@getstrata/core 0.5.62 → 0.5.63

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/core changelog
 
+## 0.5.63
+
+- Flash cookies honor `FLASH_COOKIE_NAME` (default `workhub_flash`) so sibling apps do not inherit WorkHub’s cookie name.
+
 ## 0.5.62
 
 Laravel URL signing, Bun-native markdown mail, and session-auth cleanup.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.62 && git push origin v0.5.62`
+2. Tag a release: `git tag v0.5.64 && git push origin v0.5.64`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/http/flashSession.d.ts

@@ -1,3 +1,5 @@
+declare const FLASH_COOKIE = "workhub_flash";
+declare function flashCookieName(): string;
 type FlashLevel = "success" | "error" | "info";
 interface FlashMessage {
     level: FlashLevel;
@@ -9,4 +11,4 @@ declare function pullFlash(request: Request): FlashMessage | null;
 declare function flashResponse(response: Response, message: FlashMessage): Response;
 declare function withFlashClear(response: Response): Response;
 export type { FlashLevel, FlashMessage };
-export { clearFlashCookie, createFlashCookie, flashResponse, pullFlash, withFlashClear };
+export { clearFlashCookie, createFlashCookie, FLASH_COOKIE, flashCookieName, flashResponse, pullFlash, withFlashClear, };

package/dist/entries/http/flashMiddleware.js

@@ -3,6 +3,9 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -17,7 +20,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -67,10 +70,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/dist/entries/http/flashSession.js

@@ -3,6 +3,9 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -17,7 +20,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -67,10 +70,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);
@@ -98,8 +101,10 @@ function withFlashClear(response) {
   });
 }
 export {
+  FLASH_COOKIE,
   clearFlashCookie,
   createFlashCookie,
+  flashCookieName,
   flashResponse,
   pullFlash,
   withFlashClear

package/dist/entries/view.js

@@ -524,6 +524,9 @@ function resolveCsrfTokenForRequest(request) {
 import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -538,7 +541,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -588,10 +591,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/dist/index.js

@@ -4660,6 +4660,9 @@ function createCsrfProtection(secret, options = {}) {
 import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -4674,7 +4677,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -4721,7 +4724,7 @@ function parseFlashCookie(cookieValue) {
   }
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.62",
+  "version": "0.5.63",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",