npm - autoworkflow - Versions diffs - 3.1.4 → 3.5.0 - Mend

autoworkflow 3.1.4 → 3.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (123) hide show

package/.claude/commands/analyze.md +19 -0
package/.claude/commands/audit.md +174 -11
package/.claude/commands/build.md +39 -0
package/.claude/commands/commit.md +25 -0
package/.claude/commands/fix.md +23 -0
package/.claude/commands/plan.md +18 -0
package/.claude/commands/suggest.md +23 -0
package/.claude/commands/verify.md +18 -0
package/.claude/hooks/post-bash-router.sh +20 -0
package/.claude/hooks/post-commit.sh +140 -0
package/.claude/hooks/pre-edit.sh +129 -0
package/.claude/hooks/session-check.sh +79 -0
package/.claude/settings.json +40 -6
package/.claude/settings.local.json +3 -1
package/.claude/skills/actix.md +337 -0
package/.claude/skills/alembic.md +504 -0
package/.claude/skills/angular.md +237 -0
package/.claude/skills/api-design.md +187 -0
package/.claude/skills/aspnet-core.md +377 -0
package/.claude/skills/astro.md +245 -0
package/.claude/skills/auth-clerk.md +327 -0
package/.claude/skills/auth-firebase.md +367 -0
package/.claude/skills/auth-nextauth.md +359 -0
package/.claude/skills/auth-supabase.md +368 -0
package/.claude/skills/axum.md +386 -0
package/.claude/skills/blazor.md +456 -0
package/.claude/skills/chi.md +348 -0
package/.claude/skills/code-review.md +133 -0
package/.claude/skills/csharp.md +296 -0
package/.claude/skills/css-modules.md +325 -0
package/.claude/skills/cypress.md +343 -0
package/.claude/skills/debugging.md +133 -0
package/.claude/skills/diesel.md +392 -0
package/.claude/skills/django.md +301 -0
package/.claude/skills/docker.md +319 -0
package/.claude/skills/doctrine.md +473 -0
package/.claude/skills/documentation.md +182 -0
package/.claude/skills/dotnet.md +409 -0
package/.claude/skills/drizzle.md +293 -0
package/.claude/skills/echo.md +321 -0
package/.claude/skills/eloquent.md +256 -0
package/.claude/skills/emotion.md +426 -0
package/.claude/skills/entity-framework.md +370 -0
package/.claude/skills/express.md +316 -0
package/.claude/skills/fastapi.md +329 -0
package/.claude/skills/fastify.md +299 -0
package/.claude/skills/fiber.md +315 -0
package/.claude/skills/flask.md +322 -0
package/.claude/skills/gin.md +342 -0
package/.claude/skills/git.md +116 -0
package/.claude/skills/github-actions.md +353 -0
package/.claude/skills/go.md +377 -0
package/.claude/skills/gorm.md +409 -0
package/.claude/skills/graphql.md +478 -0
package/.claude/skills/hibernate.md +379 -0
package/.claude/skills/hono.md +306 -0
package/.claude/skills/java.md +400 -0
package/.claude/skills/jest.md +313 -0
package/.claude/skills/jpa.md +282 -0
package/.claude/skills/kotlin.md +347 -0
package/.claude/skills/kubernetes.md +363 -0
package/.claude/skills/laravel.md +414 -0
package/.claude/skills/mcp-browser.md +320 -0
package/.claude/skills/mcp-database.md +219 -0
package/.claude/skills/mcp-fetch.md +241 -0
package/.claude/skills/mcp-filesystem.md +204 -0
package/.claude/skills/mcp-github.md +217 -0
package/.claude/skills/mcp-memory.md +240 -0
package/.claude/skills/mcp-search.md +218 -0
package/.claude/skills/mcp-slack.md +262 -0
package/.claude/skills/micronaut.md +388 -0
package/.claude/skills/mongodb.md +319 -0
package/.claude/skills/mongoose.md +355 -0
package/.claude/skills/mysql.md +281 -0
package/.claude/skills/nestjs.md +335 -0
package/.claude/skills/nextjs-app-router.md +260 -0
package/.claude/skills/nextjs-pages.md +172 -0
package/.claude/skills/nuxt.md +202 -0
package/.claude/skills/openapi.md +489 -0
package/.claude/skills/performance.md +199 -0
package/.claude/skills/php.md +398 -0
package/.claude/skills/playwright.md +371 -0
package/.claude/skills/postgresql.md +257 -0
package/.claude/skills/prisma.md +293 -0
package/.claude/skills/pydantic.md +304 -0
package/.claude/skills/pytest.md +313 -0
package/.claude/skills/python.md +272 -0
package/.claude/skills/quarkus.md +377 -0
package/.claude/skills/react.md +230 -0
package/.claude/skills/redis.md +391 -0
package/.claude/skills/refactoring.md +143 -0
package/.claude/skills/remix.md +246 -0
package/.claude/skills/rest-api.md +490 -0
package/.claude/skills/rocket.md +366 -0
package/.claude/skills/rust.md +341 -0
package/.claude/skills/sass.md +380 -0
package/.claude/skills/sea-orm.md +382 -0
package/.claude/skills/security.md +167 -0
package/.claude/skills/sequelize.md +395 -0
package/.claude/skills/spring-boot.md +416 -0
package/.claude/skills/sqlalchemy.md +269 -0
package/.claude/skills/sqlx-rust.md +408 -0
package/.claude/skills/state-jotai.md +346 -0
package/.claude/skills/state-mobx.md +353 -0
package/.claude/skills/state-pinia.md +431 -0
package/.claude/skills/state-redux.md +337 -0
package/.claude/skills/state-tanstack-query.md +434 -0
package/.claude/skills/state-zustand.md +340 -0
package/.claude/skills/styled-components.md +403 -0
package/.claude/skills/svelte.md +238 -0
package/.claude/skills/sveltekit.md +207 -0
package/.claude/skills/symfony.md +437 -0
package/.claude/skills/tailwind.md +279 -0
package/.claude/skills/terraform.md +394 -0
package/.claude/skills/testing-library.md +371 -0
package/.claude/skills/trpc.md +426 -0
package/.claude/skills/typeorm.md +368 -0
package/.claude/skills/vitest.md +330 -0
package/.claude/skills/vue.md +202 -0
package/.claude/skills/warp.md +365 -0
package/README.md +135 -52
package/package.json +1 -1
package/system/triggers.md +152 -11

package/.claude/skills/auth-clerk.md ADDED Viewed

@@ -0,0 +1,327 @@
+# Clerk Auth Skill
+## Setup (Next.js App Router)
+\`\`\`typescript
+// middleware.ts
+import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server';
+const isPublicRoute = createRouteMatcher([
+  '/',
+  '/sign-in(.*)',
+  '/sign-up(.*)',
+  '/api/webhooks(.*)',
+]);
+export default clerkMiddleware((auth, req) => {
+  if (!isPublicRoute(req)) {
+    auth().protect();
+  }
+});
+export const config = {
+  matcher: ['/((?!.*\\\\..*|_next).*)', '/', '/(api|trpc)(.*)'],
+};
+// app/layout.tsx
+import { ClerkProvider } from '@clerk/nextjs';
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <ClerkProvider>
+      <html lang="en">
+        <body>{children}</body>
+      </html>
+    </ClerkProvider>
+  );
+}
+\`\`\`
+## Server Components
+\`\`\`typescript
+// Get auth in Server Components
+import { auth, currentUser } from '@clerk/nextjs/server';
+import { redirect } from 'next/navigation';
+export default async function ProtectedPage() {
+  const { userId, sessionClaims } = auth();
+  if (!userId) {
+    redirect('/sign-in');
+  }
+  // Get full user object
+  const user = await currentUser();
+  return (
+    <div>
+      <h1>Welcome, {user?.firstName}</h1>
+      <p>Email: {user?.emailAddresses[0]?.emailAddress}</p>
+      <p>User ID: {userId}</p>
+    </div>
+  );
+}
+// API Route Protection
+import { auth } from '@clerk/nextjs/server';
+import { NextResponse } from 'next/server';
+export async function GET() {
+  const { userId } = auth();
+  if (!userId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  // Proceed with authenticated request
+  return NextResponse.json({ userId });
+}
+\`\`\`
+## Client Components
+\`\`\`tsx
+'use client';
+import {
+  SignIn,
+  SignUp,
+  SignOutButton,
+  SignedIn,
+  SignedOut,
+  UserButton,
+  useUser,
+  useAuth,
+  useClerk,
+} from '@clerk/nextjs';
+// Pre-built Components
+export function AuthPage() {
+  return (
+    <div>
+      <SignedOut>
+        <SignIn routing="hash" />
+        {/* Or SignUp for registration */}
+      </SignedOut>
+      <SignedIn>
+        <UserButton afterSignOutUrl="/" />
+      </SignedIn>
+    </div>
+  );
+}
+// Using hooks
+export function UserProfile() {
+  const { isLoaded, isSignedIn, user } = useUser();
+  const { signOut, getToken } = useAuth();
+  const clerk = useClerk();
+  if (!isLoaded) return <div>Loading...</div>;
+  if (!isSignedIn) {
+    return <button onClick={() => clerk.openSignIn()}>Sign In</button>;
+  }
+  const handleApiCall = async () => {
+    const token = await getToken();
+    // Use token for authenticated API calls
+    const response = await fetch('/api/protected', {
+      headers: { Authorization: \`Bearer \${token}\` },
+    });
+  };
+  return (
+    <div>
+      <img src={user.imageUrl} alt={user.fullName ?? ''} />
+      <h1>{user.fullName}</h1>
+      <p>{user.primaryEmailAddress?.emailAddress}</p>
+      <button onClick={handleApiCall}>Make API Call</button>
+      <SignOutButton>
+        <button>Sign Out</button>
+      </SignOutButton>
+    </div>
+  );
+}
+// Custom Sign In Page
+// app/sign-in/[[...sign-in]]/page.tsx
+export default function SignInPage() {
+  return (
+    <div className="flex items-center justify-center min-h-screen">
+      <SignIn
+        appearance={{
+          elements: {
+            rootBox: 'mx-auto',
+            card: 'shadow-xl',
+          },
+        }}
+      />
+    </div>
+  );
+}
+\`\`\`
+## Organizations & Roles
+\`\`\`typescript
+// Server-side organization check
+import { auth } from '@clerk/nextjs/server';
+export default async function OrgPage() {
+  const { orgId, orgRole, orgSlug } = auth();
+  if (!orgId) {
+    return <div>Please select an organization</div>;
+  }
+  if (orgRole !== 'org:admin') {
+    return <div>Admin access required</div>;
+  }
+  return <div>Organization: {orgSlug}</div>;
+}
+// Client-side organization
+'use client';
+import {
+  OrganizationSwitcher,
+  OrganizationProfile,
+  useOrganization,
+  useOrganizationList,
+} from '@clerk/nextjs';
+export function OrgDashboard() {
+  const { organization, membership } = useOrganization();
+  const { userMemberships } = useOrganizationList();
+  return (
+    <div>
+      <OrganizationSwitcher />
+      {organization && (
+        <div>
+          <h1>{organization.name}</h1>
+          <p>Your role: {membership?.role}</p>
+        </div>
+      )}
+    </div>
+  );
+}
+\`\`\`
+## Webhooks
+\`\`\`typescript
+// app/api/webhooks/clerk/route.ts
+import { Webhook } from 'svix';
+import { headers } from 'next/headers';
+import { WebhookEvent } from '@clerk/nextjs/server';
+export async function POST(req: Request) {
+  const WEBHOOK_SECRET = process.env.CLERK_WEBHOOK_SECRET;
+  if (!WEBHOOK_SECRET) {
+    throw new Error('Missing CLERK_WEBHOOK_SECRET');
+  }
+  const headerPayload = headers();
+  const svix_id = headerPayload.get('svix-id');
+  const svix_timestamp = headerPayload.get('svix-timestamp');
+  const svix_signature = headerPayload.get('svix-signature');
+  if (!svix_id || !svix_timestamp || !svix_signature) {
+    return new Response('Missing svix headers', { status: 400 });
+  }
+  const payload = await req.json();
+  const body = JSON.stringify(payload);
+  const wh = new Webhook(WEBHOOK_SECRET);
+  let evt: WebhookEvent;
+  try {
+    evt = wh.verify(body, {
+      'svix-id': svix_id,
+      'svix-timestamp': svix_timestamp,
+      'svix-signature': svix_signature,
+    }) as WebhookEvent;
+  } catch (err) {
+    return new Response('Invalid signature', { status: 400 });
+  }
+  const eventType = evt.type;
+  switch (eventType) {
+    case 'user.created':
+      const { id, email_addresses, first_name, last_name } = evt.data;
+      // Create user in your database
+      await db.user.create({
+        data: {
+          clerkId: id,
+          email: email_addresses[0]?.email_address,
+          name: \`\${first_name} \${last_name}\`,
+        },
+      });
+      break;
+    case 'user.updated':
+      // Update user in your database
+      break;
+    case 'user.deleted':
+      // Delete user from your database
+      break;
+  }
+  return new Response('OK', { status: 200 });
+}
+\`\`\`
+## Custom Session Claims
+\`\`\`typescript
+// In Clerk Dashboard, add custom claims to session token
+// Or use middleware to add dynamic claims
+// middleware.ts
+import { clerkMiddleware } from '@clerk/nextjs/server';
+export default clerkMiddleware(async (auth, req) => {
+  const { userId, sessionClaims } = auth();
+  // Access custom claims
+  const role = sessionClaims?.metadata?.role as string;
+  if (req.nextUrl.pathname.startsWith('/admin') && role !== 'admin') {
+    return Response.redirect(new URL('/unauthorized', req.url));
+  }
+});
+// Access in components
+const { sessionClaims } = auth();
+const userRole = sessionClaims?.metadata?.role;
+\`\`\`
+## Environment Variables
+\`\`\`bash
+# .env.local
+NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
+CLERK_SECRET_KEY=sk_test_...
+CLERK_WEBHOOK_SECRET=whsec_...
+# Custom pages (optional)
+NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
+NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up
+NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL=/dashboard
+NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL=/onboarding
+\`\`\`
+## ❌ DON'T
+- Expose CLERK_SECRET_KEY to client
+- Skip webhook signature verification
+- Forget middleware for protected routes
+- Store sensitive data in public metadata
+## ✅ DO
+- Use clerkMiddleware for route protection
+- Sync user data via webhooks
+- Use organizations for multi-tenant apps
+- Use session claims for role-based access
+- Customize appearance to match your brand

package/.claude/skills/auth-firebase.md ADDED Viewed

@@ -0,0 +1,367 @@
+# Firebase Auth Skill
+## Setup
+\`\`\`typescript
+// lib/firebase.ts
+import { initializeApp, getApps } from 'firebase/app';
+import { getAuth } from 'firebase/auth';
+import { getFirestore } from 'firebase/firestore';
+const firebaseConfig = {
+  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,
+  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,
+  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
+  storageBucket: process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET,
+  messagingSenderId: process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID,
+  appId: process.env.NEXT_PUBLIC_FIREBASE_APP_ID,
+};
+// Initialize Firebase (prevent multiple instances)
+const app = getApps().length === 0 ? initializeApp(firebaseConfig) : getApps()[0];
+export const auth = getAuth(app);
+export const db = getFirestore(app);
+\`\`\`
+## Authentication Methods
+\`\`\`typescript
+import {
+  createUserWithEmailAndPassword,
+  signInWithEmailAndPassword,
+  signInWithPopup,
+  signInWithRedirect,
+  GoogleAuthProvider,
+  GithubAuthProvider,
+  sendPasswordResetEmail,
+  sendEmailVerification,
+  updateProfile,
+  signOut,
+} from 'firebase/auth';
+import { auth } from '@/lib/firebase';
+// Email/Password Sign Up
+async function signUp(email: string, password: string, displayName: string) {
+  const { user } = await createUserWithEmailAndPassword(auth, email, password);
+  // Update profile with display name
+  await updateProfile(user, { displayName });
+  // Send verification email
+  await sendEmailVerification(user);
+  return user;
+}
+// Email/Password Sign In
+async function signIn(email: string, password: string) {
+  const { user } = await signInWithEmailAndPassword(auth, email, password);
+  return user;
+}
+// Google Sign In (Popup)
+async function signInWithGoogle() {
+  const provider = new GoogleAuthProvider();
+  provider.addScope('profile');
+  provider.addScope('email');
+  const { user } = await signInWithPopup(auth, provider);
+  return user;
+}
+// Google Sign In (Redirect - better for mobile)
+async function signInWithGoogleRedirect() {
+  const provider = new GoogleAuthProvider();
+  await signInWithRedirect(auth, provider);
+}
+// GitHub Sign In
+async function signInWithGitHub() {
+  const provider = new GithubAuthProvider();
+  provider.addScope('read:user');
+  const { user } = await signInWithPopup(auth, provider);
+  return user;
+}
+// Password Reset
+async function resetPassword(email: string) {
+  await sendPasswordResetEmail(auth, email, {
+    url: \`\${window.location.origin}/login\`,
+  });
+}
+// Sign Out
+async function logout() {
+  await signOut(auth);
+}
+\`\`\`
+## Auth State Listener
+\`\`\`typescript
+import { onAuthStateChanged, User } from 'firebase/auth';
+import { auth } from '@/lib/firebase';
+// React Hook
+import { useState, useEffect, createContext, useContext } from 'react';
+interface AuthContextType {
+  user: User | null;
+  loading: boolean;
+}
+const AuthContext = createContext<AuthContextType>({ user: null, loading: true });
+export function AuthProvider({ children }: { children: React.ReactNode }) {
+  const [user, setUser] = useState<User | null>(null);
+  const [loading, setLoading] = useState(true);
+  useEffect(() => {
+    const unsubscribe = onAuthStateChanged(auth, (user) => {
+      setUser(user);
+      setLoading(false);
+    });
+    return () => unsubscribe();
+  }, []);
+  return (
+    <AuthContext.Provider value={{ user, loading }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+export function useAuth() {
+  const context = useContext(AuthContext);
+  if (!context) {
+    throw new Error('useAuth must be used within AuthProvider');
+  }
+  return context;
+}
+// Usage
+function ProtectedComponent() {
+  const { user, loading } = useAuth();
+  if (loading) return <div>Loading...</div>;
+  if (!user) return <div>Please sign in</div>;
+  return <div>Welcome, {user.displayName}</div>;
+}
+\`\`\`
+## Protected Routes
+\`\`\`tsx
+'use client';
+import { useAuth } from '@/hooks/useAuth';
+import { useRouter } from 'next/navigation';
+import { useEffect } from 'react';
+export function ProtectedRoute({ children }: { children: React.ReactNode }) {
+  const { user, loading } = useAuth();
+  const router = useRouter();
+  useEffect(() => {
+    if (!loading && !user) {
+      router.push('/login');
+    }
+  }, [user, loading, router]);
+  if (loading) {
+    return <div>Loading...</div>;
+  }
+  if (!user) {
+    return null;
+  }
+  return <>{children}</>;
+}
+// Usage in page
+export default function DashboardPage() {
+  return (
+    <ProtectedRoute>
+      <Dashboard />
+    </ProtectedRoute>
+  );
+}
+\`\`\`
+## ID Tokens for API Auth
+\`\`\`typescript
+// Client: Get ID token for API calls
+async function getIdToken() {
+  const user = auth.currentUser;
+  if (!user) throw new Error('Not authenticated');
+  const token = await user.getIdToken();
+  return token;
+}
+// API call with token
+async function fetchProtectedData() {
+  const token = await getIdToken();
+  const response = await fetch('/api/protected', {
+    headers: {
+      Authorization: \`Bearer \${token}\`,
+    },
+  });
+  return response.json();
+}
+// Server: Verify ID token (API route)
+// app/api/protected/route.ts
+import { getAuth } from 'firebase-admin/auth';
+import { initializeApp, getApps, cert } from 'firebase-admin/app';
+// Initialize Firebase Admin
+if (getApps().length === 0) {
+  initializeApp({
+    credential: cert({
+      projectId: process.env.FIREBASE_PROJECT_ID,
+      clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
+      privateKey: process.env.FIREBASE_PRIVATE_KEY?.replace(/\\\\n/g, '\\n'),
+    }),
+  });
+}
+export async function GET(request: Request) {
+  const authHeader = request.headers.get('Authorization');
+  if (!authHeader?.startsWith('Bearer ')) {
+    return Response.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  const token = authHeader.split('Bearer ')[1];
+  try {
+    const decodedToken = await getAuth().verifyIdToken(token);
+    const userId = decodedToken.uid;
+    // Proceed with authenticated request
+    return Response.json({ userId });
+  } catch (error) {
+    return Response.json({ error: 'Invalid token' }, { status: 401 });
+  }
+}
+\`\`\`
+## Custom Claims (Roles)
+\`\`\`typescript
+// Server-side: Set custom claims (Firebase Admin)
+import { getAuth } from 'firebase-admin/auth';
+async function setUserRole(uid: string, role: string) {
+  await getAuth().setCustomUserClaims(uid, { role });
+}
+// Client-side: Check claims
+async function checkAdmin() {
+  const user = auth.currentUser;
+  if (!user) return false;
+  const tokenResult = await user.getIdTokenResult();
+  return tokenResult.claims.role === 'admin';
+}
+// Force token refresh after claims change
+await auth.currentUser?.getIdToken(true);
+\`\`\`
+## Firestore Security Rules
+\`\`\`javascript
+// firestore.rules
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    // Users can only access their own data
+    match /users/{userId} {
+      allow read, write: if request.auth != null && request.auth.uid == userId;
+    }
+    // Posts are readable by all, writable by author
+    match /posts/{postId} {
+      allow read: if true;
+      allow create: if request.auth != null;
+      allow update, delete: if request.auth != null
+        && request.auth.uid == resource.data.authorId;
+    }
+    // Admin-only access
+    match /admin/{document=**} {
+      allow read, write: if request.auth != null
+        && request.auth.token.role == 'admin';
+    }
+  }
+}
+\`\`\`
+## Phone Authentication
+\`\`\`typescript
+import {
+  RecaptchaVerifier,
+  signInWithPhoneNumber,
+  ConfirmationResult,
+} from 'firebase/auth';
+let confirmationResult: ConfirmationResult;
+// Setup reCAPTCHA
+function setupRecaptcha() {
+  window.recaptchaVerifier = new RecaptchaVerifier(auth, 'recaptcha-container', {
+    size: 'invisible',
+    callback: () => {
+      // reCAPTCHA solved
+    },
+  });
+}
+// Send OTP
+async function sendOTP(phoneNumber: string) {
+  const appVerifier = window.recaptchaVerifier;
+  confirmationResult = await signInWithPhoneNumber(auth, phoneNumber, appVerifier);
+}
+// Verify OTP
+async function verifyOTP(code: string) {
+  const result = await confirmationResult.confirm(code);
+  return result.user;
+}
+\`\`\`
+## User Profile Updates
+\`\`\`typescript
+import { updateProfile, updateEmail, updatePassword, User } from 'firebase/auth';
+async function updateUserProfile(user: User, data: { displayName?: string; photoURL?: string }) {
+  await updateProfile(user, data);
+}
+async function updateUserEmail(user: User, newEmail: string) {
+  await updateEmail(user, newEmail);
+  // User needs to re-verify email
+}
+async function updateUserPassword(user: User, newPassword: string) {
+  await updatePassword(user, newPassword);
+}
+\`\`\`
+## ❌ DON'T
+- Store Firebase config with private keys on client
+- Skip email verification for sensitive apps
+- Use currentUser without waiting for auth state
+- Expose Firebase Admin credentials to client
+- Skip Firestore security rules
+## ✅ DO
+- Use onAuthStateChanged for auth state
+- Verify ID tokens on server for API calls
+- Use custom claims for role-based access
+- Implement proper Firestore security rules
+- Handle all auth errors gracefully
+- Force token refresh after claims change