@getstrata/core 0.5.63 → 0.5.65

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -1,269 +1,14 @@
 // @bun
-// ../../src/core/jobs/dispatchWebhookJob.ts
+// ../../src/modules/webhook/dispatchWebhookJob.ts
 import { createHmac } from "crypto";
-import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-class SyncQueue {
-  async dispatch(job, payload) {
-    await job.handle(payload);
-  }
-}
-
-class AsyncQueue {
-  async dispatch(job, payload) {
-    setTimeout(() => {
-      job.handle(payload).catch((error) => {
-        console.error("[AsyncQueue] Job failed:", error);
-      });
-    }, 0);
-  }
-}
-function createQueue(driver) {
-  return driver === "async" ? new AsyncQueue : new SyncQueue;
-}
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/tenant/resolveTenant.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { Job } from "@getstrata/core/queue";
+import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
+import { safeFetch } from "@getstrata/core/security/safeFetch";
+import { assertSafeOutboundUrl } from "@getstrata/core/security/safeUrl";
+import { resolveTenant } from "@getstrata/core/tenant/resolveTenant";
+import { runWithTenantDatabase } from "@getstrata/core/tenant/tenantDatabaseScope";
 
-// ../../src/core/tenant/tenancyConfig.ts
-function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
-}
-function isTenancyEnabled(env = process.env) {
-  return readTenancyDriver(env) !== "none";
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  if (!isTenancyEnabled()) {
-    return {
-      id: tenantId,
-      slug: "default",
-      plan: "free",
-      region: "eu"
-    };
-  }
-  const rows = await db`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-
-// ../../src/core/tenant/tenantContext.ts
-var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
-    return await runWithTenant(tenant, callback);
-  }
-  if (hasActiveDatabaseConnection()) {
-    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection2, tenant.id);
-    return await runWithTenant(tenant, callback);
-  }
-  return await getDefaultDatabasePool().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
-  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
 class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
@@ -280,7 +25,7 @@ class DispatchWebhookJob extends Job {
     }
   }
   async deliver(payload) {
-    const rows = await db2`
+    const rows = await db`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -293,7 +38,7 @@ class DispatchWebhookJob extends Job {
     const body = JSON.stringify({ event: payload.event, payload: payload.payload });
     const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
     const allowHttp = (process.env.APP_ENV ?? "local") !== "production";
-    const signatureHeader = process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || "x-workhub-signature";
+    const signatureHeader = webhookSignatureHeader();
     assertSafeOutboundUrl(webhook.url, { allowHttp });
     let responseStatus = null;
     let errorMessage = null;
@@ -312,7 +57,7 @@ class DispatchWebhookJob extends Job {
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await db2`
+      await db`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -324,7 +69,7 @@ class DispatchWebhookJob extends Job {
       `;
       return error instanceof Error ? error : new Error(errorMessage);
     }
-    await db2`
+    await db`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -153,11 +153,39 @@ async function runWithMigrationBypass(callback) {
   }
 }
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
     timestamp: input.created_at.toISOString(),
-    event_type: "workhub.audit",
+    event_type: siemEventType(),
     actor_user_id: input.user_id,
     tenant_id: input.tenant_id ?? null,
     trace_id: input.trace_id ?? null,
@@ -183,7 +211,7 @@ function formatCefLine(event) {
     `src=${event.ip_address ?? ""}`,
     `request=${event.trace_id ?? ""}`
   ].join(" ");
-  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+  return `CEF:0|${appDisplayName()}|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
 }
 
 // ../../src/core/audit/exportAuditLogs.ts

package/dist/entries/mail/mailer.js

@@ -1,4 +1,32 @@
 // @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {
   const host = process.env.MAIL_HOST?.trim();
@@ -89,7 +117,7 @@ async function defaultSmtpTransport(config, message) {
   const { socket, readResponse } = await openSmtpConnection(config);
   try {
     await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO workhub.local\r
+    await socket.write(`EHLO ${smtpEhloHost()}\r
 `);
     await waitForSmtpResponse(readResponse, ["250"]);
     if (config.username && config.password) {

package/dist/entries/queue/createAppQueue.js

@@ -153,18 +153,57 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/queue/publicQueue.js

@@ -153,18 +153,57 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/queue/queueMetrics.js

@@ -156,18 +156,57 @@ async function runQueueJob(envelope, failedJobs) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {

package/dist/entries/queue/redisQueue.js

@@ -2,6 +2,34 @@
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
   factories = new Map;
@@ -91,18 +119,27 @@ async function runQueueJob(envelope, failedJobs) {
 }
 
 // ../../src/core/queue/redisQueue.ts
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
+function queueListKey() {
+  return namespacedRedisKey("queue:default");
+}
+function queueHighKey() {
+  return namespacedRedisKey("queue:high");
+}
+function queueLowKey() {
+  return namespacedRedisKey("queue:low");
+}
+var QUEUE_LIST_KEY = queueListKey();
+var QUEUE_HIGH_KEY = queueHighKey();
+var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
-      return QUEUE_HIGH_KEY;
+      return queueHighKey();
     case "low":
-      return QUEUE_LOW_KEY;
+      return queueLowKey();
     default:
-      return QUEUE_LIST_KEY;
+      return queueListKey();
   }
 }
 function parseQueueJobEnvelope(rawPayload) {