diff --git a/apps/api/src/routes/events.ts b/apps/api/src/routes/events.ts
index e85c19c..0920705 100644
--- a/apps/api/src/routes/events.ts
+++ b/apps/api/src/routes/events.ts
@@ -23,6 +23,7 @@
 
 import { randomUUID } from 'node:crypto'
 import { Hono } from 'hono'
+import type { Context } from 'hono'
 import { zValidator } from '@hono/zod-validator'
 import { z } from 'zod'
 import { and, or, eq, desc } from 'drizzle-orm'
@@ -55,8 +56,10 @@ const MAX_WINDOW_DAYS = 90
 //      Identity is keyed on oidc_iss + oidc_sub (D-10), never email.
 //   3. Callers emit 401 when resolveUserId returns null.
 //
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function resolveUserId(c: any): Promise<number | null> {
+// IN-04: typed as Hono's Context instead of `any`. c.get('user') resolves through the
+// ContextVariableMap augmentation in auth/devBypass.ts (typed as the DEV_USER shape),
+// and getAuth(c) accepts a Context — so no `any` / eslint-disable is needed here.
+async function resolveUserId(c: Context): Promise<number | null> {
   const devUser = c.get('user') as { id: number } | undefined
   if (devUser) return devUser.id