@getstrata/core 0.5.64 → 0.5.66

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 0.5.66
+
+- `createValidateSignatureMiddleware()` on `@getstrata/core/http/signedUrl` is Laravel’s `signed` / `ValidateSignature` middleware. Invalid or expired links throw `ForbiddenError`.
+
+## 0.5.65
+
+- Identity helpers on `@getstrata/core/runtime/appKeyPrefix` (`smtpEhloHost`, `siemEventType`, `appUserAgent`, `otelServiceName`, `appDisplayName`, `webhookSignatureHeader`) so sibling apps are not stuck with WorkHub SMTP/SIEM/OTEL/OAuth names.
+- SIEM `event_type` and CEF vendor follow `SIEM_EVENT_TYPE` / `APP_NAME` (defaults stay `workhub.audit` / `WorkHub`).
+
 ## 0.5.64
 
 - `APP_KEY_PREFIX` (default `workhub`) namespaces Redis cache, queue, and throttle keys so sibling apps do not share WorkHub’s keyspace.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.66 && git push origin v0.5.66`
+2. Tag a release: `git tag v0.5.68 && git push origin v0.5.68`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/http/signedUrl.d.ts

@@ -1,3 +1,4 @@
+import type { Middleware } from "./middleware";
 interface TemporarySignedUrlOptions {
     expiresInSeconds?: number;
     query?: Record<string, string | number>;
@@ -7,5 +8,6 @@ declare function temporarySignedUrl(path: string, expiresInSeconds: number, quer
 declare function absoluteTemporarySignedUrl(path: string, expiresInSeconds: number, query?: Record<string, string | number>, origin?: string): string;
 declare function hasValidSignature(input: Request | URL | string): boolean;
 declare function assertValidSignature(input: Request | URL | string): void;
+declare function createValidateSignatureMiddleware(): Middleware;
 export type { TemporarySignedUrlOptions };
-export { absoluteTemporarySignedUrl, assertValidSignature, hasValidSignature, signedUrl, temporarySignedUrl, };
+export { absoluteTemporarySignedUrl, assertValidSignature, createValidateSignatureMiddleware, hasValidSignature, signedUrl, temporarySignedUrl, };

package/dist/core/runtime/appKeyPrefix.d.ts

@@ -1,3 +1,9 @@
 declare function appKeyPrefix(): string;
 declare function namespacedRedisKey(kind: string): string;
-export { appKeyPrefix, namespacedRedisKey };
+declare function smtpEhloHost(): string;
+declare function siemEventType(): string;
+declare function appUserAgent(): string;
+declare function otelServiceName(): string;
+declare function webhookSignatureHeader(): string;
+declare function appDisplayName(): string;
+export { appDisplayName, appKeyPrefix, appUserAgent, namespacedRedisKey, otelServiceName, siemEventType, smtpEhloHost, webhookSignatureHeader, };

package/dist/entries/audit/exportAuditLogs.js

@@ -153,11 +153,39 @@ async function runWithMigrationBypass(callback) {
   }
 }
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
     timestamp: input.created_at.toISOString(),
-    event_type: "workhub.audit",
+    event_type: siemEventType(),
     actor_user_id: input.user_id,
     tenant_id: input.tenant_id ?? null,
     trace_id: input.trace_id ?? null,
@@ -183,7 +211,7 @@ function formatCefLine(event) {
     `src=${event.ip_address ?? ""}`,
     `request=${event.trace_id ?? ""}`
   ].join(" ");
-  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+  return `CEF:0|${appDisplayName()}|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
 }
 
 // ../../src/core/audit/exportAuditLogs.ts

package/dist/entries/audit/siemFormatter.js

@@ -1,9 +1,37 @@
 // @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
     timestamp: input.created_at.toISOString(),
-    event_type: "workhub.audit",
+    event_type: siemEventType(),
     actor_user_id: input.user_id,
     tenant_id: input.tenant_id ?? null,
     trace_id: input.trace_id ?? null,
@@ -29,7 +57,7 @@ function formatCefLine(event) {
     `src=${event.ip_address ?? ""}`,
     `request=${event.trace_id ?? ""}`
   ].join(" ");
-  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+  return `CEF:0|${appDisplayName()}|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
 }
 export {
   formatCefLine,

package/dist/entries/auth/oauth/providers.js

@@ -1,4 +1,32 @@
 // @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/auth/oauth/providers.ts
 class GitHubOAuthProvider {
   options;
@@ -37,7 +65,7 @@ class GitHubOAuthProvider {
       headers: {
         authorization: `Bearer ${tokenBody.access_token}`,
         accept: "application/json",
-        "user-agent": "workhub"
+        "user-agent": appUserAgent()
       }
     });
     const profile = await profileResponse.json();

package/dist/entries/auth/oauth/samlProvider.js

@@ -1,4 +1,32 @@
 // @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/auth/oauth/samlProvider.ts
 class SamlProvider {
   loginUrl;
@@ -15,8 +43,8 @@ class SamlProvider {
     }
     const [, email, name] = code.split(":");
     return {
-      providerUserId: email ?? "saml-user",
-      email: email ?? "saml-user@workhub.test",
+      providerUserId: email || "saml-user",
+      email: email || `saml-user@${appKeyPrefix()}.test`,
       name: name ?? "SAML User"
     };
   }

package/dist/entries/cache/createCacheStore.js

@@ -9,6 +9,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/cache/redisCacheStore.ts
 function cacheKeyPrefix() {

package/dist/entries/facades.js

@@ -11,6 +11,34 @@ import {
   resolveApplicationQueue
 } from "@getstrata/core/runtime/applicationRegistry";
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {
   const host = process.env.MAIL_HOST?.trim();
@@ -101,7 +129,7 @@ async function defaultSmtpTransport(config, message) {
   const { socket, readResponse } = await openSmtpConnection(config);
   try {
     await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO workhub.local\r
+    await socket.write(`EHLO ${smtpEhloHost()}\r
 `);
     await waitForSmtpResponse(readResponse, ["250"]);
     if (config.username && config.password) {

package/dist/entries/http/loginThrottleMiddleware.js

@@ -9,6 +9,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -6,6 +6,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/scimThrottleMiddleware.js

@@ -9,6 +9,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/signedUrl.js

@@ -88,9 +88,16 @@ function assertValidSignature(input) {
     throw new ForbiddenError("Invalid or expired signed URL.");
   }
 }
+function createValidateSignatureMiddleware() {
+  return async (request, next) => {
+    assertValidSignature(request);
+    return await next();
+  };
+}
 export {
   absoluteTemporarySignedUrl,
   assertValidSignature,
+  createValidateSignatureMiddleware,
   hasValidSignature,
   signedUrl,
   temporarySignedUrl

package/dist/entries/http/throttleMiddleware.js

@@ -11,6 +11,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -3,6 +3,7 @@
 import { createHmac } from "crypto";
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
 import { Job } from "@getstrata/core/queue";
+import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
 import { safeFetch } from "@getstrata/core/security/safeFetch";
 import { assertSafeOutboundUrl } from "@getstrata/core/security/safeUrl";
 import { resolveTenant } from "@getstrata/core/tenant/resolveTenant";
@@ -37,7 +38,7 @@ class DispatchWebhookJob extends Job {
     const body = JSON.stringify({ event: payload.event, payload: payload.payload });
     const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
     const allowHttp = (process.env.APP_ENV ?? "local") !== "production";
-    const signatureHeader = process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || "x-workhub-signature";
+    const signatureHeader = webhookSignatureHeader();
     assertSafeOutboundUrl(webhook.url, { allowHttp });
     let responseStatus = null;
     let errorMessage = null;

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -153,11 +153,39 @@ async function runWithMigrationBypass(callback) {
   }
 }
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
     timestamp: input.created_at.toISOString(),
-    event_type: "workhub.audit",
+    event_type: siemEventType(),
     actor_user_id: input.user_id,
     tenant_id: input.tenant_id ?? null,
     trace_id: input.trace_id ?? null,
@@ -183,7 +211,7 @@ function formatCefLine(event) {
     `src=${event.ip_address ?? ""}`,
     `request=${event.trace_id ?? ""}`
   ].join(" ");
-  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+  return `CEF:0|${appDisplayName()}|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
 }
 
 // ../../src/core/audit/exportAuditLogs.ts

package/dist/entries/mail/mailer.js

@@ -1,4 +1,32 @@
 // @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {
   const host = process.env.MAIL_HOST?.trim();
@@ -89,7 +117,7 @@ async function defaultSmtpTransport(config, message) {
   const { socket, readResponse } = await openSmtpConnection(config);
   try {
     await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO workhub.local\r
+    await socket.write(`EHLO ${smtpEhloHost()}\r
 `);
     await waitForSmtpResponse(readResponse, ["250"]);
     if (config.username && config.password) {

package/dist/entries/queue/createAppQueue.js

@@ -161,6 +161,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/queue/redisQueue.ts
 function queueListKey() {

package/dist/entries/queue/publicQueue.js

@@ -161,6 +161,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/queue/redisQueue.ts
 function queueListKey() {

package/dist/entries/queue/queueMetrics.js

@@ -164,6 +164,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/queue/redisQueue.ts
 function queueListKey() {

package/dist/entries/queue/redisQueue.js

@@ -9,6 +9,26 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {

package/dist/entries/runtime/appKeyPrefix.js

@@ -0,0 +1,38 @@
+// @bun
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+export {
+  appDisplayName,
+  appKeyPrefix,
+  appUserAgent,
+  namespacedRedisKey,
+  otelServiceName,
+  siemEventType,
+  smtpEhloHost,
+  webhookSignatureHeader
+};

package/dist/entries/tracing/tracingMiddleware.js

@@ -1,6 +1,36 @@
 // @bun
 // ../../src/core/tracing/otel.ts
 import { randomBytes } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+
+// ../../src/core/tracing/otel.ts
 function randomHex(bytes) {
   return randomBytes(bytes).toString("hex");
 }
@@ -24,7 +54,7 @@ async function exportOtelSpan(span) {
   if (!endpoint) {
     return;
   }
-  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const serviceName = otelServiceName();
   const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
   await fetch(url, {
     method: "POST",

package/dist/framework/public-api.d.ts

@@ -83,7 +83,7 @@ export type { RouteRequest } from "../core/http/route.ts";
 export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath, } from "../core/http/safeInternalPath.ts";
 export { createScimThrottleMiddleware } from "../core/http/scimThrottleMiddleware.ts";
 export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMiddleware.ts";
-export { absoluteTemporarySignedUrl, assertValidSignature, hasValidSignature, signedUrl, temporarySignedUrl, } from "../core/http/signedUrl.ts";
+export { absoluteTemporarySignedUrl, assertValidSignature, createValidateSignatureMiddleware, hasValidSignature, signedUrl, temporarySignedUrl, } from "../core/http/signedUrl.ts";
 export { createThrottleMiddleware } from "../core/http/throttleMiddleware.ts";
 export { WebFormRequest } from "../core/http/webFormRequest.ts";
 export { installGracefulShutdownSignals, registerShutdownHandler, runGracefulShutdown, } from "../core/lifecycle/gracefulShutdown.ts";

package/dist/index.js

@@ -974,6 +974,14 @@ function appKeyPrefix() {
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
 
 // ../../src/core/cache/redisCacheStore.ts
 function cacheKeyPrefix() {
@@ -3894,7 +3902,7 @@ async function defaultSmtpTransport(config, message) {
   const { socket, readResponse } = await openSmtpConnection(config);
   try {
     await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO workhub.local\r
+    await socket.write(`EHLO ${smtpEhloHost()}\r
 `);
     await waitForSmtpResponse(readResponse, ["250"]);
     if (config.username && config.password) {
@@ -5782,6 +5790,12 @@ function assertValidSignature(input) {
     throw new ForbiddenError("Invalid or expired signed URL.");
   }
 }
+function createValidateSignatureMiddleware() {
+  return async (request, next) => {
+    assertValidSignature(request);
+    return await next();
+  };
+}
 // ../../src/core/http/throttleMiddleware.ts
 var {RedisClient: RedisClient4 } = globalThis.Bun;
 function resolveThrottleIdentity(request) {
@@ -6693,7 +6707,7 @@ async function exportOtelSpan(span) {
   if (!endpoint) {
     return;
   }
-  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const serviceName = otelServiceName();
   const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
   await fetch(url, {
     method: "POST",
@@ -7215,6 +7229,7 @@ export {
   createThrottleMiddleware,
   createTracingMiddleware,
   createTrackedJob,
+  createValidateSignatureMiddleware,
   createdResponse,
   currentAuthUser,
   currentOrgRole,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.64",
+  "version": "0.5.66",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -665,6 +665,11 @@
       "import": "./dist/entries/queue/types.js",
       "default": "./dist/entries/queue/types.js"
     },
+    "./runtime/appKeyPrefix": {
+      "types": "./dist/core/runtime/appKeyPrefix.d.ts",
+      "import": "./dist/entries/runtime/appKeyPrefix.js",
+      "default": "./dist/entries/runtime/appKeyPrefix.js"
+    },
     "./runtime/applicationRegistry": {
       "types": "./dist/core/runtime/applicationRegistry.d.ts",
       "import": "./dist/entries/runtime/applicationRegistry.js",
@@ -803,7 +808,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/model.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/loginThrottleMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/validation.ts entries/jobs/dispatchWebhookJob.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/lifecycle/gracefulShutdown.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/asyncContextStore.ts entries/scheduler/schedule.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeFetch.ts entries/security/safeUrl.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/model.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/loginThrottleMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/validation.ts entries/jobs/dispatchWebhookJob.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/lifecycle/gracefulShutdown.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appKeyPrefix.ts entries/runtime/asyncContextStore.ts entries/scheduler/schedule.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeFetch.ts entries/security/safeUrl.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {