@getstrata/core 0.5.62 → 0.5.64

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 0.5.64
+
+- `APP_KEY_PREFIX` (default `workhub`) namespaces Redis cache, queue, and throttle keys so sibling apps do not share WorkHub’s keyspace.
+- `DispatchWebhookJob` implementation lives in the WorkHub webhook module. `@getstrata/core/jobs/dispatchWebhookJob` remains a compatibility re-export.
+
+## 0.5.63
+
+- Flash cookies honor `FLASH_COOKIE_NAME` (default `workhub_flash`) so sibling apps do not inherit WorkHub’s cookie name.
+
 ## 0.5.62
 
 Laravel URL signing, Bun-native markdown mail, and session-auth cleanup.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.62 && git push origin v0.5.62`
+2. Tag a release: `git tag v0.5.66 && git push origin v0.5.66`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/http/flashSession.d.ts

@@ -1,3 +1,5 @@
+declare const FLASH_COOKIE = "workhub_flash";
+declare function flashCookieName(): string;
 type FlashLevel = "success" | "error" | "info";
 interface FlashMessage {
     level: FlashLevel;
@@ -9,4 +11,4 @@ declare function pullFlash(request: Request): FlashMessage | null;
 declare function flashResponse(response: Response, message: FlashMessage): Response;
 declare function withFlashClear(response: Response): Response;
 export type { FlashLevel, FlashMessage };
-export { clearFlashCookie, createFlashCookie, flashResponse, pullFlash, withFlashClear };
+export { clearFlashCookie, createFlashCookie, FLASH_COOKIE, flashCookieName, flashResponse, pullFlash, withFlashClear, };

package/dist/core/jobs/dispatchWebhookJob.d.ts

@@ -1,16 +1 @@
-import { Job } from "../queue";
-interface DispatchWebhookPayload {
-    webhookId: number;
-    tenantId: number;
-    event: string;
-    payload: Record<string, unknown>;
-}
-declare class DispatchWebhookJob extends Job<DispatchWebhookPayload> {
-    readonly maxAttempts = 3;
-    readonly backoffMs = 2000;
-    handle(payload: DispatchWebhookPayload): Promise<void>;
-    private deliver;
-}
-export { DispatchWebhookJob };
-export default DispatchWebhookJob;
-export type { DispatchWebhookPayload };
+export { DispatchWebhookJob, type DispatchWebhookPayload, default, } from "../../modules/webhook/dispatchWebhookJob";

package/dist/core/queue/redisQueue.d.ts

@@ -1,9 +1,9 @@
 import type FailedJobService from "./failedJobService";
 import type { Job, Queue, QueuePriority } from "./index";
 import { type QueueJobEnvelope } from "./jobRunner";
-declare const QUEUE_LIST_KEY = "workhub:queue:default";
-declare const QUEUE_HIGH_KEY = "workhub:queue:high";
-declare const QUEUE_LOW_KEY = "workhub:queue:low";
+declare const QUEUE_LIST_KEY: string;
+declare const QUEUE_HIGH_KEY: string;
+declare const QUEUE_LOW_KEY: string;
 declare function queueKeyForPriority(priority?: QueuePriority): string;
 declare function parseQueueJobEnvelope(rawPayload: string): QueueJobEnvelope | null;
 declare class RedisQueue implements Queue {

package/dist/core/runtime/appKeyPrefix.d.ts

@@ -0,0 +1,3 @@
+declare function appKeyPrefix(): string;
+declare function namespacedRedisKey(kind: string): string;
+export { appKeyPrefix, namespacedRedisKey };

package/dist/entries/cache/createCacheStore.js

@@ -1,8 +1,22 @@
 // @bun
 // ../../src/core/cache/redisCacheStore.ts
 var {RedisClient } = globalThis.Bun;
-var KEY_PREFIX = "workhub:cache:";
-var TAG_PREFIX = "workhub:cache:tag:";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
+// ../../src/core/cache/redisCacheStore.ts
+function cacheKeyPrefix() {
+  return namespacedRedisKey("cache:");
+}
+function cacheTagPrefix() {
+  return namespacedRedisKey("cache:tag:");
+}
 
 class RedisCacheStore {
   ttlMs;
@@ -89,10 +103,10 @@ class RedisCacheStore {
     return deleted > 0;
   }
   async invalidateByPrefix(prefix) {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     let removed = 0;
     for (const storageKey of keys) {
-      const key = storageKey.slice(KEY_PREFIX.length);
+      const key = storageKey.slice(cacheKeyPrefix().length);
       if (key === prefix || key.startsWith(`${prefix}?`)) {
         if (await this.invalidate(key)) {
           removed += 1;
@@ -102,11 +116,11 @@ class RedisCacheStore {
     return removed;
   }
   async clear() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     if (keys.length > 0) {
       await this.client.del(...keys);
     }
-    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
+    const tagKeys = await this.client.keys(`${cacheTagPrefix()}*`);
     if (tagKeys.length > 0) {
       await this.client.del(...tagKeys);
     }
@@ -114,14 +128,14 @@ class RedisCacheStore {
     this.keyTags.clear();
   }
   async size() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     return keys.length;
   }
   storageKey(key) {
-    return `${KEY_PREFIX}${key}`;
+    return `${cacheKeyPrefix()}${key}`;
   }
   tagKey(tag) {
-    return `${TAG_PREFIX}${tag}`;
+    return `${cacheTagPrefix()}${tag}`;
   }
   async detachKeyFromTags(key) {
     const tags = this.keyTags.get(key);
@@ -134,7 +148,7 @@ class RedisCacheStore {
     this.keyTags.delete(key);
   }
   async enforceMaxEntries() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     if (keys.length <= this.maxEntries) {
       return;
     }

package/dist/entries/http/flashMiddleware.js

@@ -3,6 +3,9 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -17,7 +20,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -67,10 +70,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/dist/entries/http/flashSession.js

@@ -3,6 +3,9 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -17,7 +20,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -67,10 +70,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);
@@ -98,8 +101,10 @@ function withFlashClear(response) {
   });
 }
 export {
+  FLASH_COOKIE,
   clearFlashCookie,
   createFlashCookie,
+  flashCookieName,
   flashResponse,
   pullFlash,
   withFlashClear

package/dist/entries/http/loginThrottleMiddleware.js

@@ -2,6 +2,14 @@
 // ../../src/core/http/loginThrottleMiddleware.ts
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
@@ -37,7 +45,7 @@ async function resolveLoginEmail(request) {
 }
 function createLoginThrottleMiddleware(options) {
   const client = new RedisClient(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
+  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
   return async (request, next) => {
     const identity = resolveLoginIdentity(request);
     const email = await resolveLoginEmail(request);

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -1,4 +1,12 @@
 // @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
@@ -17,7 +25,7 @@ function readClientIp(request, env = process.env) {
 // ../../src/core/http/memoryThrottleMiddleware.ts
 var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
+  const prefix = options.keyPrefix ?? namespacedRedisKey("memory-throttle:");
   const buckets = new Map;
   throttleBucketRegistries.add(buckets);
   return async (request, next) => {

package/dist/entries/http/scimThrottleMiddleware.js

@@ -2,6 +2,14 @@
 // ../../src/core/http/scimThrottleMiddleware.ts
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
@@ -39,7 +47,7 @@ function createScimThrottleMiddleware(options) {
   const client = options.redisUrl ? new RedisClient(options.redisUrl) : null;
   return async (request, next) => {
     const identity = resolveScimIdentity(request);
-    const key = `workhub:scim-throttle:${identity}`;
+    const key = `${namespacedRedisKey("scim-throttle:")}${identity}`;
     if (client) {
       const attempts = Number(await client.incr(key));
       if (attempts === 1) {

package/dist/entries/http/throttleMiddleware.js

@@ -4,6 +4,14 @@ import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentTenant, rateLimitMultiplierForPlan } from "@getstrata/core/tenant/tenantContext";
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
@@ -32,7 +40,7 @@ function resolveThrottleIdentity(request) {
 }
 function createThrottleMiddleware(options) {
   const client = new RedisClient(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  const prefix = options.keyPrefix ?? namespacedRedisKey("throttle:");
   return async (request, next) => {
     const identity = resolveThrottleIdentity(request);
     const path = new URL(request.url).pathname;

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -1,269 +1,13 @@
 // @bun
-// ../../src/core/jobs/dispatchWebhookJob.ts
+// ../../src/modules/webhook/dispatchWebhookJob.ts
 import { createHmac } from "crypto";
-import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-class SyncQueue {
-  async dispatch(job, payload) {
-    await job.handle(payload);
-  }
-}
-
-class AsyncQueue {
-  async dispatch(job, payload) {
-    setTimeout(() => {
-      job.handle(payload).catch((error) => {
-        console.error("[AsyncQueue] Job failed:", error);
-      });
-    }, 0);
-  }
-}
-function createQueue(driver) {
-  return driver === "async" ? new AsyncQueue : new SyncQueue;
-}
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/tenant/resolveTenant.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { Job } from "@getstrata/core/queue";
+import { safeFetch } from "@getstrata/core/security/safeFetch";
+import { assertSafeOutboundUrl } from "@getstrata/core/security/safeUrl";
+import { resolveTenant } from "@getstrata/core/tenant/resolveTenant";
+import { runWithTenantDatabase } from "@getstrata/core/tenant/tenantDatabaseScope";
 
-// ../../src/core/tenant/tenancyConfig.ts
-function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
-}
-function isTenancyEnabled(env = process.env) {
-  return readTenancyDriver(env) !== "none";
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  if (!isTenancyEnabled()) {
-    return {
-      id: tenantId,
-      slug: "default",
-      plan: "free",
-      region: "eu"
-    };
-  }
-  const rows = await db`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-
-// ../../src/core/tenant/tenantContext.ts
-var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
-    return await runWithTenant(tenant, callback);
-  }
-  if (hasActiveDatabaseConnection()) {
-    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection2, tenant.id);
-    return await runWithTenant(tenant, callback);
-  }
-  return await getDefaultDatabasePool().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
-  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
 class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
@@ -280,7 +24,7 @@ class DispatchWebhookJob extends Job {
     }
   }
   async deliver(payload) {
-    const rows = await db2`
+    const rows = await db`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -312,7 +56,7 @@ class DispatchWebhookJob extends Job {
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await db2`
+      await db`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -324,7 +68,7 @@ class DispatchWebhookJob extends Job {
       `;
       return error instanceof Error ? error : new Error(errorMessage);
     }
-    await db2`
+    await db`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},

package/dist/entries/queue/createAppQueue.js

@@ -153,18 +153,37 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/queue/publicQueue.js

@@ -153,18 +153,37 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/queue/queueMetrics.js

@@ -156,18 +156,37 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/queue/redisQueue.js

@@ -2,6 +2,14 @@
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
   factories = new Map;
@@ -91,18 +99,27 @@ async function runQueueJob(envelope, failedJobs) {
 }
 
 // ../../src/core/queue/redisQueue.ts
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/view.js

@@ -524,6 +524,9 @@ function resolveCsrfTokenForRequest(request) {
 import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -538,7 +541,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -588,10 +591,10 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/dist/index.js

@@ -966,8 +966,22 @@ function jsonScimError(detail, status) {
 }
 // ../../src/core/cache/redisCacheStore.ts
 var {RedisClient } = globalThis.Bun;
-var KEY_PREFIX = "workhub:cache:";
-var TAG_PREFIX = "workhub:cache:tag:";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+
+// ../../src/core/cache/redisCacheStore.ts
+function cacheKeyPrefix() {
+  return namespacedRedisKey("cache:");
+}
+function cacheTagPrefix() {
+  return namespacedRedisKey("cache:tag:");
+}
 
 class RedisCacheStore {
   ttlMs;
@@ -1054,10 +1068,10 @@ class RedisCacheStore {
     return deleted > 0;
   }
   async invalidateByPrefix(prefix) {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     let removed = 0;
     for (const storageKey of keys) {
-      const key = storageKey.slice(KEY_PREFIX.length);
+      const key = storageKey.slice(cacheKeyPrefix().length);
       if (key === prefix || key.startsWith(`${prefix}?`)) {
         if (await this.invalidate(key)) {
           removed += 1;
@@ -1067,11 +1081,11 @@ class RedisCacheStore {
     return removed;
   }
   async clear() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     if (keys.length > 0) {
       await this.client.del(...keys);
     }
-    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
+    const tagKeys = await this.client.keys(`${cacheTagPrefix()}*`);
     if (tagKeys.length > 0) {
       await this.client.del(...tagKeys);
     }
@@ -1079,14 +1093,14 @@ class RedisCacheStore {
     this.keyTags.clear();
   }
   async size() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     return keys.length;
   }
   storageKey(key) {
-    return `${KEY_PREFIX}${key}`;
+    return `${cacheKeyPrefix()}${key}`;
   }
   tagKey(tag) {
-    return `${TAG_PREFIX}${tag}`;
+    return `${cacheTagPrefix()}${tag}`;
   }
   async detachKeyFromTags(key) {
     const tags = this.keyTags.get(key);
@@ -1099,7 +1113,7 @@ class RedisCacheStore {
     this.keyTags.delete(key);
   }
   async enforceMaxEntries() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
     if (keys.length <= this.maxEntries) {
       return;
     }
@@ -4660,6 +4674,9 @@ function createCsrfProtection(secret, options = {}) {
 import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || FLASH_COOKIE;
+}
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
@@ -4674,7 +4691,7 @@ function readFlashCookie(request) {
   }
   for (const part of cookieHeader.split(";")) {
     const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
+    if (name === flashCookieName()) {
       return decodeURIComponent(rest.join("="));
     }
   }
@@ -4721,7 +4738,7 @@ function parseFlashCookie(cookieValue) {
   }
 }
 function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);
@@ -5398,7 +5415,7 @@ async function resolveLoginEmail(request) {
 }
 function createLoginThrottleMiddleware(options) {
   const client = new RedisClient2(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
+  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
   return async (request, next) => {
     const identity = resolveLoginIdentity(request);
     const email = await resolveLoginEmail(request);
@@ -5421,7 +5438,7 @@ function createLoginThrottleMiddleware(options) {
 // ../../src/core/http/memoryThrottleMiddleware.ts
 var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
+  const prefix = options.keyPrefix ?? namespacedRedisKey("memory-throttle:");
   const buckets = new Map;
   throttleBucketRegistries.add(buckets);
   return async (request, next) => {
@@ -5623,7 +5640,7 @@ function createScimThrottleMiddleware(options) {
   const client = options.redisUrl ? new RedisClient3(options.redisUrl) : null;
   return async (request, next) => {
     const identity = resolveScimIdentity(request);
-    const key = `workhub:scim-throttle:${identity}`;
+    const key = `${namespacedRedisKey("scim-throttle:")}${identity}`;
     if (client) {
       const attempts = Number(await client.incr(key));
       if (attempts === 1) {
@@ -5779,7 +5796,7 @@ function resolveThrottleIdentity(request) {
 }
 function createThrottleMiddleware(options) {
   const client = new RedisClient4(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  const prefix = options.keyPrefix ?? namespacedRedisKey("throttle:");
   return async (request, next) => {
     const identity = resolveThrottleIdentity(request);
     const path = new URL(request.url).pathname;
@@ -6260,18 +6277,27 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient: RedisClient5 } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/modules/webhook/dispatchWebhookJob.d.ts

@@ -0,0 +1,16 @@
+import { Job } from "@getstrata/core/queue";
+interface DispatchWebhookPayload {
+    webhookId: number;
+    tenantId: number;
+    event: string;
+    payload: Record<string, unknown>;
+}
+declare class DispatchWebhookJob extends Job<DispatchWebhookPayload> {
+    readonly maxAttempts = 3;
+    readonly backoffMs = 2000;
+    handle(payload: DispatchWebhookPayload): Promise<void>;
+    private deliver;
+}
+export { DispatchWebhookJob };
+export default DispatchWebhookJob;
+export type { DispatchWebhookPayload };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.62",
+  "version": "0.5.64",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",