@getstrata/core 0.5.101 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @getstrata/core changelog
 
+## 0.7.3
+
+- `JsonResource.whenLoaded` returns `null` when a relation is loaded but empty. It does not call the transform, so `new PositionResource(value).toArray()` cannot crash on a missing belongsTo.
+
+## 0.7.2
+
+- `withJsonErrorHandling` always maps thrown errors to JSON. `requestPrefersJson` treats `/api/` as JSON even when `Accept` is HTML, so hybrid staff HTML cannot remap JSON API errors.
+
+## 0.7.1
+
+- `readSpaPrefix` / `normalizeSpaPrefix` own `SPA_PREFIX` (default `/app`). Apps set the env value. They do not copy a second static-file server.
+- The log mail driver records `htmlBytes` instead of dumping the HTML document onto stdout.
+
+## 0.7.0
+
+- `FRONTEND_MODE=hybrid` turns on staff HTML and the candidate SPA together. Views are on for `server-htmx` and `hybrid`. The SPA is on for `spa-react` and `hybrid`.
+- `parseFrontendMode`, `FRONTEND_MODES`, and `FRONTEND_MODE_PATTERN` are the allowed-value list. Apps should reuse that pattern in env schemas.
+- Named database connections: `registerNamedConnection`, `runOnNamedConnection`, SQLite (`bun:sqlite`), and MySQL (`mysql2`). `runWithSqlDialect` keeps the dialect across `await` via AsyncLocalStorage.
+- New subpaths: `database/namedConnections`, `database/sqliteConnection`, `database/mysqlConnection`, `database/connectionContext`.
+- OpenAPI treats `POST /api/apply/login` as unauthenticated.
+
+## 0.6.0
+
+- **Breaking:** cookie session signatures use HMAC-SHA256. Existing HMAC cookies signed with the previous digest will not verify. Rotate `SESSION_SECRET` or sign users in again.
+- **Breaking:** default `MEMBER_ABILITIES` are profile and token scopes (`profile:read`, `auth:tokens:*`), not org/project/task. Apps replace the catalog with `configureAbilityCatalog`. HiroApp maps admin / recruiter / candidate.
+- Named auth guards: opaque Bearer tokens, JWT HS256, HTTP Basic, and cookie sessions. `AuthManager` picks a guard from the `Authorization` scheme. CSRF is skipped for Bearer and Basic.
+- OpenAPI treats HiroApp login, JWT mint (`POST /api/auth/token`), and public careers as unauthenticated. Partner ping and audit export require credentials.
+- SQL dialect helpers (`pgsql`, `mysql`, `sqlite`) for placeholders, quoting, `ILIKE`/`LIKE`, `RETURNING`, and `NULLS LAST`. Full-text `tsMatch` stays Postgres-only and throws on other engines.
+- HiroApp is the only in-repo example product. The leftover `src/db` schema is a test fixture, not a second app.
+- New subpaths: `auth/jwt`, `auth/jwtGuard`, `auth/basicAuthGuard`, `auth/tokenAbilityChecker`, `database/dialect`, `http/statelessAuth`.
+
 ## 0.5.101
 
 - Tenant middleware falls back with explicit branches when a member, admin, or guest tenant lookup misses, so the request still scopes to the default tenant.
@@ -16,12 +47,12 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names. `hashe
 
 ## 0.5.99
 
-HiroApp dogfood of 0.5.98 found lookalike APIs. This release matches Laravel call shape and SQL, not just export names.
+HiroApp dogfood of 0.5.98 found lookalike APIs. This release matches the previous PHP framework call shape and SQL, not just export names.
 
 - Relation queries are thenable: `await user.applications()` delegates to `get()`.
 - `Model.with()` / `where()` / `whereHas()` return a `ModelQuery` that hydrates models and chains into `where` / `find` / `findOrFail` / `first` / `get`. `first()` / `find()` use `LIMIT` / PK lookup.
 - `belongsTo.where()` threads constraints into `whereHas` EXISTS (HiroApp application search).
-- `{ ilike }` uses the value as-is (Laravel). Pass `%term%` yourself; the operator no longer wraps extra `%`.
+- `{ ilike }` uses the value as-is (the previous PHP framework). Pass `%term%` yourself; the operator no longer wraps extra `%`.
 - Morph type defaults to `$morphClass` / class name, not `table.name`. Override with `$morphClass = "App\\Models\\User"` or the last `morphMany` argument. `morphTo()` no longer silently defaults to `imageable_*`.
 - `primaryKey()` defaults to the table PK (`id`).
 - Nested `load("a.b")` / `with("a.b")` skip already-loaded heads and batch the next level.
@@ -41,7 +72,7 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 - `Model.where()`, `firstOrNew()`, `firstOrCreate()`, and `updateOrCreate()`.
 - Factory `count`/`state`/`sequence`/`for`/`has`/`recycle` plus `afterMaking`/`afterCreating`.
 - `JsonResource` (`wrap`, `whenLoaded`, `additional`, `collection`).
-- Laravel aliases: container `make`/`instance`, EventBus `on`/`emit`, query `whereNull`/`whereIn`/`whereExists`.
+- the previous PHP framework aliases: container `make`/`instance`, EventBus `on`/`emit`, query `whereNull`/`whereIn`/`whereExists`.
 - Parity audit reports design score separately. Horizon/Nova/CLI stay Bun-native stand-ins.
 
 ## 0.5.97
@@ -59,10 +90,10 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 
 ## 0.5.90
 
-- **Breaking identity defaults:** `appKeyPrefix()` is `strata` and `appDisplayName()` is `Strata` when `APP_KEY_PREFIX` / `APP_NAME` are unset (were `workhub` / `WorkHub`). WorkHub pins those env vars.
+- **Breaking identity defaults:** `appKeyPrefix()` is `strata` and `appDisplayName()` is `Strata` when `APP_KEY_PREFIX` / `APP_NAME` are unset (were `strata` / `the previous in-repo app`). the previous in-repo app pins those env vars.
 - `Schedule.command()` rejects cron strings other than `* * * * *` and `*/N * * * *` instead of silently never running them.
 - OpenAPI marks `GET /users/me/*` as bearer-authenticated.
-- OpenAPI `/users/me/current-organization` summaries no longer say Jetstream.
+- OpenAPI `/users/me/current-organization` summaries no longer say team invitations.
 
 ## 0.5.89
 
@@ -70,16 +101,16 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 
 ## 0.5.88
 
-- Exported cookie name constants (`SESSION_COOKIE`, `CSRF_COOKIE`, `FLASH_COOKIE`, `INTENDED_URL_COOKIE`, `PASSWORD_CONFIRM_COOKIE`) are `appCookieName(...)` so they match the default prefix instead of a hardcoded `workhub_` string.
-- `@getstrata/core/jobs/dispatchWebhookJob` is a deprecated compatibility re-export of the WorkHub webhook job.
+- Exported cookie name constants (`SESSION_COOKIE`, `CSRF_COOKIE`, `FLASH_COOKIE`, `INTENDED_URL_COOKIE`, `PASSWORD_CONFIRM_COOKIE`) are `appCookieName(...)` so they match the default prefix instead of a hardcoded `strata_` string.
+- `@getstrata/core/jobs/dispatchWebhookJob` is a deprecated compatibility re-export of the the previous in-repo app webhook job.
 
 ## 0.5.87
 
-- `AuthUserDirectory.hasActiveBrowserSession?(userId, issuedAt)` is optional. `SessionGuard` calls it after `session_valid_after` and rejects the HMAC cookie when it returns false so WorkHub can revoke a single browser session by deleting the `sessions` row.
+- `AuthUserDirectory.hasActiveBrowserSession?(userId, issuedAt)` is optional. `SessionGuard` calls it after `session_valid_after` and rejects the HMAC cookie when it returns false so the previous in-repo app can revoke a single browser session by deleting the `sessions` row.
 
 ## 0.5.86
 
-- `createSessionCookieDetails()` returns the HMAC session header plus `issuedAt` / `ttlSeconds` so apps can persist Jetstream browser-session rows without changing the cookie format.
+- `createSessionCookieDetails()` returns the HMAC session header plus `issuedAt` / `ttlSeconds` so apps can persist team invitations browser-session rows without changing the cookie format.
 
 ## 0.5.85
 
@@ -91,24 +122,24 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 
 ## 0.5.83
 
-- `MEMBER_ABILITIES` includes `auth:tokens:delete` so Jetstream-style personal access token revoke works for members (`DELETE /auth/tokens/:id`). HTML `/account/tokens/:id/revoke` was already authenticated-only.
+- `MEMBER_ABILITIES` includes `auth:tokens:delete` so team invitations-style personal access token revoke works for members (`DELETE /auth/tokens/:id`). HTML `/account/tokens/:id/revoke` was already authenticated-only.
 - `buildOtpauthUrl()` defaults the issuer through `appDisplayName()` (`APP_NAME`).
 
 ## 0.5.82
 
-- `MEMBER_ABILITIES` includes `organizations:create` so Jetstream-style extra teams work for members (HTML `POST /organizations` and JSON `POST /organizations`). `OrganizationPolicy.create` already allowed any authenticated user.
+- `MEMBER_ABILITIES` includes `organizations:create` so team invitations-style extra teams work for members (HTML `POST /organizations` and JSON `POST /organizations`). `OrganizationPolicy.create` already allowed any authenticated user.
 
 ## 0.5.81
 
-- `@getstrata/core/auth/intendedUrlCookie` (`createIntendedUrlCookie`, `readIntendedUrl`, `clearIntendedUrlCookie`, `createIntendedUrlCookieFromRequest`). Fortify intended URL after HTML email verification: register with `redirect=` and Laravel `verified` HTML redirects stash `${APP_KEY_PREFIX}_intended` (`INTENDED_URL_COOKIE_NAME`, default `workhub_intended`; TTL `INTENDED_URL_TTL_SECONDS`, default 86400s). `GET /verify-email` honors and clears it.
+- `@getstrata/core/auth/intendedUrlCookie` (`createIntendedUrlCookie`, `readIntendedUrl`, `clearIntendedUrlCookie`, `createIntendedUrlCookieFromRequest`). HTML auth intended URL after HTML email verification: register with `redirect=` and the previous PHP framework `verified` HTML redirects stash `${APP_KEY_PREFIX}_intended` (`INTENDED_URL_COOKIE_NAME`, default `strata_intended`; TTL `INTENDED_URL_TTL_SECONDS`, default 86400s). `GET /verify-email` honors and clears it.
 
 ## 0.5.80
 
-- `appCookieName()` / `appDevSecret()` on `@getstrata/core/runtime/appKeyPrefix`. HMAC session, CSRF, flash, password-confirm, signed-URL, OAuth-state, and token-pepper fallbacks follow `APP_KEY_PREFIX` (WorkHub defaults unchanged).
+- `appCookieName()` / `appDevSecret()` on `@getstrata/core/runtime/appKeyPrefix`. HMAC session, CSRF, flash, password-confirm, signed-URL, OAuth-state, and token-pepper fallbacks follow `APP_KEY_PREFIX` (the previous in-repo app defaults unchanged).
 
 ## 0.5.79
 
-- `readSession()` returns `{ userId, issuedAt }` from the HMAC session cookie. `isSessionInvalidated(issuedAt, session_valid_after)` lets `SessionGuard` reject cookies issued before `AuthUserRecord.session_valid_after` (Jetstream logout-other-devices / password change).
+- `readSession()` returns `{ userId, issuedAt }` from the HMAC session cookie. `isSessionInvalidated(issuedAt, session_valid_after)` lets `SessionGuard` reject cookies issued before `AuthUserRecord.session_valid_after` (team invitations logout-other-devices / password change).
 
 ## 0.5.78
 
@@ -116,7 +147,7 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 
 ## 0.5.77
 
-- `@getstrata/core/security/recoveryCodes` (`generateRecoveryCodes`, `hashRecoveryCode`, `recoveryCodeMatches`). Fortify-style one-time MFA backup codes (`abcd-efgh`).
+- `@getstrata/core/security/recoveryCodes` (`generateRecoveryCodes`, `hashRecoveryCode`, `recoveryCodeMatches`). HTML auth-style one-time MFA backup codes (`abcd-efgh`).
 
 ## 0.5.76
 
@@ -124,12 +155,12 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 
 ## 0.5.75
 
-- Laravel `password.confirm`: `@getstrata/core/auth/passwordConfirmCookie` (`createPasswordConfirmCookie`, `hasFreshPasswordConfirmation`, `clearPasswordConfirmCookie`) and `createRequirePasswordConfirmMiddleware()` (HTML 302 `/confirm-password`, JSON 423). Cookie name `PASSWORD_CONFIRM_COOKIE_NAME` (default `workhub_password_confirmed`), TTL `PASSWORD_CONFIRM_TIMEOUT` (default 10800s).
+- the previous PHP framework `password.confirm`: `@getstrata/core/auth/passwordConfirmCookie` (`createPasswordConfirmCookie`, `hasFreshPasswordConfirmation`, `clearPasswordConfirmCookie`) and `createRequirePasswordConfirmMiddleware()` (HTML 302 `/confirm-password`, JSON 423). Cookie name `PASSWORD_CONFIRM_COOKIE_NAME` (default `strata_password_confirmed`), TTL `PASSWORD_CONFIRM_TIMEOUT` (default 10800s).
 
 ## 0.5.74
 
 - `AuthUser.emailVerifiedAt` and `@getstrata/core/auth/emailVerification` (`isEmailVerificationRequired`, `hasVerifiedEmail`). `null` means unverified; missing is treated as verified (GuestGuard / legacy).
-- `createRequireVerifiedMiddleware()` is Laravel `verified` (HTML 302 `/email/verify`, JSON 403).
+- `createRequireVerifiedMiddleware()` is the previous PHP framework `verified` (HTML 302 `/email/verify`, JSON 403).
 
 ## 0.5.73
 
@@ -154,40 +185,40 @@ Still non-conforming (honest): Bun cannot infer `morphTo()` method names (`debug
 
 ## 0.5.68
 
-- Published core no longer imports WorkHub `src/config`. Frontend mode, queue retries, CORS, and upload limits read env (`FRONTEND_MODE`, `QUEUE_*`, `CORS_ALLOWED_ORIGINS`, `MAX_UPLOAD_BYTES`).
+- Published core no longer imports the previous in-repo app `src/config`. Frontend mode, queue retries, CORS, and upload limits read env (`FRONTEND_MODE`, `QUEUE_*`, `CORS_ALLOWED_ORIGINS`, `MAX_UPLOAD_BYTES`).
 - `@getstrata/core/runtime/frontendMode` exports `readFrontendMode` / `isViewsEnabled` / `isSpaEnabled`.
 
 ## 0.5.67
 
-- OpenAPI title, server URLs, and generated SDK class name come from `APP_NAME` / `APP_URL` / `API_PREFIX` / `APP_SDK_CLASS` instead of importing WorkHub `src/config/app`.
-- `appEnv()`, `appUrl()`, `apiPrefix()`, and `sdkClientClassName()` live on `@getstrata/core/runtime/appKeyPrefix`. SIEM export, HSTS, and `safeFetch` DNS resolve use `appEnv()` instead of WorkHub `appConfig`.
+- OpenAPI title, server URLs, and generated SDK class name come from `APP_NAME` / `APP_URL` / `API_PREFIX` / `APP_SDK_CLASS` instead of importing the previous in-repo app `src/config/app`.
+- `appEnv()`, `appUrl()`, `apiPrefix()`, and `sdkClientClassName()` live on `@getstrata/core/runtime/appKeyPrefix`. SIEM export, HSTS, and `safeFetch` DNS resolve use `appEnv()` instead of the previous in-repo app `appConfig`.
 
 ## 0.5.66
 
-- `createValidateSignatureMiddleware()` on `@getstrata/core/http/signedUrl` is Laravel’s `signed` / `ValidateSignature` middleware. Invalid or expired links throw `ForbiddenError`.
+- `createValidateSignatureMiddleware()` on `@getstrata/core/http/signedUrl` is the previous PHP framework's `signed` / `ValidateSignature` middleware. Invalid or expired links throw `ForbiddenError`.
 
 ## 0.5.65
 
-- Identity helpers on `@getstrata/core/runtime/appKeyPrefix` (`smtpEhloHost`, `siemEventType`, `appUserAgent`, `otelServiceName`, `appDisplayName`, `webhookSignatureHeader`) so sibling apps are not stuck with WorkHub SMTP/SIEM/OTEL/OAuth names.
-- SIEM `event_type` and CEF vendor follow `SIEM_EVENT_TYPE` / `APP_NAME` (defaults stay `workhub.audit` / `WorkHub`).
+- Identity helpers on `@getstrata/core/runtime/appKeyPrefix` (`smtpEhloHost`, `siemEventType`, `appUserAgent`, `otelServiceName`, `appDisplayName`, `webhookSignatureHeader`) so sibling apps are not stuck with the previous in-repo app SMTP/SIEM/OTEL/OAuth names.
+- SIEM `event_type` and CEF vendor follow `SIEM_EVENT_TYPE` / `APP_NAME` (defaults stay `strata.audit` / `the previous in-repo app`).
 
 ## 0.5.64
 
-- `APP_KEY_PREFIX` (default `workhub`) namespaces Redis cache, queue, and throttle keys so sibling apps do not share WorkHub’s keyspace.
-- `DispatchWebhookJob` implementation lives in the WorkHub webhook module. `@getstrata/core/jobs/dispatchWebhookJob` remains a compatibility re-export.
+- `APP_KEY_PREFIX` (default `strata`) namespaces Redis cache, queue, and throttle keys so sibling apps do not share the previous in-repo app's keyspace.
+- `DispatchWebhookJob` implementation lives in the the previous in-repo app webhook module. `@getstrata/core/jobs/dispatchWebhookJob` remains a compatibility re-export.
 
 ## 0.5.63
 
-- Flash cookies honor `FLASH_COOKIE_NAME` (default `workhub_flash`) so sibling apps do not inherit WorkHub’s cookie name.
+- Flash cookies honor `FLASH_COOKIE_NAME` (default `strata_flash`) so sibling apps do not inherit the previous in-repo app's cookie name.
 
 ## 0.5.62
 
-Laravel URL signing, Bun-native markdown mail, and session-auth cleanup.
+the previous PHP framework URL signing, Bun-native markdown mail, and session-auth cleanup.
 
 - `temporarySignedUrl` / `signedUrl` / `hasValidSignature` / `assertValidSignature` on `@getstrata/core/http/signedUrl`. HMAC uses `SIGNED_URL_SECRET` or `SESSION_SECRET`. Paths must be same-origin (`/` only; reject `//` and `://`).
 - `markdownToHtml()` uses `Bun.markdown.html()` plus `sanitizeMailHtml` (allowlist). Scripts, `javascript:` links, and unknown tags are stripped.
 - `ExportAuditLogsJob` (`@getstrata/core/jobs/exportAuditLogsJob`) wraps SIEM export so the scheduler can dispatch a real job.
-- `DispatchWebhookJob` reads `APP_ENV` and `WEBHOOK_SIGNATURE_HEADER` instead of WorkHub `appConfig`.
+- `DispatchWebhookJob` reads `APP_ENV` and `WEBHOOK_SIGNATURE_HEADER` instead of the previous in-repo app `appConfig`.
 - `createRequireWebAuthMiddleware` runs the handler inside `runWithAuthUser` so `currentAuthUser()` works on HTMX session routes.
 - `generateTotpSecret()` / `buildOtpauthUrl()` on `@getstrata/core/security/totp`.
 - `createRequireAbilityMiddleware` rethrows `ForbiddenError` for HTML views so HTMX routes render a styled 403 instead of JSON.
@@ -211,13 +242,13 @@ HTMX HTML kernel gaps that sibling apps could not work around without weakening
 
 ## 0.5.59
 
-Sibling HTMX apps can consume published packages without WorkHub-only glue.
+Sibling HTMX apps can consume published packages without the previous in-repo app-only glue.
 
 - Emit `@getstrata/core/facades` types at `dist/core/facades/index.d.ts` (CI checks every `exports.*.types` path after build).
-- Session and CSRF cookie names are configurable (`SESSION_COOKIE_NAME`, `CSRF_COOKIE_NAME`). Defaults remain `workhub_session` and `workhub_csrf` for WorkHub.
+- Session and CSRF cookie names are configurable (`SESSION_COOKIE_NAME`, `CSRF_COOKIE_NAME`). Defaults remain `strata_session` and `strata_csrf` for the previous in-repo app.
 - Split `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN` from `CORE_TOKEN_SERVICE_TOKEN`. HttpKernel prefers the ability-checker token; HMAC `SessionGuard` / layout data prefer the user directory. A compatibility shim uses `CORE_TOKEN_SERVICE_TOKEN` only when the bound value matches the requested type.
-- `configureWebLayoutData` lets apps choose `currentUser` vs `authUser`, a custom user loader, and extra template fields. WorkHub still gets `{ authUser, csrfToken, flash }`.
+- `configureWebLayoutData` lets apps choose `currentUser` vs `authUser`, a custom user loader, and extra template fields. the previous in-repo app still gets `{ authUser, csrfToken, flash }`.
 - `redirectResponse`, `notFoundHtmlResponse`, `textResponse`, and `xmlResponse` join `htmlResponse` / `isHtmxRequest` on `@getstrata/core/view`.
 - `LOGIN_RATE_LIMIT_WINDOW_MS` is a deprecated alias for `LOGIN_RATE_LIMIT_WINDOW_SECONDS`.
 
-HMAC `SessionGuard` is unchanged for WorkHub API/token apps. Sibling HTMX apps should use `@getstrata/bootstrap` `CookieSessionStore` + `createCookieSessionAuthManager`.
+HMAC `SessionGuard` is unchanged for the previous in-repo app API/token apps. Sibling HTMX apps should use `@getstrata/bootstrap` `CookieSessionStore` + `createCookieSessionAuthManager`.

package/README.md

@@ -2,73 +2,56 @@
 
 Stable **Strata** framework surface for application modules.
 
-**Source:** `src/framework/public-api.ts` (monorepo)  
+**Source:** `src/framework/public-api.ts` (monorepo)
 **Repository:** [EyK-26/strata](https://github.com/EyK-26/strata), directory `packages/strata-core`
 
-WorkHub is the reference application built on Strata; import the framework from this package in your own modules. Sibling HTMX apps (Eta, cookie sessions, no API tokens) should follow [docs/SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
+HiroApp is the example product. Import this package from your own modules. HTML cookie apps: [docs/BUILDING-APPS.md](../../docs/BUILDING-APPS.md). Auth choices: [docs/AUTH.md](../../docs/AUTH.md). SQL engines: [docs/DATABASE.md](../../docs/DATABASE.md).
 
 ## Usage
 
-Set `DATABASE_URL` before importing (connection is created lazily on first query):
+Set `DATABASE_URL` before importing (the connection is created lazily on first query):
 
 ```typescript
 process.env.DATABASE_URL ??= "postgresql://postgres:postgres@localhost:5432/myapp";
 
-import { AdminResourceRegistry } from "@getstrata/core/admin/registry";
-import { formatAdminValue } from "@getstrata/core/admin/formatValue";
 import { Policy } from "@getstrata/core/auth/policy";
 import { BaseRepository } from "@getstrata/core/database/baseRepository";
-import { mail } from "@getstrata/core/facades";
 import { FormRequest } from "@getstrata/core/http/formRequest";
 import { withErrorHandling } from "@getstrata/core/http/response";
-import { mailer } from "@getstrata/core/mail/mailer";
-import { storage } from "@getstrata/core/facades";
 import { EtaViewEngine } from "@getstrata/core/view";
 ```
 
-`.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not Pug. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
+`.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not another template language. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
 
-**Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database driver is your app's choice. WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; create and bind it with `createBunSqlPool()` / `bindBunSql()`, or call `bindDatabaseConnection()` yourself.
+**Dependency:** `eta` is a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database **engine** is your choice. HiroApp uses **Bun's built-in `Bun.sql`** (Postgres). Create and bind it with `createBunSqlPool()` / `bindBunSql()`, or call `bindDatabaseConnection()` yourself. Extra engines register with `registerNamedConnection` (`database/namedConnections`, `database/sqliteConnection`, `database/mysqlConnection`).
 
-`orderBy` accepts explicit `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`.
+`orderBy` accepts `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`. `{ ilike }` uses the value as-is. Pass `%term%` yourself.
 
 ## Admin and queue helpers
 
-Exports for admin dashboards and queue recovery:
-
 - `AdminResourceRegistry`, `formatAdminValue`: read-only resource browsers
 - `createFailedJobService`, `FailedJobService.delete()`: failed job persistence and cleanup
 - `runQueueJob`, `jobRegistry`: dispatch retried jobs from admin UIs
 
+HiroApp uses failed-job recovery in the staff dashboard. You do not have to use the admin registry.
+
 ## Build and verify (monorepo root)
 
 ```bash
 bun run build:framework
-bun run verify:framework   # build + public API tests
-bun run verify:shared-subpaths  # after build: confirm singleton shims
+bun run verify:framework
+bun run verify:shared-subpaths
 ```
 
 ## Subpath imports
 
-`@getstrata/core` publishes **144+ subpaths** (for example `@getstrata/core/http/authMiddleware`,
-`@getstrata/core/database/migrations`). Prefer subpaths over the root import in apps, bootstrap, and tests.
+`@getstrata/core` publishes many subpaths (for example `@getstrata/core/http/authMiddleware`, `@getstrata/core/database/migrations`). Prefer subpaths over the root import in apps, bootstrap, and tests.
 
-Some subpaths **re-export the main bundle** so singleton state stays shared (database pool binding,
-`AsyncLocalStorage` auth/tenant context, global registries, `HttpError` / `Notification` classes for
-`instanceof`). The canonical list lives in `scripts/core-shared-subpaths.ts` and is verified by
-`scripts/verify-core-shared-subpaths.ts` after each framework build.
+Some subpaths **re-export the main bundle** so singleton state stays shared (database pool, dialect override, async-local auth/tenant, `HttpError` for `instanceof`). The list lives in `scripts/core-shared-subpaths.ts`.
+
+When adding a subpath that owns process-wide state or base classes used with `instanceof`, append it to `CORE_SHARED_SUBPATHS`, run `bun scripts/sync-package-subpaths.ts`, and rebuild.
 
-When adding a subpath that owns process-wide state or base classes used with `instanceof`, append it to
-`CORE_SHARED_SUBPATHS`, run `bun scripts/sync-package-subpaths.ts`, and rebuild. Non-shared subpath
-bundles are built with generated `--external @getstrata/core/*` flags (all 144+ subpaths) so framework
-source can import shared modules via package self-imports (`scripts/codemod-core-self-imports.ts`).
-Bootstrap subpath builds externalize all `@getstrata/bootstrap/*` and `@getstrata/core/*` entries.
 `scripts/verify-no-root-imports.ts` blocks root `@getstrata/core` imports in application source.
-`scripts/verify-no-shared-barrel-imports.ts` blocks `@getstrata/core/database` and
-`@getstrata/core/http` barrel imports in application source.
-`scripts/audit-public-api-surface.ts` reports root exports with no in-repo root import usage.
-`scripts/verify-bundled-subpaths.ts` ensures entries like `http/webFormRequest` do not inline
-`ValidationError`.
 
 ```typescript
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
@@ -82,9 +65,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.96 && git push origin v0.5.96`
+2. Tag a release: `git tag v0.7.3 && git push origin v0.7.3`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
-Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.
-
-See [docs/PACKAGING.md](../../docs/PACKAGING.md) for boundaries and future extraction.
+See [docs/PACKAGING.md](../../docs/PACKAGING.md).

package/dist/core/auth/abilityCatalog.d.ts

@@ -1,5 +1,5 @@
-declare const MEMBER_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete"];
-declare const ADMIN_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete", "organizations:create", "organizations:update", "organizations:delete", "projects:update", "projects:delete", "tasks:update", "tasks:delete", "comments:update", "comments:delete", "attachments:delete", "webhooks:read", "webhooks:write", "audit:read"];
+declare const MEMBER_ABILITIES: readonly ["profile:read", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete"];
+declare const ADMIN_ABILITIES: readonly ["profile:read", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete", "webhooks:read", "webhooks:write", "audit:read", "audit:export"];
 declare const PLATFORM_ADMIN_ABILITIES: readonly ["*"];
 interface AbilityCatalog {
     member: readonly string[];

package/dist/core/auth/basicAuthGuard.d.ts

@@ -0,0 +1,9 @@
+import type { ServiceContainerLike } from "../contracts/serviceContainer";
+import type { AuthUser } from "./authContext";
+import type { AuthGuard } from "./guard";
+declare class BasicAuthGuard implements AuthGuard {
+    private readonly container;
+    constructor(container: ServiceContainerLike);
+    resolve(request: Request): Promise<AuthUser | null>;
+}
+export { BasicAuthGuard };

package/dist/core/auth/guard.d.ts

@@ -26,11 +26,17 @@ declare class CompositeGuard implements AuthGuard {
 }
 declare class AuthManager {
     private readonly guard;
+    private readonly namedGuards;
     constructor(guard: AuthGuard);
+    registerGuard(name: string, next: AuthGuard): this;
+    use(name?: string): AuthGuard;
+    guardNames(): string[];
     resolve(request?: Request): Promise<AuthUser | null>;
     user(request?: Request): Promise<AuthUser | null>;
     check(request?: Request): Promise<boolean>;
     requireUser(request?: Request): Promise<AuthUser>;
+    private authenticateRequest;
+    private tryNamedGuards;
 }
 export type { AuthGuard, AuthUser };
 export { ApiTokenGuard, AuthManager, CompositeGuard, DatabaseTokenGuard, GuestGuard };

package/dist/core/auth/jwt.d.ts

@@ -0,0 +1,19 @@
+interface JwtPayload {
+    sub: string | number;
+    role?: string;
+    abilities?: string[];
+    emailVerifiedAt?: Date | string | null;
+    iat?: number;
+    exp?: number;
+    [key: string]: unknown;
+}
+interface SignJwtOptions {
+    secret?: string;
+    ttlSeconds?: number;
+}
+declare function resolveJwtSecret(secret?: string): string;
+declare function jwtTtlSeconds(override?: number): number;
+declare function signJwt(payload: JwtPayload, options?: SignJwtOptions): string;
+declare function verifyJwt(token: string, secret?: string): JwtPayload | null;
+export type { JwtPayload, SignJwtOptions };
+export { jwtTtlSeconds, resolveJwtSecret, signJwt, verifyJwt };

package/dist/core/auth/jwtGuard.d.ts

@@ -0,0 +1,14 @@
+import type { AuthUser } from "./authContext";
+import type { AuthGuard } from "./guard";
+import { type JwtPayload } from "./jwt";
+interface JwtGuardOptions {
+    secret?: string;
+}
+declare function authUserFromJwt(payload: JwtPayload): AuthUser;
+declare class JwtGuard implements AuthGuard {
+    private readonly options;
+    constructor(options?: JwtGuardOptions);
+    resolve(request: Request): AuthUser | null;
+}
+export type { JwtGuardOptions };
+export { authUserFromJwt, JwtGuard };

package/dist/core/auth/tokenAbilityChecker.d.ts

@@ -0,0 +1,5 @@
+import type { AbilityChecker } from "./abilityChecker";
+import type { AuthUser } from "./authContext";
+declare function tokenCan(user: AuthUser | null, ability: string): boolean;
+declare function createTokenAbilityChecker(): AbilityChecker;
+export { createTokenAbilityChecker, tokenCan };

package/dist/core/cache/tags.d.ts

@@ -5,6 +5,12 @@ declare const CACHE_TAGS: {
     readonly comments: "comments";
     readonly attachments: "attachments";
     readonly reports: "reports";
+    readonly users: "users";
+    readonly departments: "departments";
+    readonly positions: "positions";
+    readonly applications: "applications";
+    readonly careers: "careers";
+    readonly offers: "offers";
 };
 type CacheTag = (typeof CACHE_TAGS)[keyof typeof CACHE_TAGS];
 export type { CacheTag };

package/dist/core/contracts/authUserDirectory.d.ts

@@ -10,5 +10,9 @@ interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;
     findByIdOrThrow(id: number): Promise<AuthUserRecord>;
     hasActiveBrowserSession?(userId: number, issuedAt: number): Promise<boolean>;
+    findByEmail?(email: string): Promise<(AuthUserRecord & {
+        password?: string | null;
+    }) | null>;
+    verifyCredentials?(email: string, password: string): Promise<AuthUser | null>;
 }
 export type { AuthUserDirectory, AuthUserRecord };

package/dist/core/database/dialect.d.ts

@@ -0,0 +1,18 @@
+import { type DatabaseDriver } from "./schema/driver.ts";
+interface SqlDialect {
+    readonly driver: DatabaseDriver;
+    placeholder(index: number): string;
+    quoteIdentifier(identifier: string): string;
+    nowExpression(): string;
+    returningClause(columns: string): string;
+    ilikeOperator(): "ILIKE" | "LIKE";
+    nullsLastSuffix(): string;
+    castToText(expression: string): string;
+}
+declare function dialectFor(driver: DatabaseDriver): SqlDialect;
+declare function currentSqlDialect(): SqlDialect;
+declare function useSqlDialect(driver: DatabaseDriver): SqlDialect;
+declare function resetSqlDialect(): void;
+declare function runWithSqlDialect<T>(driver: DatabaseDriver, callback: () => T | Promise<T>): T | Promise<T>;
+export type { SqlDialect };
+export { currentSqlDialect, dialectFor, resetSqlDialect, runWithSqlDialect, useSqlDialect };

package/dist/core/database/factory.d.ts

@@ -44,6 +44,7 @@ declare class Factory<TRecord extends object, Counted extends boolean = false> {
     create(overrides?: Partial<TRecord>): Promise<FactoryMakeResult<TRecord, Counted>>;
     protected makeOne(overrides?: Partial<TRecord>): TRecord;
     protected createOne(overrides?: Partial<TRecord>): Promise<TRecord>;
+    protected persistCreated(record: TRecord): Promise<TRecord>;
     protected insertable(record: TRecord): Partial<TRecord>;
     protected persist(values: Partial<TRecord>): Promise<TRecord>;
 }

package/dist/core/database/index.d.ts

@@ -1,17 +1,25 @@
 export type { DatabaseConnection } from "./baseRepository.ts";
 export { default as BaseRepository } from "./baseRepository.ts";
 export { createDatabaseConnection } from "./connection.ts";
+export type { ActiveDatabaseHandle } from "./connectionContext.ts";
+export { getActiveDatabaseConnection, hasActiveDatabaseConnection, runWithDatabaseConnection, } from "./connectionContext.ts";
+export type { SqlDialect } from "./dialect.ts";
+export { currentSqlDialect, dialectFor, resetSqlDialect, runWithSqlDialect, useSqlDialect, } from "./dialect.ts";
 export { mapDatabaseError, withDatabaseErrorHandling } from "./errors.ts";
 export { Factory } from "./factory.ts";
 export { foreignKeyFromTable, pivotTableName, singularize } from "./inflection.ts";
 export type { CastType, GlobalScopeFn, ModelConstructor } from "./model.ts";
 export { applyCasts, BelongsToManyRelationQuery, BelongsToRelationQuery, dehydrateValue, filterMassAssignable, HasManyRelationQuery, HasManyThroughRelationQuery, HasOneRelationQuery, hydrateValue, Model, ModelQuery, MorphManyRelationQuery, MorphOneRelationQuery, MorphToRelationQuery, registerModelClass, registerModelRepository, } from "./model.ts";
+export { createMysqlConnection, createMysqlConnectionFromPool } from "./mysqlConnection.ts";
+export type { NamedConnectionEntry } from "./namedConnections.ts";
+export { getNamedConnection, hasNamedConnection, registerNamedConnection, resetNamedConnections, runOnNamedConnection, unregisterNamedConnection, } from "./namedConnections.ts";
 export { buildAdvancedWhereClause, buildCountQuery, buildDeleteByIdQuery, buildGroupedCountQuery, buildInsertQuery, buildJoinClause, buildOrderByClause, buildProjectionQuery, buildQueryWhereClause, buildRestoreByIdQuery, buildSelectQuery, buildSoftDeleteByIdQuery, buildUpdateQuery, buildWhereClause, parseQualifiedColumn, qualifyColumn, quoteIdentifier, resolveQualifiedColumn, resolveSoftDeleteColumn, } from "./query.ts";
 export type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasManyThroughRelation, HasOneRelation, MorphManyRelation, MorphOneRelation, MorphToRelation, } from "./relationships.ts";
 export { belongsTo, belongsToMany, hasMany, hasManyThrough, hasOne, indexBelongsToManyRelation, indexBelongsToRelation, indexHasManyRelation, indexHasManyThroughRelation, indexHasOneRelation, indexMorphManyRelation, indexMorphOneRelation, indexMorphToRelation, morphMany, morphOne, morphTo, } from "./relationships.ts";
 export { RepositoryQuery } from "./repositoryQuery.ts";
 export type { BlueprintAction, BlueprintCallback, ColumnKind, DatabaseDriver, ForeignKeyOptions, Grammar, IndexDefinition, IndexKind, ResolveDatabaseDriverOptions, SchemaBuilder, } from "./schema/index.ts";
 export { Blueprint, ColumnDefinition, compileBlueprint, createSchemaBuilder, ForeignIdColumnDefinition, grammarForDriver, inferReferencedTable, MySqlGrammar, PostgresGrammar, resolveDatabaseDriver, Schema, SqliteGrammar, UnsupportedSchemaFeatureError, } from "./schema/index.ts";
+export { createSqliteConnection } from "./sqliteConnection.ts";
 export type { TableDefinition } from "./table.ts";
 export { defineTable } from "./table.ts";
 export { runInTransaction } from "./transaction.ts";

package/dist/core/database/mysqlConnection.d.ts

@@ -0,0 +1,12 @@
+import type { ActiveDatabaseHandle } from "./connectionContext.ts";
+type MysqlExecutable = {
+    execute: (sql: string, params?: unknown[]) => Promise<[unknown, unknown]>;
+    end?: () => Promise<void>;
+};
+type MysqlConnection = ActiveDatabaseHandle & {
+    close(): Promise<void>;
+};
+declare function createMysqlConnectionFromPool(pool: MysqlExecutable): MysqlConnection;
+declare function createMysqlConnection(url: string): MysqlConnection;
+export type { MysqlConnection, MysqlExecutable };
+export { createMysqlConnection, createMysqlConnectionFromPool };

package/dist/core/database/namedConnections.d.ts

@@ -0,0 +1,15 @@
+import { type ActiveDatabaseHandle } from "./connectionContext.ts";
+import type { DatabaseDriver } from "./schema/driver.ts";
+type NamedConnectionEntry = {
+    name: string;
+    driver: DatabaseDriver;
+    connection: ActiveDatabaseHandle;
+};
+declare function registerNamedConnection(name: string, driver: DatabaseDriver, connection: ActiveDatabaseHandle): void;
+declare function unregisterNamedConnection(name: string): boolean;
+declare function hasNamedConnection(name: string): boolean;
+declare function getNamedConnection(name: string): NamedConnectionEntry;
+declare function resetNamedConnections(): void;
+declare function runOnNamedConnection<T>(name: string, callback: () => T | Promise<T>): T | Promise<T>;
+export type { NamedConnectionEntry };
+export { getNamedConnection, hasNamedConnection, registerNamedConnection, resetNamedConnections, runOnNamedConnection, unregisterNamedConnection, };

package/dist/core/database/repositoryQuery.d.ts

@@ -45,5 +45,6 @@ declare class RepositoryQuery<TEntity extends object, PrimaryKey extends keyof T
     private buildOptions;
     private addJoin;
     private attach;
+    private hydrateEagerLoad;
 }
 export { RepositoryQuery };

package/dist/core/database/sqliteConnection.d.ts

@@ -0,0 +1,7 @@
+import type { ActiveDatabaseHandle } from "./connectionContext.ts";
+type SqliteConnection = ActiveDatabaseHandle & {
+    close(): void;
+};
+declare function createSqliteConnection(filename: string): SqliteConnection;
+export type { SqliteConnection };
+export { createSqliteConnection };

package/dist/core/http/loginThrottleMiddleware.d.ts

@@ -1,11 +1,14 @@
 import type { Middleware } from "./middleware";
 interface LoginThrottleOptions {
-    redisUrl: string;
+    redisUrl?: string;
     maxAttempts: number;
     decaySeconds: number;
     keyPrefix?: string;
 }
 declare function resolveLoginIdentity(request: Request): string;
+declare function resolveLoginEmail(request: Request): Promise<string>;
+declare function createMemoryLoginThrottleMiddleware(options: LoginThrottleOptions): Middleware;
 declare function createLoginThrottleMiddleware(options: LoginThrottleOptions): Middleware;
+declare function resetMemoryLoginThrottleForTests(): void;
 export type { LoginThrottleOptions };
-export { createLoginThrottleMiddleware, resolveLoginIdentity };
+export { createLoginThrottleMiddleware, createMemoryLoginThrottleMiddleware, resetMemoryLoginThrottleForTests, resolveLoginEmail, resolveLoginIdentity, };

package/dist/core/http/resources.d.ts

@@ -1,7 +1,7 @@
 declare function serializeDate(value: Date | string): string;
 declare function whenLoaded<T>(model: {
     loaded: (name: string) => unknown;
-}, relation: string, transform?: (value: unknown) => T): T | undefined;
+}, relation: string, transform?: (value: unknown) => T): T | undefined | null;
 declare class JsonResource<T = unknown> {
     protected readonly resource: T;
     static wrap: string | null;
@@ -11,7 +11,7 @@ declare class JsonResource<T = unknown> {
     static collection<TResource>(items: readonly TResource[]): ResourceCollection<TResource>;
     additional(data: Record<string, unknown>): this;
     when<TValue>(condition: boolean, value: TValue): TValue | undefined;
-    whenLoaded<TValue = unknown>(relation: string, transform?: (value: unknown) => TValue): TValue | undefined;
+    whenLoaded<TValue = unknown>(relation: string, transform?: (value: unknown) => TValue): TValue | undefined | null;
     toArray(): Record<string, unknown>;
     toResponse(): Record<string, unknown>;
 }

package/dist/core/http/response.d.ts

@@ -3,4 +3,5 @@ declare function createdResponse(data: unknown, init?: ResponseInit): Response;
 declare function noContentResponse(): Response;
 declare function errorResponse(error: unknown): Response;
 declare function withErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
-export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling };
+declare function withJsonErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
+export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, withJsonErrorHandling, };

package/dist/core/http/statelessAuth.d.ts

@@ -0,0 +1,8 @@
+declare function authorizationScheme(request: Request): string;
+declare function requestUsesHeaderCredentials(request: Request): boolean;
+declare function readBearerToken(request: Request): string | null;
+declare function readBasicCredentials(request: Request): {
+    username: string;
+    password: string;
+} | null;
+export { authorizationScheme, readBasicCredentials, readBearerToken, requestUsesHeaderCredentials };

package/dist/core/http/throttleResponse.d.ts

@@ -0,0 +1,2 @@
+declare function tooManyRequestsResponse(request: Request, message: string, decaySeconds: number): Promise<Response>;
+export { tooManyRequestsResponse };

package/dist/core/runtime/frontendMode.d.ts

@@ -1,6 +1,14 @@
-type FrontendMode = "api" | "server-htmx" | "spa-react";
+declare const FRONTEND_MODES: readonly ["api", "server-htmx", "spa-react", "hybrid"];
+declare const DEFAULT_SPA_PREFIX = "/app";
+type FrontendMode = (typeof FRONTEND_MODES)[number];
+declare const FRONTEND_MODE_PATTERN: RegExp;
+declare function parseFrontendMode(value: string | undefined): FrontendMode;
 declare function readFrontendMode(): FrontendMode;
+declare function isViewsMode(mode: FrontendMode): boolean;
+declare function isSpaMode(mode: FrontendMode): boolean;
 declare function isViewsEnabled(): boolean;
 declare function isSpaEnabled(): boolean;
+declare function normalizeSpaPrefix(value: string | undefined): string;
+declare function readSpaPrefix(): string;
 export type { FrontendMode };
-export { isSpaEnabled, isViewsEnabled, readFrontendMode };
+export { DEFAULT_SPA_PREFIX, FRONTEND_MODE_PATTERN, FRONTEND_MODES, isSpaEnabled, isSpaMode, isViewsEnabled, isViewsMode, normalizeSpaPrefix, parseFrontendMode, readFrontendMode, readSpaPrefix, };