@getstrata/core 0.5.78 → 0.5.80

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 0.5.80
+
+- `appCookieName()` / `appDevSecret()` on `@getstrata/core/runtime/appKeyPrefix`. HMAC session, CSRF, flash, password-confirm, signed-URL, OAuth-state, and token-pepper fallbacks follow `APP_KEY_PREFIX` (WorkHub defaults unchanged).
+
+## 0.5.79
+
+- `readSession()` returns `{ userId, issuedAt }` from the HMAC session cookie. `isSessionInvalidated(issuedAt, session_valid_after)` lets `SessionGuard` reject cookies issued before `AuthUserRecord.session_valid_after` (Jetstream logout-other-devices / password change).
+
 ## 0.5.78
 
 - OpenAPI treats `POST /auth/two-factor-challenge` as a public operation (no bearer), including when routes are registered under `API_PREFIX`.

package/dist/core/auth/sessionCookie.d.ts

@@ -4,11 +4,17 @@ declare const SESSION_REMEMBER_TTL_SECONDS: number;
 interface CreateSessionCookieOptions {
     remember?: boolean;
 }
+interface SignedSession {
+    userId: number;
+    issuedAt: number;
+}
 declare function sessionCookieName(): string;
 declare function sessionTtlSeconds(): number;
 declare function sessionRememberTtlSeconds(): number;
+declare function readSession(request: Request): SignedSession | null;
 declare function readSessionUserId(request: Request): number | null;
+declare function isSessionInvalidated(issuedAt: number, validAfter: Date | string | null | undefined): boolean;
 declare function createSessionCookie(userId: number, options?: CreateSessionCookieOptions): string;
 declare function clearSessionCookie(): string;
-export type { CreateSessionCookieOptions };
-export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };
+export type { CreateSessionCookieOptions, SignedSession };
+export { clearSessionCookie, createSessionCookie, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };

package/dist/core/contracts/authUserDirectory.d.ts

@@ -4,6 +4,7 @@ interface AuthUserRecord {
     email?: string | null;
     role: string;
     email_verified_at?: Date | string | null;
+    session_valid_after?: Date | string | null;
 }
 interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;

package/dist/core/runtime/appKeyPrefix.d.ts

@@ -1,4 +1,6 @@
 declare function appKeyPrefix(): string;
+declare function appCookieName(kind: string): string;
+declare function appDevSecret(kind: string): string;
 declare function namespacedRedisKey(kind: string): string;
 declare function smtpEhloHost(): string;
 declare function siemEventType(): string;
@@ -10,4 +12,4 @@ declare function appEnv(): string;
 declare function appUrl(): string;
 declare function apiPrefix(): string;
 declare function sdkClientClassName(): string;
-export { apiPrefix, appDisplayName, appEnv, appKeyPrefix, appUrl, appUserAgent, namespacedRedisKey, otelServiceName, sdkClientClassName, siemEventType, smtpEhloHost, webhookSignatureHeader, };
+export { apiPrefix, appCookieName, appDevSecret, appDisplayName, appEnv, appKeyPrefix, appUrl, appUserAgent, namespacedRedisKey, otelServiceName, sdkClientClassName, siemEventType, smtpEhloHost, webhookSignatureHeader, };

package/dist/entries/audit/exportAuditLogs.js

@@ -6,6 +6,12 @@ import { repositoryConnection as db2 } from "@getstrata/core/database/repository
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "workhub";
 }
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }

package/dist/entries/audit/siemFormatter.js

@@ -3,6 +3,12 @@
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "workhub";
 }
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }

package/dist/entries/auth/oauth/providers.js

@@ -3,6 +3,12 @@
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "workhub";
 }
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }

package/dist/entries/auth/oauth/samlProvider.js

@@ -3,6 +3,12 @@
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "workhub";
 }
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }

package/dist/entries/auth/passwordConfirmCookie.js

@@ -1,17 +1,73 @@
 // @bun
 // ../../src/core/auth/passwordConfirmCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/passwordConfirmCookie.ts
 var PASSWORD_CONFIRM_COOKIE = "workhub_password_confirmed";
 var DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS = 3 * 60 * 60;
 function passwordConfirmCookieName() {
-  return process.env.PASSWORD_CONFIRM_COOKIE_NAME?.trim() || PASSWORD_CONFIRM_COOKIE;
+  return process.env.PASSWORD_CONFIRM_COOKIE_NAME?.trim() || appCookieName("password_confirmed");
 }
 function passwordConfirmTtlSeconds() {
   const parsed = Number.parseInt(process.env.PASSWORD_CONFIRM_TIMEOUT ?? "", 10);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS;
 }
 function resolvePasswordConfirmSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-session-secret";
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("session-secret");
 }
 function signPasswordConfirm(userId, confirmedAt) {
   const payload = `${userId}.${confirmedAt}`;

package/dist/entries/auth/sessionCookie.js

@@ -1,11 +1,67 @@
 // @bun
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/sessionCookie.ts
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
 var SESSION_REMEMBER_TTL_SECONDS = 60 * 60 * 24 * 30;
 function sessionCookieName() {
-  return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
+  return process.env.SESSION_COOKIE_NAME?.trim() || appCookieName("session");
 }
 function parsePositiveSeconds(raw, fallback) {
   const parsed = Number.parseInt(raw ?? "", 10);
@@ -18,7 +74,7 @@ function sessionRememberTtlSeconds() {
   return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
 }
 function resolveSessionSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("session-secret");
 }
 function signSession(userId, issuedAt, ttlSeconds) {
   const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
@@ -62,9 +118,9 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return userId;
+  return { userId, issuedAt };
 }
-function readSessionUserId(request) {
+function readSession(request) {
   const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
@@ -80,6 +136,19 @@ function readSessionUserId(request) {
   const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
   return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
 }
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
 function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
@@ -97,6 +166,8 @@ export {
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
+  isSessionInvalidated,
+  readSession,
   readSessionUserId,
   sessionCookieName,
   sessionRememberTtlSeconds,

package/dist/entries/auth/sessionGuard.js

@@ -84,11 +84,67 @@ function resolveAbilitiesForRole(role) {
 
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/sessionCookie.ts
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
 var SESSION_REMEMBER_TTL_SECONDS = 60 * 60 * 24 * 30;
 function sessionCookieName() {
-  return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
+  return process.env.SESSION_COOKIE_NAME?.trim() || appCookieName("session");
 }
 function parsePositiveSeconds(raw, fallback) {
   const parsed = Number.parseInt(raw ?? "", 10);
@@ -101,7 +157,7 @@ function sessionRememberTtlSeconds() {
   return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
 }
 function resolveSessionSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("session-secret");
 }
 function signSession(userId, issuedAt, ttlSeconds) {
   const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
@@ -145,9 +201,9 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return userId;
+  return { userId, issuedAt };
 }
-function readSessionUserId(request) {
+function readSession(request) {
   const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
@@ -163,6 +219,19 @@ function readSessionUserId(request) {
   const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
   return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
 }
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
 function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
@@ -182,8 +251,8 @@ class SessionGuard {
     this.container = container;
   }
   async resolve(request) {
-    const userId = readSessionUserId(request);
-    if (!userId) {
+    const session = readSession(request);
+    if (!session) {
       return null;
     }
     const tokenService = resolveAuthUserDirectory(this.container);
@@ -191,7 +260,10 @@ class SessionGuard {
       return null;
     }
     try {
-      const user = await tokenService.findByIdOrThrow(userId);
+      const user = await tokenService.findByIdOrThrow(session.userId);
+      if (isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
+        return null;
+      }
       return {
         id: user.id,
         role: user.role,

package/dist/entries/auth/tokenHash.js

@@ -1,12 +1,68 @@
 // @bun
 // ../../src/core/auth/tokenHash.ts
 import { createHash, createHmac } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/tokenHash.ts
 function resolveTokenPepper() {
-  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
+  return process.env.TOKEN_HASH_PEPPER?.trim() ?? appDevSecret("token-pepper");
 }
 function hashApiToken(token) {
   const pepper = resolveTokenPepper();
-  if (pepper && pepper !== "workhub-dev-token-pepper") {
+  if (pepper && pepper !== appDevSecret("token-pepper")) {
     return createHmac("sha256", pepper).update(token).digest("hex");
   }
   return createHash("sha256").update(token).digest("hex");

package/dist/entries/cache/createCacheStore.js

@@ -6,6 +6,12 @@ var {RedisClient } = globalThis.Bun;
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "workhub";
 }
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }

package/dist/entries/facades.js

@@ -15,6 +15,12 @@ import {
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "workhub";
 }
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }

package/dist/entries/http/csrfMiddleware.js

@@ -5,6 +5,60 @@ import { ForbiddenError } from "@getstrata/core/errors/http";
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
 // ../../src/core/http/cookies.ts
 function readRequestCookie(request, name) {
   const cookies = request.cookies;
@@ -63,10 +117,10 @@ function currentRequestMeta() {
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
 function csrfCookieName() {
-  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
+  return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };