@stratum-hq/create 0.2.3 → 0.3.1

package/CHANGELOG.md

@@ -0,0 +1,42 @@
+# @stratum-hq/create
+
+## 0.3.1
+
+### Patch Changes
+
+- b55ae70: Correct and complete package metadata for the npm registry listing.
+
+  Every published package now declares `license` (MIT), `author`, `homepage`, and
+  `bugs`. Runtime packages declare `engines` (Node >=20) to match the project's
+  support policy; this fixes `@stratum-hq/cli`, which previously declared Node >=18.
+  `@stratum-hq/mysql` and `@stratum-hq/mongodb` gain the `keywords` array they were
+  missing. No runtime code changes.
+
+- c17b1a5: Point `@stratum-hq/create`'s `exports["./matrix"]` at built output instead of raw source (#219, from the #133 v1.0 surface review).
+
+  The `./matrix` subpath previously resolved (and shipped) `./src/matrix.ts` for both the `import` and `types` conditions, blessing a raw-source subpath unlike every other package. The build now emits `dist/matrix.js` and `./matrix` resolves there, matching the package's `.` entry. The stack-combination matrix API is unchanged.
+
+- c17b1a5: Give the `@stratum-hq/db-adapters` barrel one consistent naming scheme for the tenant-context helpers (#219, from the #133 v1.0 surface review).
+
+  The barrel previously exposed the same "run in tenant context" concept under colliding names patched over with `as` aliases. The 1.0 names use an `<orm>` prefix so no export is an alias workaround:
+  - `withTenant` (Prisma) -> `prismaWithTenant`
+  - `withDrizzleTenant` -> `drizzleWithTenant`
+  - `withTenantScope` (Sequelize) -> `sequelizeWithTenantScope`
+  - `withDrizzleTenantScope` -> `drizzleWithTenantScope`
+  - `enableRLSMigration` (migration helper) -> `enableRLSForMigration` (distinct from the runtime `enableRLS`)
+
+  Behavior is identical; only the exported names change. The `@stratum-hq/cli` and `@stratum-hq/create` scaffolding templates emit the new `prismaWithTenant` name. Update your imports to the new names.
+
+- 4adcbb5: Stop shipping test files in published tarballs. tsc-built packages now exclude **tests** directories and .test/.spec files from compilation, so dist and the tarball contain only real package output. The create package, which ships source for its ./matrix export, excludes tests via .npmignore instead. The vitest runner is unaffected and still runs tests from src.
+
+## 0.3.0
+
+### Minor Changes
+
+- Security hardening release plus ecosystem polish: NestJS ALS context-leak fix, SSRF-safe webhook validation, production JWT/HKDF enforcement, fail-closed ORM adapters, SHA-pinned CI (#84); `create --preset` architecture with ORM-aware generators and Stack Wizard (#85); scaffolded projects now target Next 15 / React 19 / NestJS 11; MIT LICENSE and READMEs shipped in every package; dependency security bumps across the workspace.
+
+## 0.2.3
+
+### Patch Changes
+
+- Security hardening: fix NestJS tenant context leak, SSRF bypass in webhook delivery, RLS session scoping, fail-closed DB adapters, JWT secret hardening, tenant endpoint scoping, Knex INSERT injection, GitHub Actions pinning

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Christian Crank
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,52 @@
+# @stratum-hq/create
+
+Scaffold a complete [Stratum](https://github.com/stratum-hq/Stratum) multi-tenancy project with one command — package.json, Docker Compose, environment files, and framework-specific starter code.
+
+## Usage
+
+```bash
+npx @stratum-hq/create my-app
+```
+
+This creates a `my-app/` directory containing:
+
+- `package.json` with `@stratum-hq/lib`, `pg`, and your chosen framework
+- `docker-compose.yml` with PostgreSQL 16 and the `ltree` + `uuid-ossp` extensions pre-loaded
+- `.env.example` with `DATABASE_URL` and other defaults
+- A starter server wired up with Stratum middleware
+- `README.md` with getting-started instructions
+
+## Options
+
+```bash
+npx @stratum-hq/create my-app [options]
+
+  --template <name>   express (default), fastify, or nextjs
+  --skip-install      skip npm install after scaffolding
+  --force             overwrite an existing directory
+```
+
+## Templates
+
+- **express** (default) — Express server with Stratum middleware, tenant-aware routes, and TypeScript config.
+- **fastify** — Fastify server with the Stratum plugin registered.
+- **nextjs** — Next.js project with edge middleware for tenant resolution and server-side helpers.
+
+## After Scaffolding
+
+```bash
+cd my-app
+docker compose up -d   # start PostgreSQL
+npm run dev            # run the app
+```
+
+The generated project uses `autoMigrate: true`, so Stratum creates its tables automatically on first run — no separate migration step.
+
+## Links
+
+- Documentation: https://docs.stratum-hq.org/packages/create/
+- GitHub: https://github.com/stratum-hq/Stratum
+
+## License
+
+MIT © Christian Crank