@getstrata/core 0.5.58 → 0.5.59

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# @getstrata/core changelog
+
+## 0.5.59
+
+Sibling HTMX apps can consume published packages without WorkHub-only glue.
+
+- Emit `@getstrata/core/facades` types at `dist/core/facades/index.d.ts` (CI checks every `exports.*.types` path after build).
+- Session and CSRF cookie names are configurable (`SESSION_COOKIE_NAME`, `CSRF_COOKIE_NAME`). Defaults remain `workhub_session` and `workhub_csrf` for WorkHub.
+- Split `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN` from `CORE_TOKEN_SERVICE_TOKEN`. HttpKernel prefers the ability-checker token; HMAC `SessionGuard` / layout data prefer the user directory. A compatibility shim uses `CORE_TOKEN_SERVICE_TOKEN` only when the bound value matches the requested type.
+- `configureWebLayoutData` lets apps choose `currentUser` vs `authUser`, a custom user loader, and extra template fields. WorkHub still gets `{ authUser, csrfToken, flash }`.
+- `redirectResponse`, `notFoundHtmlResponse`, `textResponse`, and `xmlResponse` join `htmlResponse` / `isHtmxRequest` on `@getstrata/core/view`.
+- `LOGIN_RATE_LIMIT_WINDOW_MS` is a deprecated alias for `LOGIN_RATE_LIMIT_WINDOW_SECONDS`.
+
+HMAC `SessionGuard` is unchanged for WorkHub API/token apps. Sibling HTMX apps should use `@getstrata/bootstrap` `CookieSessionStore` + `createCookieSessionAuthManager`.

package/README.md

@@ -5,7 +5,7 @@ Stable **Strata** framework surface for application modules.
 **Source:** `src/framework/public-api.ts` (monorepo)  
 **Repository:** [EyK-26/strata](https://github.com/EyK-26/strata), directory `packages/strata-core`
 
-WorkHub is the reference application built on Strata; import the framework from this package in your own modules.
+WorkHub is the reference application built on Strata; import the framework from this package in your own modules. Sibling HTMX apps (Eta, cookie sessions, no API tokens) should follow [docs/SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
 
 ## Usage
 
@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.58 && git push origin v0.5.58`
+2. Tag a release: `git tag v0.5.60 && git push origin v0.5.60`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/bootstrap/config.d.ts

@@ -4,7 +4,7 @@ declare const CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
 declare const CACHE_DRIVER_CONFIG_KEY = "cache.driver";
 declare const REDIS_URL_CONFIG_KEY = "cache.redisUrl";
 declare const DATABASE_URL_CONFIG_KEY = "database.url";
-export { CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
 declare const AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
 declare const DEFAULT_APP_PORT = 3000;
 declare const DEFAULT_CACHE_TTL_MS = 3600000;

package/dist/core/auth/sessionCookie.d.ts

@@ -1,6 +1,7 @@
 declare const SESSION_COOKIE = "workhub_session";
 declare const SESSION_TTL_SECONDS: number;
+declare function sessionCookieName(): string;
 declare function readSessionUserId(request: Request): number | null;
 declare function createSessionCookie(userId: number): string;
 declare function clearSessionCookie(): string;
-export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_TTL_SECONDS, };
+export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_TTL_SECONDS, sessionCookieName, };

package/dist/core/contracts/serviceTokens.d.ts

@@ -1,3 +1,6 @@
+import type { AbilityChecker } from "../auth/abilityChecker";
+import type { AuthUserDirectory } from "./authUserDirectory";
+import type { ServiceContainerLike } from "./container";
 declare const CORE_CONFIG_TOKEN = "core.config";
 declare const CORE_CACHE_TOKEN = "core.cache";
 declare const CORE_QUEUE_TOKEN = "core.queue";
@@ -5,4 +8,10 @@ declare const CORE_EVENT_BUS_TOKEN = "core.eventBus";
 declare const CORE_POLICY_GATE_TOKEN = "core.policyGate";
 declare const CORE_AUTH_TOKEN = "core.auth";
 declare const CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
-export { CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, };
+declare const CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+declare const CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+declare function isAbilityChecker(value: unknown): value is AbilityChecker;
+declare function isAuthUserDirectory(value: unknown): value is AuthUserDirectory;
+declare function resolveAbilityChecker(container: ServiceContainerLike): AbilityChecker;
+declare function resolveAuthUserDirectory(container: ServiceContainerLike): AuthUserDirectory | null;
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, isAbilityChecker, isAuthUserDirectory, resolveAbilityChecker, resolveAuthUserDirectory, };

package/dist/core/http/csrfToken.d.ts

@@ -1,4 +1,5 @@
 declare const CSRF_COOKIE = "workhub_csrf";
+declare function csrfCookieName(): string;
 declare function createCsrfTokenCookie(): {
     token: string;
     cookie: string;
@@ -11,4 +12,4 @@ declare function readSubmittedCsrfToken(request: Request): string | null;
 declare function readSubmittedCsrfTokenFromBody(request: Request): Promise<string | null>;
 declare function verifyCsrfToken(request: Request, submittedToken: string | null): boolean;
 declare function resolveCsrfTokenForRequest(request: Request): string;
-export { CSRF_COOKIE, createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, };
+export { CSRF_COOKIE, createCsrfTokenCookie, csrfCookieName, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, };

package/dist/core/view/htmlResponse.d.ts

@@ -3,4 +3,12 @@ declare function htmlResponse(html: string, init?: {
     statusText?: string;
 }): Response;
 declare function isHtmxRequest(request: Request): boolean;
-export { htmlResponse, isHtmxRequest };
+declare function redirectResponse(location: string, status?: number): Response;
+declare function notFoundHtmlResponse(body?: string): Response;
+declare function textResponse(body: string, init?: {
+    status?: number;
+}): Response;
+declare function xmlResponse(body: string, init?: {
+    status?: number;
+}): Response;
+export { htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, textResponse, xmlResponse, };

package/dist/core/view/index.d.ts

@@ -1,5 +1,5 @@
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine } from "./etaViewEngine";
-export { htmlResponse, isHtmxRequest } from "./htmlResponse";
+export { htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, textResponse, xmlResponse, } from "./htmlResponse";
 export type { ViewEngine } from "./viewEngine";
-export type { WebLayoutAuthUser, WebLayoutData } from "./webLayoutData";
-export { resolveWebLayoutData } from "./webLayoutData";
+export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "./webLayoutData";
+export { configureWebLayoutData, resolveWebLayoutData } from "./webLayoutData";

package/dist/core/view/webLayoutData.d.ts

@@ -3,15 +3,26 @@ interface WebLayoutAuthUser {
     id: number;
     email: string;
     role: string;
+    [key: string]: unknown;
 }
 interface WebLayoutData {
-    authUser: WebLayoutAuthUser | null;
+    authUser?: WebLayoutAuthUser | null;
+    currentUser?: WebLayoutAuthUser | null;
     csrfToken: string;
     flash: {
         level: string;
         message: string;
     } | null;
+    [key: string]: unknown;
 }
-declare function resolveWebLayoutData(container: ServiceContainerLike, request?: Request): Promise<Record<string, unknown>>;
-export type { WebLayoutAuthUser, WebLayoutData };
-export { resolveWebLayoutData };
+type WebLayoutUserKey = "authUser" | "currentUser";
+interface WebLayoutDataOptions {
+    userKey?: WebLayoutUserKey;
+    loadUser?: (container: ServiceContainerLike, request: Request | undefined) => Promise<Record<string, unknown> | null>;
+    extra?: Record<string, unknown> | ((user: Record<string, unknown> | null) => Record<string, unknown> | Promise<Record<string, unknown>>);
+}
+declare function configureWebLayoutData(options: WebLayoutDataOptions): void;
+declare function resetWebLayoutDataConfigForTests(): void;
+declare function resolveWebLayoutData(container: ServiceContainerLike, request?: Request, options?: WebLayoutDataOptions): Promise<Record<string, unknown>>;
+export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey };
+export { configureWebLayoutData, resetWebLayoutDataConfigForTests, resolveWebLayoutData };

package/dist/entries/auth/sessionCookie.js

@@ -3,6 +3,9 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function sessionCookieName() {
+  return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
+}
 function resolveSessionSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
@@ -25,7 +28,7 @@ function readCookieValue(request, cookieName) {
   return null;
 }
 function readSessionUserId(request) {
-  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
@@ -60,16 +63,17 @@ function createSessionCookie(userId) {
   const issuedAt = Date.now();
   const value = signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+  return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 export {
   SESSION_COOKIE,
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
-  readSessionUserId
+  readSessionUserId,
+  sessionCookieName
 };

package/dist/entries/auth/sessionGuard.js

@@ -7,6 +7,42 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
@@ -50,6 +86,9 @@ function resolveAbilitiesForRole(role) {
 import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function sessionCookieName() {
+  return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
+}
 function resolveSessionSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
@@ -72,7 +111,7 @@ function readCookieValue(request, cookieName) {
   return null;
 }
 function readSessionUserId(request) {
-  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
@@ -107,11 +146,11 @@ function createSessionCookie(userId) {
   const issuedAt = Date.now();
   const value = signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+  return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 
 // ../../src/core/auth/sessionGuard.ts
@@ -125,10 +164,10 @@ class SessionGuard {
     if (!userId) {
       return null;
     }
-    if (!this.container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = resolveAuthUserDirectory(this.container);
+    if (!tokenService) {
       return null;
     }
-    const tokenService = this.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     try {
       const user = await tokenService.findByIdOrThrow(userId);
       return {

package/dist/entries/contracts/serviceTokens.js

@@ -7,12 +7,54 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 export {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
   CORE_POLICY_GATE_TOKEN,
   CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
+  CORE_TOKEN_SERVICE_TOKEN,
+  isAbilityChecker,
+  isAuthUserDirectory,
+  resolveAbilityChecker,
+  resolveAuthUserDirectory
 };

package/dist/entries/http/csrfMiddleware.js

@@ -62,6 +62,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -81,11 +84,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -121,7 +124,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }

package/dist/entries/http/csrfToken.js

@@ -59,6 +59,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -78,11 +81,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -118,7 +121,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }
@@ -137,6 +140,7 @@ function resolveCsrfTokenForRequest(request) {
 export {
   CSRF_COOKIE,
   createCsrfTokenCookie,
+  csrfCookieName,
   readSubmittedCsrfToken,
   readSubmittedCsrfTokenFromBody,
   resolveCsrfToken,

package/dist/entries/http/response.js

@@ -309,6 +309,33 @@ function htmlResponse(html, init = {}) {
 function isHtmxRequest(request) {
   return request.headers.get("HX-Request") === "true";
 }
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function notFoundHtmlResponse(body = "Not Found") {
+  return htmlResponse(body, { status: 404 });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "application/xml; charset=utf-8"
+    }
+  });
+}
 // ../../src/core/view/webLayoutData.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
@@ -321,6 +348,42 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
@@ -382,6 +445,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -401,11 +467,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -441,7 +507,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }
@@ -558,44 +624,56 @@ function withFlashClear(response) {
 }
 
 // ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
+var configuredLayoutOptions = {};
+function configureWebLayoutData(options) {
+  configuredLayoutOptions = { ...options };
+}
+function layoutUserKey(options) {
+  return options.userKey ?? "authUser";
+}
+async function defaultLoadLayoutUser(container, _request) {
   const authUser = currentAuthUser();
   if (!authUser) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
   const userId = Number(authUser.id);
   if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
-  if (!container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+  const directory = resolveAuthUserDirectory(container);
+  if (!directory) {
     return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: "",
+      role: authUser.role ?? "member"
     };
   }
-  const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
   try {
-    const user = await tokenService.findByIdOrThrow(userId);
+    const user = await directory.findByIdOrThrow(userId);
     return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: user.email ?? "",
+      role: authUser.role ?? user.role ?? "member"
     };
   } catch {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
 }
+async function resolveWebLayoutData(container, request, options = {}) {
+  const resolved = { ...configuredLayoutOptions, ...options };
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
+  const userKey = layoutUserKey(resolved);
+  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
+  const user = await loadUser(container, request);
+  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
+  return {
+    [userKey]: user,
+    csrfToken,
+    flash,
+    ...extra
+  };
+}
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
   if (!request) {

package/dist/entries/http/webErrorResponse.js

@@ -306,6 +306,33 @@ function htmlResponse(html, init = {}) {
 function isHtmxRequest(request) {
   return request.headers.get("HX-Request") === "true";
 }
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function notFoundHtmlResponse(body = "Not Found") {
+  return htmlResponse(body, { status: 404 });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "application/xml; charset=utf-8"
+    }
+  });
+}
 // ../../src/core/view/webLayoutData.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
@@ -318,6 +345,42 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
@@ -379,6 +442,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -398,11 +464,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -438,7 +504,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }
@@ -555,44 +621,56 @@ function withFlashClear(response) {
 }
 
 // ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
+var configuredLayoutOptions = {};
+function configureWebLayoutData(options) {
+  configuredLayoutOptions = { ...options };
+}
+function layoutUserKey(options) {
+  return options.userKey ?? "authUser";
+}
+async function defaultLoadLayoutUser(container, _request) {
   const authUser = currentAuthUser();
   if (!authUser) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
   const userId = Number(authUser.id);
   if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
-  if (!container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+  const directory = resolveAuthUserDirectory(container);
+  if (!directory) {
     return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: "",
+      role: authUser.role ?? "member"
     };
   }
-  const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
   try {
-    const user = await tokenService.findByIdOrThrow(userId);
+    const user = await directory.findByIdOrThrow(userId);
     return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: user.email ?? "",
+      role: authUser.role ?? user.role ?? "member"
     };
   } catch {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
 }
+async function resolveWebLayoutData(container, request, options = {}) {
+  const resolved = { ...configuredLayoutOptions, ...options };
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
+  const userKey = layoutUserKey(resolved);
+  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
+  const user = await loadUser(container, request);
+  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
+  return {
+    [userKey]: user,
+    csrfToken,
+    flash,
+    ...extra
+  };
+}
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
   if (!request) {

package/dist/entries/queue/createAppQueue.js

@@ -102,7 +102,9 @@ var jobRegistry = readSharedJobRegistry();
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/queue/jobRunner.js

@@ -1,7 +1,9 @@
 // @bun
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/queue/publicQueue.js

@@ -102,7 +102,9 @@ var jobRegistry = readSharedJobRegistry();
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/queue/queueMetrics.js

@@ -4,7 +4,9 @@ var {RedisClient: RedisClient2 } = globalThis.Bun;
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/queue/redisQueue.js

@@ -41,7 +41,9 @@ var jobRegistry = readSharedJobRegistry();
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/view.js

@@ -225,6 +225,33 @@ function htmlResponse(html, init = {}) {
 function isHtmxRequest(request) {
   return request.headers.get("HX-Request") === "true";
 }
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function notFoundHtmlResponse(body = "Not Found") {
+  return htmlResponse(body, { status: 404 });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "application/xml; charset=utf-8"
+    }
+  });
+}
 // ../../src/core/view/webLayoutData.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
@@ -237,6 +264,42 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
@@ -298,6 +361,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -317,11 +383,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -357,7 +423,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }
@@ -474,48 +540,65 @@ function withFlashClear(response) {
 }
 
 // ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
+var configuredLayoutOptions = {};
+function configureWebLayoutData(options) {
+  configuredLayoutOptions = { ...options };
+}
+function layoutUserKey(options) {
+  return options.userKey ?? "authUser";
+}
+async function defaultLoadLayoutUser(container, _request) {
   const authUser = currentAuthUser();
   if (!authUser) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
   const userId = Number(authUser.id);
   if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
-  if (!container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+  const directory = resolveAuthUserDirectory(container);
+  if (!directory) {
     return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: "",
+      role: authUser.role ?? "member"
     };
   }
-  const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
   try {
-    const user = await tokenService.findByIdOrThrow(userId);
+    const user = await directory.findByIdOrThrow(userId);
     return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: user.email ?? "",
+      role: authUser.role ?? user.role ?? "member"
     };
   } catch {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
 }
+async function resolveWebLayoutData(container, request, options = {}) {
+  const resolved = { ...configuredLayoutOptions, ...options };
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
+  const userKey = layoutUserKey(resolved);
+  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
+  const user = await loadUser(container, request);
+  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
+  return {
+    [userKey]: user,
+    csrfToken,
+    flash,
+    ...extra
+  };
+}
 export {
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
+  configureWebLayoutData,
   htmlResponse,
   isHtmxRequest,
-  resolveWebLayoutData
+  notFoundHtmlResponse,
+  redirectResponse,
+  resolveWebLayoutData,
+  textResponse,
+  xmlResponse
 };

package/dist/framework/public-api.d.ts

@@ -118,6 +118,6 @@ export { currentTraceId, runWithTraceContext } from "../core/tracing/traceContex
 export { createTracingMiddleware } from "../core/tracing/tracingMiddleware.ts";
 export type { ValidationRule, ValidationSchema } from "../core/validation/rules.ts";
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
-export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, htmlResponse, isHtmxRequest, resolveWebLayoutData, } from "../core/view/index.ts";
+export { configureWebLayoutData, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, resolveWebLayoutData, textResponse, xmlResponse, } from "../core/view/index.ts";
 export type { ViewEngine } from "../core/view/viewEngine.ts";
-export type { WebLayoutAuthUser, WebLayoutData } from "../core/view/webLayoutData.ts";
+export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "../core/view/webLayoutData.ts";

package/dist/index.js

@@ -172,6 +172,28 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
@@ -276,10 +298,10 @@ class DatabaseTokenGuard {
     if (!token) {
       return null;
     }
-    if (!this.container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = resolveAuthUserDirectory(this.container);
+    if (!tokenService || typeof tokenService.resolveUserFromToken !== "function") {
       return null;
     }
-    const tokenService = this.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     return await tokenService.resolveUserFromToken(token);
   }
 }
@@ -4366,6 +4388,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -4385,11 +4410,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -4425,7 +4450,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }
@@ -5094,45 +5119,84 @@ function htmlResponse(html, init = {}) {
 function isHtmxRequest(request) {
   return request.headers.get("HX-Request") === "true";
 }
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function notFoundHtmlResponse(body = "Not Found") {
+  return htmlResponse(body, { status: 404 });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "application/xml; charset=utf-8"
+    }
+  });
+}
 // ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+var configuredLayoutOptions = {};
+function configureWebLayoutData(options) {
+  configuredLayoutOptions = { ...options };
+}
+function layoutUserKey(options) {
+  return options.userKey ?? "authUser";
+}
+async function defaultLoadLayoutUser(container, _request) {
   const authUser = currentAuthUser();
   if (!authUser) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
   const userId = Number(authUser.id);
   if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
-  if (!container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+  const directory = resolveAuthUserDirectory(container);
+  if (!directory) {
     return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: "",
+      role: authUser.role ?? "member"
     };
   }
-  const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
   try {
-    const user = await tokenService.findByIdOrThrow(userId);
+    const user = await directory.findByIdOrThrow(userId);
     return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
+      id: userId,
+      email: user.email ?? "",
+      role: authUser.role ?? user.role ?? "member"
     };
   } catch {
-    return { authUser: null, csrfToken, flash };
+    return null;
   }
 }
+async function resolveWebLayoutData(container, request, options = {}) {
+  const resolved = { ...configuredLayoutOptions, ...options };
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const userKey = layoutUserKey(resolved);
+  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
+  const user = await loadUser(container, request);
+  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
+  return {
+    [userKey]: user,
+    csrfToken,
+    flash,
+    ...extra
+  };
+}
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
   if (!request) {
@@ -6683,6 +6747,7 @@ export {
   conditionalJsonResponse,
   config,
   configureMembershipLookup,
+  configureWebLayoutData,
   createAuthMiddleware,
   createAuthorizeMiddleware,
   createBodySizeLimitMiddleware,
@@ -6780,6 +6845,7 @@ export {
   morphTo,
   noContentResponse,
   normalizeMetricPath,
+  notFoundHtmlResponse,
   paginatedResponse,
   parseMultipartUpload,
   parsePaginationQuery,
@@ -6794,6 +6860,7 @@ export {
   readSubmittedCsrfToken,
   readSubmittedCsrfTokenFromBody,
   readTenancyDriver,
+  redirectResponse,
   registerDefaultDatabasePool,
   registerModelRepository,
   registerShutdownHandler,
@@ -6841,6 +6908,7 @@ export {
   storageFacade as storage,
   stringRule,
   stripMarkdown,
+  textResponse,
   toPaginatedResourceCollection,
   toResourceCollection,
   trustForwardedFor,
@@ -6850,5 +6918,6 @@ export {
   withMiddleware,
   withMigrationLock,
   wrapMarkdownMailLayout,
-  wrapRouteHandler
+  wrapRouteHandler,
+  xmlResponse
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.58",
+  "version": "0.5.59",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -306,7 +306,7 @@
       "default": "./dist/entries/events.js"
     },
     "./facades": {
-      "types": "./dist/core/facades.d.ts",
+      "types": "./dist/core/facades/index.d.ts",
       "import": "./dist/entries/facades.js",
       "default": "./dist/entries/facades.js"
     },
@@ -765,7 +765,8 @@
   "types": "./dist/framework/public-api.d.ts",
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "bun run build:bundle && bun run build:shims && bun run build:subpaths && bun run build:types",