@getstrata/starter 1.1.4 → 1.1.5

package/dist/cli.js

@@ -117,10 +117,10 @@ function nowTimestampLiteral(database) {
   return database === "mysql" ? `new Date().toISOString().slice(0, 19).replace("T", " ")` : "new Date().toISOString()";
 }
 function extraApplies(extra, auth) {
-  if (extra === "metrics") {
+  if (extra === "metrics" || extra === "billing" || extra === "webhooks") {
     return true;
   }
-  if (extra === "mfa") {
+  if (extra === "mfa" || extra === "oauthGithub") {
     return htmlAuthKit(auth);
   }
   return authNeedsUsers(auth);
@@ -194,13 +194,19 @@ var noneExtras = {
   mfa: false,
   emailVerification: false,
   scim: false,
-  metrics: false
+  metrics: false,
+  oauthGithub: false,
+  billing: false,
+  webhooks: false
 };
 var enterpriseExtras = {
   mfa: true,
   emailVerification: true,
   scim: true,
-  metrics: true
+  metrics: true,
+  oauthGithub: false,
+  billing: false,
+  webhooks: false
 };
 function withDocker(layers, composeForNeededTools) {
   return {
@@ -267,7 +273,10 @@ Options:
   --email-verification / --no-email-verification
   --scim / --no-scim
   --metrics / --no-metrics
-  --extras            Interactive extras list (MFA, email verification, SCIM, metrics)
+  --oauth-github / --no-oauth-github
+  --billing / --no-billing
+  --webhooks / --no-webhooks
+  --extras            Interactive extras list (MFA, email verification, SCIM, metrics, GitHub OAuth, billing, webhooks)
   --docker            Write Docker Compose for every selected tool that needs a service
   --no-docker         Skip docker-compose.yml; use installs already on this machine
   --docker-services   Subset: postgres, mysql, redis, mailpit, adminer (comma-separated)
@@ -370,7 +379,13 @@ function parseCreateStrataArgs(argv) {
       ["--scim", "scim", true],
       ["--no-scim", "scim", false],
       ["--metrics", "metrics", true],
-      ["--no-metrics", "metrics", false]
+      ["--no-metrics", "metrics", false],
+      ["--oauth-github", "oauthGithub", true],
+      ["--no-oauth-github", "oauthGithub", false],
+      ["--billing", "billing", true],
+      ["--no-billing", "billing", false],
+      ["--webhooks", "webhooks", true],
+      ["--no-webhooks", "webhooks", false]
     ];
     const boolMatch = boolFlags.find(([name]) => name === arg);
     if (boolMatch) {
@@ -488,7 +503,13 @@ function applyDockerFlags(layers, flags) {
   return layers;
 }
 function extraFlagName(extra) {
-  return extra === "emailVerification" ? "email-verification" : extra;
+  if (extra === "emailVerification") {
+    return "email-verification";
+  }
+  if (extra === "oauthGithub") {
+    return "oauth-github";
+  }
+  return extra;
 }
 function dropInapplicableExtras(layers, flags) {
   for (const key of Object.keys(layers.extras)) {
@@ -889,7 +910,10 @@ var EXTRA_CHOICES = [
   { value: "mfa", label: "mfa: authenticator challenge + setup pages" },
   { value: "emailVerification", label: "email-verification: signed links + /email/verify" },
   { value: "scim", label: "scim: /Users adapter" },
-  { value: "metrics", label: "metrics: Prometheus token" }
+  { value: "metrics", label: "metrics: Prometheus token" },
+  { value: "oauthGithub", label: "oauth-github: GitHub cookie login at /auth/github" },
+  { value: "billing", label: "billing: Stripe webhook stub + GET /api/v1/billing/subscription" },
+  { value: "webhooks", label: "webhooks: outbound notes.created job (webhook.dispatch)" }
 ];
 function isInteractive(flags) {
   if (flags.yes || flags.noInteractive) {
@@ -1175,6 +1199,7 @@ function renderAuthModule(layers) {
     return null;
   }
   const cookie = htmlAuthKit(layers.auth);
+  const github = Boolean(layers.extras.oauthGithub && cookie);
   const mfa = Boolean(layers.extras.mfa && cookie);
   const verify = Boolean(layers.extras.emailVerification);
   const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
@@ -1194,6 +1219,10 @@ function renderAuthModule(layers) {
     imports.push(`import { wrapWebLogin, wrapWebRegister } from "@getstrata/bootstrap/web/routing";`);
     imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
     imports.push(`import { createSamlServiceProvider } from "@getstrata/core/auth/saml/samlServiceProvider";`);
+    if (github) {
+      imports.push(`import { GitHubOAuthProvider } from "@getstrata/core/auth/oauth/providers";`);
+      imports.push(`import { appUrl } from "@getstrata/core/runtime/appKeyPrefix";`);
+    }
   }
   if (jsonApi) {
     imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
@@ -1344,6 +1373,43 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
     is_admin: user.role === "admin",
   };
 }
+
+async function completeBrowserSsoLogin(
+  dependencies: { container: { resolve: <T>(token: string) => T } },
+  profile: { email: string; name: string },
+  label: string,
+): Promise<Response> {
+  let record = await starterAuthDirectory.findByEmail?.(profile.email);
+  if (!record) {
+    if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
+      return jsonResponse({ error: \`\${label} user is not provisioned.\` }, { status: 403 });
+    }
+    const hashed = await hashPassword(randomBytes(18).toString("hex"));
+    try {
+      await runAuthWrite(profile.email, async () => {
+        await User.create({
+          name: profile.name,
+          email: profile.email,
+          password: hashed,
+          is_admin: false,${samlTenantCreateField}
+        });
+      });
+    } catch {
+      // Unique email: another request already provisioned this user.
+    }
+    record = await starterAuthDirectory.findByEmail?.(profile.email);
+  }
+  if (!record) {
+    return jsonResponse({ error: \`Could not complete \${label} login.\` }, { status: 500 });
+  }
+  ${mfa ? `if (record.mfa_enabled) {
+    const pending = redirectTo("/login/mfa");
+    pending.headers.append("set-cookie", pendingMfaSetCookie(record.id));
+    return pending;
+  }
+  ` : ""}const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+  return auth.signInRedirect(sessionUser(record), "/");
+}
 ` : ""}`;
   const tokenLogin = authUsesToken(layers.auth) ? `
         "/api/v1/auth/login": {
@@ -1580,41 +1646,55 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             if (!profile) {
               return jsonResponse({ error: "Invalid SAML response." }, { status: 400 });
             }
-            let record = await starterAuthDirectory.findByEmail?.(profile.email);
-            if (!record) {
-              if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
-                return jsonResponse({ error: "SAML user is not provisioned." }, { status: 403 });
-              }
-              const hashed = await hashPassword(randomBytes(18).toString("hex"));
-              try {
-                await runAuthWrite(profile.email, async () => {
-                  await User.create({
-                    name: profile.name,
-                    email: profile.email,
-                    password: hashed,
-                    is_admin: false,${samlTenantCreateField}
-                  });
-                });
-              } catch {
-                // Unique email: another request already provisioned this user.
-              }
-              record = await starterAuthDirectory.findByEmail?.(profile.email);
+            return completeBrowserSsoLogin(dependencies, profile, "SAML");
+          })),
+        },` : "";
+  const githubRoutes = github ? `
+        "/auth/github": {
+          GET: kernel.wrap("api", withErrorHandling(async () => {
+            if (process.env.FEATURE_OAUTH !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const clientId = process.env.GITHUB_CLIENT_ID?.trim();
+            const clientSecret = process.env.GITHUB_CLIENT_SECRET?.trim();
+            if (!clientId || !clientSecret) {
+              return new Response("Not found", { status: 404 });
             }
-            if (!record) {
-              return jsonResponse({ error: "Could not complete SAML login." }, { status: 500 });
+            const redirectUri = process.env.GITHUB_REDIRECT_URI?.trim() || \`\${appUrl()}/auth/github/callback\`;
+            const issued = createOAuthState();
+            const url = new GitHubOAuthProvider({ clientId, clientSecret, redirectUri }).getAuthorizationUrl(issued.state);
+            return new Response(null, { status: 302, headers: { location: url } });
+          })),
+        },
+        "/auth/github/callback": {
+          GET: kernel.wrap("api", withErrorHandling(async (request) => {
+            if (process.env.FEATURE_OAUTH !== "true") {
+              return new Response("Not found", { status: 404 });
             }
-            ${mfa ? `if (record.mfa_enabled) {
-              const pending = redirectTo("/login/mfa");
-              pending.headers.append("set-cookie", pendingMfaSetCookie(record.id));
-              return pending;
+            const clientId = process.env.GITHUB_CLIENT_ID?.trim();
+            const clientSecret = process.env.GITHUB_CLIENT_SECRET?.trim();
+            if (!clientId || !clientSecret) {
+              return new Response("Not found", { status: 404 });
+            }
+            const url = new URL(request.url);
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            if (!code || !verifyOAuthState(request, state)) {
+              return jsonResponse({ error: "Invalid GitHub OAuth state." }, { status: 403 });
+            }
+            const redirectUri = process.env.GITHUB_REDIRECT_URI?.trim() || \`\${appUrl()}/auth/github/callback\`;
+            const profile = await new GitHubOAuthProvider({ clientId, clientSecret, redirectUri })
+              .exchangeCode(code)
+              .catch(() => null);
+            if (!profile) {
+              return jsonResponse({ error: "Invalid GitHub OAuth response." }, { status: 400 });
             }
-            ` : ""}const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
-            return auth.signInRedirect(sessionUser(record), "/");
+            return completeBrowserSsoLogin(dependencies, profile, "GitHub");
           })),
         },` : "";
   const apiRoutes = jsonApi || cookie ? `
     routes({ kernel, dependencies }) {
-      return {${csrfRoute}${samlRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
+      return {${csrfRoute}${samlRoutes}${githubRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
       };
     },` : "";
   const mfaLoginBranch = `const mfaResult = completePasswordLogin(user, { mfaCode: mfa_code });
@@ -2228,10 +2308,12 @@ function textField(name, label, type, extra = "") {
       <input type="${type}" name="${name}" value="<%= it.${name} || "" %>" ${extra} />
     </label>`;
 }
-function renderLoginView() {
+function renderLoginView(layers) {
+  const githubLink = layers.extras.oauthGithub && htmlAuthKit(layers.auth) ? `
+    <a href="/auth/github">Sign in with GitHub</a>` : "";
   return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
     ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
-    <a href="/forgot-password">Forgot password</a>`).replace('action="<%= it.action || "" %>"', 'action="/login"');
+    <a href="/forgot-password">Forgot password</a>${githubLink}`).replace('action="<%= it.action || "" %>"', 'action="/login"');
 }
 function renderRegisterView() {
   return renderFormView("Create account", `${textField("name", "Name", "text", "required")}
@@ -2641,6 +2723,8 @@ function renderEnvExample(projectName, layers) {
   lines.push("# wrapWebPublicRead / wrapPublicRead require login when false (production-safe default).");
   lines.push("# Local storefronts/catalogs may set true in .env. Production boot rejects FEATURE_PUBLIC_READS=true.");
   lines.push("FEATURE_SIEM_EXPORT=false");
+  lines.push("# SIEM_EXPORT_URL=");
+  lines.push("# SIEM_EXPORT_TOKEN=");
   lines.push("FEATURE_REGISTRATION=true");
   lines.push("FEATURE_SAML=false");
   lines.push("# SAML_IDP_SSO_URL=");
@@ -2650,6 +2734,30 @@ function renderEnvExample(projectName, layers) {
   lines.push("# SAML_IDP_ISSUER=");
   lines.push("# SAML_WANT_RESPONSE_SIGNED=");
   lines.push("# SAML_DISABLE_REQUESTED_AUTHN_CONTEXT=");
+  const oauthOn = Boolean(layers.extras.oauthGithub);
+  lines.push(`FEATURE_OAUTH=${envFlag(oauthOn)}`);
+  if (oauthOn) {
+    lines.push("GITHUB_CLIENT_ID=");
+    lines.push("GITHUB_CLIENT_SECRET=");
+    lines.push("GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback");
+    lines.push("OAUTH_STATE_SECRET=dev-oauth-state-secret-change-me-please-32");
+  } else {
+    lines.push("# GITHUB_CLIENT_ID=");
+    lines.push("# GITHUB_CLIENT_SECRET=");
+    lines.push("# GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback");
+    lines.push("# OAUTH_STATE_SECRET=");
+  }
+  lines.push("# OIDC cookie login is not generated. Use GitHub cookie routes (--oauth-github) or app-owned PKCE.");
+  const billingOn = Boolean(layers.extras.billing);
+  lines.push(`FEATURE_BILLING=${envFlag(billingOn)}`);
+  if (billingOn) {
+    lines.push("STRIPE_WEBHOOK_SECRET=whsec_change-me");
+  } else {
+    lines.push("# STRIPE_WEBHOOK_SECRET=");
+  }
+  lines.push("# Outbound webhook deliveries (create-strata --webhooks). Local receivers:");
+  lines.push("# WEBHOOK_ALLOW_PRIVATE=true");
+  lines.push("# WEBHOOK_SIGNATURE_HEADER=");
   if (needsRedis(layers)) {
     lines.push("REDIS_PASSWORD=dev-redis-change-me");
     lines.push("REDIS_URL=redis://:dev-redis-change-me@127.0.0.1:6379");
@@ -2858,9 +2966,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^1.1.4",
-    "@getstrata/cli": "^1.1.4",
-    "@getstrata/core": "^1.1.4"
+    "@getstrata/bootstrap": "^1.1.5",
+    "@getstrata/cli": "^1.1.5",
+    "@getstrata/core": "^1.1.5"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -2975,6 +3083,15 @@ function renderApiDocs(projectName, layers) {
   if (layers.extras.metrics) {
     rows.push("| `GET` | `/metrics` | Prometheus text. Production requires `Authorization: Bearer <METRICS_TOKEN>`. |");
   }
+  if (layers.extras.billing) {
+    rows.push("| `POST` | `/billing/webhooks/stripe` | Stripe signature verification. CSRF skipped by path. Plan sync is yours. |", "| `GET` | `/api/v1/billing/subscription` | Current tenant (or first) subscription row. |");
+  }
+  if (layers.extras.webhooks) {
+    rows.push("| (job) | `webhook.dispatch` | Discovered from `src/jobs/dispatchOutboundWebhookJob.ts`. No HTTP route. |");
+  }
+  if (layers.extras.oauthGithub && authUsesCookie(layers.auth)) {
+    rows.push("| `GET` | `/auth/github` | Redirects to GitHub. 404 unless `FEATURE_OAUTH=true`. |", "| `GET` | `/auth/github/callback` | Exchanges the code, JIT user, MFA gate, cookie session. |");
+  }
   const authNote = layers.auth === "headers" ? `Auth is \`headers\`. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`) for local work and tests. There are no login endpoints and no \`users\` table. Production must set \`AUTH_DEV_HEADERS=false\`, which turns those headers off and leaves you without a guard, so pick another auth layer before you ship.` : authUsesToken(layers.auth) ? `Sign in with \`GET /api/v1/auth/csrf\` then \`POST /api/v1/auth/login\` (send \`X-CSRF-Token\`), then send \`Authorization: Bearer <token>\` on every request. Tokens are stored hashed in \`api_tokens\` and expire after \`API_TOKEN_DEFAULT_EXPIRY_DAYS\` (30 in \`.env.example\`). The response includes \`expires_at\`.` : `Mint a JWT with \`POST /api/auth/token\`, then send \`Authorization: Bearer <jwt>\`. JWTs expire; re-mint rather than refreshing in place.`;
   return `# ${projectName} API
 
@@ -3026,6 +3143,42 @@ Import from \`@getstrata/core/...\` subpaths rather than the package root, so si
 - [Databases](https://github.com/EyK-26/strata/blob/main/docs/DATABASE.md)
 `;
 }
+function renderIntegrationsReadme(layers) {
+  const enabled = [
+    layers.extras.oauthGithub ? "GitHub OAuth cookie login (`/auth/github`)" : null,
+    layers.extras.billing ? "Stripe billing stub (`POST /billing/webhooks/stripe`, `GET /api/v1/billing/subscription`)" : null,
+    layers.extras.webhooks ? "Outbound webhooks (`notes.created` listener + `webhook.dispatch` job)" : null
+  ].filter((row) => row !== null);
+  const lines = [
+    "## Integrations",
+    "",
+    "OAuth, billing, outbound webhooks, SIEM, and SAML are **off by default**. Commented placeholders live in `.env.example`. Framework map: [INTEGRATIONS.md](https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md).",
+    "",
+    "Wizard flags (any stack unless noted): `--oauth-github` (cookie HTML), `--billing`, `--webhooks`. They emit modules, migrations, jobs, or listeners. `createApp` still calls `discoverListeners()` and `discoverJobs()`.",
+    ""
+  ];
+  if (enabled.length > 0) {
+    lines.push("Enabled in this app:", "", ...enabled.map((row) => `- ${row}`), "");
+  } else {
+    lines.push("This app did not pass those flags. Turn a flag on and re-run `create-strata`, or copy the commented env block and add a module yourself.", "");
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function renderOpenApiReadme() {
+  return `## OpenAPI
+
+After you add routes, regenerate and commit the spec so CI can catch drift:
+
+\`\`\`bash
+bunx strata openapi:generate
+bunx strata openapi:check
+\`\`\`
+
+Put \`openapi:check\` in CI. A failure means \`docs/openapi.json\` does not match the live route map (billing, auth, webhooks, and anything else you added).
+`;
+}
 function renderReadmeIntro(projectName, options) {
   if (options.dogfood) {
     return `# ${projectName}
@@ -3075,8 +3228,9 @@ function renderReadme(projectName, layers, options = {}) {
 | Docker Compose | ${dockerLabel} |
 ${extras.length > 0 ? `| Extras | ${extras.join(", ")} |
 ` : ""}
-This file is the map for this app. Framework guides: [Building apps](https://github.com/EyK-26/strata/blob/main/docs/BUILDING-APPS.md), [Auth](https://github.com/EyK-26/strata/blob/main/docs/AUTH.md), [Starter](https://github.com/EyK-26/strata/blob/main/docs/STARTER.md).
+This file is the map for this app. Framework guides: [Building apps](https://github.com/EyK-26/strata/blob/main/docs/BUILDING-APPS.md), [Auth](https://github.com/EyK-26/strata/blob/main/docs/AUTH.md), [Starter](https://github.com/EyK-26/strata/blob/main/docs/STARTER.md), [Integrations](https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md).
 
+${renderIntegrationsReadme(layers)}
 ## Run it
 
 \`\`\`bash
@@ -3101,7 +3255,7 @@ HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
 - Register: \`/register\`
 - Forgot password: \`/forgot-password\`
 - Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
-${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`)\n" : ""}
 Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
 ` : ""}${authUsesToken(layers.auth) ? `
 Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
@@ -3125,6 +3279,7 @@ Until \`frontend/dist\` exists, \`${layers.spaPrefix}\` answers 503. Use \`bun r
 
 The app uses the database named in \`DATABASE_URL\` and creates it on first migrate when the connection user may. Set \`APP_DATABASE_URL\` only when migrations and the app should target a different database than \`DATABASE_URL\`.${usesComposePostgres(layers) ? ` \`.env.example\` points \`DATABASE_URL\` at \`${GENERATED_POSTGRES_APP_ROLE}\` (\`NOSUPERUSER\` \`NOBYPASSRLS\`), including \`--no-docker\`. \`db/ensure-postgres-app-role.sql\` is repeatable on an existing volume; Compose init still runs on first empty volume. The \`postgres\` superuser is for CREATE ROLE / GRANT / migrate and Adminer.` : ""}
 `}
+${renderOpenApiReadme()}
 ## Deploy
 
 \`Dockerfile\` builds a production image from the committed \`bun.lock\` (run \`bun install\` once and commit the lockfile).${needsFrontendBuild(layers.frontend) ? " The React frontend is built inside the image." : ""}
@@ -3147,7 +3302,7 @@ The image sets \`APP_ENV=production\` and \`AUTH_DEV_HEADERS=false\`; everything
 - Set \`FEATURE_PUBLIC_READS=false\`. Generated \`.env.example\` already ships \`false\` so \`wrapWebPublicRead\` requires a login. Local storefronts may set \`true\` in \`.env\` for an anonymous catalog; \`assertProductionSecrets()\` rejects \`true\` in production. Do not ship a public-reads production boot.
 - Cross-origin browser calls are off in production until you set \`CORS_ALLOWED_ORIGINS\` to explicit origins. A \`*\` entry is rejected. Non-browser clients are unaffected.
 - Behind a reverse proxy or load balancer, set \`TRUST_FORWARDED_FOR=true\` so throttles and session records see the client address instead of the proxy. Only the rightmost public hop of \`X-Forwarded-For\` is trusted.
-${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
+${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.extras.oauthGithub ? "- Set `OAUTH_STATE_SECRET` and `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`.\n" : ""}${layers.extras.billing ? "- Set `STRIPE_WEBHOOK_SECRET` when `FEATURE_BILLING=true`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
 ` : ""}
 \`strata start\` does not migrate when \`APP_ENV=production\`. Run \`bun run db:migrate\` as a deploy step. \`GET /health\` is 200 when \`notes\` is readable (including zero rows) and 503 when that read fails. Redis jobs need a worker: \`bun run queue:work\` (requires \`REDIS_URL\`).
 `;
@@ -3931,6 +4086,29 @@ export type { AuthOneTimeTokenRecord };
 export { AuthOneTimeToken };
 `;
 }
+function renderModelsRegister(layers) {
+  const lines = [
+    "// Side-effect imports run registerModelRepository() in each model file.",
+    "// registerModelClass() is only for a string alias that is neither constructor.name nor $morphClass.",
+    'import { registerModelClass } from "@getstrata/core/database/model";',
+    'import "./Note.ts";'
+  ];
+  if (authNeedsUsers(layers.auth)) {
+    lines.push('import "./User.ts";');
+    lines.push('import "./AuthOneTimeToken.ts";');
+  }
+  if (authUsesToken(layers.auth)) {
+    lines.push('import "./ApiToken.ts";');
+  }
+  lines.push("");
+  lines.push("// Example after you add a Product model with belongsTo('Category'):");
+  lines.push('// registerModelClass("Category", Category);');
+  lines.push("void registerModelClass;");
+  lines.push("");
+  return `${lines.join(`
+`)}
+`;
+}
 function dropTables(layers) {
   const ordered = ["failed_job"];
   if (authUsesToken(layers.auth)) {
@@ -4040,6 +4218,7 @@ function renderPreloadTs(layers, projectName) {
 ` : "";
   return `import { join } from "node:path";
 import { configureModulesDirectory } from "@getstrata/bootstrap/discoverModules";
+import "../models/register.ts";
 
 process.env.DATABASE_URL ??= ${JSON.stringify(fallback)};
 ${migrationLine}process.env.FRONTEND_MODE ??= ${JSON.stringify(layers.frontend)};
@@ -4605,6 +4784,286 @@ export function plainText(body: string, status = 200): Response {
 `;
 }
 
+// src/renderIntegrations.ts
+function activeBoolColumn(database) {
+  if (database === "postgres") {
+    return "BOOLEAN NOT NULL DEFAULT TRUE";
+  }
+  if (database === "mysql") {
+    return "TINYINT(1) NOT NULL DEFAULT 1";
+  }
+  return "INTEGER NOT NULL DEFAULT 1";
+}
+function webhookMigrationName(layers) {
+  if (!layers.extras.webhooks) {
+    return null;
+  }
+  return "0002_webhooks_schema";
+}
+function billingMigrationName(layers) {
+  if (!layers.extras.billing) {
+    return null;
+  }
+  return layers.extras.webhooks ? "0003_billing_schema" : "0002_billing_schema";
+}
+function renderFileMigration(name, upSql, downSql) {
+  const upCalls = upSql.map((sql) => `    await db.unsafe(${JSON.stringify(sql)});`).join(`
+`);
+  const downCalls = downSql.map((sql) => `    await db.unsafe(${JSON.stringify(sql)});`).join(`
+`);
+  return `import type { Migration } from "@getstrata/core/database/migrations/types";
+
+const migration: Migration = {
+  name: ${JSON.stringify(name)},
+  async up(db) {
+${upCalls}
+  },
+  async down(db) {
+${downCalls}
+  },
+};
+
+export default migration;
+`;
+}
+function renderWebhooksMigration(layers) {
+  const name = webhookMigrationName(layers);
+  if (!name) {
+    return null;
+  }
+  const d = dialectFragments(layers.database);
+  const payloadType = layers.database === "postgres" ? "JSONB NOT NULL" : `${d.text} NOT NULL`;
+  const cascade = layers.database === "sqlite" ? "" : " CASCADE";
+  return renderFileMigration(name, [
+    `CREATE TABLE IF NOT EXISTS webhooks (
+    id ${d.id},
+    url ${d.text} NOT NULL,
+    secret ${d.text} NOT NULL,
+    events ${d.defaultText} NOT NULL DEFAULT '*',
+    active ${activeBoolColumn(layers.database)},
+    created_at ${d.timestamp}
+  )`,
+    `CREATE TABLE IF NOT EXISTS webhook_deliveries (
+    id ${d.id},
+    webhook_id INTEGER NOT NULL,
+    event ${d.keyText} NOT NULL,
+    payload ${payloadType},
+    response_status INTEGER,
+    attempt INTEGER NOT NULL DEFAULT 1,
+    error ${d.text},
+    created_at ${d.timestamp}
+  )`
+  ], [
+    `DROP TABLE IF EXISTS webhook_deliveries${cascade}`,
+    `DROP TABLE IF EXISTS webhooks${cascade}`
+  ]);
+}
+function renderBillingMigration(layers) {
+  const name = billingMigrationName(layers);
+  if (!name) {
+    return null;
+  }
+  const d = dialectFragments(layers.database);
+  const tenancyOn = usesTenantTable(layers.tenancy);
+  const cascade = layers.database === "sqlite" ? "" : " CASCADE";
+  const up = [];
+  if (tenancyOn) {
+    up.push(`ALTER TABLE tenant ADD COLUMN stripe_customer_id ${d.keyText}`);
+  }
+  const tenantColumn = tenancyOn ? `
+    tenant_id INTEGER NOT NULL,` : "";
+  up.push(`CREATE TABLE IF NOT EXISTS subscription (
+    id ${d.id},${tenantColumn}
+    stripe_subscription_id ${d.keyText} UNIQUE,
+    plan ${d.defaultText} NOT NULL DEFAULT 'free',
+    status ${d.defaultText} NOT NULL DEFAULT 'active',
+    current_period_end ${d.timestampNull},
+    created_at ${d.timestamp},
+    updated_at ${d.timestamp}
+  )`);
+  const eventTenant = tenancyOn ? `
+    tenant_id INTEGER,` : "";
+  up.push(`CREATE TABLE IF NOT EXISTS stripe_webhook_event (
+    id ${d.keyText} PRIMARY KEY,
+    event_type ${d.keyText} NOT NULL,${eventTenant}
+    processed_at ${d.timestamp}
+  )`);
+  const down = [
+    `DROP TABLE IF EXISTS stripe_webhook_event${cascade}`,
+    `DROP TABLE IF EXISTS subscription${cascade}`
+  ];
+  return renderFileMigration(name, up, down);
+}
+function renderDispatchOutboundWebhookJob() {
+  return `import { Job } from "@getstrata/core/queue";
+import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
+import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
+import { safeFetch } from "@getstrata/core/security/safeFetch";
+import { signWebhookBody } from "@getstrata/core/security/webhookSignature";
+import { getSql } from "../bootstrap/database.ts";
+
+interface DispatchOutboundWebhookPayload {
+  webhookId: number;
+  url: string;
+  secret: string;
+  body: string;
+}
+
+class DispatchOutboundWebhookJob extends Job<DispatchOutboundWebhookPayload> {
+  static readonly jobName = "webhook.dispatch";
+
+  override async handle(payload: DispatchOutboundWebhookPayload): Promise<void> {
+    const allowPrivate = !isProductionEnv() && process.env.WEBHOOK_ALLOW_PRIVATE === "true";
+    let responseStatus: number | null = null;
+    let error: string | null = null;
+    try {
+      const response = await safeFetch(
+        payload.url,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            [webhookSignatureHeader()]: signWebhookBody(payload.secret, payload.body),
+          },
+          body: payload.body,
+        },
+        { timeoutMs: 10_000, maxRedirects: 0, allowPrivate, allowHttp: allowPrivate },
+      );
+      responseStatus = response.status;
+      if (!response.ok) {
+        error = \`HTTP \${response.status}\`;
+      }
+    } catch (caught) {
+      error = caught instanceof Error ? caught.message : "webhook dispatch failed";
+    }
+
+    await getSql().unsafe(
+      "INSERT INTO webhook_deliveries (webhook_id, event, payload, response_status, attempt, error) VALUES (?, ?, ?, ?, ?, ?)",
+      [payload.webhookId, "notes.created", payload.body, responseStatus, 1, error],
+    );
+  }
+}
+
+export default DispatchOutboundWebhookJob;
+export type { DispatchOutboundWebhookPayload };
+`;
+}
+function renderNoteCreatedWebhookListener() {
+  return `import { eventBus, modelEventName } from "@getstrata/core/events";
+import { resolveApplicationQueue } from "@getstrata/core/runtime/applicationRegistry";
+import { getSql } from "../bootstrap/database.ts";
+import DispatchOutboundWebhookJob from "../jobs/dispatchOutboundWebhookJob.ts";
+
+function registerNoteCreatedWebhookListener(): void {
+  eventBus.listen(modelEventName("notes", "created"), async (payload) => {
+    const rows = await getSql().unsafe<{
+      id: number;
+      url: string;
+      secret: string;
+      active: number | boolean;
+    }>("SELECT id, url, secret, active FROM webhooks");
+    const queue = resolveApplicationQueue();
+    const body = JSON.stringify({ event: "notes.created", data: payload });
+    for (const hook of rows) {
+      if (!hook.active) {
+        continue;
+      }
+      await queue.dispatch(new DispatchOutboundWebhookJob(), {
+        webhookId: hook.id,
+        url: hook.url,
+        secret: hook.secret,
+        body,
+      });
+    }
+  });
+}
+
+export default registerNoteCreatedWebhookListener;
+`;
+}
+function renderBillingModule(layers) {
+  const tenancyOn = usesTenantTable(layers.tenancy);
+  const tenantImport = tenancyOn ? `import { currentTenant } from "@getstrata/core/tenant/tenantContext";
+` : "";
+  const subscriptionQuery = tenancyOn ? `        const tenant = currentTenant();
+        if (!tenant) {
+          return jsonResponse({ error: "Tenant context is required." }, { status: 500 });
+        }
+        const rows = await getSql().unsafe<Record<string, unknown>>(
+          "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription WHERE tenant_id = ? LIMIT 1",
+          [tenant.id],
+        );` : `        const rows = await getSql().unsafe<Record<string, unknown>>(
+          "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription LIMIT 1",
+        );`;
+  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";
+import { verifyStripeWebhookSignature } from "@getstrata/core/security/stripeWebhook";
+${tenantImport}import { getSql } from "../../bootstrap/database.ts";
+
+function billingEnabled(): boolean {
+  return process.env.FEATURE_BILLING === "true";
+}
+
+const billingModule: AppModule = {
+  name: "billing",
+  order: 40,
+  routes({ kernel }) {
+    return {
+      "/billing/webhooks/stripe": {
+        POST: kernel.wrap(
+          "api",
+          withErrorHandling(async (request) => {
+            if (!billingEnabled()) {
+              return new Response("Not found", { status: 404 });
+            }
+            const secret = process.env.STRIPE_WEBHOOK_SECRET?.trim();
+            if (!secret) {
+              return jsonResponse({ error: "STRIPE_WEBHOOK_SECRET is not set." }, { status: 503 });
+            }
+            const rawBody = await request.text();
+            verifyStripeWebhookSignature(rawBody, request.headers.get("stripe-signature"), secret);
+            let event: { id?: string; type?: string; data?: { object?: Record<string, unknown> } };
+            try {
+              event = JSON.parse(rawBody) as typeof event;
+            } catch {
+              return jsonResponse({ error: "Invalid JSON." }, { status: 400 });
+            }
+            // Persist event.id on stripe_webhook_event yourself. Stripe POSTs have no tenant ALS.
+            // Wrap those writes in runWithMigrationBypass when TENANCY_DRIVER=rls.
+            // See https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md
+            void event.data;
+            return jsonResponse({ received: true, id: event.id ?? null, type: event.type ?? null });
+          }),
+        ),
+      },
+      "/api/v1/billing/subscription": {
+        GET: kernel.wrapApi(
+          withErrorHandling(async () => {
+            if (!billingEnabled()) {
+              return new Response("Not found", { status: 404 });
+            }
+${subscriptionQuery}
+            const row = rows[0];
+            if (!row) {
+              return jsonResponse({ plan: "free", status: "none" });
+            }
+            return jsonResponse({
+              plan: row.plan ?? "free",
+              status: row.status ?? "none",
+              stripe_subscription_id: row.stripe_subscription_id ?? null,
+              current_period_end: row.current_period_end ?? null,
+            });
+          }),
+        ),
+      },
+    };
+  },
+};
+
+export default billingModule;
+`;
+}
+
 // src/renderScim.ts
 function renderScimModule(layers) {
   if (!layers.extras.scim || !authNeedsUsers(layers.auth)) {
@@ -5026,9 +5485,23 @@ function writeGeneratedFiles(options) {
   } else {
     removeIfExists(join2(src, "models/ApiToken.ts"));
   }
+  writeText(join2(src, "models/register.ts"), renderModelsRegister(layers));
   writeText(join2(src, "db/migrate.ts"), renderMigrateTs(layers));
   writeText(join2(src, "db/migrationRuntime.ts"), renderMigrationRuntimeTs(layers));
   writeText(join2(src, "db/migrations/0001_starter_schema.ts"), renderStarterSchemaMigration(layers));
+  removeIfExists(join2(src, "db/migrations/0002_webhooks_schema.ts"));
+  removeIfExists(join2(src, "db/migrations/0002_billing_schema.ts"));
+  removeIfExists(join2(src, "db/migrations/0003_billing_schema.ts"));
+  const webhooksMigration = renderWebhooksMigration(layers);
+  const webhooksName = webhookMigrationName(layers);
+  if (webhooksMigration && webhooksName) {
+    writeText(join2(src, `db/migrations/${webhooksName}.ts`), webhooksMigration);
+  }
+  const billingMigration = renderBillingMigration(layers);
+  const billingName = billingMigrationName(layers);
+  if (billingMigration && billingName) {
+    writeText(join2(src, `db/migrations/${billingName}.ts`), billingMigration);
+  }
   writeText(join2(src, "db/fresh.ts"), renderFreshTs(layers));
   writeText(join2(src, "db/seed.ts"), renderSeedTs());
   writeText(join2(src, "db/status.ts"), renderStatusTs(layers));
@@ -5052,6 +5525,18 @@ function writeGeneratedFiles(options) {
   } else {
     removeIfExists(join2(src, "modules/scim/index.ts"));
   }
+  if (layers.extras.billing) {
+    writeText(join2(src, "modules/billing/index.ts"), renderBillingModule(layers));
+  } else {
+    removeIfExists(join2(src, "modules/billing/index.ts"));
+  }
+  if (layers.extras.webhooks) {
+    writeText(join2(src, "jobs/dispatchOutboundWebhookJob.ts"), renderDispatchOutboundWebhookJob());
+    writeText(join2(src, "listeners/noteCreatedWebhookListener.ts"), renderNoteCreatedWebhookListener());
+  } else {
+    removeIfExists(join2(src, "jobs/dispatchOutboundWebhookJob.ts"));
+    removeIfExists(join2(src, "listeners/noteCreatedWebhookListener.ts"));
+  }
   if (layers.extras.mfa && htmlAuthKit(layers.auth)) {
     writeText(join2(src, "bootstrap/pendingMfa.ts"), renderPendingMfaTs());
   } else {
@@ -5072,7 +5557,7 @@ function writeGeneratedFiles(options) {
   writeText(join2(targetDir, "views/home.eta"), renderHomeView(projectName, layers));
   writeText(join2(targetDir, "views/layouts/app.eta"), renderLayout(layers, projectName));
   if (htmlAuthKit(layers.auth)) {
-    writeText(join2(targetDir, "views/auth/login.eta"), renderLoginView());
+    writeText(join2(targetDir, "views/auth/login.eta"), renderLoginView(layers));
     writeText(join2(targetDir, "views/auth/register.eta"), renderRegisterView());
     writeText(join2(targetDir, "views/auth/forgot-password.eta"), renderForgotPasswordView());
     writeText(join2(targetDir, "views/auth/reset-password.eta"), renderResetPasswordView());

package/dist/templates/package.json

@@ -12,9 +12,9 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@getstrata/bootstrap": "^1.1.4",
-    "@getstrata/cli": "^1.1.4",
-    "@getstrata/core": "^1.1.4",
+    "@getstrata/bootstrap": "^1.1.5",
+    "@getstrata/cli": "^1.1.5",
+    "@getstrata/core": "^1.1.5",
     "eta": "^4.6.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/starter",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Interactive create-strata wizard. Choose each layer; one database engine.",
   "type": "module",
   "license": "MIT",