@almadar/orb 16.9.1 → 17.0.0

package/shells/almadar-shell-hono/package.json

@@ -1,14 +1,13 @@
 {
   "name": "@almadar/shell-hono",
-  "version": "0.1.2",
-  "private": true,
+  "version": "0.1.88",
   "description": "Minimal full-stack shell template for Almadar applications (Hono server)",
   "workspaces": [
     "packages/*"
   ],
   "scripts": {
-    "dev": "concurrently -n client,server -c blue,green \"bun --filter @app/client dev\" \"bun --filter @app/server dev\"",
-    "build": "bun run --filter @app/shared build && bun run --filter @app/client build && bun run --filter @app/server build",
+    "dev": "concurrently -n client,server -c blue,green \"bun --filter @almadar/shell-hono-client dev\" \"bun --filter @almadar/shell-hono-server dev\"",
+    "build": "turbo run build",
     "serve": "bun run packages/server/src/serve.ts",
     "typecheck": "turbo run typecheck",
     "lint": "turbo run lint",
@@ -19,7 +18,13 @@
     "turbo": "^2.8.17"
   },
   "files": [
-    "dist"
+    "packages",
+    "locales",
+    "pnpm-workspace.yaml",
+    "turbo.json",
+    "pnpm-lock.yaml",
+    ".env.example",
+    ".gitignore"
   ],
   "repository": {
     "type": "git",
@@ -27,5 +32,6 @@
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "packageManager": "pnpm@10.30.3"
 }

package/shells/almadar-shell-hono/packages/client/package.json

@@ -13,11 +13,11 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/ui": ">=4.30.0",
-    "@almadar/syntax": ">=1.4.0",
-    "@almadar/evaluator": ">=2.9.2",
-    "@almadar/patterns": ">=2.18.1",
-    "@almadar/core": ">=5.8.0",
+    "@almadar/ui": "^6.31.0",
+    "@almadar/syntax": "^1.17.0",
+    "@almadar/evaluator": "^2.47.0",
+    "@almadar/patterns": "^2.101.0",
+    "@almadar/core": "^10.99.0",
     "firebase": "^11.4.0",
     "@tanstack/react-query": "^5.67.3",
     "react": "^19.0.0",
@@ -42,7 +42,7 @@
     "postprocessing": "^6.39.0"
   },
   "devDependencies": {
-    "@almadar/eslint-plugin": ">=2.8.0",
+    "@almadar/eslint-plugin": "^2.18.0",
     "@typescript-eslint/parser": "8.56.0",
     "eslint": "10.0.0",
     "@testing-library/react": "^16.1.0",

package/shells/almadar-shell-hono/packages/client/src/App.tsx

@@ -14,9 +14,8 @@
 import { BrowserRouter, Routes, Route } from 'react-router-dom';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { ThemeProvider, UISlotProvider } from '@almadar/ui/context';
-import { UISlotComponent, NotifyListener } from '@almadar/ui/components';
+import { UISlotComponent } from '@almadar/ui/components';
 import {
-  EntityStoreProvider,
   EventBusProvider,
   VerificationProvider,
 } from '@almadar/ui/providers';
@@ -49,7 +48,6 @@ function App() {
     <I18nProvider value={i18nValue}>
     <QueryClientProvider client={queryClient}>
       <ThemeProvider>
-        <EntityStoreProvider>
         <EventBusProvider>
           <VerificationProvider>
             <UISlotProvider>
@@ -68,13 +66,11 @@ function App() {
                   {/* Portal slots rendered by compiled trait views via CompiledPortal */}
                   {/* Toast notifications (non-overlapping, always safe to render here) */}
                   <UISlotComponent slot="toast" portal />
-                  <NotifyListener />
                 </BrowserRouter>
               </NavigationProvider>
             </UISlotProvider>
           </VerificationProvider>
         </EventBusProvider>
-        </EntityStoreProvider>
       </ThemeProvider>
     </QueryClientProvider>
     </I18nProvider>

package/shells/almadar-shell-hono/packages/client/src/config/firebase.ts

@@ -1,8 +1,8 @@
 import { initializeApp, getApps, getApp, FirebaseApp } from 'firebase/app';
 import { getAuth, Auth } from 'firebase/auth';
 
-let app: FirebaseApp;
-let auth: Auth;
+let app: FirebaseApp | undefined;
+let auth: Auth | undefined;
 
 export async function initializeFirebase(): Promise<void> {
   if (getApps().length > 0) {
@@ -30,8 +30,29 @@ export async function initializeFirebase(): Promise<void> {
     };
   }
 
+  // No credentials anywhere — auth stays disabled instead of crashing
+  // the app boot with auth/invalid-api-key.
+  if (!config.apiKey) {
+    console.warn('Firebase not configured — auth disabled (set VITE_APP_FIREBASE_* env vars)');
+    return;
+  }
+
   app = initializeApp(config);
   auth = getAuth(app);
 }
 
+export function requireAuth(): Auth {
+  if (!auth) {
+    throw new Error('Firebase auth is not configured — set VITE_APP_FIREBASE_* env vars');
+  }
+  return auth;
+}
+
+// True once Firebase initialized with real credentials. When false the
+// app runs in auth-disabled mode: route guards pass through and sign-in
+// actions report the missing config instead of crashing the boot.
+export function isAuthEnabled(): boolean {
+  return auth !== undefined;
+}
+
 export { auth, app };

package/shells/almadar-shell-hono/packages/client/src/features/auth/AuthContext.tsx

@@ -27,6 +27,11 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     let unsubscribe: (() => void) | undefined;
 
     initializeFirebase().then(() => {
+      // Auth disabled (no Firebase config) — render without a listener.
+      if (!auth) {
+        setLoading(false);
+        return;
+      }
       unsubscribe = auth.onAuthStateChanged((firebaseUser) => {
         setUser(firebaseUser);
         setLoading(false);
@@ -43,7 +48,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithGoogle();
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       const firebaseErr = err as { code?: string; message?: string };
       const isCancel =
@@ -61,7 +66,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmail(email, password);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-in failed');
     }
@@ -72,7 +77,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signUpWithEmail(email, password, displayName);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-up failed');
     }
@@ -88,7 +93,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       };
       await authService.sendSignInLinkToEmail(email, actionCodeSettings);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Failed to send sign-in link');
     }
@@ -99,7 +104,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmailLink(email, emailLink);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Email link sign-in failed');
     }
@@ -115,7 +120,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       await authService.signOut();
       setUser(null);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-out failed');
     }

package/shells/almadar-shell-hono/packages/client/src/features/auth/authService.ts

@@ -10,7 +10,7 @@ import {
   signInWithEmailLink as firebaseSignInWithEmailLink,
   ActionCodeSettings,
 } from 'firebase/auth';
-import { auth } from '../../config/firebase';
+import { auth, requireAuth } from '../../config/firebase';
 
 const googleProvider = new GoogleAuthProvider();
 
@@ -18,7 +18,7 @@ export const authService = {
   // Google Sign In
   signInWithGoogle: async () => {
     try {
-      const result = await signInWithPopup(auth, googleProvider);
+      const result = await signInWithPopup(requireAuth(), googleProvider);
       return result.user;
     } catch (error) {
       throw error;
@@ -28,7 +28,7 @@ export const authService = {
   // Email/Password Sign In
   signInWithEmail: async (email: string, password: string) => {
     try {
-      const result = await signInWithEmailAndPassword(auth, email, password);
+      const result = await signInWithEmailAndPassword(requireAuth(), email, password);
       return result.user;
     } catch (error) {
       throw error;
@@ -38,7 +38,7 @@ export const authService = {
   // Email/Password Sign Up
   signUpWithEmail: async (email: string, password: string, displayName?: string) => {
     try {
-      const result = await createUserWithEmailAndPassword(auth, email, password);
+      const result = await createUserWithEmailAndPassword(requireAuth(), email, password);
 
       if (displayName) {
         await updateProfile(result.user, { displayName });
@@ -53,7 +53,7 @@ export const authService = {
   // Sign Out
   signOut: async () => {
     try {
-      await firebaseSignOut(auth);
+      await firebaseSignOut(requireAuth());
     } catch (error) {
       throw error;
     }
@@ -62,19 +62,22 @@ export const authService = {
   // Email Link Authentication
   sendSignInLinkToEmail: async (email: string, actionCodeSettings: ActionCodeSettings) => {
     try {
-      await firebaseSendSignInLinkToEmail(auth, email, actionCodeSettings);
+      await firebaseSendSignInLinkToEmail(requireAuth(), email, actionCodeSettings);
     } catch (error) {
       throw error;
     }
   },
 
   isSignInWithEmailLink: (emailLink: string): boolean => {
+    // Predicate evaluated during Login render — degrade, don't throw,
+    // when auth is unconfigured: it simply isn't an email-link sign-in.
+    if (!auth) return false;
     return firebaseIsSignInWithEmailLink(auth, emailLink);
   },
 
   signInWithEmailLink: async (email: string, emailLink: string) => {
     try {
-      const result = await firebaseSignInWithEmailLink(auth, email, emailLink);
+      const result = await firebaseSignInWithEmailLink(requireAuth(), email, emailLink);
       return result.user;
     } catch (error) {
       throw error;

package/shells/almadar-shell-hono/packages/client/src/features/auth/components/ProtectedRoute.tsx

@@ -1,6 +1,7 @@
 import React from 'react';
 import { Navigate } from 'react-router-dom';
 import { useAuthContext } from '../AuthContext';
+import { isAuthEnabled } from '../../../config/firebase';
 
 interface ProtectedRouteProps {
   children: React.ReactNode;
@@ -17,6 +18,14 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     );
   }
 
+  // Auth-disabled mode (no Firebase config): nothing can sign in, so
+  // gating would strand every route on /login — pass straight through.
+  // Checked after `loading` so a configured-but-initializing Firebase
+  // still shows the spinner instead of flashing protected content.
+  if (!isAuthEnabled()) {
+    return <>{children}</>;
+  }
+
   if (!user) {
     return <Navigate to="/login" replace />;
   }

package/shells/almadar-shell-hono/packages/server/package.json

@@ -13,10 +13,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/server-hono": ">=0.2.0",
-    "@almadar/evaluator": ">=2.9.2",
-    "@almadar/core": ">=5.8.0",
-    "@almadar/integrations": ">=2.6.1",
+    "@almadar/server-hono": "^0.4.13",
+    "@almadar/evaluator": "^2.47.0",
+    "@almadar/core": "^10.99.0",
+    "@almadar/integrations": "^2.36.0",
     "hono": "^4.7.0",
     "@hono/node-server": "^1.14.0",
     "@hono/zod-validator": "^0.4.0",
@@ -25,7 +25,7 @@
     "zod": "^3.22.0"
   },
   "devDependencies": {
-    "@almadar/eslint-plugin": ">=2.8.0",
+    "@almadar/eslint-plugin": "^2.18.0",
     "@typescript-eslint/parser": "8.56.0",
     "@types/bun": "^1.1.0",
     "@types/node": "^20.17.19",

package/shells/almadar-shell-hono/packages/server/src/app.ts

@@ -8,8 +8,15 @@ import {
   errorHandler,
   notFoundHandler,
   debugEventsRouter,
+  pushRouter,
+  pushServiceWorkerHandler,
+  PUSH_SERVICE_WORKER_PATH,
+  reportsRouter,
+  createHooksRouter,
   type AppEnv,
 } from '@almadar/server-hono';
+import { hookProviders } from './hooks-providers.js';
+import { broadcastBusEvent } from './sse.js';
 import { registerRoutes } from './routes.js';
 
 export const app = new Hono<AppEnv>();
@@ -23,9 +30,41 @@ app.get('/health', (c) => c.json({ status: 'ok' }));
 // Debug event bus endpoints (dev-only, no-op in production)
 app.route('/api/debug', debugEventsRouter());
 
+// Web Push surface (browser/push-subscribe): public VAPID key + the shared
+// service worker (root-scoped — a SW's max scope is its own directory).
+app.route('/api/push', pushRouter);
+app.get(PUSH_SERVICE_WORKER_PATH, pushServiceWorkerHandler);
+
+// Inbound webhook ingress (I-19 decision): mounted BEFORE the authenticated
+// /api routes — hook senders (Google Calendar watch channels, e-sign status,
+// banking callbacks) cannot present a Firebase token, so each provider
+// VERIFIES its own signature/channel token and unverified requests get 400.
+// Dispatch = SSE bus broadcast to every connected client, so client circuits'
+// `listens` fire; the cron pull cycle stays the no-client backstop.
+app.route(
+  '/api/hooks',
+  createHooksRouter({
+    // Derived from this app's invoked services (generated hooks-providers.ts, I-26).
+    providers: hookProviders(),
+    dispatch: (event, payload) => {
+      broadcastBusEvent(undefined, {
+        type: 'bus',
+        event,
+        payload,
+        source: { orbital: 'webhook', trait: 'ingress' },
+        timestamp: Date.now(),
+      });
+    },
+  }),
+);
+
 // Register generated routes
 registerRoutes(app);
 
+// Server-side report export (Excel/PDF/CSV). Mounted AFTER registerRoutes so
+// the /api/* auth middleware it registers covers this route too.
+app.route('/api/reports', reportsRouter);
+
 // Error handling
 app.notFound(notFoundHandler);
 app.onError(errorHandler);

package/shells/almadar-shell-hono/packages/server/src/hooks-providers.ts

@@ -0,0 +1,11 @@
+/**
+ * Hook Providers
+ *
+ * Checked-in stub so the template builds standalone in CI; the compiler
+ * overwrites it with the provider map derived from the app's invoked
+ * services × the registry's hook declarations (I-26).
+ */
+
+export function hookProviders() {
+  return {};
+}

package/shells/almadar-shell-hono/packages/server/src/index.ts

@@ -4,15 +4,54 @@
 
 import { initializeFirebase, env, logger } from '@almadar/server-hono';
 
-// Initialize Firebase before anything else uses it
-initializeFirebase();
+// Initialize Firebase before anything else uses it. When no credentials
+// are configured (local dev without FIREBASE_*/FIRESTORE_EMULATOR_HOST),
+// boot anyway — a purely client-side app must still serve.
+try {
+  initializeFirebase();
+} catch (e) {
+  const message = e instanceof Error ? e.message : String(e);
+  // In production the real data source IS Firebase (env.ts refuses to boot with
+  // USE_MOCK_DATA=true there), so swallowing this leaves a server that starts
+  // cleanly and then throws on the first request. Fail at boot instead.
+  if (env.NODE_ENV === 'production') {
+    logger.error(`Firebase is required when NODE_ENV=production — refusing to start: ${message}`);
+    throw e;
+  }
+  logger.warn(`Firebase not configured — auth/db routes disabled: ${message}`);
+}
 
 import { serve } from '@hono/node-server';
+import { validateIntegrationEnv, FirestoreCredentialPersistence } from '@almadar/server-hono';
 import { app } from './app.js';
+import { invokedServices, installTenantCredentialStore } from './services/clients.js';
+
+// Fail fast in production when a required integration credential is missing
+// (see SECRETS.md); registers the invoked services for /health reporting.
+validateIntegrationEnv(invokedServices);
 
 const PORT = env.PORT || 3030;
 
 async function start(): Promise<void> {
+  // W4 tenant credential store: with a master key configured, stored
+  // credentials (Firestore rows, AES-256-GCM) layer over the env —
+  // store → env → unconfigured — and go live on change without restart.
+  if (process.env.ALMADAR_CREDENTIAL_MASTER_KEY) {
+    try {
+      await installTenantCredentialStore(new FirestoreCredentialPersistence());
+      logger.info('Tenant credential store installed');
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      // A configured master key IS the deployment's statement that the store
+      // is in use — failing to serve it in production is a boot failure.
+      if (env.NODE_ENV === 'production') {
+        logger.error(`Tenant credential store failed to initialize — refusing to start: ${message}`);
+        throw e;
+      }
+      logger.warn(`Tenant credential store unavailable — falling back to env credentials: ${message}`);
+    }
+  }
+
   // Seed mock data when USE_MOCK_DATA is enabled
   if (env.USE_MOCK_DATA) {
     try {

package/shells/almadar-shell-hono/packages/server/src/serve.ts

@@ -15,8 +15,10 @@ import { join } from 'path';
 const PORT = Number(env.PORT) || 3030;
 const clientDist = join(import.meta.dir, '../../client/dist');
 
-// Seed mock data
-if (env.USE_MOCK_DATA || env.NODE_ENV !== 'production') {
+// Seed mock data. Gated on USE_MOCK_DATA alone, matching the three other server
+// entry points — "not production" is a different question from "is the data
+// source mock", and conflating them seeds a store nothing reads.
+if (env.USE_MOCK_DATA) {
   try {
     const { initializeMockData } = await import(/* @vite-ignore */ './seedMockData.js' as string);
     await initializeMockData();

package/shells/almadar-shell-hono/packages/server/src/services/clients.ts

@@ -0,0 +1,17 @@
+/**
+ * Service Clients — placeholder
+ *
+ * Compiler generates the real service clients here (delegating to
+ * @almadar/integrations; see orbital-shell-typescript codegen/service.rs).
+ * This stub only lets the template build standalone; an emitted app
+ * overwrites it wholesale.
+ */
+
+export const declaredServices = [] as const;
+
+export const invokedServices = [] as const;
+
+/** Overwritten at emit time with the RuntimeIntegrationManager-backed store install. */
+export async function installTenantCredentialStore(_adapter: object): Promise<void> {
+  // {{GENERATED_SERVICE_CLIENTS}}
+}

package/shells/almadar-shell-hono/packages/server/src/sse.ts

@@ -0,0 +1,20 @@
+/**
+ * Live-push SSE channel — placeholder
+ *
+ * Compiler generates the real SSE module here (connection registry +
+ * cross-client broadcast; see orbital-shell-typescript backend/server/sse.rs).
+ * This stub only lets the template build standalone; an emitted app
+ * overwrites it wholesale.
+ */
+
+export interface BusBroadcastItem {
+  type: 'bus';
+  event: string;
+  payload?: object;
+  source: { orbital: string; trait: string };
+  timestamp: number;
+}
+
+export function broadcastBusEvent(_originClientId: string | undefined, _item: BusBroadcastItem): void {
+  // {{GENERATED_SSE_BROADCAST}}
+}

package/shells/almadar-shell-hono/packages/server/tsconfig.json

@@ -5,7 +5,6 @@
     "moduleResolution": "bundler",
     "outDir": "./dist",
     "strict": true,
-    "strictNullChecks": false,
     "esModuleInterop": true,
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true,