@almadar/orb 4.3.0 → 4.7.0

package/shells/almadar-shell/packages/client/src/config/mockAuth.ts

@@ -0,0 +1,257 @@
+/**
+ * Mock auth — a working sign-up / sign-in when Firebase is not configured.
+ *
+ * Without credentials `requireAuth()` throws and every sign-in reports "not
+ * configured", so a generated app cannot be signed into at all. That matters
+ * beyond convenience: `@user.id` and `@user.role` are what ownership scoping and
+ * role gates resolve against, so with no viewer every "only mine" list is empty
+ * and every role gate takes its negative branch — the app can only be seen as
+ * nobody. Bypassed the moment real Firebase credentials are present.
+ */
+
+import {
+  DEFAULT_VIEWER,
+  encodeDevIdentityToken,
+  findPersonaInRoster,
+  isFieldValue,
+  type FieldValue,
+  type UserContext,
+} from '@almadar/core';
+
+export interface MockUser {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  photoURL: string | null;
+  role?: string;
+  getIdToken(): Promise<string>;
+}
+
+type Listener = (user: MockUser | null) => void;
+
+const STORAGE_KEY = 'almadar.mockAuth.session';
+const REGISTERED_KEY = 'almadar.mockAuth.registered';
+
+/** The role a brand-new or unknown account gets — never `admin`. */
+const DEFAULT_ROLE = 'member';
+
+/** Empty in dev (the Vite proxy forwards /api); the full server URL in prod. */
+const API_BASE: string =
+  typeof import.meta.env.VITE_API_URL === 'string' ? import.meta.env.VITE_API_URL : '';
+
+const listeners = new Set<Listener>();
+const rosterListeners = new Set<() => void>();
+let current: MockUser | null = null;
+let registered: UserContext[] = [];
+let roster: UserContext[] = [];
+
+function toMockUser(p: UserContext): MockUser {
+  return {
+    uid: p.id,
+    email: typeof p.email === 'string' ? p.email : null,
+    displayName: typeof p.name === 'string' ? p.name : null,
+    photoURL: null,
+    role: typeof p.role === 'string' ? p.role : undefined,
+    // The server trusts this only under ALLOW_DEV_AUTH_BYPASS; it carries the
+    // whole persona so server-side `@user.role` matches the client's.
+    getIdToken: () => Promise.resolve(encodeDevIdentityToken(p)),
+  };
+}
+
+/** A stored account, validated field by field — never trust localStorage shape. */
+function readPersona(raw: FieldValue | undefined): UserContext | null {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw) || raw instanceof Date) {
+    return null;
+  }
+  const record: { [key: string]: FieldValue | undefined } = { ...raw };
+  const id = record['id'];
+  if (typeof id !== 'string' || id.length === 0) return null;
+  const persona: UserContext = { id };
+  for (const key of ['email', 'name', 'role'] as const) {
+    const value = record[key];
+    if (typeof value === 'string' && isFieldValue(value)) persona[key] = value;
+  }
+  return persona;
+}
+
+function readRegistered(): UserContext[] {
+  try {
+    const raw = localStorage.getItem(REGISTERED_KEY);
+    if (!raw) return [];
+    const parsed: FieldValue = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.map(readPersona).filter((p): p is UserContext => p !== null);
+  } catch {
+    return [];
+  }
+}
+
+function writeRegistered(list: UserContext[]): void {
+  registered = list;
+  try {
+    localStorage.setItem(REGISTERED_KEY, JSON.stringify(list));
+  } catch {
+    /* storage unavailable — the session stays in memory for this tab */
+  }
+}
+
+/**
+ * The app's personas, fetched from its own server.
+ *
+ * They are the LIVE seeded rows of the app's `[identity]` entity, not a
+ * hardcoded list and not a re-derivation: `@user.id` is what ownership scoping
+ * compares against, so a persona whose id is not literally one of those rows
+ * owns nothing and every "only mine" list renders empty — indistinguishable
+ * from a working filter over no data.
+ *
+ * An app that declares no `[identity]` entity has no roster to serve, so the
+ * shell's own default viewer stands in and sign-in still works.
+ */
+async function loadRoster(): Promise<void> {
+  try {
+    const response = await fetch(`${API_BASE}/api/personas`);
+    if (response.ok) {
+      const data = (await response.json()) as { personas?: UserContext[] };
+      roster = Array.isArray(data.personas) ? data.personas : [];
+    }
+  } catch {
+    /* server unreachable — fall through to the default viewer */
+  }
+  if (roster.length === 0) roster = [DEFAULT_VIEWER];
+  for (const fn of rosterListeners) fn();
+}
+
+function allAccounts(): UserContext[] {
+  return [...roster, ...registered];
+}
+
+function emit(): void {
+  for (const fn of listeners) fn(current);
+}
+
+function persist(user: MockUser | null): void {
+  try {
+    if (user) localStorage.setItem(STORAGE_KEY, JSON.stringify({ uid: user.uid }));
+    else localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* storage unavailable */
+  }
+}
+
+/**
+ * Load the app's roster, then restore a persisted session. Safe to call more
+ * than once.
+ *
+ * The roster is awaited first because a restored session names a persona by id:
+ * resolved before the rows arrive, every stored session would silently fail to
+ * restore and the app would open signed out.
+ */
+export async function initMockAuth(): Promise<void> {
+  registered = readRegistered();
+  await loadRoster();
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return;
+    const parsed: FieldValue = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return;
+    if (parsed instanceof Date) return;
+    const session: { [key: string]: FieldValue | undefined } = { ...parsed };
+    const uid = session['uid'];
+    if (typeof uid !== 'string') return;
+    const found = allAccounts().find((a) => a.id === uid);
+    if (found) {
+      current = toMockUser(found);
+      emit();
+    }
+  } catch {
+    /* ignore a corrupt session */
+  }
+}
+
+/** Every persona that can be signed into — for the dev persona picker. */
+export function listMockAccounts(): readonly UserContext[] {
+  return allAccounts();
+}
+
+/**
+ * Subscribe to roster arrival. The roster loads over HTTP after first paint, so
+ * the persona picker renders empty and must be told when the rows land — the
+ * auth listener cannot carry it, since the signed-out viewer does not change.
+ */
+export function onMockRosterChanged(fn: () => void): () => void {
+  rosterListeners.add(fn);
+  return () => {
+    rosterListeners.delete(fn);
+  };
+}
+
+function newAccount(email: string, displayName?: string): UserContext {
+  return {
+    id: `user-${allAccounts().length + 1}`,
+    email,
+    name: displayName ?? email.split('@')[0] ?? email,
+    role: DEFAULT_ROLE,
+  };
+}
+
+function byEmail(email: string): UserContext | undefined {
+  return allAccounts().find(
+    (a) => typeof a.email === 'string' && a.email.toLowerCase() === email.toLowerCase(),
+  );
+}
+
+function signInAs(account: UserContext): MockUser {
+  current = toMockUser(account);
+  persist(current);
+  emit();
+  return current;
+}
+
+export const mockAuth = {
+  get currentUser(): MockUser | null {
+    return current;
+  },
+
+  onAuthStateChanged(fn: Listener): () => void {
+    listeners.add(fn);
+    // Match Firebase: the listener fires immediately with the current state.
+    fn(current);
+    return () => listeners.delete(fn);
+  },
+
+  /** Any password is accepted; an unknown email signs in as a new end-user. */
+  signInWithEmail(email: string, _password: string): Promise<MockUser> {
+    return Promise.resolve(signInAs(byEmail(email) ?? newAccount(email)));
+  },
+
+  signUpWithEmail(email: string, _password: string, displayName?: string): Promise<MockUser> {
+    if (byEmail(email)) {
+      return Promise.reject(new Error('An account with that email already exists'));
+    }
+    const account = newAccount(email, displayName);
+    writeRegistered([...registered, account]);
+    return Promise.resolve(signInAs(account));
+  },
+
+  /** Sign in directly as a named persona — the dev persona switch. */
+  signInAsPersona(idOrRole: string): Promise<MockUser> {
+    const account =
+      findPersonaInRoster(roster, idOrRole) ??
+      registered.find((a) => a.id === idOrRole || a.role === idOrRole);
+    if (!account) {
+      return Promise.reject(
+        new Error(
+          `Unknown persona "${idOrRole}". Known: ${allAccounts().map((a) => `${a.id}/${String(a.role)}`).join(', ')}`,
+        ),
+      );
+    }
+    return Promise.resolve(signInAs(account));
+  },
+
+  signOut(): Promise<void> {
+    current = null;
+    persist(null);
+    emit();
+    return Promise.resolve();
+  },
+};

package/shells/almadar-shell/packages/client/src/features/auth/AuthContext.tsx

@@ -1,8 +1,8 @@
 import React, { createContext, useContext, useEffect, useState } from 'react';
-import { User } from 'firebase/auth';
 import { auth, initializeFirebase } from '../../config/firebase';
+import { initMockAuth, mockAuth } from '../../config/mockAuth';
 import { authService } from './authService';
-import { AuthContextType } from './types';
+import { AuthContextType, AuthViewer } from './types';
 
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
 
@@ -19,7 +19,7 @@ interface AuthProviderProps {
 }
 
 export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
-  const [user, setUser] = useState<User | null>(null);
+  const [user, setUser] = useState<AuthViewer | null>(null);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 
@@ -27,6 +27,19 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     let unsubscribe: (() => void) | undefined;
 
     initializeFirebase().then(() => {
+      // No Firebase config — subscribe to the persona-backed mock instead of
+      // rendering signed-out forever, so the app can be viewed as each persona.
+      if (!auth) {
+        // Subscribe first: the listener fires immediately with the current
+        // (signed-out) state so the app paints, then again once the roster has
+        // arrived and a persisted session is restored.
+        unsubscribe = mockAuth.onAuthStateChanged((mockUser) => {
+          setUser(mockUser);
+          setLoading(false);
+        });
+        void initMockAuth();
+        return;
+      }
       unsubscribe = auth.onAuthStateChanged((firebaseUser) => {
         setUser(firebaseUser);
         setLoading(false);
@@ -43,7 +56,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithGoogle();
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       const firebaseErr = err as { code?: string; message?: string };
       const isCancel =
@@ -61,7 +74,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmail(email, password);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-in failed');
     }
@@ -72,7 +85,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signUpWithEmail(email, password, displayName);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-up failed');
     }
@@ -88,7 +101,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       };
       await authService.sendSignInLinkToEmail(email, actionCodeSettings);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Failed to send sign-in link');
     }
@@ -99,7 +112,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmailLink(email, emailLink);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Email link sign-in failed');
     }
@@ -115,7 +128,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       await authService.signOut();
       setUser(null);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-out failed');
     }

package/shells/almadar-shell/packages/client/src/features/auth/authService.ts

@@ -10,15 +10,24 @@ import {
   signInWithEmailLink as firebaseSignInWithEmailLink,
   ActionCodeSettings,
 } from 'firebase/auth';
-import { auth } from '../../config/firebase';
+import { auth, isAuthEnabled, requireAuth } from '../../config/firebase';
+import { mockAuth } from '../../config/mockAuth';
+
+// With no Firebase credentials the real calls throw "not configured", which
+// leaves a generated app impossible to sign into — and therefore impossible to
+// view as anyone, since @user.id/@user.role drive ownership and role gates.
+// Route to the persona-backed mock in exactly that case.
+const useMock = (): boolean => !isAuthEnabled();
 
 const googleProvider = new GoogleAuthProvider();
 
 export const authService = {
   // Google Sign In
   signInWithGoogle: async () => {
+    // No popup to show without Firebase — sign in as the seeded end-user.
+    if (useMock()) return mockAuth.signInAsPersona('member');
     try {
-      const result = await signInWithPopup(auth, googleProvider);
+      const result = await signInWithPopup(requireAuth(), googleProvider);
       return result.user;
     } catch (error) {
       throw error;
@@ -27,8 +36,9 @@ export const authService = {
 
   // Email/Password Sign In
   signInWithEmail: async (email: string, password: string) => {
+    if (useMock()) return mockAuth.signInWithEmail(email, password);
     try {
-      const result = await signInWithEmailAndPassword(auth, email, password);
+      const result = await signInWithEmailAndPassword(requireAuth(), email, password);
       return result.user;
     } catch (error) {
       throw error;
@@ -37,8 +47,9 @@ export const authService = {
 
   // Email/Password Sign Up
   signUpWithEmail: async (email: string, password: string, displayName?: string) => {
+    if (useMock()) return mockAuth.signUpWithEmail(email, password, displayName);
     try {
-      const result = await createUserWithEmailAndPassword(auth, email, password);
+      const result = await createUserWithEmailAndPassword(requireAuth(), email, password);
 
       if (displayName) {
         await updateProfile(result.user, { displayName });
@@ -52,8 +63,9 @@ export const authService = {
 
   // Sign Out
   signOut: async () => {
+    if (useMock()) return mockAuth.signOut();
     try {
-      await firebaseSignOut(auth);
+      await firebaseSignOut(requireAuth());
     } catch (error) {
       throw error;
     }
@@ -62,22 +74,31 @@ export const authService = {
   // Email Link Authentication
   sendSignInLinkToEmail: async (email: string, actionCodeSettings: ActionCodeSettings) => {
     try {
-      await firebaseSendSignInLinkToEmail(auth, email, actionCodeSettings);
+      await firebaseSendSignInLinkToEmail(requireAuth(), email, actionCodeSettings);
     } catch (error) {
       throw error;
     }
   },
 
   isSignInWithEmailLink: (emailLink: string): boolean => {
+    // Predicate evaluated during Login render — degrade, don't throw,
+    // when auth is unconfigured: it simply isn't an email-link sign-in.
+    if (!auth) return false;
     return firebaseIsSignInWithEmailLink(auth, emailLink);
   },
 
   signInWithEmailLink: async (email: string, emailLink: string) => {
     try {
-      const result = await firebaseSignInWithEmailLink(auth, email, emailLink);
+      const result = await firebaseSignInWithEmailLink(requireAuth(), email, emailLink);
       return result.user;
     } catch (error) {
       throw error;
     }
   },
+
+  /** Sign in as a named seeded persona (dev only; no-op with real Firebase). */
+  signInAsPersona: async (idOrRole: string) => {
+    if (useMock()) return mockAuth.signInAsPersona(idOrRole);
+    throw new Error('Persona sign-in is a dev-only affordance; real auth is configured');
+  },
 };

package/shells/almadar-shell/packages/client/src/features/auth/components/PersonaSwitcher.tsx

@@ -0,0 +1,50 @@
+/**
+ * Dev persona switch — view the app as each identity its domain implies.
+ *
+ * Renders only when auth is mocked (no Firebase credentials), so it cannot appear
+ * in a real deployment. Role gates and ownership-scoped lists are the parts of an
+ * app that look identical whether they work or are simply empty; switching viewer
+ * in one click is how you tell the difference.
+ */
+
+import React from 'react';
+import { HStack, Select, Typography } from '@almadar/ui';
+import { isAuthEnabled } from '../../../config/firebase';
+import { listMockAccounts, onMockRosterChanged } from '../../../config/mockAuth';
+import { authService } from '../authService';
+import { useAuthContext } from '../AuthContext';
+
+export function PersonaSwitcher(): React.ReactElement | null {
+  const { user } = useAuthContext();
+  // The roster arrives over HTTP after first paint. Without this the picker
+  // renders its empty pre-fetch state and never updates, because the signed-out
+  // viewer never changes and so the auth listener never fires.
+  const [accounts, setAccounts] = React.useState(() => listMockAccounts());
+
+  React.useEffect(() => onMockRosterChanged(() => setAccounts(listMockAccounts())), []);
+
+  if (isAuthEnabled()) return null;
+
+  const options = accounts.map((p) => ({
+    value: p.id,
+    label: `${String(p.name ?? p.id)} — ${String(p.role ?? 'no role')}`,
+  }));
+
+  return (
+    <HStack gap="sm" align="center">
+      <Typography variant="caption" color="muted">
+        Viewing as
+      </Typography>
+      <Select
+        options={options}
+        value={user?.uid ?? ''}
+        placeholder="Signed out"
+        onChange={(event) => {
+          void authService.signInAsPersona(event.target.value);
+        }}
+      />
+    </HStack>
+  );
+}
+
+export default PersonaSwitcher;

package/shells/almadar-shell/packages/client/src/features/auth/components/ProtectedRoute.tsx

@@ -1,6 +1,7 @@
 import React from 'react';
 import { Navigate } from 'react-router-dom';
 import { useAuthContext } from '../AuthContext';
+import { isAuthEnabled } from '../../../config/firebase';
 
 interface ProtectedRouteProps {
   children: React.ReactNode;
@@ -17,6 +18,14 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     );
   }
 
+  // Auth-disabled mode (no Firebase config): nothing can sign in, so
+  // gating would strand every route on /login — pass straight through.
+  // Checked after `loading` so a configured-but-initializing Firebase
+  // still shows the spinner instead of flashing protected content.
+  if (!isAuthEnabled()) {
+    return <>{children}</>;
+  }
+
   if (!user) {
     return <Navigate to="/login" replace />;
   }

package/shells/almadar-shell/packages/client/src/features/auth/index.ts

@@ -5,9 +5,10 @@ export { AuthProvider, useAuthContext } from './AuthContext';
 export { default as Login } from './components/Login';
 export { default as UserProfile } from './components/UserProfile';
 export { default as ProtectedRoute } from './components/ProtectedRoute';
+export { PersonaSwitcher } from './components/PersonaSwitcher';
 
 // Service
 export { authService } from './authService';
 
 // Types
-export type { AuthContextType, LoginCredentials, SignUpCredentials } from './types';
+export type { AuthContextType, AuthViewer, LoginCredentials, SignUpCredentials } from './types';

package/shells/almadar-shell/packages/client/src/features/auth/types.ts

@@ -1,4 +1,20 @@
-import { User } from 'firebase/auth';
+/**
+ * The signed-in viewer, as the auth UI reads it. Firebase's `User` and the mocked
+ * `MockUser` are both structurally assignable to this, so the provider carries
+ * either without a cast and without the UI knowing which one is live.
+ *
+ * A type alias, not an interface: only aliases get TS's implicit index signature,
+ * which is what lets this be passed to `normalizeUserContext(claims: RawUserClaims)`
+ * without a cast.
+ */
+export type AuthViewer = {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  photoURL: string | null;
+  /** Present only for mocked personas; real Firebase claims carry no role. */
+  role?: string;
+};
 
 export interface LoginCredentials {
   email: string;
@@ -10,7 +26,7 @@ export interface SignUpCredentials extends LoginCredentials {
 }
 
 export interface AuthContextType {
-  user: User | null;
+  user: AuthViewer | null;
   loading: boolean;
   error: string | null;
   signInWithGoogle: () => Promise<void>;

package/shells/almadar-shell/packages/client/src/index.css

@@ -1,29 +1,13 @@
 /* Import Almadar theme - @import must precede @tailwind directives */
-@import '@almadar/ui/themes/almadar.css';
+@import '@almadar/ui/themes/minimalist.css';
 
 @tailwind base;
 @tailwind components;
 @tailwind utilities;
 
-/* Page-level layout: padding and max-width for main content area */
-.ui-slot-main {
-  padding: 1.5rem 1rem;
-  max-width: 80rem;
-  margin-left: auto;
-  margin-right: auto;
-}
-
-@media (min-width: 768px) {
-  .ui-slot-main {
-    padding: 1.5rem 1.5rem;
-  }
-}
-
-@media (min-width: 1024px) {
-  .ui-slot-main {
-    padding: 2rem 2rem;
-  }
-}
+/* Main slot fills the viewport edge-to-edge. Variant trees control their
+ * own width and padding via className utilities (max-w-*, mx-auto, px-*).
+ * The shell stays out of the way. */
 
 /* Global transition baseline: smooth state changes on interactive elements */
 button,

package/shells/almadar-shell/packages/client/tailwind.config.js

@@ -6,9 +6,19 @@ const require = createRequire(import.meta.url);
 const uiEntry = require.resolve('@almadar/ui');
 const uiDist = join(dirname(uiEntry), '..', '**', '*.js');
 
+// @almadar/ui's DashboardLayout (sidebar / topnav / bottomnav modes) and
+// several molecules use container-query Tailwind variants (`@md/dashboard:flex`,
+// `@sm/dashboard:block`, etc.). Without this plugin Tailwind silently drops
+// every `@*/dashboard:*` class and the chrome renders as a blank top-bar with
+// action icons collapsed to the left (no nav, no search, no app title).
+const containerQueries = require('@tailwindcss/container-queries');
+
 /** @type {import('tailwindcss').Config} */
 export default {
-  presets: [require('./tailwind-preset.cjs')],
+  // Single source of truth for Layer 1 + Layer 2 token mappings is
+  // @almadar/ui's published preset. Don't fork a local copy — it goes
+  // stale silently and breaks look variants without any build error.
+  presets: [require('@almadar/ui/tailwind-preset')],
   content: [
     "./index.html",
     "./src/**/*.{js,ts,jsx,tsx}",
@@ -17,5 +27,5 @@ export default {
   theme: {
     extend: {},
   },
-  plugins: [],
+  plugins: [containerQueries],
 }

package/shells/almadar-shell/packages/server/eslint.config.cjs

@@ -12,7 +12,11 @@ module.exports = [
     },
     plugins: { almadar: almadarPlugin },
     rules: {
+      // Zero escape hatches in emitted shell code — same rule set as client;
+      // see docs/Almadar_Compiler_Gaps.md for the per-rule codegen fix.
       "almadar/no-as-any": "error",
+      "almadar/no-unknown-type": "error",
+      "almadar/no-record-string-unknown": "error",
       "almadar/no-import-generated": "error",
     },
   },

package/shells/almadar-shell/packages/server/package.json

@@ -8,31 +8,35 @@
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --packages=external --outfile=dist/index.js",
     "start": "node dist/index.js",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint src/",
+    "lint": "eslint --max-warnings 0 src/",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/server": ">=2.1.5",
-    "@almadar/evaluator": ">=2.6.0",
-    "@almadar/core": ">=2.9.0",
-    "@almadar/integrations": ">=2.3.0",
+    "@almadar/core": "^10.92.0",
+    "@almadar/evaluator": "^2.45.0",
+    "@almadar/integrations": "^2.36.0",
+    "@almadar/logger": "^1.12.0",
+    "@almadar/runtime": "^6.78.0",
+    "@almadar/server": "^2.41.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
+    "express-rate-limit": "^7.4.0",
     "firebase-admin": "^12.7.0",
+    "helmet": "^8.0.0",
     "zod": "^3.22.0"
   },
   "devDependencies": {
-    "@almadar/eslint-plugin": ">=2.3.0",
-    "@typescript-eslint/parser": "8.56.0",
+    "@almadar/eslint-plugin": "^2.18.0",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.0",
     "@types/node": "^20.17.19",
-    "eslint": "10.0.0",
+    "@typescript-eslint/parser": "8.56.0",
     "esbuild": "^0.25.0",
+    "eslint": "10.0.0",
     "tsx": "^4.19.3",
     "typescript": "^5.7.3",
     "vitest": "^2.1.9"
   }
-}
+}