feat!: migrate to Harper v5 (harper npm package)

.bun/preload.js

@@ -1,17 +1,17 @@
 /**
  * Bun test setup file
- * This runs before any tests and sets up the environment for HarperDB mocks
+ * This runs before any tests and sets up the environment for Harper mocks
  */
 
 import { mock } from 'bun:test';
 
-// Mock the harperdb module to prevent initialization errors in Bun
-// HarperDB's threadServer.js tries to call database() functions during module init
+// Mock the harper module to prevent initialization errors in Bun
+// Harper's threadServer.js tries to call database() functions during module init
 // which fail in test environment
 //
 // This mock Resource class provides enough functionality for OAuthResource to extend
 // and for tests to work properly
-mock.module('harperdb', () => {
+mock.module('harper', () => {
 	return {
 		Resource: class Resource {
 			static loadAsInstance = false;

CLAUDE.md

@@ -75,7 +75,7 @@ request.session = {
 - Logging: `logger?.info?.()` pattern (optional logger)
 - **Never log tokens; never expose tokens in responses**
 - CSRF protection: all flows use state tokens (10-minute expiry)
-- Harper types: `import type { Scope, User, RequestTarget } from 'harperdb'`
+- Harper types: `import type { Scope, User, RequestTarget } from 'harper'`
 
 ## Non-Obvious Gotchas
 
@@ -110,13 +110,13 @@ request.session = {
 
 ## Testing
 
-Node.js built-in test runner (`node:test`) and Bun. Tests import from compiled `dist/`. Use `node:assert/strict`. Bun uses a preload script (`test/bun-preload.js`) to mock the `harperdb` module.
+Node.js built-in test runner (`node:test`) and Bun. Tests import from compiled `dist/`. Use `node:assert/strict`. Bun uses a preload script (`.bun/preload.js`) to mock the `harper` module.
 
 Test scripts use `$(find test -name '*.test.js' -type f)`-style globbing for Node 20 compatibility; once Node 20 support ends, switch to `node --test test` or `node --test "test/**/*.test.js"` on Node 22+.
 
 ## Dependencies
 
 - **Runtime:** `jsonwebtoken`, `jwks-rsa` (required by Okta / JWT-based providers)
-- **Peer:** `harperdb` (`>=4.6.0`)
-- **Dev:** `typescript`, `eslint`, `prettier`, `@types/node`, `@types/jsonwebtoken`, `@harperdb/code-guidelines`, `harperdb` (for types + test)
+- **Peer:** `harper` (`>=5.0.0`)
+- **Dev:** `typescript`, `eslint`, `prettier`, `@types/node`, `@types/jsonwebtoken`, `@harperdb/code-guidelines`, `harper` (for types + test)
 - **Invariant:** justify any new runtime dependency in the PR; prefer built-ins (`fetch`, `crypto`)

docs/api-reference.md

@@ -324,7 +324,7 @@ export class MyResource extends tables.Resource {
 ### Authentication Errors
 
 ```javascript
-import { ClientError } from 'harperdb';
+import { ClientError } from 'harper';
 
 export class ProtectedResource extends tables.Resource {
 	async get(target, request) {