@getstrata/core 1.0.3 → 1.0.5

package/dist/entries/auth/sessionCookie.js

@@ -2,6 +2,26 @@
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -74,7 +103,7 @@ function sessionRememberTtlSeconds() {
   return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
 }
 function resolveSessionSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("session-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "session-secret");
 }
 function signSession(userId, issuedAt, ttlSeconds) {
   const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
@@ -153,7 +182,7 @@ function createSessionCookieDetails(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
   const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
@@ -165,7 +194,7 @@ function createSessionCookie(userId, options = {}) {
   return createSessionCookieDetails(userId, options).header;
 }
 function clearSessionCookie() {
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 export {

package/dist/entries/auth/sessionGuard.js

@@ -69,6 +69,26 @@ function resolveAbilitiesForRole(role) {
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -79,6 +99,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -96,9 +128,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -141,7 +170,7 @@ function sessionRememberTtlSeconds() {
   return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
 }
 function resolveSessionSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("session-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "session-secret");
 }
 function signSession(userId, issuedAt, ttlSeconds) {
   const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
@@ -220,7 +249,7 @@ function createSessionCookieDetails(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
   const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
@@ -232,7 +261,7 @@ function createSessionCookie(userId, options = {}) {
   return createSessionCookieDetails(userId, options).header;
 }
 function clearSessionCookie() {
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 

package/dist/entries/auth/tokenHash.js

@@ -2,6 +2,26 @@
 // ../../src/core/auth/tokenHash.ts
 import { createHash, createHmac } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -58,7 +87,7 @@ function sdkClientClassName() {
 
 // ../../src/core/auth/tokenHash.ts
 function resolveTokenPepper() {
-  return process.env.TOKEN_HASH_PEPPER?.trim() ?? appDevSecret("token-pepper");
+  return requireConfiguredSecret(["TOKEN_HASH_PEPPER"], "token-pepper");
 }
 function hashApiToken(token) {
   const pepper = resolveTokenPepper();

package/dist/entries/cache/createCacheStore.js

@@ -2,6 +2,26 @@
 // ../../src/core/cache/redisCacheStore.ts
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/database/mysqlConnection.js

@@ -1,132 +1 @@
-// @bun
-// ../../src/core/runtime/optionalPeer.ts
-function missingOptionalPeer(packageName, reason, error) {
-  return new Error(`Install ${packageName} ${reason} (\`bun add ${packageName}\`).`, {
-    cause: error
-  });
-}
-
-// ../../src/core/database/mysqlConnection.ts
-var MYSQL_SESSION_UTC = "SET time_zone = '+00:00'";
-var mysqlModule;
-var mysqlPending;
-var importMysql = defaultImportMysql;
-async function defaultImportMysql() {
-  return import("mysql2/promise");
-}
-function resetMysqlLoaderForTests(importer) {
-  mysqlModule = undefined;
-  mysqlPending = undefined;
-  importMysql = importer ? async () => await importer() : defaultImportMysql;
-}
-function mysqlApi(mod) {
-  if (typeof mod.createPool === "function") {
-    return mod;
-  }
-  const withDefault = mod;
-  if (typeof withDefault.default?.createPool === "function") {
-    return withDefault.default;
-  }
-  throw new Error("mysql2/promise did not export createPool.");
-}
-async function loadMysql() {
-  if (mysqlModule) {
-    return mysqlModule;
-  }
-  if (!mysqlPending) {
-    mysqlPending = (async () => {
-      let mod;
-      try {
-        mod = await importMysql();
-      } catch (error) {
-        mysqlPending = undefined;
-        throw missingOptionalPeer("mysql2", "to open a MySQL connection", error);
-      }
-      try {
-        mysqlModule = mysqlApi(mod);
-        return mysqlModule;
-      } catch (error) {
-        mysqlPending = undefined;
-        throw error;
-      }
-    })();
-  }
-  return mysqlPending;
-}
-function rowsFromResult(result) {
-  if (Array.isArray(result)) {
-    return result;
-  }
-  if (result && typeof result === "object") {
-    return [result];
-  }
-  return [];
-}
-function createMysqlConnectionFromPool(pool) {
-  return {
-    async unsafe(query, params = []) {
-      const [result] = await pool.execute(query, [...params]);
-      return rowsFromResult(result);
-    },
-    async close() {
-      if (typeof pool.end === "function") {
-        await pool.end();
-      }
-    }
-  };
-}
-function pinSessionToUtc(connection) {
-  connection.query(MYSQL_SESSION_UTC, (error) => {
-    if (error) {
-      console.warn(`[mysql] Could not set the session time zone to UTC; DATETIME comparisons may drift: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  });
-}
-function createPoolFromModule(mysql, url) {
-  const pool = mysql.createPool({ uri: url, timezone: "Z" });
-  pool.on("connection", (connection) => {
-    pinSessionToUtc(connection);
-  });
-  return pool;
-}
-async function createMysqlPool(url) {
-  return createPoolFromModule(await loadMysql(), url);
-}
-function createMysqlConnection(url) {
-  if (!url.trim()) {
-    throw new Error("MYSQL_URL is not configured. Set url before creating a MySQL pool.");
-  }
-  let poolPending;
-  function ensurePool() {
-    if (!poolPending) {
-      poolPending = createMysqlPool(url).catch((error) => {
-        poolPending = undefined;
-        throw error;
-      });
-    }
-    return poolPending;
-  }
-  return {
-    async unsafe(query, params = []) {
-      const [result] = await (await ensurePool()).execute(query, [...params]);
-      return rowsFromResult(result);
-    },
-    async close() {
-      if (!poolPending) {
-        return;
-      }
-      const pending = poolPending;
-      poolPending = undefined;
-      const pool = await pending.catch(() => {
-        return;
-      });
-      await pool?.end();
-    }
-  };
-}
-export {
-  createMysqlConnection,
-  createMysqlConnectionFromPool,
-  createMysqlPool,
-  resetMysqlLoaderForTests
-};
+export * from "../../index.js";

package/dist/entries/facades.js

@@ -11,6 +11,26 @@ import {
   resolveApplicationQueue
 } from "@getstrata/core/runtime/applicationRegistry";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -21,6 +41,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -38,9 +70,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/corsMiddleware.js

@@ -1,7 +1,22 @@
 // @bun
 // ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
 function isProductionEnv(env = process.env) {
-  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
 }
 
 // ../../src/core/http/corsMiddleware.ts

package/dist/entries/http/csrfMiddleware.js

@@ -5,6 +5,26 @@ import { ForbiddenError } from "@getstrata/core/errors/http";
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -15,6 +35,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -32,9 +64,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -120,7 +149,7 @@ function csrfCookieName() {
   return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("csrf-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
@@ -135,7 +164,7 @@ function tokensMatch(left, right) {
 }
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return {
     token,
     cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`

package/dist/entries/http/csrfToken.js

@@ -2,6 +2,26 @@
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -117,7 +146,7 @@ function csrfCookieName() {
   return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("csrf-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
@@ -132,7 +161,7 @@ function tokensMatch(left, right) {
 }
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return {
     token,
     cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`