diff --git a/src/api/base44Client.js b/src/api/base44Client.ts
similarity index 94%
rename from src/api/base44Client.js
rename to src/api/base44Client.ts
index 05f1992..f8369f2 100644
--- a/src/api/base44Client.js
+++ b/src/api/base44Client.ts
@@ -143,7 +143,11 @@ let authenticated = false;
  * A 401 here is the ordinary state of a signed-out visitor, not a failure: the
  * app opens on the login page and this request is how it finds that out.
  */
-let hydration = request('GET', '/me')
+/* `Promise<any> | null`, because the runtime already assigns both: the shared
+   first request, then `null` once it has been consumed or superseded by a
+   login. Inference alone would fix the type at `Promise<any>` and reject the
+   two `hydration = null` assignments that make the sharing work. */
+let hydration: Promise<any> | null = request('GET', '/me')
   .then((user) => {
     currentUser = user;
     authenticated = true;
@@ -204,7 +208,11 @@ const auth = {
    * by design: telling the two apart would say whether an address is
    * registered. The caller shows that message as-is.
    */
-  async login({ email, password, rememberMe = false }) {
+  async login({ email, password, rememberMe = false }: {
+    email: string;
+    password: string;
+    rememberMe?: boolean;
+  }) {
     const user = await request('POST', '/auth/login', {
       body: { email, password, remember_me: Boolean(rememberMe) },
     });
@@ -215,7 +223,7 @@ const auth = {
     return { ...user };
   },
 
-  async updateMe(patch) {
+  async updateMe(patch: any) {
     const user = await request('PATCH', '/me', { body: patch });
     currentUser = user;
     cacheUser();
@@ -247,7 +255,7 @@ const auth = {
    * question the shape exists to answer is now answered by whether this
    * function resolved at all.
    */
-  async updatePreferences(patch) {
+  async updatePreferences(patch: any) {
     const preferences = await request('PATCH', '/me/preferences', { body: patch });
     currentUser = { ...currentUser, preferences };
     cacheUser();
@@ -274,7 +282,7 @@ const auth = {
    * reach the API must still leave the browser signed out locally, and the
    * cookie it keeps will be refused by every request it is sent on.
    */
-  async logout(redirectTo = '/admin/login') {
+  async logout(redirectTo: string = '/admin/login') {
     try {
       await request('POST', '/auth/logout');
     } catch {
@@ -320,7 +328,7 @@ const workflows = {
    * across from the application by the server, because it is already the truth
    * about this person and retyping it here is how the two records drift apart.
    */
-  async hire(applicationId, body = {}) {
+  async hire(applicationId: string, body: any = {}) {
     return request('POST', `/job-applications/${encodeURIComponent(applicationId)}/hire`, {
       body,
     });
@@ -336,7 +344,7 @@ const workflows = {
    * inside the same transaction; a worker taken straight from the talent pool
    * with neither is placed without one rather than given an invented one.
    */
-  async assign(jobPostingId, workers = []) {
+  async assign(jobPostingId: string, workers: any[] = []) {
     return request('POST', `/job-postings/${encodeURIComponent(jobPostingId)}/assignments`, {
       body: { workers },
     });
@@ -368,7 +376,7 @@ const workflows = {
  */
 const owliver = {
   /** @param {any} request */
-  async suggestions({ page, query = '' } = {}) {
+  async suggestions({ page, query = '' }: { page?: string; query?: string } = {}) {
     if (!page) return [];
     const typed = String(query || '').trim();
     const data = await request('GET', '/owliver/suggestions', {
@@ -388,7 +396,7 @@ const integrations = {
 };
 
 const analytics = {
-  track({ eventName, properties } = {}) {
+  track({ eventName, properties }: { eventName?: string; properties?: any } = {}) {
     if (import.meta.env.DEV) {
       console.debug('[krow-demo] analytics', eventName, properties || {});
     }