chore: rename package from @hykocx/zen to @zen/core

Update all references across source files, documentation, and
configuration to reflect the new package scope and name. This includes
updating `.npmrc` registry config, install instructions, module
examples, and all import path comments throughout the codebase.

src/features/admin/actions.js

@@ -5,8 +5,8 @@
  * server-side code (which includes database imports) into client components.
  * 
  * Usage:
- * import { getDashboardStats, getModuleDashboardStats } from '@hykocx/zen/admin/actions';
+ * import { getDashboardStats, getModuleDashboardStats } from '@zen/core/admin/actions';
  */
 
 export { getDashboardStats } from './actions/statsActions.js';
-export { getAllModuleDashboardStats as getModuleDashboardStats } from '@hykocx/zen/modules/actions';
+export { getAllModuleDashboardStats as getModuleDashboardStats } from '@zen/core/modules/actions';

src/features/admin/actions/statsActions.js

@@ -9,9 +9,9 @@
  * 
  * ```javascript
  * // app/(admin)/admin/[...admin]/page.js
- * import { protectAdmin } from '@hykocx/zen/admin';
- * import { getDashboardStats, getModuleDashboardStats } from '@hykocx/zen/admin/actions';
- * import { AdminPagesClient } from '@hykocx/zen/admin/pages';
+ * import { protectAdmin } from '@zen/core/admin';
+ * import { getDashboardStats, getModuleDashboardStats } from '@zen/core/admin/actions';
+ * import { AdminPagesClient } from '@zen/core/admin/pages';
  * 
  * export default async function AdminPage({ params }) {
  *   const { user } = await protectAdmin();
@@ -37,7 +37,7 @@
 
 'use server';
 
-import { query } from '@hykocx/zen/database';
+import { query } from '@zen/core/database';
 
 /**
  * Get total number of users

src/features/admin/components/pages/ProfilePage.js

@@ -2,7 +2,7 @@
 
 import React, { useState, useEffect, useRef } from 'react';
 import { Card, Input, Button } from '../../../../shared/components';
-import { useToast } from '@hykocx/zen/toast';
+import { useToast } from '@zen/core/toast';
 
 const ProfilePage = ({ user: initialUser }) => {
     const toast = useToast();

src/features/admin/components/pages/UserEditPage.js

@@ -3,7 +3,7 @@
 import React, { useState, useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 import { Button, Card, Input, Select, Loading } from '../../../../shared/components';
-import { useToast } from '@hykocx/zen/toast';
+import { useToast } from '@zen/core/toast';
 
 /**
  * User Edit Page Component

src/features/admin/components/pages/UsersPage.js

@@ -4,7 +4,7 @@ import React, { useState, useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 import { Card, Table, StatusBadge, Pagination, Button } from '../../../../shared/components';
 import { PencilEdit01Icon } from '../../../../shared/Icons.js';
-import { useToast } from '@hykocx/zen/toast';
+import { useToast } from '@zen/core/toast';
 
 const UsersPageClient = () => {
     const router = useRouter();

src/features/admin/index.js

@@ -9,8 +9,8 @@ export { protectAdmin, isAdmin } from './middleware/protect.js';
 // Component exports (for catch-all routes)
 export { AdminPagesClient, AdminPagesLayout } from './pages.js';
 
-// NOTE: Server-only navigation builder is in '@hykocx/zen/admin/navigation'
+// NOTE: Server-only navigation builder is in '@zen/core/admin/navigation'
 // Do NOT import from this file to avoid bundling database code into client
 
 // NOTE: Admin server actions are exported separately to avoid bundling issues
-// Import them from '@hykocx/zen/admin/actions' instead
+// Import them from '@zen/core/admin/actions' instead

src/features/admin/middleware/protect.js

@@ -17,7 +17,7 @@ import { redirect } from 'next/navigation';
  * 
  * @example
  * // In a server component:
- * import { protectAdmin } from '@hykocx/zen/admin';
+ * import { protectAdmin } from '@zen/core/admin';
  * 
  * export default async function AdminPage() {
  *   const session = await protectAdmin();
@@ -47,7 +47,7 @@ async function protectAdmin(options = {}) {
  * @returns {Promise<boolean>} True if user is admin
  * 
  * @example
- * import { isAdmin } from '@hykocx/zen/admin';
+ * import { isAdmin } from '@zen/core/admin';
  * 
  * export default async function Page() {
  *   const admin = await isAdmin();

src/features/admin/navigation.server.js

@@ -7,16 +7,16 @@
  * IMPORTANT: This file is NOT bundled to ensure it shares the same registry instance
  * that was populated during module discovery.
  * 
- * IMPORTANT: We import from '@hykocx/zen' (main package) to use the same registry
+ * IMPORTANT: We import from '@zen/core' (main package) to use the same registry
  * instance that was populated during initializeZen(). DO NOT import from 
- * '@hykocx/zen/core/modules' as that's a separate bundle with its own registry.
+ * '@zen/core/core/modules' as that's a separate bundle with its own registry.
  * 
  * IMPORTANT: Navigation data must be serializable (no functions/components).
  * Icons are passed as string names and resolved on the client.
  */
 
 // Import from the main package to use the same registry as discovery
-import { moduleSystem } from '@hykocx/zen';
+import { moduleSystem } from '@zen/core';
 const { getAllAdminNavigation } = moduleSystem;
 
 /**

src/features/admin/page.js

@@ -5,18 +5,18 @@
  * Users can simply re-export this in their app/admin/[...admin]/page.js:
  * 
  * ```javascript
- * export { default } from '@hykocx/zen/admin/page';
+ * export { default } from '@zen/core/admin/page';
  * ```
  * 
  * This eliminates the need to manually import and pass all actions and props.
  */
 
-import { AdminPagesLayout, AdminPagesClient } from '@hykocx/zen/admin/pages';
-import { protectAdmin } from '@hykocx/zen/admin';
-import { buildNavigationSections } from '@hykocx/zen/admin/navigation';
-import { getDashboardStats, getModuleDashboardStats } from '@hykocx/zen/admin/actions';
-import { logoutAction } from '@hykocx/zen/auth/actions';
-import { getAppName, getModulesConfig, getAppConfig, moduleSystem } from '@hykocx/zen';
+import { AdminPagesLayout, AdminPagesClient } from '@zen/core/admin/pages';
+import { protectAdmin } from '@zen/core/admin';
+import { buildNavigationSections } from '@zen/core/admin/navigation';
+import { getDashboardStats, getModuleDashboardStats } from '@zen/core/admin/actions';
+import { logoutAction } from '@zen/core/auth/actions';
+import { getAppName, getModulesConfig, getAppConfig, moduleSystem } from '@zen/core';
 
 const { getAdminPage } = moduleSystem;
 

src/features/auth/README-custom-login.md

@@ -15,8 +15,8 @@ You can use a **custom page for every auth flow**:
 | Confirm email   | `ConfirmEmailPage`   | `verifyEmailAction`                 |
 | Logout          | `LogoutPage`         | `logoutAction`, `setSessionCookie`  |
 
-- **Components**: from `@hykocx/zen/auth/components`
-- **Actions**: from `@hykocx/zen/auth/actions`
+- **Components**: from `@zen/core/auth/components`
+- **Actions**: from `@zen/core/auth/actions`
 
 Create your own routes (e.g. `/login`, `/register`, `/auth/forgot`) and wrap Zen’s components in your layout. Each page follows the same pattern: a **server component** that loads data and passes actions, and a **client wrapper** that handles navigation and renders the Zen component.
 
@@ -58,7 +58,7 @@ Use this when wiring each custom page.
 **Server:** `app/login/page.js` (or `app/auth/login/page.js`)
 
 ```js
-import { getSession, loginAction, setSessionCookie } from '@hykocx/zen/auth/actions';
+import { getSession, loginAction, setSessionCookie } from '@zen/core/auth/actions';
 import { LoginPageWrapper } from './LoginPageWrapper';
 
 export default async function LoginRoute() {
@@ -81,7 +81,7 @@ export default async function LoginRoute() {
 'use client';
 
 import { useRouter } from 'next/navigation';
-import { LoginPage } from '@hykocx/zen/auth/components';
+import { LoginPage } from '@zen/core/auth/components';
 
 export function LoginPageWrapper({ loginAction, setSessionCookie, currentUser }) {
   const router = useRouter();
@@ -104,7 +104,7 @@ export function LoginPageWrapper({ loginAction, setSessionCookie, currentUser })
 **Server:** `app/register/page.js`
 
 ```js
-import { getSession, registerAction } from '@hykocx/zen/auth/actions';
+import { getSession, registerAction } from '@zen/core/auth/actions';
 import { RegisterPageWrapper } from './RegisterPageWrapper';
 
 export default async function RegisterRoute() {
@@ -126,7 +126,7 @@ export default async function RegisterRoute() {
 'use client';
 
 import { useRouter } from 'next/navigation';
-import { RegisterPage } from '@hykocx/zen/auth/components';
+import { RegisterPage } from '@zen/core/auth/components';
 
 export function RegisterPageWrapper({ registerAction, currentUser }) {
   const router = useRouter();
@@ -147,7 +147,7 @@ export function RegisterPageWrapper({ registerAction, currentUser }) {
 **Server:** `app/forgot/page.js`
 
 ```js
-import { getSession, forgotPasswordAction } from '@hykocx/zen/auth/actions';
+import { getSession, forgotPasswordAction } from '@zen/core/auth/actions';
 import { ForgotPasswordPageWrapper } from './ForgotPasswordPageWrapper';
 
 export default async function ForgotRoute() {
@@ -169,7 +169,7 @@ export default async function ForgotRoute() {
 'use client';
 
 import { useRouter } from 'next/navigation';
-import { ForgotPasswordPage } from '@hykocx/zen/auth/components';
+import { ForgotPasswordPage } from '@zen/core/auth/components';
 
 export function ForgotPasswordPageWrapper({ forgotPasswordAction, currentUser }) {
   const router = useRouter();
@@ -192,7 +192,7 @@ Requires `email` and `token` from the reset link (e.g. `/auth/reset?email=...&to
 **Server:** `app/auth/reset/page.js` (or `app/reset/page.js` with dynamic segment if needed)
 
 ```js
-import { resetPasswordAction } from '@hykocx/zen/auth/actions';
+import { resetPasswordAction } from '@zen/core/auth/actions';
 import { ResetPasswordPageWrapper } from './ResetPasswordPageWrapper';
 
 export default async function ResetRoute({ searchParams }) {
@@ -217,7 +217,7 @@ export default async function ResetRoute({ searchParams }) {
 'use client';
 
 import { useRouter } from 'next/navigation';
-import { ResetPasswordPage } from '@hykocx/zen/auth/components';
+import { ResetPasswordPage } from '@zen/core/auth/components';
 
 export function ResetPasswordPageWrapper({ resetPasswordAction, email, token }) {
   const router = useRouter();
@@ -241,7 +241,7 @@ Requires `email` and `token` from the verification link (e.g. `/auth/confirm?ema
 **Server:** `app/auth/confirm/page.js`
 
 ```js
-import { verifyEmailAction } from '@hykocx/zen/auth/actions';
+import { verifyEmailAction } from '@zen/core/auth/actions';
 import { ConfirmEmailPageWrapper } from './ConfirmEmailPageWrapper';
 
 export default async function ConfirmRoute({ searchParams }) {
@@ -266,7 +266,7 @@ export default async function ConfirmRoute({ searchParams }) {
 'use client';
 
 import { useRouter } from 'next/navigation';
-import { ConfirmEmailPage } from '@hykocx/zen/auth/components';
+import { ConfirmEmailPage } from '@zen/core/auth/components';
 
 export function ConfirmEmailPageWrapper({ verifyEmailAction, email, token }) {
   const router = useRouter();
@@ -288,7 +288,7 @@ export function ConfirmEmailPageWrapper({ verifyEmailAction, email, token }) {
 **Server:** `app/auth/logout/page.js`
 
 ```js
-import { logoutAction, setSessionCookie } from '@hykocx/zen/auth/actions';
+import { logoutAction, setSessionCookie } from '@zen/core/auth/actions';
 import { LogoutPageWrapper } from './LogoutPageWrapper';
 
 export default function LogoutRoute() {
@@ -308,7 +308,7 @@ export default function LogoutRoute() {
 ```js
 'use client';
 
-import { LogoutPage } from '@hykocx/zen/auth/components';
+import { LogoutPage } from '@zen/core/auth/components';
 
 export function LogoutPageWrapper({ logoutAction, setSessionCookie }) {
   return (
@@ -324,10 +324,10 @@ export function LogoutPageWrapper({ logoutAction, setSessionCookie }) {
 
 ## Protecting routes
 
-Use `protect()` from `@hykocx/zen/auth` and set `redirectTo` to your custom login path:
+Use `protect()` from `@zen/core/auth` and set `redirectTo` to your custom login path:
 
 ```js
-import { protect } from '@hykocx/zen/auth';
+import { protect } from '@zen/core/auth';
 
 export const middleware = protect({ redirectTo: '/login' });
 ```
@@ -341,7 +341,7 @@ So unauthenticated users are sent to your custom login page.
 If you don’t need a custom layout, keep using the built-in auth UI. In `app/auth/[...auth]/page.js`:
 
 ```js
-export { default } from '@hykocx/zen/auth/page';
+export { default } from '@zen/core/auth/page';
 ```
 
 This serves login, register, forgot, reset, confirm, and logout under `/auth/*` with the default styling.

src/features/auth/README-dashboard.md

@@ -7,11 +7,11 @@ This guide explains how to build a **client dashboard** in your Next.js app usin
 | Need | Solution |
 |------|----------|
 | Require login on a page | `protect()` in a **server component** – redirects to login if not authenticated |
-| Get current user on server | `getSession()` from `@hykocx/zen/auth/actions` |
-| Check auth without redirect | `checkAuth()` from `@hykocx/zen/auth` |
-| Require a role | `requireRole(['admin', 'manager'])` from `@hykocx/zen/auth` |
-| Show user in client (header/nav) | `UserMenu` or `UserAvatar` + `useCurrentUser` from `@hykocx/zen/auth/components` |
-| Edit account (name + avatar) | `AccountSection` from `@hykocx/zen/auth/components` |
+| Get current user on server | `getSession()` from `@zen/core/auth/actions` |
+| Check auth without redirect | `checkAuth()` from `@zen/core/auth` |
+| Require a role | `requireRole(['admin', 'manager'])` from `@zen/core/auth` |
+| Show user in client (header/nav) | `UserMenu` or `UserAvatar` + `useCurrentUser` from `@zen/core/auth/components` |
+| Edit account (name + avatar) | `AccountSection` from `@zen/core/auth/components` |
 | Call user API from client | `GET /zen/api/users/me`, `PUT /zen/api/users/profile`, `POST/DELETE /zen/api/users/profile/picture` (with `credentials: 'include'`) |
 
 All user APIs are **session-based**: the session cookie is read on the server. No token in client code. Avatar and profile updates are scoped to the current user; the API validates the session on every request.
@@ -24,7 +24,7 @@ Use `protect()` in a **server component**. If there is no valid session, the use
 
 ```js
 // app/dashboard/page.js (Server Component)
-import { protect } from '@hykocx/zen/auth';
+import { protect } from '@zen/core/auth';
 import { DashboardClient } from './DashboardClient';
 
 export default async function DashboardPage() {
@@ -52,8 +52,8 @@ In your layout or header (server component), get the session and pass `user` to
 
 ```js
 // app/layout.js or app/dashboard/layout.js
-import { getSession } from '@hykocx/zen/auth/actions';
-import { UserMenu } from '@hykocx/zen/auth/components';
+import { getSession } from '@zen/core/auth/actions';
+import { UserMenu } from '@zen/core/auth/components';
 
 export default async function Layout({ children }) {
   const session = await getSession();
@@ -80,7 +80,7 @@ If you prefer not to pass user from the server, use the hook in a client compone
 ```js
 'use client';
 
-import { UserMenu } from '@hykocx/zen/auth/components';
+import { UserMenu } from '@zen/core/auth/components';
 
 export function Header() {
   return (
@@ -115,8 +115,8 @@ Use **`AccountSection`** on a page that is already protected (e.g. `/dashboard/a
 
 ```js
 // app/dashboard/account/page.js
-import { protect } from '@hykocx/zen/auth';
-import { AccountSection } from '@hykocx/zen/auth/components';
+import { protect } from '@zen/core/auth';
+import { AccountSection } from '@zen/core/auth/components';
 
 export default async function AccountPage() {
   const session = await protect({ redirectTo: '/auth/login' });
@@ -139,7 +139,7 @@ export default async function AccountPage() {
 - `POST /zen/api/users/profile/picture` for upload
 - `DELETE /zen/api/users/profile/picture` for remove
 
-All with `credentials: 'include'` (session cookie). Ensure your app uses **ToastProvider** (from `@hykocx/zen/toast`) if you want toasts.
+All with `credentials: 'include'` (session cookie). Ensure your app uses **ToastProvider** (from `@zen/core/toast`) if you want toasts.
 
 ---
 
@@ -148,7 +148,7 @@ All with `credentials: 'include'` (session cookie). Ensure your app uses **Toast
 Use **`checkAuth()`** in a server component when you only need to know whether someone is logged in:
 
 ```js
-import { checkAuth } from '@hykocx/zen/auth';
+import { checkAuth } from '@zen/core/auth';
 
 export default async function Page() {
   const session = await checkAuth();
@@ -159,7 +159,7 @@ export default async function Page() {
 Use **`requireRole()`** when a page is only for certain roles:
 
 ```js
-import { requireRole } from '@hykocx/zen/auth';
+import { requireRole } from '@zen/core/auth';
 
 export default async function ManagerPage() {
   const session = await requireRole(['admin', 'manager'], {
@@ -201,8 +201,8 @@ app/
 **dashboard/layout.js:**
 
 ```js
-import { protect } from '@hykocx/zen/auth';
-import { UserMenu } from '@hykocx/zen/auth/components';
+import { protect } from '@zen/core/auth';
+import { UserMenu } from '@zen/core/auth/components';
 import Link from 'next/link';
 
 export default async function DashboardLayout({ children }) {
@@ -227,7 +227,7 @@ export default async function DashboardLayout({ children }) {
 **dashboard/page.js:**
 
 ```js
-import { protect } from '@hykocx/zen/auth';
+import { protect } from '@zen/core/auth';
 
 export default async function DashboardPage() {
   const session = await protect({ redirectTo: '/auth/login' });
@@ -244,8 +244,8 @@ export default async function DashboardPage() {
 **dashboard/account/page.js:**
 
 ```js
-import { protect } from '@hykocx/zen/auth';
-import { AccountSection } from '@hykocx/zen/auth/components';
+import { protect } from '@zen/core/auth';
+import { AccountSection } from '@zen/core/auth/components';
 
 export default async function AccountPage() {
   const session = await protect({ redirectTo: '/auth/login' });
@@ -269,6 +269,6 @@ If you use the **Invoice** module and want logged-in users to see their own invo
 
 - **User–client link**: In the admin, link a user to a client (User edit → Client). Only invoices for that client are shown.
 - **API**: `GET /zen/api/invoices/me` (session required) returns the current user’s linked client and that client’s invoices.
-- **Component**: Use `ClientInvoicesSection` from `@hykocx/zen/invoice/dashboard` on a protected page (e.g. `/dashboard/invoices`).
+- **Component**: Use `ClientInvoicesSection` from `@zen/core/invoice/dashboard` on a protected page (e.g. `/dashboard/invoices`).
 
 See the [Invoice module dashboard guide](../../modules/invoice/README-dashboard.md) for the full setup (API details, page example, linking users to clients, and security).

src/features/auth/components/AccountSection.js

@@ -11,7 +11,7 @@
 
 import React, { useState, useEffect, useRef } from 'react';
 import { Card, Input, Button } from '../../../shared/components/index.js';
-import { useToast } from '@hykocx/zen/toast';
+import { useToast } from '@zen/core/toast';
 import { useCurrentUser } from './useCurrentUser.js';
 import UserAvatar from './UserAvatar.js';
 

src/features/auth/components/index.js

@@ -3,8 +3,8 @@
  *
  * Use these components to build custom auth pages for every flow (login, register, forgot,
  * reset, confirm, logout) so they match your site's style.
- * For a ready-made catch-all auth UI, use AuthPagesClient from '@hykocx/zen/auth/pages'.
- * For the default full-page auth (no custom layout), re-export from '@hykocx/zen/auth/page'.
+ * For a ready-made catch-all auth UI, use AuthPagesClient from '@zen/core/auth/pages'.
+ * For the default full-page auth (no custom layout), re-export from '@zen/core/auth/page'.
  *
  * --- Custom auth pages (all types) ---
  *
@@ -21,7 +21,7 @@
  *
  * onNavigate receives 'login' | 'register' | 'forgot' | 'reset'. Map to your routes (e.g. /auth/${page}).
  * For reset/confirm, pass email and token from searchParams. Full guide: see README-custom-login.md in this package.
- * Protect routes with protect() from '@hykocx/zen/auth', redirectTo your login path.
+ * Protect routes with protect() from '@zen/core/auth', redirectTo your login path.
  *
  * --- Dashboard / user display ---
  *

src/features/auth/index.js

@@ -1,8 +1,8 @@
 /**
  * Zen Authentication Module - Server-side utilities
  * 
- * For client components, use '@hykocx/zen/auth/pages'
- * For server actions, use '@hykocx/zen/auth/actions'
+ * For client components, use '@zen/core/auth/pages'
+ * For server actions, use '@zen/core/auth/actions'
  */
 
 // Authentication library (server-side only)

src/features/auth/middleware/protect.js

@@ -16,7 +16,7 @@ import { redirect } from 'next/navigation';
  * 
  * @example
  * // In a server component:
- * import { protect } from '@hykocx/zen/auth';
+ * import { protect } from '@zen/core/auth';
  * 
  * export default async function ProtectedPage() {
  *   const session = await protect();
@@ -42,7 +42,7 @@ async function protect(options = {}) {
  * @returns {Promise<Object|null>} Session object or null if not authenticated
  * 
  * @example
- * import { checkAuth } from '@hykocx/zen/auth';
+ * import { checkAuth } from '@zen/core/auth';
  * 
  * export default async function Page() {
  *   const session = await checkAuth();

src/features/auth/page.js

@@ -2,14 +2,14 @@
  * Auth Page - Server Component Wrapper for Next.js App Router
  *
  * Default auth UI: login, register, forgot, reset, confirm, logout at /auth/[...auth].
- * Re-export in your app: export { default } from '@hykocx/zen/auth/page';
+ * Re-export in your app: export { default } from '@zen/core/auth/page';
  *
  * For custom auth pages (all flows) that match your site style, use components from
- * '@hykocx/zen/auth/components' and actions from '@hykocx/zen/auth/actions'.
+ * '@zen/core/auth/components' and actions from '@zen/core/auth/actions'.
  * See README-custom-login.md in this package. Basic sites can keep using this default page.
  */
 
-import { AuthPagesClient } from '@hykocx/zen/auth/pages';
+import { AuthPagesClient } from '@zen/core/auth/pages';
 import { 
   registerAction,
   loginAction,
@@ -19,7 +19,7 @@ import {
   verifyEmailAction,
   setSessionCookie,
   getSession
-} from '@hykocx/zen/auth/actions';
+} from '@zen/core/auth/actions';
 
 export default async function AuthPage({ params, searchParams }) {
   const session = await getSession();

src/features/provider/ZenProvider.js

@@ -1,7 +1,7 @@
 'use client';
 
 import { useState } from 'react';
-import { ToastProvider, ToastContainer } from '@hykocx/zen/toast';
+import { ToastProvider, ToastContainer } from '@zen/core/toast';
 import { registerExternalModulePages } from '../../modules/modules.pages.js';
 
 /**