    const parsed: FieldValue = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return;
+    if (parsed instanceof Date) return;
+    const session: { [key: string]: FieldValue | undefined } = { ...parsed };
+    const uid = session['uid'];
+    if (typeof uid !== 'string') return;
+    const found = allAccounts().find((a) => a.id === uid);
+    if (found) {
+      current = toMockUser(found);
+      emit();
+    }
+  } catch {
+    /* ignore a corrupt session */
+  }
+}
+
+/** Every persona that can be signed into — for the dev persona picker. */
+export function listMockAccounts(): readonly UserContext[] {
+  return allAccounts();
+}
+
+/**
+ * Subscribe to roster arrival. The roster loads over HTTP after first paint, so
+ * the persona picker renders empty and must be told when the rows land — the
+ * auth listener cannot carry it, since the signed-out viewer does not change.
+ */
+export function onMockRosterChanged(fn: () => void): () => void {
+  rosterListeners.add(fn);
+  return () => {
+    rosterListeners.delete(fn);
+  };
+}
+
+function newAccount(email: string, displayName?: string): UserContext {
+  return {
+    id: `user-${allAccounts().length + 1}`,
+    email,
+    name: displayName ?? email.split('@')[0] ?? email,
+    role: DEFAULT_ROLE,
+  };
+}
+
+function byEmail(email: string): UserContext | undefined {
+  return allAccounts().find(
+    (a) => typeof a.email === 'string' && a.email.toLowerCase() === email.toLowerCase(),
+  );
+}
+
+function signInAs(account: UserContext): MockUser {
+  current = toMockUser(account);
+  persist(current);
+  emit();
+  return current;
+}
+
+export const mockAuth = {
+  get currentUser(): MockUser | null {
+    return current;
+  },
+
+  onAuthStateChanged(fn: Listener): () => void {
+    listeners.add(fn);
+    // Match Firebase: the listener fires immediately with the current state.
+    fn(current);
+    return () => listeners.delete(fn);
+  },
+
+  /** Any password is accepted; an unknown email signs in as a new end-user. */
+  signInWithEmail(email: string, _password: string): Promise<MockUser> {
+    return Promise.resolve(signInAs(byEmail(email) ?? newAccount(email)));
+  },
+
+  signUpWithEmail(email: string, _password: string, displayName?: string): Promise<MockUser> {
+    if (byEmail(email)) {
+      return Promise.reject(new Error('An account with that email already exists'));
+    }
+    const account = newAccount(email, displayName);
+    writeRegistered([...registered, account]);
+    return Promise.resolve(signInAs(account));
+  },
+
+  /** Sign in directly as a named persona — the dev persona switch. */
+  signInAsPersona(idOrRole: string): Promise<MockUser> {
+    const account =
+      findPersonaInRoster(roster, idOrRole) ??
+      registered.find((a) => a.id === idOrRole || a.role === idOrRole);
+    if (!account) {
+      return Promise.reject(
+        new Error(
+          `Unknown persona "${idOrRole}". Known: ${allAccounts().map((a) => `${a.id}/${String(a.role)}`).join(', ')}`,
+        ),
+      );
+    }
+    return Promise.resolve(signInAs(account));
+  },
+
+  signOut(): Promise<void> {
+    current = null;
+    persist(null);
+    emit();
+    return Promise.resolve();
+  },
+};

package/shells/almadar-shell/packages/client/src/features/auth/AuthContext.tsx

@@ -1,8 +1,8 @@
 import React, { createContext, useContext, useEffect, useState } from 'react';
-import { User } from 'firebase/auth';
 import { auth, initializeFirebase } from '../../config/firebase';
+import { initMockAuth, mockAuth } from '../../config/mockAuth';
 import { authService } from './authService';
-import { AuthContextType } from './types';
+import { AuthContextType, AuthViewer } from './types';
 
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
 
@@ -19,7 +19,7 @@ interface AuthProviderProps {
 }
 
 export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
-  const [user, setUser] = useState<User | null>(null);
+  const [user, setUser] = useState<AuthViewer | null>(null);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 
@@ -27,6 +27,19 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     let unsubscribe: (() => void) | undefined;
 
     initializeFirebase().then(() => {
+      // No Firebase config — subscribe to the persona-backed mock instead of
+      // rendering signed-out forever, so the app can be viewed as each persona.
+      if (!auth) {
+        // Subscribe first: the listener fires immediately with the current
+        // (signed-out) state so the app paints, then again once the roster has
+        // arrived and a persisted session is restored.
+        unsubscribe = mockAuth.onAuthStateChanged((mockUser) => {
+          setUser(mockUser);
+          setLoading(false);
+        });
+        void initMockAuth();
+        return;
+      }
       unsubscribe = auth.onAuthStateChanged((firebaseUser) => {
         setUser(firebaseUser);
         setLoading(false);
@@ -43,7 +56,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithGoogle();
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       const firebaseErr = err as { code?: string; message?: string };
       const isCancel =
@@ -61,7 +74,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmail(email, password);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-in failed');
     }
@@ -72,7 +85,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signUpWithEmail(email, password, displayName);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-up failed');
     }
@@ -88,7 +101,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       };
       await authService.sendSignInLinkToEmail(email, actionCodeSettings);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Failed to send sign-in link');
     }
@@ -99,7 +112,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmailLink(email, emailLink);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Email link sign-in failed');
     }
@@ -115,7 +128,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       await authService.signOut();
       setUser(null);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-out failed');
     }