@getstrata/core 0.5.66 → 0.5.68

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @getstrata/core changelog
 
+## 0.5.68
+
+- Published core no longer imports WorkHub `src/config`. Frontend mode, queue retries, CORS, and upload limits read env (`FRONTEND_MODE`, `QUEUE_*`, `CORS_ALLOWED_ORIGINS`, `MAX_UPLOAD_BYTES`).
+- `@getstrata/core/runtime/frontendMode` exports `readFrontendMode` / `isViewsEnabled` / `isSpaEnabled`.
+
+## 0.5.67
+
+- OpenAPI title, server URLs, and generated SDK class name come from `APP_NAME` / `APP_URL` / `API_PREFIX` / `APP_SDK_CLASS` instead of importing WorkHub `src/config/app`.
+- `appEnv()`, `appUrl()`, `apiPrefix()`, and `sdkClientClassName()` live on `@getstrata/core/runtime/appKeyPrefix`. SIEM export, HSTS, and `safeFetch` DNS resolve use `appEnv()` instead of WorkHub `appConfig`.
+
 ## 0.5.66
 
 - `createValidateSignatureMiddleware()` on `@getstrata/core/http/signedUrl` is Laravel’s `signed` / `ValidateSignature` middleware. Invalid or expired links throw `ForbiddenError`.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.68 && git push origin v0.5.68`
+2. Tag a release: `git tag v0.5.70 && git push origin v0.5.70`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/http/corsMiddleware.d.ts

@@ -1,3 +1,10 @@
 import type { Middleware } from "./middleware";
+interface CorsConfig {
+    allowedOrigins: string[];
+    allowedMethods: string[];
+    allowedHeaders: string[];
+    maxAgeSeconds: number;
+}
+declare function resolveCorsConfig(): CorsConfig;
 declare function createCorsMiddleware(): Middleware;
-export { createCorsMiddleware };
+export { createCorsMiddleware, resolveCorsConfig };

package/dist/core/openapi/generator.d.ts

@@ -1,4 +1,4 @@
-import type { RegisteredRoute } from "../openapi/registeredRoute";
+import type { RegisteredRoute } from "./registeredRoute";
 interface OpenApiSpec {
     openapi: string;
     info: {
@@ -17,6 +17,6 @@ interface OpenApiSpec {
 }
 declare function generateOpenApiSpec(routes: RegisteredRoute[]): OpenApiSpec;
 declare function renderOpenApiDocument(spec: OpenApiSpec): string;
-declare function renderTypeScriptSdk(spec: OpenApiSpec, apiPrefix?: string): string;
+declare function renderTypeScriptSdk(spec: OpenApiSpec, prefix?: string): string;
 export type { OpenApiSpec };
 export { generateOpenApiSpec, renderOpenApiDocument, renderTypeScriptSdk };

package/dist/{config/queue.d.ts → core/queue/queueConfig.d.ts}

@@ -3,6 +3,7 @@ interface QueueConfig {
     maxAttempts: number;
     backoffMs: number;
 }
+declare function resolveQueueConfig(): QueueConfig;
 declare const queueConfig: QueueConfig;
 export type { QueueConfig };
-export { queueConfig };
+export { queueConfig, resolveQueueConfig };

package/dist/core/runtime/appKeyPrefix.d.ts

@@ -6,4 +6,8 @@ declare function appUserAgent(): string;
 declare function otelServiceName(): string;
 declare function webhookSignatureHeader(): string;
 declare function appDisplayName(): string;
-export { appDisplayName, appKeyPrefix, appUserAgent, namespacedRedisKey, otelServiceName, siemEventType, smtpEhloHost, webhookSignatureHeader, };
+declare function appEnv(): string;
+declare function appUrl(): string;
+declare function apiPrefix(): string;
+declare function sdkClientClassName(): string;
+export { apiPrefix, appDisplayName, appEnv, appKeyPrefix, appUrl, appUserAgent, namespacedRedisKey, otelServiceName, sdkClientClassName, siemEventType, smtpEhloHost, webhookSignatureHeader, };

package/dist/entries/audit/exportAuditLogs.js

@@ -2,14 +2,53 @@
 // ../../src/core/audit/exportAuditLogs.ts
 import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/security/safeUrl.ts
 import { lookup as dnsLookupImpl } from "dns/promises";
@@ -113,7 +152,7 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function safeFetch(input, init = {}, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const resolveDns = options.resolveDns ?? appEnv() === "production";
   const urlOptions = { allowHttp: options.allowHttp, resolveDns };
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -153,34 +192,6 @@ async function runWithMigrationBypass(callback) {
   }
 }
 
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
-}
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
-}
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "WorkHub";
-}
-
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {
   return {
@@ -220,7 +231,7 @@ function resolveAuditExportConfig() {
   if (!endpoint) {
     return null;
   }
-  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
+  assertSafeOutboundUrl(endpoint, { allowHttp: appEnv() !== "production" });
   const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
   return {
     endpoint,
@@ -278,7 +289,7 @@ async function exportPendingAuditLogs() {
         ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
       },
       body
-    }, { allowHttp: appConfig.env !== "production" });
+    }, { allowHttp: appEnv() !== "production" });
     if (!response.ok) {
       throw new Error(`SIEM export failed with status ${response.status}.`);
     }

package/dist/entries/audit/siemFormatter.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {

package/dist/entries/auth/oauth/providers.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/auth/oauth/providers.ts
 class GitHubOAuthProvider {

package/dist/entries/auth/oauth/samlProvider.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/auth/oauth/samlProvider.ts
 class SamlProvider {

package/dist/entries/cache/createCacheStore.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/cache/redisCacheStore.ts
 function cacheKeyPrefix() {

package/dist/entries/facades.js

@@ -38,6 +38,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {

package/dist/entries/http/corsMiddleware.js

@@ -1,22 +1,22 @@
 // @bun
-// ../../src/config/cors.ts
-var corsConfig = {
-  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
-  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-  allowedHeaders: [
-    "Authorization",
-    "Content-Type",
-    "X-Request-Id",
-    "X-Tenant-Id",
-    "X-Authenticated-User-Id",
-    "X-Authenticated-User-Role",
-    "If-Match",
-    "If-None-Match"
-  ],
-  maxAgeSeconds: 86400
-};
-
 // ../../src/core/http/corsMiddleware.ts
+function resolveCorsConfig() {
+  return {
+    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+    allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+    allowedHeaders: [
+      "Authorization",
+      "Content-Type",
+      "X-Request-Id",
+      "X-Tenant-Id",
+      "X-Authenticated-User-Id",
+      "X-Authenticated-User-Role",
+      "If-Match",
+      "If-None-Match"
+    ],
+    maxAgeSeconds: 86400
+  };
+}
 function createCorsMiddleware() {
   return async (request, next) => {
     if (request.method === "OPTIONS") {
@@ -40,6 +40,7 @@ function createCorsMiddleware() {
 function buildCorsHeaders(request) {
   const headers = new Headers;
   const origin = request.headers.get("origin");
+  const corsConfig = resolveCorsConfig();
   const allowedOrigins = corsConfig.allowedOrigins;
   const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
   headers.set("Access-Control-Allow-Origin", allowOrigin);
@@ -50,5 +51,6 @@ function buildCorsHeaders(request) {
   return headers;
 }
 export {
-  createCorsMiddleware
+  createCorsMiddleware,
+  resolveCorsConfig
 };

package/dist/entries/http/loginThrottleMiddleware.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -26,6 +26,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/parseMultipartUpload.js

@@ -2,7 +2,7 @@
 // ../../src/core/http/parseMultipartUpload.ts
 import { BadRequestError, PayloadTooLargeError } from "@getstrata/core/errors/http";
 
-// ../../src/config/uploads.ts
+// ../../src/core/http/uploads.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
 var ALLOWED_UPLOAD_MIME_TYPES = new Set([
   "application/pdf",

package/dist/entries/http/requireAbilityMiddleware.js

@@ -3,7 +3,7 @@
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { ForbiddenError } from "@getstrata/core/errors/http";
 
-// ../../src/config/frontend.ts
+// ../../src/core/runtime/frontendMode.ts
 function readFrontendMode() {
   const mode = (process.env.FRONTEND_MODE ?? "api").trim();
   if (mode === "server-htmx") {
@@ -17,6 +17,9 @@ function readFrontendMode() {
 function isViewsEnabled() {
   return readFrontendMode() === "server-htmx";
 }
+function isSpaEnabled() {
+  return readFrontendMode() === "spa-react";
+}
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {

package/dist/entries/http/response.js

@@ -68,7 +68,7 @@ async function withDatabaseErrorHandling(operation) {
 // ../../src/core/http/webErrorResponse.ts
 import { HttpError as HttpError2, UnauthorizedError, ValidationError } from "@getstrata/core/errors/http";
 
-// ../../src/config/frontend.ts
+// ../../src/core/runtime/frontendMode.ts
 function readFrontendMode() {
   const mode = (process.env.FRONTEND_MODE ?? "api").trim();
   if (mode === "server-htmx") {
@@ -82,6 +82,9 @@ function readFrontendMode() {
 function isViewsEnabled() {
   return readFrontendMode() === "server-htmx";
 }
+function isSpaEnabled() {
+  return readFrontendMode() === "spa-react";
+}
 
 // ../../src/core/view/webErrorView.ts
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";

package/dist/entries/http/scimThrottleMiddleware.js

@@ -29,6 +29,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {

package/dist/entries/http/securityHeadersMiddleware.js

@@ -7,14 +7,53 @@ import {
 } from "@getstrata/core/http/contentSecurityPolicy";
 import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/securityHeadersMiddleware.ts
 function createSecurityHeadersMiddleware(options = {}) {
@@ -33,7 +72,7 @@ function createSecurityHeadersMiddleware(options = {}) {
       headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
       headers.set("X-XSS-Protection", "0");
       headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response, { ...options, nonce }));
-      if (appConfig.env === "production") {
+      if (appEnv() === "production") {
         headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
       }
       return new Response(response.body, {

package/dist/entries/http/throttleMiddleware.js

@@ -31,6 +31,26 @@ function webhookSignatureHeader() {
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "WorkHub";
 }
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/http/clientIp.ts
 function trustForwardedFor(env = process.env) {