@getstrata/core 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @getstrata/core changelog
 
+## 1.0.4
+
+- `isProductionEnv()` treats `APP_ENV` or `NODE_ENV` `production` as production (case-insensitive), treats `staging` as production, and default-denies unrecognized `APP_ENV` values such as `prod`.
+- `envFlagEnabled()` is true only for the exact string `true`.
+- JWT, session, CSRF, flash, signed-URL, OAuth-state, and token-pepper resolvers throw outside development when the secret is unset. They no longer derive a secret from the app name.
+- `runWithMigrationBypass()` uses a transaction and `SET LOCAL` so `app.bypass_rls` cannot leak across pooled connections.
+- `@getstrata/core/view` (and related singleton subpaths) re-export the main bundle so `configureWebErrorView` is shared.
+- Shared subpath shims re-export the barrel. Subpath-only helpers such as `assertSafeOutboundUrl`, `webErrorResponse`, and `renderWebErrorHtml` are now on the public API so those imports work at runtime, not only in `.d.ts` files.
+
+## 1.0.3
+
+- `eta` and `mysql2` are optional peers, loaded with `import()` on first use. SQLite and Postgres apps no longer install `mysql2` through core. If a package is missing, the error names `bun add` for that package.
+- Breaking: `createMysqlPool(url)` returns a `Promise` because it lazy-loads `mysql2`. It shipped synchronous in 1.0.1 and 1.0.2; `await` it. `createMysqlConnection(url)` stays synchronous and opens the pool on the first query.
+- `createMysqlConnection()` shares one pool across concurrent first queries by caching the pending promise. Before this fix, three requests arriving together opened three pools and `close()` ended only the last one. A failed load is retried on the next query, and a query after `close()` opens a fresh pool.
+- The MySQL helpers stay exported from `@getstrata/core` and `@getstrata/core/database`. Importing either barrel does not install `mysql2`; the barrel bundle carries the lazy `import("mysql2/promise")` and evaluates it only when a MySQL pool is opened.
+
 ## 1.0.2
 
 - Lockstep with `create-strata` 1.0.2. No runtime changes.

package/README.md

@@ -39,7 +39,7 @@ The engine is your choice, and an app should have one primary engine. Postgres a
 
 Full-text `tsMatch` is PostgreSQL only.
 
-`mysql2` and `eta` are direct dependencies, so they install even for a SQLite JSON API app.
+`eta` and `mysql2` are optional peers. Core loads them with `import()` the first time you render a view or open a MySQL connection. SQLite and Postgres apps do not install `mysql2`. Generated apps add `eta` because the welcome page uses it. MySQL apps also add `mysql2`. The MySQL helpers are exported from `@getstrata/core/database/mysqlConnection`, `@getstrata/core/database`, and the root barrel; importing any of them does not install `mysql2`, and apps should prefer the subpath as with every other core module.
 
 ## Views
 

package/dist/core/database/index.d.ts

@@ -10,7 +10,8 @@ export { Factory } from "./factory.ts";
 export { foreignKeyFromTable, pivotTableName, singularize } from "./inflection.ts";
 export type { CastType, GlobalScopeFn, ModelConstructor } from "./model.ts";
 export { applyCasts, BelongsToManyRelationQuery, BelongsToRelationQuery, dehydrateValue, filterMassAssignable, HasManyRelationQuery, HasManyThroughRelationQuery, HasOneRelationQuery, hydrateValue, Model, ModelQuery, MorphManyRelationQuery, MorphOneRelationQuery, MorphToRelationQuery, registerModelClass, registerModelRepository, } from "./model.ts";
-export { createMysqlConnection, createMysqlConnectionFromPool } from "./mysqlConnection.ts";
+export type { MysqlConnection, MysqlExecutable, MysqlPool } from "./mysqlConnection.ts";
+export { createMysqlConnection, createMysqlConnectionFromPool, createMysqlPool, } from "./mysqlConnection.ts";
 export type { NamedConnectionEntry } from "./namedConnections.ts";
 export { getNamedConnection, hasNamedConnection, registerNamedConnection, resetNamedConnections, runOnNamedConnection, unregisterNamedConnection, } from "./namedConnections.ts";
 export { buildAdvancedWhereClause, buildCountQuery, buildDeleteByIdQuery, buildGroupedCountQuery, buildInsertQuery, buildJoinClause, buildOrderByClause, buildProjectionQuery, buildQueryWhereClause, buildRestoreByIdQuery, buildSelectQuery, buildSoftDeleteByIdQuery, buildUpdateQuery, buildWhereClause, parseQualifiedColumn, qualifyColumn, quoteIdentifier, resolveQualifiedColumn, resolveSoftDeleteColumn, } from "./query.ts";

package/dist/core/database/mysqlConnection.d.ts

@@ -1,14 +1,18 @@
-import mysql from "mysql2/promise";
 import type { ActiveDatabaseHandle } from "./connectionContext.ts";
 type MysqlExecutable = {
     execute: (sql: string, params?: unknown[]) => Promise<[unknown, unknown]>;
     end?: () => Promise<void>;
 };
+type MysqlPool = MysqlExecutable & {
+    end(): Promise<void>;
+    on(event: "connection", listener: (connection: unknown) => void): void;
+};
 type MysqlConnection = ActiveDatabaseHandle & {
     close(): Promise<void>;
 };
+declare function resetMysqlLoaderForTests(importer?: () => Promise<unknown>): void;
 declare function createMysqlConnectionFromPool(pool: MysqlExecutable): MysqlConnection;
-declare function createMysqlPool(url: string): mysql.Pool;
+declare function createMysqlPool(url: string): Promise<MysqlPool>;
 declare function createMysqlConnection(url: string): MysqlConnection;
-export type { MysqlConnection, MysqlExecutable };
-export { createMysqlConnection, createMysqlConnectionFromPool, createMysqlPool };
+export type { MysqlConnection, MysqlExecutable, MysqlPool };
+export { createMysqlConnection, createMysqlConnectionFromPool, createMysqlPool, resetMysqlLoaderForTests, };

package/dist/core/runtime/appEnv.d.ts

@@ -1,4 +1,18 @@
 type EnvRecord = Record<string, string | undefined>;
-/** Production when either the framework or the Node convention says so. */
+/**
+ * App environments that may boot without production secret checks.
+ * Staging is not in this set: it is typically internet-exposed with
+ * production-like data, so it must use real secrets.
+ */
+declare const NON_PRODUCTION_APP_ENVS: Set<string>;
+/**
+ * Production when APP_ENV or NODE_ENV says so, including `staging`.
+ * Unrecognized APP_ENV values (for example "prod" or "Production" after
+ * case-folding fails to match "production") default to production so secrets
+ * checks cannot be skipped by capitalization or a typo.
+ */
 declare function isProductionEnv(env?: EnvRecord): boolean;
-export { isProductionEnv };
+/** True only for the exact string "true". Unset, "false", "0", "FALSE", and "off" are off. */
+declare function envFlagEnabled(value: string | undefined): boolean;
+export type { EnvRecord };
+export { envFlagEnabled, isProductionEnv, NON_PRODUCTION_APP_ENVS };

package/dist/core/runtime/appKeyPrefix.d.ts

@@ -1,6 +1,13 @@
+import { type EnvRecord } from "./appEnv";
 declare function appKeyPrefix(): string;
 declare function appCookieName(kind: string): string;
 declare function appDevSecret(kind: string): string;
+/**
+ * Use a configured secret, or a predictable local fallback. Production,
+ * staging, and unrecognized APP_ENV values treated as production must set a
+ * real secret; never derive one from the app name.
+ */
+declare function requireConfiguredSecret(names: readonly string[], devKind: string, env?: EnvRecord): string;
 declare function namespacedRedisKey(kind: string): string;
 declare function smtpEhloHost(): string;
 declare function siemEventType(): string;
@@ -12,4 +19,4 @@ declare function appEnv(): string;
 declare function appUrl(): string;
 declare function apiPrefix(): string;
 declare function sdkClientClassName(): string;
-export { apiPrefix, appCookieName, appDevSecret, appDisplayName, appEnv, appKeyPrefix, appUrl, appUserAgent, namespacedRedisKey, otelServiceName, sdkClientClassName, siemEventType, smtpEhloHost, webhookSignatureHeader, };
+export { apiPrefix, appCookieName, appDevSecret, appDisplayName, appEnv, appKeyPrefix, appUrl, appUserAgent, namespacedRedisKey, otelServiceName, requireConfiguredSecret, sdkClientClassName, siemEventType, smtpEhloHost, webhookSignatureHeader, };

package/dist/core/runtime/optionalPeer.d.ts

@@ -0,0 +1,2 @@
+declare function missingOptionalPeer(packageName: string, reason: string, error: unknown): Error;
+export { missingOptionalPeer };

package/dist/core/view/etaViewEngine.d.ts

@@ -11,9 +11,13 @@ type LayoutDataResolver = (request?: Request) => Promise<Record<string, unknown>
  * Pug class/attribute shorthand is rejected at render time.
  */
 declare class EtaViewEngine implements ViewEngine {
-    private readonly eta;
+    private eta;
+    private etaPending;
+    private readonly viewsDirectory;
     private readonly resolveLayoutData?;
     constructor(viewsDirectory?: string, resolveLayoutData?: LayoutDataResolver);
+    private getEta;
+    private createEta;
     render(name: string, data?: Record<string, unknown>, options?: RenderOptions): Promise<string>;
 }
 export type { LayoutDataResolver, RenderOptions };

package/dist/entries/audit/exportAuditLogs.js

@@ -1,6 +1,26 @@
 // @bun
 // ../../src/core/audit/exportAuditLogs.ts
-import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
+import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
 
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -146,12 +175,6 @@ async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
   }
   return parsed;
 }
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
 
 // ../../src/core/security/safeFetch.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
@@ -188,7 +211,33 @@ async function safeFetch(input, init = {}, options = {}) {
 }
 
 // ../../src/core/tenant/databaseTenantContext.ts
-import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
 
 // ../../src/core/tenant/tenancyConfig.ts
 var TENANCY_DRIVERS = ["rls", "column", "none"];
@@ -210,16 +259,32 @@ function isRlsTenancy(env = process.env) {
 }
 
 // ../../src/core/tenant/databaseTenantContext.ts
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
 async function runWithMigrationBypass(callback) {
   if (!isRlsTenancy()) {
     return await callback();
   }
-  await db`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await db`SELECT set_config('app.bypass_rls', 'false', false)`;
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyBypassToTransaction(activeConnection, true);
+    try {
+      return await callback();
+    } finally {
+      await applyBypassToTransaction(activeConnection, false);
+    }
+  }
+  const pool = getDefaultDatabasePool();
+  if (typeof pool.begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
+  return await pool.begin(async (transaction) => {
+    await applyBypassToTransaction(transaction, true);
+    return await runWithDatabaseConnection(transaction, callback);
+  });
 }
 
 // ../../src/core/audit/siemFormatter.ts
@@ -275,7 +340,7 @@ async function exportPendingAuditLogs() {
     return 0;
   }
   return await runWithMigrationBypass(async () => {
-    const rows = await db2`
+    const rows = await db`
       SELECT
         id,
         user_id,
@@ -325,7 +390,7 @@ async function exportPendingAuditLogs() {
     }
     const ids = rows.map((row) => row.id);
     for (const id of ids) {
-      await db2`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+      await db`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
     }
     return rows.length;
   });

package/dist/entries/audit/siemFormatter.js

@@ -1,4 +1,24 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -9,6 +29,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -26,9 +58,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/intendedUrlCookie.js

@@ -32,6 +32,26 @@ function loginRedirectLocation(request) {
   return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
 }
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -42,6 +62,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -59,9 +91,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -109,7 +138,7 @@ function intendedUrlTtlSeconds() {
   return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_INTENDED_URL_TTL_SECONDS;
 }
 function cookieSecureFlag() {
-  return process.env.APP_ENV === "production" ? "; Secure" : "";
+  return isProductionEnv() ? "; Secure" : "";
 }
 function pathnameOf(path) {
   const pathname = path.split("?")[0] ?? path;

package/dist/entries/auth/jwt.js

@@ -2,6 +2,26 @@
 // ../../src/core/auth/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -58,7 +87,10 @@ function sdkClientClassName() {
 
 // ../../src/core/auth/jwt.ts
 function resolveJwtSecret(secret) {
-  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+  if (secret?.trim()) {
+    return secret.trim();
+  }
+  return requireConfiguredSecret(["JWT_SECRET", "SESSION_SECRET"], "jwt-secret");
 }
 function jwtTtlSeconds(override) {
   if (typeof override === "number" && Number.isInteger(override) && override > 0) {

package/dist/entries/auth/jwtGuard.js

@@ -44,6 +44,26 @@ function readBasicCredentials(request) {
 // ../../src/core/auth/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -54,6 +74,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -71,9 +103,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -100,7 +129,10 @@ function sdkClientClassName() {
 
 // ../../src/core/auth/jwt.ts
 function resolveJwtSecret(secret) {
-  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+  if (secret?.trim()) {
+    return secret.trim();
+  }
+  return requireConfiguredSecret(["JWT_SECRET", "SESSION_SECRET"], "jwt-secret");
 }
 function jwtTtlSeconds(override) {
   if (typeof override === "number" && Number.isInteger(override) && override > 0) {

package/dist/entries/auth/oauth/providers.js

@@ -1,4 +1,24 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -9,6 +29,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -26,9 +58,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/oauth/samlProvider.js

@@ -1,4 +1,24 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -9,6 +29,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -26,9 +58,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }