@stratum-hq/create 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @stratum-hq/create
 
+## 0.4.0
+
+### Minor Changes
+
+- 1669fd7: Harden defaults in generated projects, CLI checks, React hooks and test helpers (GHSA-rrrp-gww6-44gr). Behavior changes: `StratumProvider`'s `apiKey` is optional and generated React code uses a server-side proxy instead; `TenantThemeProvider` ignores `customCss` that is not plain declarations; `assertConfigInheritance` now takes a Stratum instance instead of a pg pool.
+
+### Patch Changes
+
+- 9de2ddb: Remove unused code from the generator. No change in generated output.
+- dca0826: Harden tenant isolation in the schema-per-tenant and database-per-tenant strategies and the Prisma and Drizzle adapters (GHSA-jhhc-cm2c-jh27). Behavior change: the schema-per-tenant `search_path` is now the tenant schema alone, without `public`; queries that call extension functions or types from another schema must schema-qualify them or opt that schema in with the new `extraSearchPath` option.
+
+## 0.3.1
+
+### Patch Changes
+
+- b55ae70: Correct and complete package metadata for the npm registry listing.
+
+  Every published package now declares `license` (MIT), `author`, `homepage`, and
+  `bugs`. Runtime packages declare `engines` (Node >=20) to match the project's
+  support policy; this fixes `@stratum-hq/cli`, which previously declared Node >=18.
+  `@stratum-hq/mysql` and `@stratum-hq/mongodb` gain the `keywords` array they were
+  missing. No runtime code changes.
+
+- c17b1a5: Point `@stratum-hq/create`'s `exports["./matrix"]` at built output instead of raw source (#219, from the #133 v1.0 surface review).
+
+  The `./matrix` subpath previously resolved (and shipped) `./src/matrix.ts` for both the `import` and `types` conditions, blessing a raw-source subpath unlike every other package. The build now emits `dist/matrix.js` and `./matrix` resolves there, matching the package's `.` entry. The stack-combination matrix API is unchanged.
+
+- c17b1a5: Give the `@stratum-hq/db-adapters` barrel one consistent naming scheme for the tenant-context helpers (#219, from the #133 v1.0 surface review).
+
+  The barrel previously exposed the same "run in tenant context" concept under colliding names patched over with `as` aliases. The 1.0 names use an `<orm>` prefix so no export is an alias workaround:
+  - `withTenant` (Prisma) -> `prismaWithTenant`
+  - `withDrizzleTenant` -> `drizzleWithTenant`
+  - `withTenantScope` (Sequelize) -> `sequelizeWithTenantScope`
+  - `withDrizzleTenantScope` -> `drizzleWithTenantScope`
+  - `enableRLSMigration` (migration helper) -> `enableRLSForMigration` (distinct from the runtime `enableRLS`)
+
+  Behavior is identical; only the exported names change. The `@stratum-hq/cli` and `@stratum-hq/create` scaffolding templates emit the new `prismaWithTenant` name. Update your imports to the new names.
+
+- 4adcbb5: Stop shipping test files in published tarballs. tsc-built packages now exclude **tests** directories and .test/.spec files from compilation, so dist and the tarball contain only real package output. The create package, which ships source for its ./matrix export, excludes tests via .npmignore instead. The vitest runner is unaffected and still runs tests from src.
+
 ## 0.3.0
 
 ### Minor Changes

package/dist/index.js

@@ -37,19 +37,14 @@ var ALL_STRATEGIES = ["rls", "schema", "database", "collection", "table-prefix"]
 var ALL_ORMS = ["prisma", "drizzle", "sequelize", "knex", "mongoose", "pg"];
 function isValidPreset(preset) {
   const config = VALID_COMBINATIONS[preset.database];
-  if (!config)
-    return false;
-  if (!config.strategies.includes(preset.strategy))
-    return false;
-  if (!config.orms.includes(preset.orm))
-    return false;
-  if (!config.frameworks.includes(preset.framework))
-    return false;
+  if (!config) return false;
+  if (!config.strategies.includes(preset.strategy)) return false;
+  if (!config.orms.includes(preset.orm)) return false;
+  if (!config.frameworks.includes(preset.framework)) return false;
   return true;
 }
 function parsePresetString(s) {
-  if (!s || typeof s !== "string")
-    return null;
+  if (!s || typeof s !== "string") return null;
   const parts = s.toLowerCase().split("-");
   let database;
   let strategy;
@@ -65,14 +60,10 @@ function parsePresetString(s) {
   } else {
     return null;
   }
-  if (!ALL_DATABASES.includes(database))
-    return null;
-  if (!ALL_STRATEGIES.includes(strategy))
-    return null;
-  if (!ALL_ORMS.includes(orm))
-    return null;
-  if (!ALL_FRAMEWORKS.includes(framework))
-    return null;
+  if (!ALL_DATABASES.includes(database)) return null;
+  if (!ALL_STRATEGIES.includes(strategy)) return null;
+  if (!ALL_ORMS.includes(orm)) return null;
+  if (!ALL_FRAMEWORKS.includes(framework)) return null;
   return {
     database,
     strategy,
@@ -182,6 +173,36 @@ volumes:
 }
 
 // src/generators/init-sql.ts
+function postgresAppRole(dbName) {
+  return `${dbName}_app`;
+}
+var POSTGRES_APP_PASSWORD = "dev_app_password";
+function postgresAppRoleSql(dbName, strategy) {
+  const role = postgresAppRole(dbName);
+  let strategyGrant = "";
+  if (strategy === "schema") {
+    strategyGrant = `
+-- schema-per-tenant: the app creates one schema per tenant
+GRANT CREATE ON DATABASE ${dbName} TO ${role};
+`;
+  } else if (strategy === "database") {
+    strategyGrant = `
+-- database-per-tenant: the app creates one database per tenant
+ALTER ROLE ${role} CREATEDB;
+`;
+  }
+  return `
+-- Application role. The app connects as ${role} (DATABASE_URL), never as the
+-- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. Use the superuser
+-- only for bootstrap and migrations.
+CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+${strategyGrant}`;
+}
 function generatePresetInitSql(projectName, preset) {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
   switch (preset.database) {
@@ -201,10 +222,13 @@ function generatePostgresInit(projectName, dbName, strategy) {
 -- Add RLS policies to each tenant-scoped table:
 --
 --   ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+--   ALTER TABLE your_table FORCE ROW LEVEL SECURITY;
 --   CREATE POLICY tenant_isolation ON your_table
---     USING (tenant_id = current_setting('app.current_tenant')::uuid);
+--     USING (tenant_id = current_setting('app.current_tenant_id')::uuid);
 --
--- The Stratum db-adapters package sets app.current_tenant automatically.
+-- FORCE makes the policy apply to the table owner too; without it, a table
+-- created by the application role is not isolated for that role.
+-- The Stratum db-adapters package sets app.current_tenant_id automatically.
 `;
   }
   return `-- Initialize ${projectName} database
@@ -215,7 +239,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-${rlsBlock}`;
+${postgresAppRoleSql(dbName, strategy)}${rlsBlock}`;
 }
 function generateMysqlInit(projectName, dbName) {
   return `-- Initialize ${projectName} database
@@ -252,7 +276,6 @@ function generateDbSetup(preset) {
 }
 function generatePrismaSetup(preset) {
   const provider = preset.database === "mysql" ? "mysql" : "postgresql";
-  const envUrl = preset.database === "mysql" ? "mysql://user:password@localhost:3306/dbname" : "postgres://user:password@localhost:5432/dbname";
   return [
     {
       filename: "prisma/schema.prisma",
@@ -283,7 +306,7 @@ model Tenant {
       content: `// Prisma client with Stratum tenant-scoped queries
 import { PrismaClient } from "@prisma/client";
 import { Pool } from "pg";
-import { withTenant } from "@stratum-hq/db-adapters";
+import { prismaWithTenant } from "@stratum-hq/db-adapters";
 
 const prisma = new PrismaClient();
 const pool = new Pool({
@@ -293,7 +316,7 @@ const pool = new Pool({
 // Create a tenant-scoped Prisma client.
 // All queries through this client are automatically filtered by RLS.
 export function createTenantPrisma(getTenantId: () => string) {
-  return withTenant(prisma, getTenantId, pool);
+  return prismaWithTenant(prisma, getTenantId, pool);
 }
 
 // Usage:
@@ -330,7 +353,7 @@ export const db = drizzle(connection);
       content: `// Drizzle ORM with Stratum tenant-scoped queries
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
-import { withTenantDrizzle } from "@stratum-hq/db-adapters";
+import { drizzleWithTenant } from "@stratum-hq/db-adapters";
 
 const pool = new Pool({
   connectionString: process.env.DATABASE_URL,
@@ -341,12 +364,13 @@ export const db = drizzle(pool);
 // Create a tenant-scoped Drizzle instance.
 // Queries are automatically filtered by RLS policy.
 export function createTenantDb(getTenantId: () => string) {
-  return withTenantDrizzle(db, getTenantId, pool);
+  return drizzleWithTenant(db, getTenantId, pool);
 }
 
-// Usage:
+// Usage: run tenant queries inside transaction() so the tenant context and
+// the query share one connection.
 // const tenantDb = createTenantDb(() => currentTenantId);
-// const rows = await tenantDb.select().from(orders);
+// const rows = await tenantDb.transaction((tx) => tx.select().from(orders));
 
 export { pool };
 `
@@ -561,11 +585,13 @@ const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use((req, _res, next) => {
-  const tenantId =
-    req.headers["x-tenant-id"] as string ||
-    req.hostname.split(".")[0];
+  const tenantId = req.hostname.split(".")[0];
   (req as any).tenantId = tenantId;
   next();
 });
@@ -595,12 +621,14 @@ function generateFastifyMiddleware(projectName) {
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction plugin
+// Tenant extraction hook. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 fastify.decorateRequest("tenantId", "");
 fastify.addHook("onRequest", async (request) => {
-  const tenantId =
-    (request.headers["x-tenant-id"] as string) ||
-    (request.hostname?.split(".")[0] ?? "");
+  const tenantId = request.hostname?.split(".")[0] ?? "";
   (request as any).tenantId = tenantId;
 });
 
@@ -631,14 +659,15 @@ function generateNextjsMiddleware(projectName) {
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -661,7 +690,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -680,11 +709,13 @@ import { serve } from "@hono/node-server";
 
 const app = new Hono();
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use("*", async (c, next) => {
-  const tenantId =
-    c.req.header("x-tenant-id") ||
-    new URL(c.req.url).hostname.split(".")[0];
+  const tenantId = new URL(c.req.url).hostname.split(".")[0];
   c.set("tenantId", tenantId);
   await next();
 });
@@ -763,9 +794,11 @@ export class AppController {
 export class TenantGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
     const request = context.switchToHttp().getRequest();
-    const tenantId =
-      request.headers["x-tenant-id"] ||
-      request.hostname?.split(".")[0];
+    // The tenant comes from the subdomain the request was routed to. Do not
+    // take it from a client-supplied header such as x-tenant-id: any caller
+    // can set one and pick another tenant. Once you add authentication, check
+    // that the signed-in user belongs to this tenant here.
+    const tenantId = request.hostname?.split(".")[0];
     request.tenantId = tenantId || null;
     return true;
   }
@@ -994,12 +1027,9 @@ See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference
 `;
 }
 function getDevCommand(preset) {
-  if (preset.framework === "nextjs")
-    return "npm run dev";
-  if (preset.framework === "nestjs")
-    return "node --env-file=.env src/main.ts";
-  if (preset.framework === "none")
-    return "node --env-file=.env src/index.ts";
+  if (preset.framework === "nextjs") return "npm run dev";
+  if (preset.framework === "nestjs") return "node --env-file=.env src/main.ts";
+  if (preset.framework === "none") return "node --env-file=.env src/index.ts";
   return "node --env-file=.env src/index.ts";
 }
 function getDbStartInfo(preset) {
@@ -1074,9 +1104,14 @@ function generatePresetEnv(projectName, preset) {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
   const jwtSecret = crypto.randomBytes(32).toString("base64url");
   let dbUrl;
+  let adminUrlLine = "";
   switch (preset.database) {
     case "postgres":
-      dbUrl = `postgres://${dbName}:dev_password@localhost:5432/${dbName}`;
+      dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
+      adminUrlLine = `
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+`;
       break;
     case "mongodb":
       dbUrl = `mongodb://${dbName}:dev_password@localhost:27017/${dbName}?authSource=admin`;
@@ -1091,7 +1126,7 @@ function generatePresetEnv(projectName, preset) {
 
 # Database
 ${urlKey}=${dbUrl}
-
+${adminUrlLine}
 # Authentication
 JWT_SECRET=${jwtSecret}
 
@@ -1322,7 +1357,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-`;
+${postgresAppRoleSql(dbName)}`;
 }
 function generateEnv(projectName) {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
@@ -1330,8 +1365,12 @@ function generateEnv(projectName) {
   return `# Environment variables for ${projectName}
 # Copy to .env and fill in values
 
-# Database
-DATABASE_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+# Database. The app connects as the non-superuser role created in init.sql,
+# so row-level security applies to it.
+DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
+
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -1419,7 +1458,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -1428,18 +1467,19 @@ export default function Home() {
 `;
 }
 function generateNextjsMiddleware2() {
-  return `// middleware.ts \u2014 tenant resolution via subdomain or header
+  return `// middleware.ts \u2014 tenant resolution via subdomain
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -1500,7 +1540,7 @@ ${projectName}/
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** \u2014 via JWT claim, subdomain, or \`x-tenant-id\` header
+- **Tenant resolution** \u2014 via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
 - **Config inheritance** \u2014 settings flow down the tenant tree with override support
 - **Permission ABAC** \u2014 role-based permissions with tenant-scoped enforcement
 

package/dist/matrix.js

@@ -0,0 +1,115 @@
+// src/matrix.ts
+var POSTGRES_STRATEGIES = ["rls", "schema", "database"];
+var POSTGRES_ORMS = ["prisma", "drizzle", "sequelize", "knex", "pg"];
+var MONGODB_STRATEGIES = ["database", "collection"];
+var MONGODB_ORMS = ["mongoose"];
+var MYSQL_STRATEGIES = ["database", "table-prefix"];
+var MYSQL_ORMS = ["sequelize", "knex", "pg"];
+var ALL_FRAMEWORKS = ["express", "fastify", "nextjs", "hono", "nestjs", "none"];
+var VALID_COMBINATIONS = {
+  postgres: {
+    strategies: POSTGRES_STRATEGIES,
+    orms: POSTGRES_ORMS,
+    frameworks: ALL_FRAMEWORKS
+  },
+  mongodb: {
+    strategies: MONGODB_STRATEGIES,
+    orms: MONGODB_ORMS,
+    frameworks: ALL_FRAMEWORKS
+  },
+  mysql: {
+    strategies: MYSQL_STRATEGIES,
+    orms: MYSQL_ORMS,
+    frameworks: ALL_FRAMEWORKS
+  }
+};
+var ALL_DATABASES = ["postgres", "mongodb", "mysql"];
+var ALL_STRATEGIES = ["rls", "schema", "database", "collection", "table-prefix"];
+var ALL_ORMS = ["prisma", "drizzle", "sequelize", "knex", "mongoose", "pg"];
+function isValidPreset(preset) {
+  const config = VALID_COMBINATIONS[preset.database];
+  if (!config) return false;
+  if (!config.strategies.includes(preset.strategy)) return false;
+  if (!config.orms.includes(preset.orm)) return false;
+  if (!config.frameworks.includes(preset.framework)) return false;
+  return true;
+}
+function parsePresetString(s) {
+  if (!s || typeof s !== "string") return null;
+  const parts = s.toLowerCase().split("-");
+  let database;
+  let strategy;
+  let orm;
+  let framework;
+  if (parts.length === 4) {
+    [database, strategy, orm, framework] = parts;
+  } else if (parts.length === 5) {
+    database = parts[0];
+    strategy = `${parts[1]}-${parts[2]}`;
+    orm = parts[3];
+    framework = parts[4];
+  } else {
+    return null;
+  }
+  if (!ALL_DATABASES.includes(database)) return null;
+  if (!ALL_STRATEGIES.includes(strategy)) return null;
+  if (!ALL_ORMS.includes(orm)) return null;
+  if (!ALL_FRAMEWORKS.includes(framework)) return null;
+  return {
+    database,
+    strategy,
+    orm,
+    framework
+  };
+}
+function formatPresetString(preset) {
+  return `${preset.database}-${preset.strategy}-${preset.orm}-${preset.framework}`;
+}
+function getValidOptions(partial) {
+  let databases = [...ALL_DATABASES];
+  let strategies = [];
+  let orms = [];
+  let frameworks = [];
+  if (partial.database) {
+    databases = [partial.database];
+  }
+  const strategySet = /* @__PURE__ */ new Set();
+  const ormSet = /* @__PURE__ */ new Set();
+  const frameworkSet = /* @__PURE__ */ new Set();
+  for (const db of databases) {
+    const config = VALID_COMBINATIONS[db];
+    if (partial.strategy && !config.strategies.includes(partial.strategy)) continue;
+    if (partial.orm && !config.orms.includes(partial.orm)) continue;
+    for (const s of config.strategies) strategySet.add(s);
+    for (const o of config.orms) ormSet.add(o);
+    for (const f of config.frameworks) frameworkSet.add(f);
+  }
+  strategies = [...strategySet];
+  orms = [...ormSet];
+  frameworks = [...frameworkSet];
+  if (partial.strategy) {
+    strategies = strategies.filter((s) => s === partial.strategy);
+  }
+  if (partial.orm) {
+    orms = orms.filter((o) => o === partial.orm);
+  }
+  if (partial.framework) {
+    frameworks = frameworks.filter((f) => f === partial.framework);
+  }
+  if (partial.strategy || partial.orm) {
+    databases = databases.filter((db) => {
+      const config = VALID_COMBINATIONS[db];
+      if (partial.strategy && !config.strategies.includes(partial.strategy)) return false;
+      if (partial.orm && !config.orms.includes(partial.orm)) return false;
+      return true;
+    });
+  }
+  return { databases, strategies, orms, frameworks };
+}
+export {
+  VALID_COMBINATIONS,
+  formatPresetString,
+  getValidOptions,
+  isValidPreset,
+  parsePresetString
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratum-hq/create",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Create a new Stratum multi-tenancy project",
   "keywords": [
     "multi-tenancy",
@@ -20,19 +20,18 @@
   },
   "exports": {
     ".": "./dist/index.js",
-    "./matrix": {
-      "import": "./src/matrix.ts",
-      "types": "./src/matrix.ts"
-    }
+    "./matrix": "./dist/matrix.js"
   },
   "type": "module",
   "scripts": {
-    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@stratum-hq/*",
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@stratum-hq/* && esbuild src/matrix.ts --bundle --platform=node --format=esm --outfile=dist/matrix.js --external:@stratum-hq/*",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
     "test": "vitest run"
   },
   "devDependencies": {
-    "esbuild": "^0.20.0",
-    "vitest": "^1.6.0",
+    "esbuild": "^0.28.2",
+    "vitest": "^4.1.11",
     "typescript": "^5.3.0"
   },
   "publishConfig": {
@@ -40,6 +39,12 @@
     "registry": "https://registry.npmjs.org/"
   },
   "license": "MIT",
+  "author": "Christian Crank",
+  "homepage": "https://github.com/stratum-hq/Stratum/tree/main/packages/create#readme",
+  "bugs": "https://github.com/stratum-hq/Stratum/issues",
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/stratum-hq/Stratum.git",

package/src/generators/db-setup.ts

@@ -24,9 +24,6 @@ export function generateDbSetup(preset: StackPreset): DbSetupFile[] {
 
 function generatePrismaSetup(preset: StackPreset): DbSetupFile[] {
   const provider = preset.database === "mysql" ? "mysql" : "postgresql";
-  const envUrl = preset.database === "mysql"
-    ? "mysql://user:password@localhost:3306/dbname"
-    : "postgres://user:password@localhost:5432/dbname";
 
   return [
     {
@@ -58,7 +55,7 @@ model Tenant {
       content: `// Prisma client with Stratum tenant-scoped queries
 import { PrismaClient } from "@prisma/client";
 import { Pool } from "pg";
-import { withTenant } from "@stratum-hq/db-adapters";
+import { prismaWithTenant } from "@stratum-hq/db-adapters";
 
 const prisma = new PrismaClient();
 const pool = new Pool({
@@ -68,7 +65,7 @@ const pool = new Pool({
 // Create a tenant-scoped Prisma client.
 // All queries through this client are automatically filtered by RLS.
 export function createTenantPrisma(getTenantId: () => string) {
-  return withTenant(prisma, getTenantId, pool);
+  return prismaWithTenant(prisma, getTenantId, pool);
 }
 
 // Usage:
@@ -107,7 +104,7 @@ export const db = drizzle(connection);
       content: `// Drizzle ORM with Stratum tenant-scoped queries
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
-import { withTenantDrizzle } from "@stratum-hq/db-adapters";
+import { drizzleWithTenant } from "@stratum-hq/db-adapters";
 
 const pool = new Pool({
   connectionString: process.env.DATABASE_URL,
@@ -118,12 +115,13 @@ export const db = drizzle(pool);
 // Create a tenant-scoped Drizzle instance.
 // Queries are automatically filtered by RLS policy.
 export function createTenantDb(getTenantId: () => string) {
-  return withTenantDrizzle(db, getTenantId, pool);
+  return drizzleWithTenant(db, getTenantId, pool);
 }
 
-// Usage:
+// Usage: run tenant queries inside transaction() so the tenant context and
+// the query share one connection.
 // const tenantDb = createTenantDb(() => currentTenantId);
-// const rows = await tenantDb.select().from(orders);
+// const rows = await tenantDb.transaction((tx) => tx.select().from(orders));
 
 export { pool };
 `,