@getstrata/core 0.5.61 → 0.5.63

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -0,0 +1,340 @@
+// @bun
+// ../../src/core/audit/exportAuditLogs.ts
+import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: process.env.APP_NAME?.trim() || "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+import { BadRequestError } from "@getstrata/core/errors/http";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
+import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+async function runWithMigrationBypass(callback) {
+  await db`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await db`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/audit/siemFormatter.ts
+function formatSiemAuditEvent(input) {
+  return {
+    timestamp: input.created_at.toISOString(),
+    event_type: "workhub.audit",
+    actor_user_id: input.user_id,
+    tenant_id: input.tenant_id ?? null,
+    trace_id: input.trace_id ?? null,
+    action: input.action,
+    subject_type: input.subject_type,
+    subject_id: input.subject_id,
+    ip_address: input.ip_address ?? null,
+    user_agent: input.user_agent ?? null,
+    checksum: input.checksum ?? null,
+    payload: input.payload ?? {}
+  };
+}
+function formatCefLine(event) {
+  const extension = [
+    `rt=${event.timestamp}`,
+    `suid=${event.actor_user_id ?? "unknown"}`,
+    `cs1=${event.action}`,
+    `cs1Label=Action`,
+    `cs2=${event.subject_type}`,
+    `cs2Label=SubjectType`,
+    `cs3=${event.subject_id ?? ""}`,
+    `cs3Label=SubjectId`,
+    `src=${event.ip_address ?? ""}`,
+    `request=${event.trace_id ?? ""}`
+  ].join(" ");
+  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+}
+
+// ../../src/core/audit/exportAuditLogs.ts
+function resolveAuditExportConfig() {
+  const endpoint = process.env.SIEM_EXPORT_URL?.trim();
+  if (!endpoint) {
+    return null;
+  }
+  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
+  const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
+  return {
+    endpoint,
+    format: process.env.SIEM_EXPORT_FORMAT === "cef" ? "cef" : "json",
+    batchSize: Number.isFinite(batchSize) ? batchSize : 100
+  };
+}
+async function exportPendingAuditLogs() {
+  const config = resolveAuditExportConfig();
+  if (!config) {
+    return 0;
+  }
+  return await runWithMigrationBypass(async () => {
+    const rows = await db2`
+      SELECT
+        id,
+        user_id,
+        action,
+        subject_type,
+        subject_id,
+        payload,
+        ip_address,
+        user_agent,
+        checksum,
+        tenant_id,
+        trace_id,
+        created_at
+      FROM audit_log
+      WHERE exported_at IS NULL
+      ORDER BY id
+      LIMIT ${config.batchSize}
+    `;
+    if (rows.length === 0) {
+      return 0;
+    }
+    const events = rows.map((row) => formatSiemAuditEvent({
+      action: row.action,
+      subject_type: row.subject_type,
+      subject_id: row.subject_id,
+      user_id: row.user_id,
+      tenant_id: row.tenant_id,
+      trace_id: row.trace_id,
+      ip_address: row.ip_address,
+      user_agent: row.user_agent,
+      checksum: row.checksum,
+      payload: row.payload,
+      created_at: row.created_at
+    }));
+    const body = config.format === "cef" ? events.map((event) => formatCefLine(event)).join(`
+`) : JSON.stringify({ events });
+    const response = await safeFetch(config.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": config.format === "cef" ? "text/plain" : "application/json",
+        ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
+      },
+      body
+    }, { allowHttp: appConfig.env !== "production" });
+    if (!response.ok) {
+      throw new Error(`SIEM export failed with status ${response.status}.`);
+    }
+    const ids = rows.map((row) => row.id);
+    for (const id of ids) {
+      await db2`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+    }
+    return rows.length;
+  });
+}
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+class SyncQueue {
+  async dispatch(job, payload) {
+    await job.handle(payload);
+  }
+}
+
+class AsyncQueue {
+  async dispatch(job, payload) {
+    setTimeout(() => {
+      job.handle(payload).catch((error) => {
+        console.error("[AsyncQueue] Job failed:", error);
+      });
+    }, 0);
+  }
+}
+function createQueue(driver) {
+  return driver === "async" ? new AsyncQueue : new SyncQueue;
+}
+
+// ../../src/core/jobs/exportAuditLogsJob.ts
+class ExportAuditLogsJob extends Job {
+  maxAttempts = 2;
+  backoffMs = 5000;
+  async handle(_payload = {}) {
+    const exported = await exportPendingAuditLogs();
+    if (exported > 0) {
+      appLogger.info(`Exported ${exported} audit log entries to SIEM.`);
+    }
+  }
+}
+export {
+  ExportAuditLogsJob
+};

package/dist/entries/mail/markdownMail.js

@@ -1,27 +1,77 @@
 // @bun
-// ../../src/core/mail/markdownMail.ts
+// ../../src/core/mail/sanitizeMailHtml.ts
+var ALLOWED_TAGS = new Set([
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "strong",
+  "ul"
+]);
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function decodeBasicEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+function isSafeHref(value) {
+  return /^(https?:|mailto:)/i.test(value.trim());
+}
+function sanitizeAttributes(tagName, rawAttributes) {
+  if (tagName !== "a") {
+    return "";
+  }
+  const hrefMatch = rawAttributes.match(/\bhref\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/i);
+  const href = decodeBasicEntities(hrefMatch?.[2] ?? hrefMatch?.[3] ?? hrefMatch?.[4] ?? "");
+  if (!href || !isSafeHref(href)) {
+    return "";
+  }
+  return ` href="${escapeHtml(href)}"`;
+}
+function sanitizeMailHtml(html) {
+  return html.replace(/<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)>/g, (match, tagName, rawAttributes) => {
+    const name = tagName.toLowerCase();
+    if (!ALLOWED_TAGS.has(name)) {
+      return "";
+    }
+    if (match.startsWith("</")) {
+      return `</${name}>`;
+    }
+    if (match.endsWith("/>") || name === "br" || name === "hr") {
+      return `<${name}>`;
+    }
+    return `<${name}${sanitizeAttributes(name, rawAttributes)}>`;
+  });
+}
+
+// ../../src/core/mail/markdownMail.ts
+function escapeHtml2(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
 function stripMarkdown(markdown) {
   return markdown.replace(/^#{1,6}\s+/gm, "").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/\*([^*]+)\*/g, "$1").replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1 ($2)").replace(/^[-*]\s+/gm, "\u2022 ").replace(/```[\s\S]*?```/g, "").replace(/\n{3,}/g, `
 
 `).trim();
 }
 function markdownToHtml(markdown) {
-  const escaped = markdown.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  return escaped.replace(/^### (.+)$/gm, "<h3>$1</h3>").replace(/^## (.+)$/gm, "<h2>$1</h2>").replace(/^# (.+)$/gm, "<h1>$1</h1>").replace(/`([^`]+)`/g, "<code>$1</code>").replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>").replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2">$1</a>').replace(/^[-*]\s+(.+)$/gm, "<li>$1</li>").replace(/(<li>[\s\S]*?<\/li>\n?)+/g, (block) => `<ul>${block}</ul>`).replace(/```(\w+)?\n([\s\S]*?)```/g, "<pre><code>$2</code></pre>").split(/\n\n+/).map((block) => {
-    if (block.startsWith("<")) {
-      return block;
-    }
-    return `<p>${block.replace(/\n/g, " ")}</p>`;
-  }).join(`
-`);
+  return sanitizeMailHtml(Bun.markdown.html(markdown));
 }
 function wrapMarkdownMailLayout(bodyHtml, options = {}) {
-  const title = escapeHtml(options.title ?? "GetStrata");
-  const preview = escapeHtml(options.preview ?? "");
-  const footer = escapeHtml(options.footer ?? "Sent by GetStrata");
+  const title = escapeHtml2(options.title ?? "GetStrata");
+  const preview = escapeHtml2(options.preview ?? "");
+  const footer = escapeHtml2(options.footer ?? "Sent by GetStrata");
   return `<!DOCTYPE html>
 <html lang="en">
 <head>

package/dist/entries/mail/markdownMailable.js

@@ -1,27 +1,77 @@
 // @bun
-// ../../src/core/mail/markdownMail.ts
+// ../../src/core/mail/sanitizeMailHtml.ts
+var ALLOWED_TAGS = new Set([
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "strong",
+  "ul"
+]);
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function decodeBasicEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+function isSafeHref(value) {
+  return /^(https?:|mailto:)/i.test(value.trim());
+}
+function sanitizeAttributes(tagName, rawAttributes) {
+  if (tagName !== "a") {
+    return "";
+  }
+  const hrefMatch = rawAttributes.match(/\bhref\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/i);
+  const href = decodeBasicEntities(hrefMatch?.[2] ?? hrefMatch?.[3] ?? hrefMatch?.[4] ?? "");
+  if (!href || !isSafeHref(href)) {
+    return "";
+  }
+  return ` href="${escapeHtml(href)}"`;
+}
+function sanitizeMailHtml(html) {
+  return html.replace(/<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)>/g, (match, tagName, rawAttributes) => {
+    const name = tagName.toLowerCase();
+    if (!ALLOWED_TAGS.has(name)) {
+      return "";
+    }
+    if (match.startsWith("</")) {
+      return `</${name}>`;
+    }
+    if (match.endsWith("/>") || name === "br" || name === "hr") {
+      return `<${name}>`;
+    }
+    return `<${name}${sanitizeAttributes(name, rawAttributes)}>`;
+  });
+}
+
+// ../../src/core/mail/markdownMail.ts
+function escapeHtml2(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
 function stripMarkdown(markdown) {
   return markdown.replace(/^#{1,6}\s+/gm, "").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/\*([^*]+)\*/g, "$1").replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1 ($2)").replace(/^[-*]\s+/gm, "\u2022 ").replace(/```[\s\S]*?```/g, "").replace(/\n{3,}/g, `
 
 `).trim();
 }
 function markdownToHtml(markdown) {
-  const escaped = markdown.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  return escaped.replace(/^### (.+)$/gm, "<h3>$1</h3>").replace(/^## (.+)$/gm, "<h2>$1</h2>").replace(/^# (.+)$/gm, "<h1>$1</h1>").replace(/`([^`]+)`/g, "<code>$1</code>").replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>").replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2">$1</a>').replace(/^[-*]\s+(.+)$/gm, "<li>$1</li>").replace(/(<li>[\s\S]*?<\/li>\n?)+/g, (block) => `<ul>${block}</ul>`).replace(/```(\w+)?\n([\s\S]*?)```/g, "<pre><code>$2</code></pre>").split(/\n\n+/).map((block) => {
-    if (block.startsWith("<")) {
-      return block;
-    }
-    return `<p>${block.replace(/\n/g, " ")}</p>`;
-  }).join(`
-`);
+  return sanitizeMailHtml(Bun.markdown.html(markdown));
 }
 function wrapMarkdownMailLayout(bodyHtml, options = {}) {
-  const title = escapeHtml(options.title ?? "GetStrata");
-  const preview = escapeHtml(options.preview ?? "");
-  const footer = escapeHtml(options.footer ?? "Sent by GetStrata");
+  const title = escapeHtml2(options.title ?? "GetStrata");
+  const preview = escapeHtml2(options.preview ?? "");
+  const footer = escapeHtml2(options.footer ?? "Sent by GetStrata");
   return `<!DOCTYPE html>
 <html lang="en">
 <head>

package/dist/entries/mail/sanitizeMailHtml.js

@@ -0,0 +1,60 @@
+// @bun
+// ../../src/core/mail/sanitizeMailHtml.ts
+var ALLOWED_TAGS = new Set([
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "strong",
+  "ul"
+]);
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function decodeBasicEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+function isSafeHref(value) {
+  return /^(https?:|mailto:)/i.test(value.trim());
+}
+function sanitizeAttributes(tagName, rawAttributes) {
+  if (tagName !== "a") {
+    return "";
+  }
+  const hrefMatch = rawAttributes.match(/\bhref\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/i);
+  const href = decodeBasicEntities(hrefMatch?.[2] ?? hrefMatch?.[3] ?? hrefMatch?.[4] ?? "");
+  if (!href || !isSafeHref(href)) {
+    return "";
+  }
+  return ` href="${escapeHtml(href)}"`;
+}
+function sanitizeMailHtml(html) {
+  return html.replace(/<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)>/g, (match, tagName, rawAttributes) => {
+    const name = tagName.toLowerCase();
+    if (!ALLOWED_TAGS.has(name)) {
+      return "";
+    }
+    if (match.startsWith("</")) {
+      return `</${name}>`;
+    }
+    if (match.endsWith("/>") || name === "br" || name === "hr") {
+      return `<${name}>`;
+    }
+    return `<${name}${sanitizeAttributes(name, rawAttributes)}>`;
+  });
+}
+export {
+  sanitizeMailHtml
+};

package/dist/entries/openapi/generator.js

@@ -1,7 +1,7 @@
 // @bun
 // ../../src/config/app.ts
 var appConfig = {
-  name: "WorkHub",
+  name: process.env.APP_NAME?.trim() || "WorkHub",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",

package/dist/entries/security/safeFetch.js

@@ -1,7 +1,7 @@
 // @bun
 // ../../src/config/app.ts
 var appConfig = {
-  name: "WorkHub",
+  name: process.env.APP_NAME?.trim() || "WorkHub",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",

package/dist/entries/security/totp.js

@@ -1,6 +1,6 @@
 // @bun
 // ../../src/core/security/totp.ts
-import { createHmac } from "crypto";
+import { createHmac, randomBytes } from "crypto";
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -18,6 +18,34 @@ function decodeBase32(input) {
   }
   return Buffer.from(bytes);
 }
+function encodeBase32(bytes) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  let bits = "";
+  for (const byte of bytes) {
+    bits += byte.toString(2).padStart(8, "0");
+  }
+  let output = "";
+  for (let index = 0;index < bits.length; index += 5) {
+    const chunk = bits.slice(index, index + 5).padEnd(5, "0");
+    output += alphabet[Number.parseInt(chunk, 2)] ?? "";
+  }
+  return output;
+}
+function generateTotpSecret(byteLength = 20) {
+  return encodeBase32(randomBytes(byteLength));
+}
+function buildOtpauthUrl(options) {
+  const issuer = options.issuer?.trim() || process.env.APP_NAME?.trim() || "WorkHub";
+  const label = `${issuer}:${options.account}`;
+  const params = new URLSearchParams({
+    secret: options.secret,
+    issuer,
+    algorithm: "SHA1",
+    digits: "6",
+    period: "30"
+  });
+  return `otpauth://totp/${encodeURIComponent(label)}?${params.toString()}`;
+}
 function generateTotp(secret, counter, digits = 6) {
   const key = decodeBase32(secret);
   const buffer = Buffer.alloc(8);
@@ -46,6 +74,8 @@ function verifyTotp(secret, token, window = 1) {
   return false;
 }
 export {
+  buildOtpauthUrl,
   generateTotp,
+  generateTotpSecret,
   verifyTotp
 };

package/dist/entries/view.js

@@ -524,6 +524,9 @@ function resolveCsrfTokenForRequest(request) {
 import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -538,7 +541,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -588,10 +591,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);