@getstrata/core 0.5.65 → 0.5.67

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 0.5.67
+
+- OpenAPI title, server URLs, and generated SDK class name come from `APP_NAME` / `APP_URL` / `API_PREFIX` / `APP_SDK_CLASS` instead of importing WorkHub `src/config/app`.
+- `appEnv()`, `appUrl()`, `apiPrefix()`, and `sdkClientClassName()` live on `@getstrata/core/runtime/appKeyPrefix`. SIEM export, HSTS, and `safeFetch` DNS resolve use `appEnv()` instead of WorkHub `appConfig`.
+
+## 0.5.66
+
+- `createValidateSignatureMiddleware()` on `@getstrata/core/http/signedUrl` is Laravel’s `signed` / `ValidateSignature` middleware. Invalid or expired links throw `ForbiddenError`.
+
 ## 0.5.65
 
 - Identity helpers on `@getstrata/core/runtime/appKeyPrefix` (`smtpEhloHost`, `siemEventType`, `appUserAgent`, `otelServiceName`, `appDisplayName`, `webhookSignatureHeader`) so sibling apps are not stuck with WorkHub SMTP/SIEM/OTEL/OAuth names.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.67 && git push origin v0.5.67`
+2. Tag a release: `git tag v0.5.69 && git push origin v0.5.69`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/http/signedUrl.d.ts

@@ -1,3 +1,4 @@
+import type { Middleware } from "./middleware";
 interface TemporarySignedUrlOptions {
     expiresInSeconds?: number;
     query?: Record<string, string | number>;
@@ -7,5 +8,6 @@ declare function temporarySignedUrl(path: string, expiresInSeconds: number, quer
 declare function absoluteTemporarySignedUrl(path: string, expiresInSeconds: number, query?: Record<string, string | number>, origin?: string): string;
 declare function hasValidSignature(input: Request | URL | string): boolean;
 declare function assertValidSignature(input: Request | URL | string): void;
+declare function createValidateSignatureMiddleware(): Middleware;
 export type { TemporarySignedUrlOptions };
-export { absoluteTemporarySignedUrl, assertValidSignature, hasValidSignature, signedUrl, temporarySignedUrl, };
+export { absoluteTemporarySignedUrl, assertValidSignature, createValidateSignatureMiddleware, hasValidSignature, signedUrl, temporarySignedUrl, };

package/dist/core/openapi/generator.d.ts

@@ -1,4 +1,4 @@
-import type { RegisteredRoute } from "../openapi/registeredRoute";
+import type { RegisteredRoute } from "./registeredRoute";
 interface OpenApiSpec {
     openapi: string;
     info: {
@@ -17,6 +17,6 @@ interface OpenApiSpec {
 }
 declare function generateOpenApiSpec(routes: RegisteredRoute[]): OpenApiSpec;
 declare function renderOpenApiDocument(spec: OpenApiSpec): string;
-declare function renderTypeScriptSdk(spec: OpenApiSpec, apiPrefix?: string): string;
+declare function renderTypeScriptSdk(spec: OpenApiSpec, prefix?: string): string;
 export type { OpenApiSpec };
 export { generateOpenApiSpec, renderOpenApiDocument, renderTypeScriptSdk };

package/dist/core/runtime/appKeyPrefix.d.ts

@@ -6,4 +6,8 @@ declare function appUserAgent(): string;
 declare function otelServiceName(): string;
 declare function webhookSignatureHeader(): string;
 declare function appDisplayName(): string;
-export { appDisplayName, appKeyPrefix, appUserAgent, namespacedRedisKey, otelServiceName, siemEventType, smtpEhloHost, webhookSignatureHeader, };
+declare function appEnv(): string;
+declare function appUrl(): string;
+declare function apiPrefix(): string;
+declare function sdkClientClassName(): string;
+export { apiPrefix, appDisplayName, appEnv, appKeyPrefix, appUrl, appUserAgent, namespacedRedisKey, otelServiceName, sdkClientClassName, siemEventType, smtpEhloHost, webhookSignatureHeader, };

package/dist/entries/audit/exportAuditLogs.js

@@ -2,14 +2,53 @@
 // ../../src/core/audit/exportAuditLogs.ts
 import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/security/safeUrl.ts
 import { lookup as dnsLookupImpl } from "dns/promises";
@@ -113,7 +152,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function safeFetch(input, init = {}, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const resolveDns = options.resolveDns ?? appEnv() === "production";
   const urlOptions = { allowHttp: options.allowHttp, resolveDns };
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -153,34 +192,6 @@ async function runWithMigrationBypass(callback) {
   }
 }
 
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
-}
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
-}
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "WorkHub";
-}
-
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
@@ -220,7 +231,7 @@ function resolveAuditExportConfig() {
   if (!endpoint) {
     return null;
   }
-  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
+  assertSafeOutboundUrl(endpoint, { allowHttp: appEnv() !== "production" });
   const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
   return {
     endpoint,
@@ -278,7 +289,7 @@ async function exportPendingAuditLogs() {
         ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
       },
       body
-    }, { allowHttp: appConfig.env !== "production" });
+    }, { allowHttp: appEnv() !== "production" });
     if (!response.ok) {
       throw new Error(`SIEM export failed with status ${response.status}.`);
     }

package/dist/entries/audit/siemFormatter.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {

package/dist/entries/auth/oauth/providers.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/auth/oauth/providers.ts
 class GitHubOAuthProvider {

package/dist/entries/auth/oauth/samlProvider.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/auth/oauth/samlProvider.ts
 class SamlProvider {

package/dist/entries/cache/createCacheStore.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/cache/redisCacheStore.ts
 function cacheKeyPrefix() {

package/dist/entries/facades.js

@@ -38,6 +38,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {

package/dist/entries/http/loginThrottleMiddleware.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/scimThrottleMiddleware.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/securityHeadersMiddleware.js

@@ -7,14 +7,53 @@ import {
 } from "@getstrata/core/http/contentSecurityPolicy";
 import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/securityHeadersMiddleware.ts
 function createSecurityHeadersMiddleware(options = {}) {
@@ -33,7 +72,7 @@ function createSecurityHeadersMiddleware(options = {}) {
       headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
       headers.set("X-XSS-Protection", "0");
       headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response, { ...options, nonce }));
-      if (appConfig.env === "production") {
+      if (appEnv() === "production") {
         headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
       }
       return new Response(response.body, {

package/dist/entries/http/signedUrl.js

@@ -88,9 +88,16 @@ function assertValidSignature(input) {
     throw new ForbiddenError("Invalid or expired signed URL.");
   }
 }
+function createValidateSignatureMiddleware() {
+  return async (request, next) => {
+    assertValidSignature(request);
+    return await next();
+  };
+}
 export {
   absoluteTemporarySignedUrl,
   assertValidSignature,
+  createValidateSignatureMiddleware,
   hasValidSignature,
   signedUrl,
   temporarySignedUrl

package/dist/entries/http/throttleMiddleware.js

@@ -31,6 +31,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -2,14 +2,53 @@
 // ../../src/core/audit/exportAuditLogs.ts
 import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/security/safeUrl.ts
 import { lookup as dnsLookupImpl } from "dns/promises";
@@ -113,7 +152,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function safeFetch(input, init = {}, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const resolveDns = options.resolveDns ?? appEnv() === "production";
   const urlOptions = { allowHttp: options.allowHttp, resolveDns };
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -153,34 +192,6 @@ async function runWithMigrationBypass(callback) {
   }
 }
 
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
-}
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
-}
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "WorkHub";
-}
-
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
@@ -220,7 +231,7 @@ function resolveAuditExportConfig() {
   if (!endpoint) {
     return null;
   }
-  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
+  assertSafeOutboundUrl(endpoint, { allowHttp: appEnv() !== "production" });
   const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
   return {
     endpoint,
@@ -278,7 +289,7 @@ async function exportPendingAuditLogs() {
         ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
       },
       body
-    }, { allowHttp: appConfig.env !== "production" });
+    }, { allowHttp: appEnv() !== "production" });
     if (!response.ok) {
       throw new Error(`SIEM export failed with status ${response.status}.`);
     }

package/dist/entries/mail/mailer.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {

package/dist/entries/openapi/generator.js

@@ -1,12 +1,51 @@
 // @bun
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/openapi/generator.ts
 var PUBLIC_ROUTE_DESCRIPTIONS = {
@@ -84,12 +123,12 @@ function generateOpenApiSpec(routes) {
   return {
     openapi: "3.1.0",
     info: {
-      title: "WorkHub API",
+      title: `${appDisplayName()} API`,
       version: "1.0.0"
     },
     servers: [
-      { url: `${appConfig.url}${appConfig.apiPrefix}`, description: "WorkHub API" },
-      { url: appConfig.url, description: "Root (health, metrics, SCIM)" }
+      { url: `${appUrl()}${apiPrefix()}`, description: `${appDisplayName()} API` },
+      { url: appUrl(), description: "Root (health, metrics, SCIM)" }
     ],
     paths,
     components: {
@@ -142,17 +181,17 @@ function renderOpenApiDocument(spec) {
   return `${JSON.stringify(spec, null, 2)}
 `;
 }
-function toMethodName(method, path, apiPrefix) {
-  const relativePath = path.startsWith(apiPrefix) ? path.slice(apiPrefix.length) || "/" : path;
+function toMethodName(method, path, apiPrefix2) {
+  const relativePath = path.startsWith(apiPrefix2) ? path.slice(apiPrefix2.length) || "/" : path;
   const segments = relativePath.replace(/\{|\}/g, "").split("/").filter(Boolean).flatMap((segment) => segment.split("-")).map((segment) => segment.replace(/[^a-zA-Z0-9]/g, "")).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1));
   return `${method.toLowerCase()}${segments.join("")}`;
 }
-function toRequestPath(path, apiPrefix) {
-  return path.startsWith(apiPrefix) ? path.slice(apiPrefix.length) || "/" : path;
+function toRequestPath(path, apiPrefix2) {
+  return path.startsWith(apiPrefix2) ? path.slice(apiPrefix2.length) || "/" : path;
 }
-function renderTypeScriptSdk(spec, apiPrefix = "/api/v1") {
+function renderTypeScriptSdk(spec, prefix = apiPrefix()) {
   const lines = [
-    "export class WorkHubClient {",
+    `export class ${sdkClientClassName()} {`,
     `  constructor(private readonly baseUrl = "${spec.servers[0]?.url ?? ""}") {}`,
     "",
     "  private async request(path: string, init: RequestInit = {}): Promise<Response> {",
@@ -161,9 +200,9 @@ function renderTypeScriptSdk(spec, apiPrefix = "/api/v1") {
     ""
   ];
   for (const [path, methods] of Object.entries(spec.paths)) {
-    const requestPath = toRequestPath(path, apiPrefix);
+    const requestPath = toRequestPath(path, prefix);
     for (const method of Object.keys(methods)) {
-      const functionName = toMethodName(method, path, apiPrefix);
+      const functionName = toMethodName(method, path, prefix);
       lines.push(`  async ${functionName}(init: RequestInit = {}): Promise<Response> {`, `    return await this.request("${requestPath}", { ...init, method: "${method.toUpperCase()}" });`, "  }", "");
     }
   }

package/dist/entries/queue/createAppQueue.js

@@ -181,6 +181,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/queue/redisQueue.ts
 function queueListKey() {

package/dist/entries/queue/publicQueue.js

@@ -181,6 +181,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/queue/redisQueue.ts
 function queueListKey() {

package/dist/entries/queue/queueMetrics.js

@@ -184,6 +184,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/queue/redisQueue.ts
 function queueListKey() {

package/dist/entries/queue/redisQueue.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {

package/dist/entries/runtime/appKeyPrefix.js

@@ -26,12 +26,36 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 export {
+  apiPrefix,
   appDisplayName,
+  appEnv,
   appKeyPrefix,
+  appUrl,
   appUserAgent,
   namespacedRedisKey,
   otelServiceName,
+  sdkClientClassName,
   siemEventType,
   smtpEhloHost,
   webhookSignatureHeader

package/dist/entries/security/safeFetch.js

@@ -1,12 +1,51 @@
 // @bun
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/security/safeUrl.ts
 import { lookup as dnsLookupImpl } from "dns/promises";
@@ -110,7 +149,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function safeFetch(input, init = {}, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const resolveDns = options.resolveDns ?? appEnv() === "production";
   const urlOptions = { allowHttp: options.allowHttp, resolveDns };
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);

package/dist/entries/tracing/tracingMiddleware.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/tracing/otel.ts
 function randomHex(bytes) {

package/dist/framework/public-api.d.ts

@@ -83,7 +83,7 @@ export type { RouteRequest } from "../core/http/route.ts";
 export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath, } from "../core/http/safeInternalPath.ts";
 export { createScimThrottleMiddleware } from "../core/http/scimThrottleMiddleware.ts";
 export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMiddleware.ts";
-export { absoluteTemporarySignedUrl, assertValidSignature, hasValidSignature, signedUrl, temporarySignedUrl, } from "../core/http/signedUrl.ts";
+export { absoluteTemporarySignedUrl, assertValidSignature, createValidateSignatureMiddleware, hasValidSignature, signedUrl, temporarySignedUrl, } from "../core/http/signedUrl.ts";
 export { createThrottleMiddleware } from "../core/http/throttleMiddleware.ts";
 export { WebFormRequest } from "../core/http/webFormRequest.ts";
 export { installGracefulShutdownSignals, registerShutdownHandler, runGracefulShutdown, } from "../core/lifecycle/gracefulShutdown.ts";

package/dist/index.js

@@ -982,6 +982,9 @@ function smtpEhloHost() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
 
 // ../../src/core/cache/redisCacheStore.ts
 function cacheKeyPrefix() {
@@ -5666,15 +5669,6 @@ function createScimThrottleMiddleware(options) {
     return await next();
   };
 }
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
 // ../../src/core/http/securityHeadersMiddleware.ts
 function createSecurityHeadersMiddleware(options = {}) {
   return async (request, next) => {
@@ -5692,7 +5686,7 @@ function createSecurityHeadersMiddleware(options = {}) {
       headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
       headers.set("X-XSS-Protection", "0");
       headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response, { ...options, nonce }));
-      if (appConfig.env === "production") {
+      if (appEnv() === "production") {
         headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
       }
       return new Response(response.body, {
@@ -5790,6 +5784,12 @@ function assertValidSignature(input) {
     throw new ForbiddenError("Invalid or expired signed URL.");
   }
 }
+function createValidateSignatureMiddleware() {
+  return async (request, next) => {
+    assertValidSignature(request);
+    return await next();
+  };
+}
 // ../../src/core/http/throttleMiddleware.ts
 var {RedisClient: RedisClient4 } = globalThis.Bun;
 function resolveThrottleIdentity(request) {
@@ -7223,6 +7223,7 @@ export {
   createThrottleMiddleware,
   createTracingMiddleware,
   createTrackedJob,
+  createValidateSignatureMiddleware,
   createdResponse,
   currentAuthUser,
   currentOrgRole,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.65",
+  "version": "0.5.67",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",

package/dist/config/app.d.ts

@@ -1,10 +0,0 @@
-interface AppConfig {
-    name: string;
-    env: string;
-    debug: boolean;
-    url: string;
-    apiPrefix: string;
-}
-declare const appConfig: AppConfig;
-export type { AppConfig };
-export { appConfig };