@holo-js/core 0.1.4 → 0.1.5

package/dist/{chunk-4VPELMZN.mjs → chunk-5ZJO35LB.mjs}

@@ -10,8 +10,8 @@ import {
 } from "@holo-js/db";
 
 // src/portable/registry.ts
-import { readFile } from "fs/promises";
-import { resolve } from "path";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
 import { DEFAULT_HOLO_PROJECT_PATHS } from "@holo-js/db";
 function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -118,10 +118,10 @@ var registryInternals = {
 };
 
 // src/portable/holo.ts
-import { createHash, createHmac } from "crypto";
-import { createRequire } from "module";
-import { resolve as resolve3 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { existsSync } from "node:fs";
+import { createHash, createHmac } from "node:crypto";
+import { resolve as resolve3 } from "node:path";
 import {
   config as globalConfig,
   configureConfigRuntime,
@@ -133,13 +133,15 @@ import {
 import {
   configureDB,
   DB,
+  Entity,
   resetDB
 } from "@holo-js/db";
 
 // src/runtimeModule.ts
-import { mkdtemp, mkdir, rm, stat, writeFile } from "fs/promises";
-import { basename, extname, join } from "path";
-import { pathToFileURL } from "url";
+import { mkdtemp, mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { basename, extname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 async function importModule(specifier) {
   if (process.env.VITEST) {
     return import(
@@ -152,6 +154,66 @@ async function importModule(specifier) {
     specifier
   );
 }
+var runtimeModuleRequire = createRequire(import.meta.url);
+function resolveOptionalImportSpecifier(specifier, projectRoot) {
+  if (!projectRoot) {
+    return specifier;
+  }
+  try {
+    return pathToFileURL(runtimeModuleRequire.resolve(specifier, {
+      paths: [projectRoot]
+    })).href;
+  } catch {
+    return specifier;
+  }
+}
+function getErrorMessage(error) {
+  return error && typeof error === "object" && "message" in error && typeof error.message === "string" ? error.message : "";
+}
+function getMissingModuleTarget(message) {
+  const match = message.match(/Cannot find package '([^']+)'|Cannot find module '([^']+)'|Failed to load url ([^ ]+)|Could not resolve "([^"]+)"/);
+  return match?.slice(1).find((value) => typeof value === "string");
+}
+function normalizeImportSpecifier(specifier) {
+  return specifier.startsWith("file://") ? fileURLToPath(specifier) : specifier;
+}
+function normalizeImportTarget(value) {
+  return normalizeImportSpecifier(value).replace(/\\/g, "/");
+}
+function matchesRelativeImportTarget(failedTarget, specifier) {
+  if (!failedTarget || !specifier.startsWith(".")) {
+    return false;
+  }
+  const suffix = specifier.startsWith("./") ? specifier.slice(2) : specifier;
+  return normalizeImportTarget(failedTarget).endsWith(`/${suffix}`);
+}
+function isMissingOptionalModule(error, specifier, resolvedSpecifier) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const message = getErrorMessage(error);
+  const failedTarget = getMissingModuleTarget(message);
+  const expectedTargets = /* @__PURE__ */ new Set([
+    specifier,
+    resolvedSpecifier,
+    normalizeImportTarget(specifier),
+    normalizeImportTarget(resolvedSpecifier)
+  ]);
+  const normalizedFailedTarget = typeof failedTarget === "string" ? normalizeImportTarget(failedTarget) : void 0;
+  const matchesRequestedTarget = typeof normalizedFailedTarget === "string" && (expectedTargets.has(normalizedFailedTarget) || matchesRelativeImportTarget(normalizedFailedTarget, specifier));
+  return "code" in error && error.code === "ERR_MODULE_NOT_FOUND" && matchesRequestedTarget || message.startsWith("Cannot find package '") && matchesRequestedTarget || message.startsWith("Cannot find module '") && matchesRequestedTarget || message.includes("Does the file exist?") && message.startsWith("Failed to load url ") && matchesRequestedTarget || message.startsWith('Could not resolve "') && matchesRequestedTarget;
+}
+async function importOptionalRuntimeModule(specifier, options = {}) {
+  const resolvedSpecifier = resolveOptionalImportSpecifier(specifier, options.projectRoot);
+  try {
+    return await importModule(resolvedSpecifier);
+  } catch (error) {
+    if (isMissingOptionalModule(error, specifier, resolvedSpecifier)) {
+      return void 0;
+    }
+    throw error;
+  }
+}
 async function pathExists(path) {
   try {
     await stat(path);
@@ -253,6 +315,7 @@ async function runEsbuild(options) {
 var runtimeModuleInternals = {
   bundleRuntimeModule,
   importModule,
+  importOptionalRuntimeModule,
   loadEsbuild,
   pathExists,
   runEsbuild,
@@ -260,38 +323,26 @@ var runtimeModuleInternals = {
 };
 
 // src/storageRuntime.ts
-import { mkdir as mkdir2, readFile as readFile2, readdir, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { dirname, join as join2, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
+import { mkdir as mkdir2, readFile as readFile2, readdir, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname, isAbsolute, join as join2, relative, resolve as resolve2, sep, win32 } from "node:path";
 async function importOptionalModule(specifier) {
-  try {
-    if (process.env.VITEST) {
-      return await import(
-        /* @vite-ignore */
-        specifier
-      );
-    }
-    return await import(
-      /* webpackIgnore: true */
-      specifier
-    );
-  } catch (error) {
-    const message = error && typeof error === "object" && "message" in error && typeof error.message === "string" ? error.message : "";
-    const resolvedSpecifier = specifier.startsWith("file://") ? fileURLToPath(specifier) : specifier;
-    const failedTarget = message.match(/Cannot find package '([^']+)'|Cannot find module '([^']+)'|Failed to load url ([^ ]+)/)?.slice(1).find((value) => typeof value === "string");
-    const matchesRequestedTarget = failedTarget === specifier || failedTarget === resolvedSpecifier;
-    if (error && typeof error === "object" && ("code" in error && error.code === "ERR_MODULE_NOT_FOUND" || message.startsWith("Cannot find package '") && matchesRequestedTarget || message.startsWith("Cannot find module '") && matchesRequestedTarget || message.includes("Does the file exist?") && message.startsWith("Failed to load url ") && matchesRequestedTarget)) {
-      return void 0;
-    }
-    throw error;
-  }
+  return importOptionalRuntimeModule(specifier);
 }
 function resolveStorageKeyPath(root, key) {
-  const segments = key.split(":").filter(Boolean);
+  if (isAbsolute(key) || win32.isAbsolute(key)) {
+    throw new Error("[Holo Storage] Storage paths must not be absolute.");
+  }
+  const segments = key.replace(/\\/g, "/").split(":").flatMap((segment) => segment.split("/")).filter(Boolean);
   if (segments.includes("..")) {
     throw new Error('[Holo Storage] Storage paths must not contain ".." segments.');
   }
-  return resolve2(root, ...segments);
+  const rootPath = resolve2(root);
+  const targetPath = resolve2(rootPath, ...segments);
+  const relativeTarget = relative(rootPath, targetPath);
+  if (relativeTarget === ".." || relativeTarget.startsWith(`..${sep}`) || isAbsolute(relativeTarget)) {
+    throw new Error("[Holo Storage] Storage paths must stay inside the configured disk root.");
+  }
+  return targetPath;
 }
 function createFileStorageBackend(root) {
   async function listStorageKeys(currentRoot, prefix = "") {
@@ -430,6 +481,40 @@ var storageRuntimeInternals = {
 };
 
 // src/portable/holo.ts
+async function preloadGeneratedSchemaModule(projectRoot, registry) {
+  const entry = registry?.paths.generatedSchema;
+  if (!entry) {
+    return;
+  }
+  const expectedTarget = resolve3(projectRoot, entry);
+  if (!existsSync(expectedTarget)) {
+    return;
+  }
+  try {
+    await importBundledRuntimeModule(projectRoot, entry);
+  } catch (error) {
+    if (error instanceof Error && /Cannot find module|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND|Failed to load url|Failed to load /.test(error.message)) {
+      const message = error.message;
+      const failedTarget = message.match(/Cannot find module '([^']+)'|Cannot find package '([^']+)'|Failed to load url ([^ ]+)|Failed to load ([^ ]+)\./)?.slice(1).find((value) => typeof value === "string");
+      if (failedTarget === expectedTarget) {
+        return;
+      }
+    }
+    throw error;
+  }
+}
+async function preloadDiscoveredModelModules(projectRoot, registry) {
+  if (!registry || registry.models.length === 0) {
+    return;
+  }
+  for (const entry of registry.models) {
+    const sourcePath = resolve3(projectRoot, entry.sourcePath);
+    if (!existsSync(sourcePath)) {
+      continue;
+    }
+    await importBundledRuntimeModule(projectRoot, sourcePath);
+  }
+}
 function closeSessionRedisAdapter(adapter) {
   return adapter.disconnect?.() || adapter.close?.();
 }
@@ -501,33 +586,8 @@ function restoreOptionalSubsystemRuntimeBindings(bindings) {
   }
 }
 var BROADCAST_PUBLISH_TIMEOUT_MS = 1e4;
-var portableRuntimeRequire = createRequire(import.meta.url);
-function resolveOptionalImportSpecifier(specifier, projectRoot) {
-  if (!projectRoot) {
-    return specifier;
-  }
-  try {
-    const resolved = portableRuntimeRequire.resolve(specifier, {
-      paths: [projectRoot]
-    });
-    return pathToFileURL2(resolved).href;
-  } catch {
-    return specifier;
-  }
-}
 async function importOptionalModule2(specifier, options = {}) {
-  const resolvedSpecifier = resolveOptionalImportSpecifier(specifier, options.projectRoot);
-  try {
-    return await import(
-      /* webpackIgnore: true */
-      resolvedSpecifier
-    );
-  } catch (error) {
-    if (error instanceof Error && (error.message.includes(`Cannot find package '${specifier}'`) || error.message.includes(`Cannot find module '${specifier}'`) || error.message.includes(`Failed to load url ${specifier}`) || error.message.includes(`Could not resolve "${specifier}"`) || error.message.includes(`Cannot find package '${resolvedSpecifier}'`) || error.message.includes(`Cannot find module '${resolvedSpecifier}'`) || error.message.includes(`Failed to load url ${resolvedSpecifier}`) || error.message.includes(`Could not resolve "${resolvedSpecifier}"`))) {
-      return void 0;
-    }
-    throw error;
-  }
+  return importOptionalRuntimeModule(specifier, options);
 }
 var portableRuntimeModuleInternals = {
   importOptionalModule: importOptionalModule2
@@ -554,192 +614,47 @@ function authConfigUsesSocialProviders(loadedConfig) {
   return Object.keys(loadedConfig.auth.social).length > 0;
 }
 function authConfigUsesWorkosProviders(loadedConfig) {
-  return Object.keys(loadedConfig.auth.workos).length > 0;
+  return Object.entries(loadedConfig.auth.workos).some(([name, provider]) => name !== "provider" && name !== "identityStore" && typeof provider === "object" && provider !== null);
 }
 function authConfigUsesClerkProviders(loadedConfig) {
-  return Object.keys(loadedConfig.auth.clerk).length > 0;
+  return Object.entries(loadedConfig.auth.clerk).some(([name, provider]) => name !== "provider" && name !== "identityStore" && typeof provider === "object" && provider !== null);
 }
 var HOLO_AUTH_PROVIDER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.auth.provider");
-function bindAuthRuntimeToContext(runtime, authContext) {
-  const activate = () => {
-    authContext.activate();
+function attachAuthRequestAccessors(context, accessors) {
+  return Object.freeze({
+    ...context,
+    getRequestCookie: accessors.getCookie,
+    getRequestHeader: accessors.getHeader,
+    appendResponseCookie: accessors.appendResponseCookie,
+    redirectResponse: accessors.redirectResponse
+  });
+}
+function createRequestAwareAuthContext(context, accessors) {
+  const requestAccessorStorage = new AsyncLocalStorage();
+  const resolveRequestContext = () => {
+    const requestAccessors = requestAccessorStorage.getStore();
+    const resolvedAccessors = requestAccessors ? requestAccessors.accessors : accessors;
+    return resolvedAccessors ? attachAuthRequestAccessors(context, resolvedAccessors) : context;
   };
   return Object.freeze({
-    check() {
-      activate();
-      return runtime.check();
+    ...context,
+    getRequestCookie(name) {
+      return resolveRequestContext().getRequestCookie?.(name);
     },
-    user() {
-      activate();
-      return runtime.user();
+    getRequestHeader(name) {
+      return resolveRequestContext().getRequestHeader?.(name);
     },
-    refreshUser() {
-      activate();
-      return runtime.refreshUser();
+    appendResponseCookie(cookie) {
+      return resolveRequestContext().appendResponseCookie?.(cookie);
     },
-    id() {
-      activate();
-      return runtime.id();
+    redirectResponse(url, status) {
+      return resolveRequestContext().redirectResponse?.(url, status);
     },
-    currentAccessToken() {
-      activate();
-      return runtime.currentAccessToken();
-    },
-    hashPassword(password) {
-      activate();
-      return runtime.hashPassword(password);
-    },
-    verifyPassword(password, digest) {
-      activate();
-      return runtime.verifyPassword(password, digest);
-    },
-    needsPasswordRehash(digest) {
-      activate();
-      return runtime.needsPasswordRehash(digest);
-    },
-    login(credentials) {
-      activate();
-      return runtime.login(credentials);
-    },
-    loginUsing(user, options) {
-      activate();
-      return runtime.loginUsing(user, options);
-    },
-    loginUsingId(userId, options) {
-      activate();
-      return runtime.loginUsingId(userId, options);
-    },
-    impersonate(user, options) {
-      activate();
-      return runtime.impersonate(user, options);
-    },
-    impersonateById(userId, options) {
-      activate();
-      return runtime.impersonateById(userId, options);
-    },
-    impersonation() {
-      activate();
-      return runtime.impersonation();
-    },
-    stopImpersonating() {
-      activate();
-      return runtime.stopImpersonating();
-    },
-    logout() {
-      activate();
-      return runtime.logout();
-    },
-    register(input) {
-      activate();
-      return runtime.register(input);
-    },
-    logoutAll(guardName) {
-      activate();
-      return runtime.logoutAll(guardName);
-    },
-    guard(name) {
-      const guard = runtime.guard(name);
-      return Object.freeze({
-        check() {
-          activate();
-          return guard.check();
-        },
-        user() {
-          activate();
-          return guard.user();
-        },
-        refreshUser() {
-          activate();
-          return guard.refreshUser();
-        },
-        id() {
-          activate();
-          return guard.id();
-        },
-        currentAccessToken() {
-          activate();
-          return guard.currentAccessToken();
-        },
-        login(credentials) {
-          activate();
-          return guard.login(credentials);
-        },
-        loginUsing(user, options) {
-          activate();
-          return guard.loginUsing(user, options);
-        },
-        loginUsingId(userId, options) {
-          activate();
-          return guard.loginUsingId(userId, options);
-        },
-        impersonate(user, options) {
-          activate();
-          return guard.impersonate(user, options);
-        },
-        impersonateById(userId, options) {
-          activate();
-          return guard.impersonateById(userId, options);
-        },
-        impersonation() {
-          activate();
-          return guard.impersonation();
-        },
-        stopImpersonating() {
-          activate();
-          return guard.stopImpersonating();
-        },
-        logout() {
-          activate();
-          return guard.logout();
-        }
+    setRequestAccessors(nextAccessors) {
+      requestAccessorStorage.enterWith({
+        accessors: nextAccessors
       });
-    },
-    tokens: Object.freeze({
-      create(user, options) {
-        activate();
-        return runtime.tokens.create(user, options);
-      },
-      list(user, options) {
-        activate();
-        return runtime.tokens.list(user, options);
-      },
-      revoke(options) {
-        activate();
-        return runtime.tokens.revoke(options);
-      },
-      revokeAll(user, options) {
-        activate();
-        return runtime.tokens.revokeAll(user, options);
-      },
-      authenticate(plainTextToken) {
-        activate();
-        return runtime.tokens.authenticate(plainTextToken);
-      },
-      can(token, ability) {
-        activate();
-        return runtime.tokens.can(token, ability);
-      }
-    }),
-    verification: Object.freeze({
-      create(user, options) {
-        activate();
-        return runtime.verification.create(user, options);
-      },
-      consume(plainTextToken) {
-        activate();
-        return runtime.verification.consume(plainTextToken);
-      }
-    }),
-    passwords: Object.freeze({
-      request(email, options) {
-        activate();
-        return runtime.passwords.request(email, options);
-      },
-      consume(input) {
-        activate();
-        return runtime.passwords.consume(input);
-      }
-    })
+    }
   });
 }
 async function loadQueueModule(required = false) {
@@ -1120,11 +1035,88 @@ function createCoreNotificationStore(loadedConfig) {
   };
   return Object.freeze(store);
 }
-function createAuthNotificationsDeliveryHook(notificationsModule) {
+var authEmailDateFormatter = new Intl.DateTimeFormat("en-US", {
+  dateStyle: "long",
+  timeStyle: "short",
+  timeZone: "UTC"
+});
+function formatAuthEmailExpiration(expiresAt) {
+  return `${authEmailDateFormatter.format(expiresAt)} UTC`;
+}
+var AUTH_EMAIL_VERIFICATION_NOTIFICATION_PATHS = [
+  "server/notifications/auth/email-verification.ts",
+  "server/notifications/auth/email-verification.mts",
+  "server/notifications/auth/email-verification.js",
+  "server/notifications/auth/email-verification.mjs",
+  "server/notifications/auth/email-verification.cts",
+  "server/notifications/auth/email-verification.cjs"
+];
+var AUTH_PASSWORD_RESET_NOTIFICATION_PATHS = [
+  "server/notifications/auth/password-reset.ts",
+  "server/notifications/auth/password-reset.mts",
+  "server/notifications/auth/password-reset.js",
+  "server/notifications/auth/password-reset.mjs",
+  "server/notifications/auth/password-reset.cts",
+  "server/notifications/auth/password-reset.cjs"
+];
+function resolveExistingProjectFile(projectRoot, candidates) {
+  if (!projectRoot) {
+    return void 0;
+  }
+  return candidates.find((candidate) => existsSync(resolve3(projectRoot, candidate)));
+}
+function resolveAuthNotification(module, exportName, filePath) {
+  const notification = module[exportName] ?? module.notification ?? module.default;
+  if (!isAuthNotificationDefinition(notification)) {
+    throw new Error(
+      `[@holo-js/core] Auth notification file "${filePath}" must export a notification definition.`
+    );
+  }
+  return notification;
+}
+function isAuthNotificationDefinition(notification) {
+  if (!notification || typeof notification !== "object") {
+    return false;
+  }
+  const candidate = notification;
+  if (typeof candidate.via !== "function" || !candidate.build || typeof candidate.build !== "object") {
+    return false;
+  }
+  return Object.values(candidate.build).some((factory) => typeof factory === "function");
+}
+async function loadProjectAuthNotification(projectRoot, candidates, exportName) {
+  const filePath = resolveExistingProjectFile(projectRoot, candidates);
+  if (!filePath) {
+    return void 0;
+  }
+  const module = await importRuntimeModule(projectRoot, filePath);
+  return resolveAuthNotification(module, exportName, filePath);
+}
+function createAuthNotificationsDeliveryHook(notificationsModule, appUrl, projectRoot) {
   return Object.freeze({
     async sendEmailVerification(input) {
       const recipientName = typeof input.user?.name === "string" ? input.user.name?.trim() : void 0;
-      const notification = notificationsModule.defineNotification({
+      const actionUrl = createAuthActionUrl(appUrl, input.route, input.token.plainTextToken);
+      const authNotification = Object.freeze({
+        email: input.email,
+        ...recipientName ? { name: recipientName } : {},
+        url: actionUrl,
+        expiresAt: input.token.expiresAt
+      });
+      const projectNotification = await loadProjectAuthNotification(
+        projectRoot,
+        AUTH_EMAIL_VERIFICATION_NOTIFICATION_PATHS,
+        "emailVerificationNotification"
+      );
+      const lines = [
+        "Confirm your account to finish signing in.",
+        `This verification link expires at ${formatAuthEmailExpiration(input.token.expiresAt)}.`
+      ];
+      const action = {
+        label: "Verify email address",
+        url: actionUrl
+      };
+      const notification = projectNotification ?? notificationsModule.defineNotification({
         type: "auth.email-verification",
         via() {
           return ["email"];
@@ -1134,12 +1126,14 @@ function createAuthNotificationsDeliveryHook(notificationsModule) {
             return {
               subject: "Verify your email address",
               ...recipientName ? { greeting: `Hello ${recipientName},` } : {},
-              lines: [
-                "Use this token to verify your email address:",
-                input.token.plainTextToken,
-                `Provider: ${input.provider}`,
-                `Expires at: ${input.token.expiresAt.toISOString()}`
-              ],
+              lines,
+              action,
+              html: createAuthEmailHtml({
+                subject: "Verify your email address",
+                ...recipientName ? { greeting: `Hello ${recipientName},` } : {},
+                lines,
+                action
+              }),
               metadata: {
                 provider: input.provider,
                 tokenId: input.token.id
@@ -1148,13 +1142,29 @@ function createAuthNotificationsDeliveryHook(notificationsModule) {
           }
         }
       });
-      await notificationsModule.notifyUsing().channel("email", recipientName ? {
-        email: input.email,
-        name: recipientName
-      } : input.email).notify(notification);
+      await notificationsModule.notify(authNotification, notification);
     },
     async sendPasswordReset(input) {
-      const notification = notificationsModule.defineNotification({
+      const actionUrl = createAuthActionUrl(appUrl, input.route, input.token.plainTextToken);
+      const authNotification = Object.freeze({
+        email: input.email,
+        url: actionUrl,
+        expiresAt: input.token.expiresAt
+      });
+      const projectNotification = await loadProjectAuthNotification(
+        projectRoot,
+        AUTH_PASSWORD_RESET_NOTIFICATION_PATHS,
+        "passwordResetNotification"
+      );
+      const lines = [
+        "Click the link below to choose a new password.",
+        `This reset link expires at ${formatAuthEmailExpiration(input.token.expiresAt)}.`
+      ];
+      const action = {
+        label: "Reset password",
+        url: actionUrl
+      };
+      const notification = projectNotification ?? notificationsModule.defineNotification({
         type: "auth.password-reset",
         via() {
           return ["email"];
@@ -1163,12 +1173,13 @@ function createAuthNotificationsDeliveryHook(notificationsModule) {
           email() {
             return {
               subject: "Reset your password",
-              lines: [
-                "Use this token to reset your password:",
-                input.token.plainTextToken,
-                `Provider: ${input.provider}`,
-                `Expires at: ${input.token.expiresAt.toISOString()}`
-              ],
+              lines,
+              action,
+              html: createAuthEmailHtml({
+                subject: "Reset your password",
+                lines,
+                action
+              }),
               metadata: {
                 provider: input.provider,
                 tokenId: input.token.id
@@ -1177,7 +1188,7 @@ function createAuthNotificationsDeliveryHook(notificationsModule) {
           }
         }
       });
-      await notificationsModule.notifyUsing().channel("email", input.email).notify(notification);
+      await notificationsModule.notify(authNotification, notification);
     }
   });
 }
@@ -1306,6 +1317,42 @@ function createNotificationMailText(message) {
   ].filter((value) => typeof value === "string" && value.length > 0);
   return parts.length > 0 ? parts.join("\n\n") : void 0;
 }
+function createNotificationMailHtml(message) {
+  const greeting = typeof message.greeting === "string" ? message.greeting.trim() : void 0;
+  const lines = (message.lines ?? []).map((line) => line.trim()).filter(Boolean);
+  const sections = [
+    greeting ? `<p style="margin:0 0 16px;">${escapeAuthEmailHtml(greeting)}</p>` : "",
+    ...lines.map((line) => `<p style="margin:0 0 16px;">${escapeAuthEmailHtml(line)}</p>`),
+    message.action ? `<p style="margin:24px 0;"><a href="${escapeAuthEmailHtml(message.action.url)}" style="display:inline-block;padding:12px 18px;background:#111827;color:#ffffff;text-decoration:none;border-radius:8px;font-weight:600;">${escapeAuthEmailHtml(message.action.label)}</a></p>` : "",
+    message.action ? `<p style="margin:0;color:#475569;font-size:14px;">If the button does not work, open this link: <a href="${escapeAuthEmailHtml(message.action.url)}">${escapeAuthEmailHtml(message.action.url)}</a></p>` : ""
+  ].join("");
+  return [
+    "<!doctype html>",
+    '<html><head><meta charset="utf-8">',
+    `<title>${escapeAuthEmailHtml(message.subject)}</title>`,
+    '</head><body style="margin:0;padding:24px;font-family:Arial,sans-serif;color:#0f172a;background:#f8fafc;">',
+    '<div style="max-width:640px;margin:0 auto;background:#ffffff;border:1px solid #e2e8f0;border-radius:12px;padding:32px;">',
+    `<h1 style="margin:0 0 24px;font-size:24px;line-height:1.3;">${escapeAuthEmailHtml(message.subject)}</h1>`,
+    sections,
+    "</div></body></html>"
+  ].join("");
+}
+function joinAppUrl(baseUrl, path) {
+  const normalizedBaseUrl = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `${normalizedBaseUrl}${normalizedPath}`;
+}
+function createAuthActionUrl(appUrl, path, token) {
+  const url = new URL(joinAppUrl(appUrl, path));
+  url.searchParams.set("token", token);
+  return url.toString();
+}
+function escapeAuthEmailHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function createAuthEmailHtml(message) {
+  return createNotificationMailHtml(message);
+}
 function createCoreNotificationMailSender(mailModule) {
   return Object.freeze({
     async send(message, context) {
@@ -1314,34 +1361,46 @@ function createCoreNotificationMailSender(mailModule) {
         throw new Error("[@holo-js/core] Email notifications require a resolved email route before bridging into mail.");
       }
       const fallbackText = createNotificationMailText(message);
+      const fallbackHtml = createNotificationMailHtml(message);
       await mailModule.sendMail({
         to: route,
         subject: message.subject,
-        ...typeof message.html === "string" ? { html: message.html } : {},
+        html: typeof message.html === "string" ? message.html : fallbackHtml,
         ...typeof (message.text ?? fallbackText) === "string" ? { text: message.text ?? fallbackText } : {},
-        ...typeof message.html !== "string" && typeof (message.text ?? fallbackText) === "string" ? { text: message.text ?? fallbackText } : {},
         ...message.metadata ? { metadata: message.metadata } : {}
       });
     }
   });
 }
-function createAuthMailDeliveryHook(mailModule) {
+function createAuthMailDeliveryHook(mailModule, appUrl) {
   return Object.freeze({
     async sendEmailVerification(input) {
       const recipientName = typeof input.user?.name === "string" ? input.user.name?.trim() : void 0;
+      const lines = [
+        "Confirm your account to finish signing in.",
+        `This verification link expires at ${formatAuthEmailExpiration(input.token.expiresAt)}.`
+      ];
+      const action = {
+        label: "Verify email address",
+        url: createAuthActionUrl(appUrl, input.route, input.token.plainTextToken)
+      };
       await mailModule.sendMail({
         to: {
           email: input.email,
           ...recipientName ? { name: recipientName } : {}
         },
         subject: "Verify your email address",
-        text: [
-          recipientName ? `Hello ${recipientName},` : void 0,
-          "Use this token to verify your email address:",
-          input.token.plainTextToken,
-          `Provider: ${input.provider}`,
-          `Expires at: ${input.token.expiresAt.toISOString()}`
-        ].filter((value) => typeof value === "string").join("\n\n"),
+        html: createAuthEmailHtml({
+          subject: "Verify your email address",
+          ...recipientName ? { greeting: `Hello ${recipientName},` } : {},
+          lines,
+          action
+        }),
+        text: createNotificationMailText({
+          ...recipientName ? { greeting: `Hello ${recipientName},` } : {},
+          lines,
+          action
+        }),
         metadata: {
           provider: input.provider,
           tokenId: input.token.id
@@ -1349,15 +1408,26 @@ function createAuthMailDeliveryHook(mailModule) {
       });
     },
     async sendPasswordReset(input) {
+      const lines = [
+        "Click the link below to choose a new password.",
+        `This reset link expires at ${formatAuthEmailExpiration(input.token.expiresAt)}.`
+      ];
+      const action = {
+        label: "Reset password",
+        url: createAuthActionUrl(appUrl, input.route, input.token.plainTextToken)
+      };
       await mailModule.sendMail({
         to: input.email,
         subject: "Reset your password",
-        text: [
-          "Use this token to reset your password:",
-          input.token.plainTextToken,
-          `Provider: ${input.provider}`,
-          `Expires at: ${input.token.expiresAt.toISOString()}`
-        ].join("\n\n"),
+        html: createAuthEmailHtml({
+          subject: "Reset your password",
+          lines,
+          action
+        }),
+        text: createNotificationMailText({
+          lines,
+          action
+        }),
         metadata: {
           provider: input.provider,
           tokenId: input.token.id
@@ -1500,6 +1570,7 @@ async function createCoreSocialBindings(projectRootOrLoadedConfig, loadedConfigO
           state: record.state,
           codeVerifier: record.codeVerifier,
           guard: record.guard,
+          browserBinding: record.browserBinding,
           createdAt: record.createdAt.toISOString()
         }
       });
@@ -1518,6 +1589,7 @@ async function createCoreSocialBindings(projectRootOrLoadedConfig, loadedConfigO
         state,
         codeVerifier: data.codeVerifier,
         guard: data.guard,
+        ...typeof data.browserBinding === "string" ? { browserBinding: data.browserBinding } : {},
         createdAt: normalizeDateValue(data.createdAt ?? /* @__PURE__ */ new Date())
       };
     },
@@ -1584,25 +1656,44 @@ function fromHostedIdentityProviderValue(namespace, provider) {
   return provider.startsWith(prefix) ? provider.slice(prefix.length) : provider;
 }
 function createCoreHostedIdentityStore(namespace) {
+  const normalizeRow = (row, fallback) => {
+    const profile = normalizeJsonValue(row.profile);
+    return {
+      provider: fromHostedIdentityProviderValue(namespace, String(row.provider ?? fallback.provider)),
+      providerUserId: String(row.provider_user_id ?? fallback.providerUserId),
+      guard: String(row.guard ?? "web"),
+      authProvider: String(row.auth_provider ?? fallback.authProvider),
+      userId: normalizeStoredUserId(row.user_id),
+      email: typeof row.email === "string" ? row.email : void 0,
+      emailVerified: row.email_verified === true || row.email_verified === 1 || row.email_verified === "1",
+      profile: typeof profile === "object" && profile ? profile : {},
+      linkedAt: normalizeDateValue(row.created_at ?? /* @__PURE__ */ new Date()),
+      updatedAt: normalizeDateValue(row.updated_at ?? /* @__PURE__ */ new Date())
+    };
+  };
+  const findStoredIdentity = async (provider, providerUserId, authProvider = "users") => {
+    const providerValue = toHostedIdentityProviderValue(namespace, provider);
+    const row = await DB.table("auth_identities").where("provider", providerValue).where("provider_user_id", providerUserId).first();
+    return row ? normalizeRow(row, { provider, providerUserId, authProvider }) : null;
+  };
+  const toPayload = (record) => {
+    const providerValue = toHostedIdentityProviderValue(namespace, record.provider);
+    return {
+      user_id: String(record.userId),
+      provider: providerValue,
+      provider_user_id: record.providerUserId,
+      guard: record.guard,
+      auth_provider: record.authProvider,
+      email: record.email ?? null,
+      email_verified: record.emailVerified ? 1 : 0,
+      profile: JSON.stringify(record.profile),
+      created_at: record.linkedAt.toISOString(),
+      updated_at: record.updatedAt.toISOString()
+    };
+  };
   return Object.freeze({
     async findByProviderUserId(provider, providerUserId) {
-      const providerValue = toHostedIdentityProviderValue(namespace, provider);
-      const row = await DB.table("auth_identities").where("provider", providerValue).where("provider_user_id", providerUserId).first();
-      if (!row) {
-        return null;
-      }
-      return {
-        provider: fromHostedIdentityProviderValue(namespace, String(row.provider ?? provider)),
-        providerUserId: String(row.provider_user_id ?? providerUserId),
-        guard: String(row.guard ?? "web"),
-        authProvider: String(row.auth_provider ?? "users"),
-        userId: normalizeStoredUserId(row.user_id),
-        email: typeof row.email === "string" ? row.email : void 0,
-        emailVerified: row.email_verified === true || row.email_verified === 1 || row.email_verified === "1",
-        profile: typeof normalizeJsonValue(row.profile) === "object" && normalizeJsonValue(row.profile) ? normalizeJsonValue(row.profile) : {},
-        linkedAt: normalizeDateValue(row.created_at ?? /* @__PURE__ */ new Date()),
-        updatedAt: normalizeDateValue(row.updated_at ?? /* @__PURE__ */ new Date())
-      };
+      return await findStoredIdentity(provider, providerUserId);
     },
     async findByUserId(provider, authProvider, userId) {
       const providerValue = toHostedIdentityProviderValue(namespace, provider);
@@ -1610,35 +1701,26 @@ function createCoreHostedIdentityStore(namespace) {
       if (!row) {
         return null;
       }
-      return {
-        provider: fromHostedIdentityProviderValue(namespace, String(row.provider ?? provider)),
+      return normalizeRow(row, {
+        provider,
         providerUserId: String(row.provider_user_id),
-        guard: String(row.guard ?? "web"),
-        authProvider: String(row.auth_provider ?? authProvider),
-        userId: normalizeStoredUserId(row.user_id),
-        email: typeof row.email === "string" ? row.email : void 0,
-        emailVerified: row.email_verified === true || row.email_verified === 1 || row.email_verified === "1",
-        profile: typeof normalizeJsonValue(row.profile) === "object" && normalizeJsonValue(row.profile) ? normalizeJsonValue(row.profile) : {},
-        linkedAt: normalizeDateValue(row.created_at ?? /* @__PURE__ */ new Date()),
-        updatedAt: normalizeDateValue(row.updated_at ?? /* @__PURE__ */ new Date())
-      };
+        authProvider
+      });
+    },
+    async claim(record) {
+      const value = record;
+      await DB.table("auth_identities").insertOrIgnore(toPayload(value));
+      const claimed = await findStoredIdentity(value.provider, value.providerUserId, value.authProvider);
+      if (!claimed) {
+        throw new Error("[@holo-js/core] Claimed hosted identity could not be read back from auth_identities.");
+      }
+      return claimed;
     },
     async save(record) {
       const value = record;
       const providerValue = toHostedIdentityProviderValue(namespace, value.provider);
       const existing = await DB.table("auth_identities").where("provider", providerValue).where("provider_user_id", value.providerUserId).first();
-      const payload = {
-        user_id: String(value.userId),
-        provider: providerValue,
-        provider_user_id: value.providerUserId,
-        guard: value.guard,
-        auth_provider: value.authProvider,
-        email: value.email ?? null,
-        email_verified: value.emailVerified ? 1 : 0,
-        profile: JSON.stringify(value.profile),
-        created_at: value.linkedAt.toISOString(),
-        updated_at: value.updatedAt.toISOString()
-      };
+      const payload = toPayload(value);
       if (existing && typeof existing.id !== "undefined") {
         await DB.table("auth_identities").where("id", existing.id).update(payload);
         return;
@@ -1825,7 +1907,9 @@ async function createCoreAuthProviders(projectRoot, loadedConfig) {
       return output;
     };
     const prepareAuthCreateInput = async (input) => {
-      const sanitizedInput = sanitizeAuthWriteInput(input);
+      const sanitizedInput = sanitizeAuthWriteInput(input, {
+        enforceFillable: false
+      });
       if (typeof resolvedModule.prepareAuthCreateInput !== "function") {
         return sanitizedInput;
       }
@@ -1834,7 +1918,9 @@ async function createCoreAuthProviders(projectRoot, loadedConfig) {
       });
     };
     const prepareAuthUpdateInput = async (user, input) => {
-      const sanitizedInput = sanitizeAuthWriteInput(input);
+      const sanitizedInput = sanitizeAuthWriteInput(input, {
+        enforceFillable: false
+      });
       if (typeof resolvedModule.prepareAuthUpdateInput !== "function") {
         return sanitizedInput;
       }
@@ -1842,6 +1928,15 @@ async function createCoreAuthProviders(projectRoot, loadedConfig) {
         enforceFillable: false
       });
     };
+    const saveAuthEntity = async (entity, values) => {
+      const repository = typeof model.getRepository === "function" ? model.getRepository() : null;
+      if (repository && typeof repository.saveEntity === "function" && entity && typeof entity === "object" && typeof entity.forceFill === "function") {
+        ;
+        entity.forceFill(values);
+        return repository.saveEntity(entity, new Set(Object.keys(values)));
+      }
+      return null;
+    };
     const adapter = {
       async findById(id) {
         const resolved = await model.find(id);
@@ -1871,14 +1966,34 @@ async function createCoreAuthProviders(projectRoot, loadedConfig) {
         return resolved ? markProviderUser(resolved, providerName) : null;
       },
       async create(input) {
-        return markProviderUser(await model.create(await prepareAuthCreateInput(input)), providerName);
+        const values = await prepareAuthCreateInput(input);
+        const repository = typeof model.getRepository === "function" ? model.getRepository() : null;
+        const entity = repository && typeof repository.saveEntity === "function" ? new Entity(repository, values, false) : null;
+        const persisted = entity ? await saveAuthEntity(entity, values) : null;
+        return markProviderUser(persisted ?? await model.create(values), providerName);
+      },
+      async delete(id) {
+        const repository = typeof model.getRepository === "function" ? model.getRepository() : null;
+        if (repository && typeof repository.delete === "function") {
+          await repository.delete(id);
+          return;
+        }
+        if (typeof model.delete === "function") {
+          await model.delete(id);
+          return;
+        }
+        const existing = typeof model.find === "function" ? await model.find(id) : null;
+        if (existing && typeof existing === "object" && "delete" in existing && typeof existing.delete === "function") {
+          await existing.delete();
+        }
       },
       /* v8 ignore start -- adapter shape mirrors the auth package contract; core tests cover the wired runtime behavior */
       async update(user, input) {
-        return markProviderUser(
-          await model.update(getEntityAttributes(user).id, await prepareAuthUpdateInput(user, input)),
-          providerName
-        );
+        const id = getEntityAttributes(user).id;
+        const values = await prepareAuthUpdateInput(user, input);
+        const existing = typeof model.find === "function" ? await model.find(id) : null;
+        const persisted = existing ? await saveAuthEntity(existing, values) : null;
+        return markProviderUser(persisted ?? await model.update(id, values), providerName);
       },
       matchesUser(user) {
         if (typeof model === "function" && user instanceof model) {
@@ -2252,6 +2367,7 @@ async function reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, opti
       getRuntimeState().securityRateLimitStoreManaged = !shouldReuseExistingSecurityStore;
       securityModule.configureSecurityRuntime({
         config: loadedConfig.security,
+        cors: loadedConfig.cors,
         rateLimitStore,
         csrfSigningKey: loadedConfig.app.key,
         defaultKeyResolver: async () => {
@@ -2334,7 +2450,8 @@ async function reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, opti
     }
     const socialModule = authConfigUsesSocialProviders(loadedConfig) ? await loadSocialModule(true) : void 0;
     const authStores = createCoreAuthStores(loadedConfig);
-    authContext = authModule.createAsyncAuthContext();
+    const baseAuthContext = authModule.createAsyncAuthContext();
+    authContext = createRequestAwareAuthContext(baseAuthContext, options.authRequest);
     authModule.configureAuthRuntime({
       config: loadedConfig.auth,
       session: sessionModule.getSessionRuntime(),
@@ -2342,17 +2459,18 @@ async function reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, opti
       tokens: authStores.tokens,
       emailVerificationTokens: authStores.emailVerificationTokens,
       passwordResetTokens: authStores.passwordResetTokens,
-      ...notificationsModule && (mailModule || notificationsRuntimeBindings?.mailer) ? { delivery: createAuthNotificationsDeliveryHook(notificationsModule) } : mailModule ? { delivery: createAuthMailDeliveryHook(mailModule) } : {},
+      ...notificationsModule && (mailModule || notificationsRuntimeBindings?.mailer) ? { delivery: createAuthNotificationsDeliveryHook(notificationsModule, loadedConfig.app.url, projectRoot) } : mailModule ? { delivery: createAuthMailDeliveryHook(mailModule, loadedConfig.app.url) } : {},
       context: authContext
     });
-    const boundAuthRuntime = bindAuthRuntimeToContext(authModule.getAuthRuntime(), authContext);
+    const authRuntime = authModule.getAuthRuntime();
     if (authorizationModule) {
       authorizationModule.authorizationInternals.configureAuthorizationAuthIntegration({
         hasGuard(guardName) {
           return guardName in loadedConfig.auth.guards;
         },
-        resolveDefaultActor: async () => boundAuthRuntime.user(),
-        resolveGuardActor: async (guardName) => boundAuthRuntime.guard(guardName).user()
+        resolveDefaultActor: async () => authRuntime.user(),
+        resolveGuardActor: async (guardName) => authRuntime.guard(guardName).user(),
+        ...options.authorizationError?.createError ? { createError: options.authorizationError.createError } : {}
       });
     }
     if (socialModule) {
@@ -2363,12 +2481,12 @@ async function reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, opti
     }
     if (workosModule) {
       workosModule.configureWorkosAuthRuntime({
-        identityStore: createCoreHostedIdentityStore("workos")
+        identityStore: loadedConfig.auth.workos.identityStore ?? createCoreHostedIdentityStore("workos")
       });
     }
     if (clerkModule) {
       clerkModule.configureClerkAuthRuntime({
-        identityStore: createCoreHostedIdentityStore("clerk")
+        identityStore: loadedConfig.auth.clerk.identityStore ?? createCoreHostedIdentityStore("clerk")
       });
     }
   } else if (authorizationModule) {
@@ -2474,11 +2592,14 @@ async function createHolo(projectRoot, options = {}) {
       return activeSessionRuntime;
     },
     get auth() {
-      return activeAuthRuntime && activeAuthContext ? bindAuthRuntimeToContext(activeAuthRuntime, activeAuthContext) : activeAuthRuntime;
+      return activeAuthRuntime;
     },
     initialized: false,
     useConfig: accessors.useConfig,
     config: accessors.config,
+    setAuthRequestAccessors(authRequest) {
+      activeAuthContext?.setRequestAccessors?.(authRequest);
+    },
     async initialize() {
       if (runtime.initialized) {
         throw new Error("Holo runtime is already initialized.");
@@ -2488,6 +2609,8 @@ async function createHolo(projectRoot, options = {}) {
       }
       configureConfigRuntime(loadedConfig.all);
       configureDB(manager);
+      await preloadGeneratedSchemaModule(projectRoot, registry);
+      await preloadDiscoveredModelModules(projectRoot, registry);
       previousOptionalSubsystemBindings = snapshotOptionalSubsystemRuntimeBindings();
       if (options.renderView) {
         configureHoloRenderingRuntime({
@@ -2497,7 +2620,9 @@ async function createHolo(projectRoot, options = {}) {
       try {
         await manager.initializeAll();
         const optionalSubsystems = await reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, {
-          renderView: options.renderView
+          renderView: options.renderView,
+          authRequest: options.authRequest,
+          authorizationError: options.authorizationError
         });
         activeQueueModule = optionalSubsystems.queueModule;
         activeSessionRuntime = optionalSubsystems.session;
@@ -2615,13 +2740,19 @@ async function initializeHolo(projectRoot, options = {}) {
     if (resolve3(current.projectRoot) !== resolvedProjectRoot) {
       throw new Error(`A Holo runtime is already initialized for "${current.projectRoot}".`);
     }
+    ;
+    current.setAuthRequestAccessors?.(options.authRequest);
     return current;
   }
   if (state.pending) {
     if (state.pendingProjectRoot && resolve3(state.pendingProjectRoot) !== resolvedProjectRoot) {
       throw new Error(`A Holo runtime is already initializing for "${state.pendingProjectRoot}".`);
     }
-    return state.pending;
+    return state.pending.then((runtime) => {
+      ;
+      runtime.setAuthRequestAccessors?.(options.authRequest);
+      return runtime;
+    });
   }
   const pending = (async () => {
     const runtime = await createHolo(projectRoot, options);
@@ -2693,7 +2824,6 @@ var holoRuntimeInternals = {
   createAuthNotificationsDeliveryHook,
   createCoreNotificationBroadcaster,
   createCoreNotificationMailSender,
-  bindAuthRuntimeToContext,
   createCoreAuthProviders,
   createCoreAuthStores,
   createCoreHostedIdentityStore,