@getstrata/core 0.5.58 → 0.5.60

package/CHANGELOG.md

@@ -0,0 +1,21 @@
+# @getstrata/core changelog
+
+## 0.5.60
+
+- `@getstrata/core/database/boundConnection` publishes `getBoundDatabaseConnection` and `resetBoundDatabaseConnection` on the JS entry (not only the types file). Tests can reset the bound pool after `closeDatabase()` without a postinstall patch.
+- `bindBunSql` / `createBunSqlPool` on `@getstrata/core/database/bunSql` create a Bun `SQL` pool and register it as the bound connection plus default pool.
+- `xmlResponse` accepts `{ contentType }`. `rssResponse` sends `application/rss+xml`.
+- Memory throttle buckets are per middleware instance. `resetMemoryThrottleForTests()` clears every instance map so nested HTTP tests do not leak.
+
+## 0.5.59
+
+Sibling HTMX apps can consume published packages without WorkHub-only glue.
+
+- Emit `@getstrata/core/facades` types at `dist/core/facades/index.d.ts` (CI checks every `exports.*.types` path after build).
+- Session and CSRF cookie names are configurable (`SESSION_COOKIE_NAME`, `CSRF_COOKIE_NAME`). Defaults remain `workhub_session` and `workhub_csrf` for WorkHub.
+- Split `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN` from `CORE_TOKEN_SERVICE_TOKEN`. HttpKernel prefers the ability-checker token; HMAC `SessionGuard` / layout data prefer the user directory. A compatibility shim uses `CORE_TOKEN_SERVICE_TOKEN` only when the bound value matches the requested type.
+- `configureWebLayoutData` lets apps choose `currentUser` vs `authUser`, a custom user loader, and extra template fields. WorkHub still gets `{ authUser, csrfToken, flash }`.
+- `redirectResponse`, `notFoundHtmlResponse`, `textResponse`, and `xmlResponse` join `htmlResponse` / `isHtmxRequest` on `@getstrata/core/view`.
+- `LOGIN_RATE_LIMIT_WINDOW_MS` is a deprecated alias for `LOGIN_RATE_LIMIT_WINDOW_SECONDS`.
+
+HMAC `SessionGuard` is unchanged for WorkHub API/token apps. Sibling HTMX apps should use `@getstrata/bootstrap` `CookieSessionStore` + `createCookieSessionAuthManager`.

package/README.md

@@ -5,7 +5,7 @@ Stable **Strata** framework surface for application modules.
 **Source:** `src/framework/public-api.ts` (monorepo)  
 **Repository:** [EyK-26/strata](https://github.com/EyK-26/strata), directory `packages/strata-core`
 
-WorkHub is the reference application built on Strata; import the framework from this package in your own modules.
+WorkHub is the reference application built on Strata; import the framework from this package in your own modules. Sibling HTMX apps (Eta, cookie sessions, no API tokens) should follow [docs/SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
 
 ## Usage
 
@@ -28,7 +28,7 @@ import { EtaViewEngine } from "@getstrata/core/view";
 
 `.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not Pug. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
 
-**Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database driver is your app's choice. WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; bind it with `bindDatabaseConnection()`.
+**Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database driver is your app's choice. WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; create and bind it with `createBunSqlPool()` / `bindBunSql()`, or call `bindDatabaseConnection()` yourself.
 
 `orderBy` accepts explicit `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`.
 
@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.58 && git push origin v0.5.58`
+2. Tag a release: `git tag v0.5.60 && git push origin v0.5.60`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/bootstrap/config.d.ts

@@ -4,7 +4,7 @@ declare const CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
 declare const CACHE_DRIVER_CONFIG_KEY = "cache.driver";
 declare const REDIS_URL_CONFIG_KEY = "cache.redisUrl";
 declare const DATABASE_URL_CONFIG_KEY = "database.url";
-export { CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
 declare const AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
 declare const DEFAULT_APP_PORT = 3000;
 declare const DEFAULT_CACHE_TTL_MS = 3600000;

package/dist/core/auth/sessionCookie.d.ts

@@ -1,6 +1,7 @@
 declare const SESSION_COOKIE = "workhub_session";
 declare const SESSION_TTL_SECONDS: number;
+declare function sessionCookieName(): string;
 declare function readSessionUserId(request: Request): number | null;
 declare function createSessionCookie(userId: number): string;
 declare function clearSessionCookie(): string;
-export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_TTL_SECONDS, };
+export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_TTL_SECONDS, sessionCookieName, };

package/dist/core/contracts/serviceTokens.d.ts

@@ -1,3 +1,6 @@
+import type { AbilityChecker } from "../auth/abilityChecker";
+import type { AuthUserDirectory } from "./authUserDirectory";
+import type { ServiceContainerLike } from "./container";
 declare const CORE_CONFIG_TOKEN = "core.config";
 declare const CORE_CACHE_TOKEN = "core.cache";
 declare const CORE_QUEUE_TOKEN = "core.queue";
@@ -5,4 +8,10 @@ declare const CORE_EVENT_BUS_TOKEN = "core.eventBus";
 declare const CORE_POLICY_GATE_TOKEN = "core.policyGate";
 declare const CORE_AUTH_TOKEN = "core.auth";
 declare const CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
-export { CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, };
+declare const CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+declare const CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+declare function isAbilityChecker(value: unknown): value is AbilityChecker;
+declare function isAuthUserDirectory(value: unknown): value is AuthUserDirectory;
+declare function resolveAbilityChecker(container: ServiceContainerLike): AbilityChecker;
+declare function resolveAuthUserDirectory(container: ServiceContainerLike): AuthUserDirectory | null;
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, isAbilityChecker, isAuthUserDirectory, resolveAbilityChecker, resolveAuthUserDirectory, };

package/dist/core/database/bindConnection.d.ts

@@ -1,3 +1 @@
-import type { DatabaseConnection } from "./baseRepository";
-declare function bindDatabaseConnection(connection: DatabaseConnection): void;
-export { bindDatabaseConnection };
+export { bindDatabaseConnection, getBoundDatabaseConnection, resetBoundDatabaseConnection, } from "./boundConnection";

package/dist/core/database/bunSql.d.ts

@@ -0,0 +1,13 @@
+import { SQL } from "bun";
+import type { DatabaseConnection } from "./baseRepository";
+interface CreateBunSqlPoolOptions {
+    url: string;
+    max?: number;
+    idleTimeout?: number;
+    maxLifetime?: number;
+    connectionTimeout?: number;
+}
+declare function createBunSqlPool(options: CreateBunSqlPoolOptions): InstanceType<typeof SQL>;
+declare function bindBunSql(sql: DatabaseConnection): DatabaseConnection;
+export type { CreateBunSqlPoolOptions };
+export { bindBunSql, createBunSqlPool };

package/dist/core/http/csrfToken.d.ts

@@ -1,4 +1,5 @@
 declare const CSRF_COOKIE = "workhub_csrf";
+declare function csrfCookieName(): string;
 declare function createCsrfTokenCookie(): {
     token: string;
     cookie: string;
@@ -11,4 +12,4 @@ declare function readSubmittedCsrfToken(request: Request): string | null;
 declare function readSubmittedCsrfTokenFromBody(request: Request): Promise<string | null>;
 declare function verifyCsrfToken(request: Request, submittedToken: string | null): boolean;
 declare function resolveCsrfTokenForRequest(request: Request): string;
-export { CSRF_COOKIE, createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, };
+export { CSRF_COOKIE, createCsrfTokenCookie, csrfCookieName, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, };

package/dist/core/http/memoryThrottleMiddleware.d.ts

@@ -5,5 +5,6 @@ interface MemoryThrottleOptions {
     keyPrefix?: string;
 }
 declare function createMemoryThrottleMiddleware(options: MemoryThrottleOptions): Middleware;
+declare function resetMemoryThrottleForTests(): void;
 export type { MemoryThrottleOptions };
-export { createMemoryThrottleMiddleware };
+export { createMemoryThrottleMiddleware, resetMemoryThrottleForTests };

package/dist/core/view/htmlResponse.d.ts

@@ -3,4 +3,16 @@ declare function htmlResponse(html: string, init?: {
     statusText?: string;
 }): Response;
 declare function isHtmxRequest(request: Request): boolean;
-export { htmlResponse, isHtmxRequest };
+declare function redirectResponse(location: string, status?: number): Response;
+declare function notFoundHtmlResponse(body?: string): Response;
+declare function textResponse(body: string, init?: {
+    status?: number;
+}): Response;
+declare function xmlResponse(body: string, init?: {
+    status?: number;
+    contentType?: string;
+}): Response;
+declare function rssResponse(body: string, init?: {
+    status?: number;
+}): Response;
+export { htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, rssResponse, textResponse, xmlResponse, };

package/dist/core/view/index.d.ts

@@ -1,5 +1,5 @@
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine } from "./etaViewEngine";
-export { htmlResponse, isHtmxRequest } from "./htmlResponse";
+export { htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, rssResponse, textResponse, xmlResponse, } from "./htmlResponse";
 export type { ViewEngine } from "./viewEngine";
-export type { WebLayoutAuthUser, WebLayoutData } from "./webLayoutData";
-export { resolveWebLayoutData } from "./webLayoutData";
+export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "./webLayoutData";
+export { configureWebLayoutData, resolveWebLayoutData } from "./webLayoutData";

package/dist/core/view/webLayoutData.d.ts

@@ -3,15 +3,26 @@ interface WebLayoutAuthUser {
     id: number;
     email: string;
     role: string;
+    [key: string]: unknown;
 }
 interface WebLayoutData {
-    authUser: WebLayoutAuthUser | null;
+    authUser?: WebLayoutAuthUser | null;
+    currentUser?: WebLayoutAuthUser | null;
     csrfToken: string;
     flash: {
         level: string;
         message: string;
     } | null;
+    [key: string]: unknown;
 }
-declare function resolveWebLayoutData(container: ServiceContainerLike, request?: Request): Promise<Record<string, unknown>>;
-export type { WebLayoutAuthUser, WebLayoutData };
-export { resolveWebLayoutData };
+type WebLayoutUserKey = "authUser" | "currentUser";
+interface WebLayoutDataOptions {
+    userKey?: WebLayoutUserKey;
+    loadUser?: (container: ServiceContainerLike, request: Request | undefined) => Promise<Record<string, unknown> | null>;
+    extra?: Record<string, unknown> | ((user: Record<string, unknown> | null) => Record<string, unknown> | Promise<Record<string, unknown>>);
+}
+declare function configureWebLayoutData(options: WebLayoutDataOptions): void;
+declare function resetWebLayoutDataConfigForTests(): void;
+declare function resolveWebLayoutData(container: ServiceContainerLike, request?: Request, options?: WebLayoutDataOptions): Promise<Record<string, unknown>>;
+export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey };
+export { configureWebLayoutData, resetWebLayoutDataConfigForTests, resolveWebLayoutData };

package/dist/entries/auth/sessionCookie.js

@@ -3,6 +3,9 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function sessionCookieName() {
+  return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
+}
 function resolveSessionSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
@@ -25,7 +28,7 @@ function readCookieValue(request, cookieName) {
   return null;
 }
 function readSessionUserId(request) {
-  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
@@ -60,16 +63,17 @@ function createSessionCookie(userId) {
   const issuedAt = Date.now();
   const value = signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+  return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 export {
   SESSION_COOKIE,
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
-  readSessionUserId
+  readSessionUserId,
+  sessionCookieName
 };

package/dist/entries/auth/sessionGuard.js

@@ -7,6 +7,42 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
@@ -50,6 +86,9 @@ function resolveAbilitiesForRole(role) {
 import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function sessionCookieName() {
+  return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
+}
 function resolveSessionSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
@@ -72,7 +111,7 @@ function readCookieValue(request, cookieName) {
   return null;
 }
 function readSessionUserId(request) {
-  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
@@ -107,11 +146,11 @@ function createSessionCookie(userId) {
   const issuedAt = Date.now();
   const value = signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+  return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 
 // ../../src/core/auth/sessionGuard.ts
@@ -125,10 +164,10 @@ class SessionGuard {
     if (!userId) {
       return null;
     }
-    if (!this.container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = resolveAuthUserDirectory(this.container);
+    if (!tokenService) {
       return null;
     }
-    const tokenService = this.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     try {
       const user = await tokenService.findByIdOrThrow(userId);
       return {

package/dist/entries/contracts/serviceTokens.js

@@ -7,12 +7,54 @@ var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
 export {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
   CORE_POLICY_GATE_TOKEN,
   CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
+  CORE_TOKEN_SERVICE_TOKEN,
+  isAbilityChecker,
+  isAuthUserDirectory,
+  resolveAbilityChecker,
+  resolveAuthUserDirectory
 };

package/dist/entries/database/bunSql.js

@@ -0,0 +1 @@
+export * from "../../index.js";

package/dist/entries/http/csrfMiddleware.js

@@ -62,6 +62,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -81,11 +84,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -121,7 +124,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }

package/dist/entries/http/csrfToken.js

@@ -59,6 +59,9 @@ function currentRequestMeta() {
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+}
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
@@ -78,11 +81,11 @@ function createCsrfTokenCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
     return { token: cookieValue };
   }
@@ -118,7 +121,7 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  const cookieValue = readRequestCookie(request, csrfCookieName());
   if (!cookieValue) {
     return false;
   }
@@ -137,6 +140,7 @@ function resolveCsrfTokenForRequest(request) {
 export {
   CSRF_COOKIE,
   createCsrfTokenCookie,
+  csrfCookieName,
   readSubmittedCsrfToken,
   readSubmittedCsrfTokenFromBody,
   resolveCsrfToken,

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -15,9 +15,11 @@ function readClientIp(request, env = process.env) {
 }
 
 // ../../src/core/http/memoryThrottleMiddleware.ts
-var buckets = new Map;
+var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
   const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
+  const buckets = new Map;
+  throttleBucketRegistries.add(buckets);
   return async (request, next) => {
     const path = new URL(request.url).pathname;
     const identity = readClientIp(request) ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
@@ -40,6 +42,12 @@ function createMemoryThrottleMiddleware(options) {
     return await next();
   };
 }
+function resetMemoryThrottleForTests() {
+  for (const buckets of throttleBucketRegistries) {
+    buckets.clear();
+  }
+}
 export {
-  createMemoryThrottleMiddleware
+  createMemoryThrottleMiddleware,
+  resetMemoryThrottleForTests
 };