@getstrata/core 1.0.3 → 1.0.5

package/dist/entries/http/response.js

@@ -110,8 +110,23 @@ import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/er
 import { appLogger } from "@getstrata/core/logging/logger";
 
 // ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
 function isProductionEnv(env = process.env) {
-  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
 }
 
 // ../../src/core/runtime/frontendMode.ts
@@ -157,9 +172,6 @@ function readSpaPrefix() {
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
-}
 function htmlResponse(html, init = {}) {
   return new Response(html, {
     status: init.status ?? 200,
@@ -169,42 +181,9 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-function redirectResponse(location, status = 302) {
-  return new Response(null, {
-    status,
-    headers: {
-      Location: location
-    }
-  });
-}
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
-}
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
-  });
-}
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
 
 // ../../src/core/view/webErrorView.ts
 var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
@@ -238,15 +217,6 @@ function renderKernelErrorChrome(input) {
 </html>
 `;
 }
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
-  }
-  if (status === 403) {
-    return "errors/forbidden";
-  }
-  return "errors/error";
-}
 async function renderWebErrorHtml(input) {
   const render = configuredErrorView.render;
   if (!render) {
@@ -264,16 +234,6 @@ async function renderWebErrorHtml(input) {
 async function htmlErrorResponse(input) {
   return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
 }
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
-  }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
-}
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {

package/dist/entries/http/scimThrottleMiddleware.js

@@ -2,6 +2,26 @@
 // ../../src/core/http/scimThrottleMiddleware.ts
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/securityHeadersMiddleware.js

@@ -7,6 +7,26 @@ import {
 } from "@getstrata/core/http/contentSecurityPolicy";
 import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -17,6 +37,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -34,9 +66,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/signedUrl.js

@@ -4,6 +4,26 @@ import { createHmac } from "crypto";
 import { ForbiddenError } from "@getstrata/core/errors/http";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -14,6 +34,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -31,9 +63,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -60,7 +89,7 @@ function sdkClientClassName() {
 
 // ../../src/core/http/signedUrl.ts
 function resolveSignedUrlSecret() {
-  return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("signed-url-secret");
+  return requireConfiguredSecret(["SIGNED_URL_SECRET", "SESSION_SECRET", "OAUTH_STATE_SECRET"], "signed-url-secret");
 }
 function resolveSignedUrlOrigin() {
   return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");

package/dist/entries/http/throttleMiddleware.js

@@ -4,6 +4,26 @@ import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentTenant, rateLimitMultiplierForPlan } from "@getstrata/core/tenant/tenantContext";
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -14,6 +34,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -31,9 +63,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -133,9 +162,6 @@ function readSpaPrefix() {
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
-}
 function htmlResponse(html, init = {}) {
   return new Response(html, {
     status: init.status ?? 200,
@@ -145,42 +171,9 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-function redirectResponse(location, status = 302) {
-  return new Response(null, {
-    status,
-    headers: {
-      Location: location
-    }
-  });
-}
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
-}
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
-  });
-}
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
 
 // ../../src/core/view/webErrorView.ts
 var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
@@ -214,15 +207,6 @@ function renderKernelErrorChrome(input) {
 </html>
 `;
 }
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
-  }
-  if (status === 403) {
-    return "errors/forbidden";
-  }
-  return "errors/error";
-}
 async function renderWebErrorHtml(input) {
   const render = configuredErrorView.render;
   if (!render) {
@@ -240,16 +224,6 @@ async function renderWebErrorHtml(input) {
 async function htmlErrorResponse(input) {
   return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
 }
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
-  }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
-}
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {