@almadar/orb 4.6.4 → 4.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/orb",
-  "version": "4.6.4",
+  "version": "4.8.0",
   "description": "Orb CLI - deterministic when it can be, intelligent when it needs to be",
   "license": "BSL-1.1",
   "repository": {
@@ -49,10 +49,10 @@
     "node": ">=16.0.0"
   },
   "optionalDependencies": {
-    "@almadar/orb-darwin-x64": "4.6.4",
-    "@almadar/orb-darwin-arm64": "4.6.4",
-    "@almadar/orb-linux-x64": "4.6.4",
-    "@almadar/orb-linux-arm64": "4.6.4",
-    "@almadar/orb-windows-x64": "4.6.4"
+    "@almadar/orb-darwin-x64": "4.8.0",
+    "@almadar/orb-darwin-arm64": "4.8.0",
+    "@almadar/orb-linux-x64": "4.8.0",
+    "@almadar/orb-linux-arm64": "4.8.0",
+    "@almadar/orb-windows-x64": "4.8.0"
   }
 }

package/shells/almadar-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/shell",
-  "version": "2.7.3",
+  "version": "2.109.0",
   "private": false,
   "description": "Minimal full-stack shell template for Almadar applications",
   "packageManager": "pnpm@10.30.3",
@@ -9,6 +9,7 @@
     "build": "pnpm run -r build",
     "typecheck": "turbo run typecheck",
     "lint": "turbo run lint",
+    "prepack": "node -e \"const fs=require('fs');if(fs.existsSync('packages'))for(const p of fs.readdirSync('packages'))for(const j of ['.turbo','package-lock.json']){const t='packages/'+p+'/'+j;if(fs.existsSync(t))fs.rmSync(t,{recursive:true,force:true});}\"",
     "prepare": "git rev-parse --git-dir > /dev/null 2>&1 && git config core.hooksPath .githooks || true"
   },
   "devDependencies": {
@@ -19,11 +20,24 @@
     "overrides": {
       "@tootallnate/once": "^3.0.1",
       "esbuild": "^0.25.0",
-      "flatted": "^3.4.1"
+      "flatted": "^3.4.1",
+      "protobufjs": ">=7.5.8 <8",
+      "node-forge": "^1.4.0",
+      "fast-xml-parser": "^5.7.0",
+      "fast-xml-builder": ">=1.1.7",
+      "express>path-to-regexp": "0.1.13",
+      "qs": "^6.15.2",
+      "lodash-es": "^4.18.0"
     }
   },
   "files": [
-    "dist"
+    "packages",
+    "locales",
+    "pnpm-workspace.yaml",
+    "turbo.json",
+    "pnpm-lock.yaml",
+    ".env.example",
+    ".gitignore"
   ],
   "repository": {
     "type": "git",

package/shells/almadar-shell/packages/client/eslint.config.cjs

@@ -1,11 +1,31 @@
 "use strict";
 const tsParser = require("@typescript-eslint/parser");
 const almadarPlugin = require("@almadar/eslint-plugin");
+// react-hooks plugin registered so the codegen-emitted
+// `// eslint-disable-next-line react-hooks/exhaustive-deps` comments are
+// well-formed (eslint errors on disable directives that reference
+// unknown rules). The actual rules are left off — enabling them would
+// surface a backlog of dep-array warnings the codegen knows are
+// intentional. Tightening is a separate codegen-fix pass.
+let reactHooksPlugin;
+try {
+  reactHooksPlugin = require("eslint-plugin-react-hooks");
+} catch (_) {
+  reactHooksPlugin = { rules: { "exhaustive-deps": { meta: {}, create: () => ({}) }, "rules-of-hooks": { meta: {}, create: () => ({}) } } };
+}
 
 module.exports = [
   { ignores: ["dist/**", "node_modules/**", "**/*.test.ts", "**/*.test.tsx"] },
   {
     files: ["src/**/*.ts", "src/**/*.tsx"],
+    // The codegen emits `// eslint-disable-next-line react-hooks/exhaustive-deps`
+    // ahead of every mount-only effect's `[]` dep array. Until the real
+    // `eslint-plugin-react-hooks` is wired (it would fire the rule and
+    // make these directives meaningful), the shim's no-op create() means
+    // the rule never reports — so ESLint flags the directives as
+    // "Unused eslint-disable directive". That's a false alarm at this
+    // stage; suppress it so the strict-error rule set still hard-fails.
+    linterOptions: { reportUnusedDisableDirectives: "off" },
     languageOptions: {
       parser: tsParser,
       parserOptions: {
@@ -14,9 +34,22 @@ module.exports = [
         sourceType: "module",
       },
     },
-    plugins: { almadar: almadarPlugin },
+    plugins: { almadar: almadarPlugin, "react-hooks": reactHooksPlugin },
     rules: {
+      // Zero escape hatches in emitted shell code. Each rule pairs with a
+      // codegen-template fix in orbital-rust (see docs/Almadar_Compiler_Gaps.md):
+      // - no-as-any:           catches `as any` casts.
+      // - no-unknown-type:     catches `: unknown` annotations.
+      //                        Service results are typed via the integrations
+      //                        contract; every other "unknown" is a typed
+      //                        shape the codegen knows.
+      // - no-record-string-unknown: catches `as Record<string, unknown>` casts
+      //                        the codegen used to index into entity rows by
+      //                        string key. The entity has a typed interface
+      //                        — emit against that.
       "almadar/no-as-any": "error",
+      "almadar/no-unknown-type": "error",
+      "almadar/no-record-string-unknown": "error",
       "almadar/no-import-generated": "error",
     },
   },

package/shells/almadar-shell/packages/client/package.json

@@ -1,59 +1,61 @@
 {
   "name": "@almadar/shell-client",
-  "version": "1.0.0",
+  "version": "2.13.15",
   "private": true,
   "type": "module",
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint src/",
+    "lint": "eslint --max-warnings 0 src/",
     "preview": "vite preview",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/ui": ">=4.4.1",
-    "@almadar/syntax": ">=1.4.0",
-    "@almadar/evaluator": ">=2.9.2",
-    "@almadar/patterns": ">=2.18.1",
-    "@almadar/core": ">=5.8.0",
-    "firebase": "^11.4.0",
+    "@almadar/core": "^10.92.0",
+    "@almadar/evaluator": "^2.45.0",
+    "@almadar/logger": "^1.12.0",
+    "@almadar/patterns": "^2.101.0",
+    "@almadar/syntax": "^1.17.0",
+    "@almadar/ui": "^6.21.0",
+    "@monaco-editor/react": "^4.7.0",
+    "@react-three/drei": "^9.92.0",
+    "@react-three/fiber": "^9.0.0",
+    "@react-three/postprocessing": "^3.0.0",
     "@tanstack/react-query": "^5.67.3",
+    "firebase": "^11.4.0",
+    "leaflet": "^1.9.4",
+    "lucide-react": "^0.344.0",
+    "monaco-editor": "^0.52.2",
+    "postprocessing": "^6.39.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "react-router-dom": "^7.3.0",
-    "zustand": "^5.0.3",
+    "react-force-graph-2d": "^1.25.5",
+    "react-leaflet": "^4.2.1",
     "react-markdown": "^9.0.1",
-    "remark-gfm": "^4.0.1",
-    "remark-math": "^6.0.0",
+    "react-router-dom": "^7.3.0",
     "rehype-katex": "^7.0.1",
     "rehype-raw": "^7.0.0",
-    "react-force-graph-2d": "^1.25.5",
-    "@monaco-editor/react": "^4.7.0",
-    "monaco-editor": "^0.52.2",
-    "leaflet": "^1.9.4",
-    "react-leaflet": "^4.2.1",
-    "lucide-react": "^0.344.0",
+    "remark-gfm": "^4.0.1",
+    "remark-math": "^6.0.0",
     "three": "^0.160.0",
-    "@react-three/fiber": "^9.0.0",
-    "@react-three/drei": "^9.92.0",
-    "@react-three/postprocessing": "^3.0.0",
-    "postprocessing": "^6.39.0"
+    "zustand": "^5.0.3"
   },
   "devDependencies": {
-    "@almadar/eslint-plugin": ">=2.8.0",
-    "@typescript-eslint/parser": "8.56.0",
-    "eslint": "10.0.0",
-    "@testing-library/react": "^16.1.0",
+    "@almadar/eslint-plugin": "^2.18.0",
     "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.1.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@typescript-eslint/parser": "8.56.0",
     "@vitejs/plugin-react": "^4.3.4",
     "autoprefixer": "^10.4.20",
+    "eslint": "10.0.0",
     "jsdom": "^25.0.1",
     "postcss": "^8.5.3",
     "tailwindcss": "^3.4.17",
+    "@tailwindcss/container-queries": "^0.1.1",
     "typescript": "^5.7.3",
     "vite": "^6.2.1",
     "vitest": "^2.1.9"

package/shells/almadar-shell/packages/client/src/App.tsx

@@ -11,14 +11,19 @@
  * - react-router is optional for URL bookmarkability
  */
 
+import React from 'react';
 import { BrowserRouter, Routes, Route } from 'react-router-dom';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { ThemeProvider, UISlotProvider } from '@almadar/ui/context';
-import { UISlotComponent, NotifyListener } from '@almadar/ui/components';
+import { UISlotComponent } from '@almadar/ui/components';
 import {
   EventBusProvider,
+  UserProvider,
   VerificationProvider,
 } from '@almadar/ui/providers';
+import { normalizeUserContext } from '@almadar/core';
+import { AuthProvider, useAuthContext } from './features/auth';
+import { PersonaSwitcher } from './features/auth/components/PersonaSwitcher';
 import { NavigationProvider } from '@almadar/ui/renderer';
 import { I18nProvider, createTranslate } from '@almadar/ui/hooks';
 import defaultLocale from '@almadar/ui/locales/en.json';
@@ -43,11 +48,25 @@ const queryClient = new QueryClient({
   },
 });
 
+/**
+ * Bridges the signed-in viewer into `UserProvider`. Generated trait hooks read
+ * `@user.x` through `useUser()`, so without this every role gate takes its
+ * negative branch and every "only mine" list renders empty — with no error, since
+ * `useUser()` falls back to anonymous. `normalizeUserContext` maps the provider's
+ * `uid`/`displayName` onto the `id`/`name` the behaviors read.
+ */
+function ViewerProvider({ children }: { children: React.ReactNode }) {
+  const { user } = useAuthContext();
+  return <UserProvider user={normalizeUserContext(user) ?? null}>{children}</UserProvider>;
+}
+
 function App() {
   return (
     <I18nProvider value={i18nValue}>
     <QueryClientProvider client={queryClient}>
-      <ThemeProvider>
+      <ThemeProvider defaultTheme="minimalist">
+       <AuthProvider>
+        <ViewerProvider>
         <EventBusProvider>
           <VerificationProvider>
             <UISlotProvider>
@@ -66,12 +85,14 @@ function App() {
                   {/* Portal slots rendered by compiled trait views via CompiledPortal */}
                   {/* Toast notifications (non-overlapping, always safe to render here) */}
                   <UISlotComponent slot="toast" portal />
-                  <NotifyListener />
+                  <PersonaSwitcher />
                 </BrowserRouter>
               </NavigationProvider>
             </UISlotProvider>
           </VerificationProvider>
         </EventBusProvider>
+        </ViewerProvider>
+       </AuthProvider>
       </ThemeProvider>
     </QueryClientProvider>
     </I18nProvider>

package/shells/almadar-shell/packages/client/src/config/firebase.ts

@@ -1,8 +1,8 @@
 import { initializeApp, getApps, getApp, FirebaseApp } from 'firebase/app';
 import { getAuth, Auth } from 'firebase/auth';
 
-let app: FirebaseApp;
-let auth: Auth;
+let app: FirebaseApp | undefined;
+let auth: Auth | undefined;
 
 export async function initializeFirebase(): Promise<void> {
   if (getApps().length > 0) {
@@ -30,8 +30,29 @@ export async function initializeFirebase(): Promise<void> {
     };
   }
 
+  // No credentials anywhere — auth stays disabled instead of crashing
+  // the app boot with auth/invalid-api-key.
+  if (!config.apiKey) {
+    console.warn('Firebase not configured — auth disabled (set VITE_APP_FIREBASE_* env vars)');
+    return;
+  }
+
   app = initializeApp(config);
   auth = getAuth(app);
 }
 
+export function requireAuth(): Auth {
+  if (!auth) {
+    throw new Error('Firebase auth is not configured — set VITE_APP_FIREBASE_* env vars');
+  }
+  return auth;
+}
+
+// True once Firebase initialized with real credentials. When false the
+// app runs in auth-disabled mode: route guards pass through and sign-in
+// actions report the missing config instead of crashing the boot.
+export function isAuthEnabled(): boolean {
+  return auth !== undefined;
+}
+
 export { auth, app };

package/shells/almadar-shell/packages/client/src/config/mockAuth.ts

@@ -0,0 +1,257 @@
+/**
+ * Mock auth — a working sign-up / sign-in when Firebase is not configured.
+ *
+ * Without credentials `requireAuth()` throws and every sign-in reports "not
+ * configured", so a generated app cannot be signed into at all. That matters
+ * beyond convenience: `@user.id` and `@user.role` are what ownership scoping and
+ * role gates resolve against, so with no viewer every "only mine" list is empty
+ * and every role gate takes its negative branch — the app can only be seen as
+ * nobody. Bypassed the moment real Firebase credentials are present.
+ */
+
+import {
+  DEFAULT_VIEWER,
+  encodeDevIdentityToken,
+  findPersonaInRoster,
+  isFieldValue,
+  type FieldValue,
+  type UserContext,
+} from '@almadar/core';
+
+export interface MockUser {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  photoURL: string | null;
+  role?: string;
+  getIdToken(): Promise<string>;
+}
+
+type Listener = (user: MockUser | null) => void;
+
+const STORAGE_KEY = 'almadar.mockAuth.session';
+const REGISTERED_KEY = 'almadar.mockAuth.registered';
+
+/** The role a brand-new or unknown account gets — never `admin`. */
+const DEFAULT_ROLE = 'member';
+
+/** Empty in dev (the Vite proxy forwards /api); the full server URL in prod. */
+const API_BASE: string =
+  typeof import.meta.env.VITE_API_URL === 'string' ? import.meta.env.VITE_API_URL : '';
+
+const listeners = new Set<Listener>();
+const rosterListeners = new Set<() => void>();
+let current: MockUser | null = null;
+let registered: UserContext[] = [];
+let roster: UserContext[] = [];
+
+function toMockUser(p: UserContext): MockUser {
+  return {
+    uid: p.id,
+    email: typeof p.email === 'string' ? p.email : null,
+    displayName: typeof p.name === 'string' ? p.name : null,
+    photoURL: null,
+    role: typeof p.role === 'string' ? p.role : undefined,
+    // The server trusts this only under ALLOW_DEV_AUTH_BYPASS; it carries the
+    // whole persona so server-side `@user.role` matches the client's.
+    getIdToken: () => Promise.resolve(encodeDevIdentityToken(p)),
+  };
+}
+
+/** A stored account, validated field by field — never trust localStorage shape. */
+function readPersona(raw: FieldValue | undefined): UserContext | null {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw) || raw instanceof Date) {
+    return null;
+  }
+  const record: { [key: string]: FieldValue | undefined } = { ...raw };
+  const id = record['id'];
+  if (typeof id !== 'string' || id.length === 0) return null;
+  const persona: UserContext = { id };
+  for (const key of ['email', 'name', 'role'] as const) {
+    const value = record[key];
+    if (typeof value === 'string' && isFieldValue(value)) persona[key] = value;
+  }
+  return persona;
+}
+
+function readRegistered(): UserContext[] {
+  try {
+    const raw = localStorage.getItem(REGISTERED_KEY);
+    if (!raw) return [];
+    const parsed: FieldValue = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.map(readPersona).filter((p): p is UserContext => p !== null);
+  } catch {
+    return [];
+  }
+}
+
+function writeRegistered(list: UserContext[]): void {
+  registered = list;
+  try {
+    localStorage.setItem(REGISTERED_KEY, JSON.stringify(list));
+  } catch {
+    /* storage unavailable — the session stays in memory for this tab */
+  }
+}
+
+/**
+ * The app's personas, fetched from its own server.
+ *
+ * They are the LIVE seeded rows of the app's `[identity]` entity, not a
+ * hardcoded list and not a re-derivation: `@user.id` is what ownership scoping
+ * compares against, so a persona whose id is not literally one of those rows
+ * owns nothing and every "only mine" list renders empty — indistinguishable
+ * from a working filter over no data.
+ *
+ * An app that declares no `[identity]` entity has no roster to serve, so the
+ * shell's own default viewer stands in and sign-in still works.
+ */
+async function loadRoster(): Promise<void> {
+  try {
+    const response = await fetch(`${API_BASE}/api/personas`);
+    if (response.ok) {
+      const data = (await response.json()) as { personas?: UserContext[] };
+      roster = Array.isArray(data.personas) ? data.personas : [];
+    }
+  } catch {
+    /* server unreachable — fall through to the default viewer */
+  }
+  if (roster.length === 0) roster = [DEFAULT_VIEWER];
+  for (const fn of rosterListeners) fn();
+}
+
+function allAccounts(): UserContext[] {
+  return [...roster, ...registered];
+}
+
+function emit(): void {
+  for (const fn of listeners) fn(current);
+}
+
+function persist(user: MockUser | null): void {
+  try {
+    if (user) localStorage.setItem(STORAGE_KEY, JSON.stringify({ uid: user.uid }));
+    else localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* storage unavailable */
+  }
+}
+
+/**
+ * Load the app's roster, then restore a persisted session. Safe to call more
+ * than once.
+ *
+ * The roster is awaited first because a restored session names a persona by id:
+ * resolved before the rows arrive, every stored session would silently fail to
+ * restore and the app would open signed out.
+ */
+export async function initMockAuth(): Promise<void> {
+  registered = readRegistered();
+  await loadRoster();
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return;
+    const parsed: FieldValue = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return;
+    if (parsed instanceof Date) return;
+    const session: { [key: string]: FieldValue | undefined } = { ...parsed };
+    const uid = session['uid'];
+    if (typeof uid !== 'string') return;
+    const found = allAccounts().find((a) => a.id === uid);
+    if (found) {
+      current = toMockUser(found);
+      emit();
+    }
+  } catch {
+    /* ignore a corrupt session */
+  }
+}
+
+/** Every persona that can be signed into — for the dev persona picker. */
+export function listMockAccounts(): readonly UserContext[] {
+  return allAccounts();
+}
+
+/**
+ * Subscribe to roster arrival. The roster loads over HTTP after first paint, so
+ * the persona picker renders empty and must be told when the rows land — the
+ * auth listener cannot carry it, since the signed-out viewer does not change.
+ */
+export function onMockRosterChanged(fn: () => void): () => void {
+  rosterListeners.add(fn);
+  return () => {
+    rosterListeners.delete(fn);
+  };
+}
+
+function newAccount(email: string, displayName?: string): UserContext {
+  return {
+    id: `user-${allAccounts().length + 1}`,
+    email,
+    name: displayName ?? email.split('@')[0] ?? email,
+    role: DEFAULT_ROLE,
+  };
+}
+
+function byEmail(email: string): UserContext | undefined {
+  return allAccounts().find(
+    (a) => typeof a.email === 'string' && a.email.toLowerCase() === email.toLowerCase(),
+  );
+}
+
+function signInAs(account: UserContext): MockUser {
+  current = toMockUser(account);
+  persist(current);
+  emit();
+  return current;
+}
+
+export const mockAuth = {
+  get currentUser(): MockUser | null {
+    return current;
+  },
+
+  onAuthStateChanged(fn: Listener): () => void {
+    listeners.add(fn);
+    // Match Firebase: the listener fires immediately with the current state.
+    fn(current);
+    return () => listeners.delete(fn);
+  },
+
+  /** Any password is accepted; an unknown email signs in as a new end-user. */
+  signInWithEmail(email: string, _password: string): Promise<MockUser> {
+    return Promise.resolve(signInAs(byEmail(email) ?? newAccount(email)));
+  },
+
+  signUpWithEmail(email: string, _password: string, displayName?: string): Promise<MockUser> {
+    if (byEmail(email)) {
+      return Promise.reject(new Error('An account with that email already exists'));
+    }
+    const account = newAccount(email, displayName);
+    writeRegistered([...registered, account]);
+    return Promise.resolve(signInAs(account));
+  },
+
+  /** Sign in directly as a named persona — the dev persona switch. */
+  signInAsPersona(idOrRole: string): Promise<MockUser> {
+    const account =
+      findPersonaInRoster(roster, idOrRole) ??
+      registered.find((a) => a.id === idOrRole || a.role === idOrRole);
+    if (!account) {
+      return Promise.reject(
+        new Error(
+          `Unknown persona "${idOrRole}". Known: ${allAccounts().map((a) => `${a.id}/${String(a.role)}`).join(', ')}`,
+        ),
+      );
+    }
+    return Promise.resolve(signInAs(account));
+  },
+
+  signOut(): Promise<void> {
+    current = null;
+    persist(null);
+    emit();
+    return Promise.resolve();
+  },
+};

package/shells/almadar-shell/packages/client/src/features/auth/AuthContext.tsx

@@ -1,8 +1,8 @@
 import React, { createContext, useContext, useEffect, useState } from 'react';
-import { User } from 'firebase/auth';
 import { auth, initializeFirebase } from '../../config/firebase';
+import { initMockAuth, mockAuth } from '../../config/mockAuth';
 import { authService } from './authService';
-import { AuthContextType } from './types';
+import { AuthContextType, AuthViewer } from './types';
 
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
 
@@ -19,7 +19,7 @@ interface AuthProviderProps {
 }
 
 export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
-  const [user, setUser] = useState<User | null>(null);
+  const [user, setUser] = useState<AuthViewer | null>(null);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 
@@ -27,6 +27,19 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
     let unsubscribe: (() => void) | undefined;
 
     initializeFirebase().then(() => {
+      // No Firebase config — subscribe to the persona-backed mock instead of
+      // rendering signed-out forever, so the app can be viewed as each persona.
+      if (!auth) {
+        // Subscribe first: the listener fires immediately with the current
+        // (signed-out) state so the app paints, then again once the roster has
+        // arrived and a persisted session is restored.
+        unsubscribe = mockAuth.onAuthStateChanged((mockUser) => {
+          setUser(mockUser);
+          setLoading(false);
+        });
+        void initMockAuth();
+        return;
+      }
       unsubscribe = auth.onAuthStateChanged((firebaseUser) => {
         setUser(firebaseUser);
         setLoading(false);
@@ -43,7 +56,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithGoogle();
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       const firebaseErr = err as { code?: string; message?: string };
       const isCancel =
@@ -61,7 +74,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmail(email, password);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-in failed');
     }
@@ -72,7 +85,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signUpWithEmail(email, password, displayName);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-up failed');
     }
@@ -88,7 +101,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       };
       await authService.sendSignInLinkToEmail(email, actionCodeSettings);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Failed to send sign-in link');
     }
@@ -99,7 +112,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       setLoading(true);
       clearError();
       await authService.signInWithEmailLink(email, emailLink);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Email link sign-in failed');
     }
@@ -115,7 +128,7 @@ export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
       await authService.signOut();
       setUser(null);
       setLoading(false);
-    } catch (err: unknown) {
+    } catch (err) {
       setLoading(false);
       setError((err as { message?: string }).message ?? 'Sign-out failed');
     }