@stratum-hq/create 0.3.1 → 0.4.1

package/dist/matrix.js

@@ -28,19 +28,14 @@ var ALL_STRATEGIES = ["rls", "schema", "database", "collection", "table-prefix"]
 var ALL_ORMS = ["prisma", "drizzle", "sequelize", "knex", "mongoose", "pg"];
 function isValidPreset(preset) {
   const config = VALID_COMBINATIONS[preset.database];
-  if (!config)
-    return false;
-  if (!config.strategies.includes(preset.strategy))
-    return false;
-  if (!config.orms.includes(preset.orm))
-    return false;
-  if (!config.frameworks.includes(preset.framework))
-    return false;
+  if (!config) return false;
+  if (!config.strategies.includes(preset.strategy)) return false;
+  if (!config.orms.includes(preset.orm)) return false;
+  if (!config.frameworks.includes(preset.framework)) return false;
   return true;
 }
 function parsePresetString(s) {
-  if (!s || typeof s !== "string")
-    return null;
+  if (!s || typeof s !== "string") return null;
   const parts = s.toLowerCase().split("-");
   let database;
   let strategy;
@@ -56,14 +51,10 @@ function parsePresetString(s) {
   } else {
     return null;
   }
-  if (!ALL_DATABASES.includes(database))
-    return null;
-  if (!ALL_STRATEGIES.includes(strategy))
-    return null;
-  if (!ALL_ORMS.includes(orm))
-    return null;
-  if (!ALL_FRAMEWORKS.includes(framework))
-    return null;
+  if (!ALL_DATABASES.includes(database)) return null;
+  if (!ALL_STRATEGIES.includes(strategy)) return null;
+  if (!ALL_ORMS.includes(orm)) return null;
+  if (!ALL_FRAMEWORKS.includes(framework)) return null;
   return {
     database,
     strategy,
@@ -87,16 +78,11 @@ function getValidOptions(partial) {
   const frameworkSet = /* @__PURE__ */ new Set();
   for (const db of databases) {
     const config = VALID_COMBINATIONS[db];
-    if (partial.strategy && !config.strategies.includes(partial.strategy))
-      continue;
-    if (partial.orm && !config.orms.includes(partial.orm))
-      continue;
-    for (const s of config.strategies)
-      strategySet.add(s);
-    for (const o of config.orms)
-      ormSet.add(o);
-    for (const f of config.frameworks)
-      frameworkSet.add(f);
+    if (partial.strategy && !config.strategies.includes(partial.strategy)) continue;
+    if (partial.orm && !config.orms.includes(partial.orm)) continue;
+    for (const s of config.strategies) strategySet.add(s);
+    for (const o of config.orms) ormSet.add(o);
+    for (const f of config.frameworks) frameworkSet.add(f);
   }
   strategies = [...strategySet];
   orms = [...ormSet];
@@ -113,10 +99,8 @@ function getValidOptions(partial) {
   if (partial.strategy || partial.orm) {
     databases = databases.filter((db) => {
       const config = VALID_COMBINATIONS[db];
-      if (partial.strategy && !config.strategies.includes(partial.strategy))
-        return false;
-      if (partial.orm && !config.orms.includes(partial.orm))
-        return false;
+      if (partial.strategy && !config.strategies.includes(partial.strategy)) return false;
+      if (partial.orm && !config.orms.includes(partial.orm)) return false;
       return true;
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratum-hq/create",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "Create a new Stratum multi-tenancy project",
   "keywords": [
     "multi-tenancy",
@@ -16,7 +16,7 @@
     "stratum"
   ],
   "bin": {
-    "create-stratum": "./dist/index.js"
+    "create-stratum": "./dist/bin.js"
   },
   "exports": {
     ".": "./dist/index.js",
@@ -24,14 +24,14 @@
   },
   "type": "module",
   "scripts": {
-    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@stratum-hq/* && esbuild src/matrix.ts --bundle --platform=node --format=esm --outfile=dist/matrix.js --external:@stratum-hq/*",
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.js --external:@stratum-hq/* && esbuild src/matrix.ts --bundle --platform=node --format=esm --outfile=dist/matrix.js --external:@stratum-hq/* && esbuild src/bin.ts --platform=node --format=esm --outfile=dist/bin.js",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "test": "vitest run"
   },
   "devDependencies": {
-    "esbuild": "^0.20.0",
-    "vitest": "^1.6.0",
+    "esbuild": "^0.28.2",
+    "vitest": "^4.1.11",
     "typescript": "^5.3.0"
   },
   "publishConfig": {

package/src/bin.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+// The bin calls main() without a check on process.argv[1]. npm runs the bin
+// through a symlink, so a compare of argv[1] with the module path is false.
+import { main } from "./index.js";
+
+main(process.argv.slice(2));

package/src/generators/db-setup.ts

@@ -24,9 +24,6 @@ export function generateDbSetup(preset: StackPreset): DbSetupFile[] {
 
 function generatePrismaSetup(preset: StackPreset): DbSetupFile[] {
   const provider = preset.database === "mysql" ? "mysql" : "postgresql";
-  const envUrl = preset.database === "mysql"
-    ? "mysql://user:password@localhost:3306/dbname"
-    : "postgres://user:password@localhost:5432/dbname";
 
   return [
     {
@@ -121,9 +118,10 @@ export function createTenantDb(getTenantId: () => string) {
   return drizzleWithTenant(db, getTenantId, pool);
 }
 
-// Usage:
+// Usage: run tenant queries inside transaction() so the tenant context and
+// the query share one connection.
 // const tenantDb = createTenantDb(() => currentTenantId);
-// const rows = await tenantDb.select().from(orders);
+// const rows = await tenantDb.transaction((tx) => tx.select().from(orders));
 
 export { pool };
 `,
@@ -205,60 +203,120 @@ export default config;
     },
     {
       filename: "src/stratum-knex.ts",
-      content: `// Knex with Stratum tenant-scoped queries
+      content: preset.database === "postgres" ? KNEX_POSTGRES_SCOPE : knexColumnScope(preset.database),
+    },
+  ];
+}
+
+// PostgreSQL does not accept a bind parameter in SET, so the generated code
+// calls set_config. The third argument (is_local = true) ends the setting with
+// the transaction, so a pooled connection never keeps another tenant's ID.
+const KNEX_POSTGRES_SCOPE = `// Knex with Stratum tenant-scoped queries
+import createKnex, { type Knex } from "knex";
+import config from "../knexfile.js";
+
+const knex = createKnex(config);
+
+// Run fn in a transaction that sets app.current_tenant_id, the setting that
+// the RLS policies read. The setting ends with the transaction, so run every
+// tenant query through trx, not through knex.
+export async function withTenantScope<T>(
+  tenantId: string,
+  fn: (trx: Knex.Transaction) => Promise<T>,
+): Promise<T> {
+  return knex.transaction(async (trx) => {
+    await trx.raw("SELECT set_config('app.current_tenant_id', ?, true)", [tenantId]);
+    return fn(trx);
+  });
+}
+
+// Usage:
+// const orders = await withTenantScope(currentTenantId, (trx) => trx("orders").select());
+
+export { knex };
+`;
+
+function knexColumnScope(database: string): string {
+  return `// Knex with Stratum tenant-scoped queries
 import Knex from "knex";
 import config from "../knexfile.js";
 
 const knex = Knex(config);
 
 // Create a tenant-scoped query builder.
-// For RLS strategy, set the session variable before queries.
 export async function withTenantScope(tenantId: string, fn: (db: typeof knex) => Promise<void>) {
-${preset.database === "postgres" ? `  await knex.raw("SET app.current_tenant = ?", [tenantId]);` : `  // For ${preset.database}, scope queries by tenant_id column`}
-  try {
-    await fn(knex);
-  } finally {
-${preset.database === "postgres" ? `    await knex.raw("RESET app.current_tenant");` : `    // Scope cleanup not needed for column-based isolation`}
-  }
+  // For ${database}, scope queries by tenant_id column
+  await fn(knex);
 }
 
 export { knex };
-`,
-    },
-  ];
+`;
+}
+
+// @stratum-hq/mongodb has no Mongoose connection helper. The generated code uses
+// Mongoose directly and copies the tenant names of the @stratum-hq/mongodb
+// adapters, so MongoDatabaseAdapter and MongoCollectionAdapter find the same
+// data, for example for purgeTenantData.
+function generateMongooseSetup(preset: StackPreset): DbSetupFile[] {
+  const tenantAccess =
+    preset.strategy === "collection"
+      ? `// Return the tenant's model for a base collection. The tenant's documents are
+// in the collection {baseCollection}_{tenantSlug}, the name that
+// MongoCollectionAdapter from @stratum-hq/mongodb uses.
+export function getTenantModel<T>(
+  baseCollection: string,
+  schema: mongoose.Schema<T>,
+  tenantSlug: string,
+) {
+  const name = \`\${baseCollection}_\${assertSlug(tenantSlug)}\`;
+  return mainConnection.models[name] ?? mainConnection.model(name, schema, name);
 }
 
-function generateMongooseSetup(_preset: StackPreset): DbSetupFile[] {
+// Usage:
+// const Order = getTenantModel("orders", OrderSchema, "tenant_abc");
+// const orders = await Order.find();`
+      : `// Return a connection to the tenant's own database. The database name is
+// stratum_tenant_{tenantSlug}, the name that MongoDatabaseAdapter from
+// @stratum-hq/mongodb uses. useCache returns the same connection on each call.
+export function getTenantConnection(tenantSlug: string) {
+  return mainConnection.useDb(\`stratum_tenant_\${assertSlug(tenantSlug)}\`, { useCache: true });
+}
+
+// Usage:
+// const conn = getTenantConnection("tenant_abc");
+// const Order = conn.model("Order", OrderSchema);
+// const orders = await Order.find();`;
+
   return [
     {
       filename: "src/stratum-mongoose.ts",
       content: `// Mongoose with Stratum multi-tenant support
 import mongoose from "mongoose";
-import { createTenantConnection } from "@stratum-hq/mongodb";
 
 // Main connection (used for tenant metadata)
 const mainConnection = mongoose.createConnection(
   process.env.MONGODB_URI || "mongodb://localhost:27017/main",
 );
 
-// Create a tenant-scoped connection.
-// Each tenant gets its own database (database-per-tenant strategy)
-// or collection prefix (collection strategy).
-export function getTenantConnection(tenantId: string) {
-  return createTenantConnection(mainConnection, tenantId);
+// A tenant slug becomes part of a MongoDB name, so it must match the Stratum
+// slug rule: a lowercase letter, then lowercase letters, digits or underscores.
+const SLUG_PATTERN = /^[a-z][a-z0-9_]{0,62}$/;
+
+function assertSlug(tenantSlug: string): string {
+  if (!SLUG_PATTERN.test(tenantSlug)) {
+    throw new Error(\`Invalid tenant slug: "\${tenantSlug}"\`);
+  }
+  return tenantSlug;
 }
 
+${tenantAccess}
+
 // Define schemas that work across tenant connections
 export const TenantSchema = new mongoose.Schema({
   name: { type: String, required: true },
   createdAt: { type: Date, default: Date.now },
 });
 
-// Usage:
-// const conn = getTenantConnection("tenant-abc");
-// const Order = conn.model("Order", OrderSchema);
-// const orders = await Order.find();
-
 export { mainConnection };
 `,
     },
@@ -278,7 +336,11 @@ const pool = mysql.createPool({
 });
 
 // Execute a query scoped to a tenant by filtering on tenant_id
-export async function tenantQuery(tenantId: string, sql: string, params: unknown[] = []) {
+export async function tenantQuery(
+  tenantId: string,
+  sql: string,
+  params: (string | number | bigint | boolean | Date | null)[] = [],
+) {
   const [rows] = await pool.execute(sql, [...params, tenantId]);
   return rows;
 }
@@ -304,9 +366,10 @@ const pool = new Pool({
 });
 
 // Create a tenant-scoped pool.
-// Sets app.current_tenant on each connection for RLS enforcement.
+// Each query runs in a transaction that sets app.current_tenant_id, the
+// setting that the RLS policies read.
 export function getTenantPool(tenantId: string) {
-  return createTenantPool(pool, tenantId);
+  return createTenantPool(pool, () => tenantId);
 }
 
 // Usage:

package/src/generators/init-sql.ts

@@ -1,5 +1,46 @@
 import type { StackPreset } from "../matrix.js";
 
+/** Name of the non-superuser role a generated app connects as. */
+export function postgresAppRole(dbName: string): string {
+  return `${dbName}_app`;
+}
+
+/** Local development password for the generated application role. */
+export const POSTGRES_APP_PASSWORD = "dev_app_password";
+
+/**
+ * SQL that creates the role the application connects as. POSTGRES_USER is a
+ * superuser, and a superuser (or any BYPASSRLS role) ignores every row-level
+ * security policy, FORCE included. So the app gets its own role, and the
+ * superuser is kept for bootstrap and migrations.
+ */
+export function postgresAppRoleSql(dbName: string, strategy?: string): string {
+  const role = postgresAppRole(dbName);
+  let strategyGrant = "";
+  if (strategy === "schema") {
+    strategyGrant = `
+-- schema-per-tenant: the app creates one schema per tenant
+GRANT CREATE ON DATABASE ${dbName} TO ${role};
+`;
+  } else if (strategy === "database") {
+    strategyGrant = `
+-- database-per-tenant: the app creates one database per tenant
+ALTER ROLE ${role} CREATEDB;
+`;
+  }
+  return `
+-- Application role. The app connects as ${role} (DATABASE_URL), never as the
+-- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. Use the superuser
+-- only for bootstrap and migrations.
+CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+${strategyGrant}`;
+}
+
 export function generatePresetInitSql(projectName: string, preset: StackPreset): string | null {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
 
@@ -22,10 +63,16 @@ function generatePostgresInit(projectName: string, dbName: string, strategy: str
 -- Add RLS policies to each tenant-scoped table:
 --
 --   ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+--   ALTER TABLE your_table FORCE ROW LEVEL SECURITY;
 --   CREATE POLICY tenant_isolation ON your_table
---     USING (tenant_id = current_setting('app.current_tenant')::uuid);
+--     USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);
 --
--- The Stratum db-adapters package sets app.current_tenant automatically.
+-- A pooled connection reads the setting as '' after a tenant transaction ends,
+-- or as NULL before the first one. NULLIF makes both return no rows; a bare
+-- ::uuid cast of '' raises an error.
+-- FORCE makes the policy apply to the table owner too; without it, a table
+-- created by the application role is not isolated for that role.
+-- The Stratum db-adapters package sets app.current_tenant_id automatically.
 `;
   }
 
@@ -37,7 +84,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-${rlsBlock}`;
+${postgresAppRoleSql(dbName, strategy)}${rlsBlock}`;
 }
 
 function generateMysqlInit(projectName: string, dbName: string): string {

package/src/generators/middleware.ts

@@ -33,11 +33,13 @@ const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use((req, _res, next) => {
-  const tenantId =
-    req.headers["x-tenant-id"] as string ||
-    req.hostname.split(".")[0];
+  const tenantId = req.hostname.split(".")[0];
   (req as any).tenantId = tenantId;
   next();
 });
@@ -68,12 +70,14 @@ function generateFastifyMiddleware(projectName: string): MiddlewareFile[] {
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction plugin
+// Tenant extraction hook. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 fastify.decorateRequest("tenantId", "");
 fastify.addHook("onRequest", async (request) => {
-  const tenantId =
-    (request.headers["x-tenant-id"] as string) ||
-    (request.hostname?.split(".")[0] ?? "");
+  const tenantId = request.hostname?.split(".")[0] ?? "";
   (request as any).tenantId = tenantId;
 });
 
@@ -105,14 +109,15 @@ function generateNextjsMiddleware(projectName: string): MiddlewareFile[] {
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -135,7 +140,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -155,11 +160,13 @@ import { serve } from "@hono/node-server";
 
 const app = new Hono();
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use("*", async (c, next) => {
-  const tenantId =
-    c.req.header("x-tenant-id") ||
-    new URL(c.req.url).hostname.split(".")[0];
+  const tenantId = new URL(c.req.url).hostname.split(".")[0];
   c.set("tenantId", tenantId);
   await next();
 });
@@ -239,9 +246,11 @@ export class AppController {
 export class TenantGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
     const request = context.switchToHttp().getRequest();
-    const tenantId =
-      request.headers["x-tenant-id"] ||
-      request.hostname?.split(".")[0];
+    // The tenant comes from the subdomain the request was routed to. Do not
+    // take it from a client-supplied header such as x-tenant-id: any caller
+    // can set one and pick another tenant. Once you add authentication, check
+    // that the signed-in user belongs to this tenant here.
+    const tenantId = request.hostname?.split(".")[0];
     request.tenantId = tenantId || null;
     return true;
   }

package/src/generators/package-json.ts

@@ -1,16 +1,24 @@
 import type { StackPreset } from "../matrix.js";
+import { rootSources } from "./tsconfig.js";
+import { STRATUM_RANGES } from "../stratum-versions.js";
 
 export function generatePresetPackageJson(projectName: string, preset: StackPreset): string {
   const deps: Record<string, string> = {
-    "@stratum-hq/lib": "^0.2.0",
+    "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"],
   };
   const devDeps: Record<string, string> = {
     typescript: "^5.3.0",
     "@types/node": "^20.11.0",
   };
+  // NestJS injection needs the decorator metadata that tsc emits and tsx does not.
+  if (preset.framework === "nestjs") {
+    devDeps["tsc-watch"] = "^7.2.0";
+  } else if (preset.framework !== "nextjs") {
+    devDeps["tsx"] = "^4.7.0";
+  }
 
   // Database driver deps
-  addDatabaseDeps(deps, preset);
+  addDatabaseDeps(deps, devDeps, preset);
 
   // ORM deps
   addOrmDeps(deps, devDeps, preset);
@@ -41,9 +49,14 @@ export function generatePresetPackageJson(projectName: string, preset: StackPres
   );
 }
 
-function addDatabaseDeps(deps: Record<string, string>, preset: StackPreset): void {
+function addDatabaseDeps(deps: Record<string, string>, devDeps: Record<string, string>, preset: StackPreset): void {
   switch (preset.database) {
     case "postgres":
+      // The generated code for these ORMs imports pg itself. The strict tsc
+      // build fails with TS7016 when the pg types are not installed.
+      if (preset.orm === "pg" || preset.orm === "prisma" || preset.orm === "drizzle") {
+        devDeps["@types/pg"] = "^8.11.0";
+      }
       if (preset.orm !== "prisma" && preset.orm !== "drizzle" && preset.orm !== "sequelize") {
         deps["pg"] = "^8.11.0";
       }
@@ -139,19 +152,19 @@ function addFrameworkDeps(deps: Record<string, string>, devDeps: Record<string,
 
 function addStratumDeps(deps: Record<string, string>, preset: StackPreset): void {
   if (preset.database === "postgres" && preset.orm !== "mongoose") {
-    deps["@stratum-hq/db-adapters"] = "^0.2.0";
+    deps["@stratum-hq/db-adapters"] = STRATUM_RANGES["@stratum-hq/db-adapters"];
   }
   if (preset.database === "mongodb") {
-    deps["@stratum-hq/mongodb"] = "^0.2.0";
+    deps["@stratum-hq/mongodb"] = STRATUM_RANGES["@stratum-hq/mongodb"];
   }
   if (preset.database === "mysql") {
-    deps["@stratum-hq/mysql"] = "^0.2.0";
+    deps["@stratum-hq/mysql"] = STRATUM_RANGES["@stratum-hq/mysql"];
   }
   if (preset.framework === "hono") {
-    deps["@stratum-hq/hono"] = "^0.2.0";
+    deps["@stratum-hq/hono"] = STRATUM_RANGES["@stratum-hq/hono"];
   }
   if (preset.framework === "nestjs") {
-    deps["@stratum-hq/nestjs"] = "^0.2.0";
+    deps["@stratum-hq/nestjs"] = STRATUM_RANGES["@stratum-hq/nestjs"];
   }
 }
 
@@ -159,10 +172,16 @@ function getScripts(preset: StackPreset): Record<string, string> {
   if (preset.framework === "nextjs") {
     return { dev: "next dev", build: "next build", start: "next start" };
   }
-  if (preset.framework === "nestjs") {
-    return { dev: "node --watch src/main.ts", build: "tsc", start: "node dist/main.js" };
-  }
-  return { dev: "node --watch src/index.js", build: "tsc", start: "node dist/index.js" };
+  const entry = preset.framework === "nestjs" ? "main" : "index";
+  // When tsc compiles from the project root, src/ is emitted to dist/src/.
+  const emittedDir = rootSources(preset).length > 0 ? "dist/src" : "dist";
+  // Node 20 cannot run a .ts file. NestJS compiles with tsc, which keeps the
+  // decorator metadata its injection needs; the other frameworks run through tsx.
+  const dev =
+    preset.framework === "nestjs"
+      ? `tsc-watch --onSuccess "node --env-file=.env ${emittedDir}/${entry}.js"`
+      : `tsx watch --env-file=.env src/${entry}.ts`;
+  return { dev, build: "tsc", start: `node ${emittedDir}/${entry}.js` };
 }
 
 function sortKeys(obj: Record<string, string>): Record<string, string> {

package/src/generators/readme.ts

@@ -1,7 +1,6 @@
 import type { StackPreset } from "../matrix.js";
 
 export function generatePresetReadme(projectName: string, preset: StackPreset): string {
-  const devCmd = getDevCommand(preset);
   const dbStartCmd = getDbStartInfo(preset);
   const dbSetupNote = getDbSetupNote(preset);
 
@@ -37,7 +36,7 @@ ${dbSetupNote}
 ### 4. Run the app
 
 \`\`\`bash
-${devCmd}
+npm run dev
 \`\`\`
 
 ## Multi-tenancy
@@ -50,13 +49,6 @@ See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference
 `;
 }
 
-function getDevCommand(preset: StackPreset): string {
-  if (preset.framework === "nextjs") return "npm run dev";
-  if (preset.framework === "nestjs") return "node --env-file=.env src/main.ts";
-  if (preset.framework === "none") return "node --env-file=.env src/index.ts";
-  return "node --env-file=.env src/index.ts";
-}
-
 function getDbStartInfo(preset: StackPreset): string {
   switch (preset.database) {
     case "postgres":
@@ -95,7 +87,7 @@ function getStrategyDescription(strategy: string): string {
   switch (strategy) {
     case "rls":
       return `- **Row-Level Security** -- PostgreSQL RLS policies filter rows by tenant automatically
-- Each query sets \`app.current_tenant\` and RLS enforces isolation
+- Each query sets \`app.current_tenant_id\` and RLS enforces isolation
 - All tenants share one database and schema`;
     case "schema":
       return `- **Schema-per-tenant** -- each tenant gets a dedicated PostgreSQL schema

package/src/generators/tsconfig.ts

@@ -0,0 +1,48 @@
+import type { Framework, StackPreset } from "../matrix.js";
+
+/**
+ * Return the source files that a preset writes at the project root and that code in `src/` imports.
+ *
+ * @param preset - The stack preset of the generated project.
+ */
+export function rootSources(preset: StackPreset): string[] {
+  // The knex CLI reads knexfile.ts from the project root, and src/stratum-knex.ts imports it.
+  return preset.orm === "knex" ? ["knexfile.ts"] : [];
+}
+
+/**
+ * Return the tsconfig.json content for a generated project.
+ *
+ * @param framework - The framework of the project. It adds the compiler options that the framework needs.
+ * @param extraSources - Source files at the project root that code in `src/` imports.
+ *   When there are any, tsc compiles from the project root, so the output of `src/` goes to `dist/src/`.
+ */
+export function generateTsconfig(framework: Framework, extraSources: string[] = []): string {
+  // tsc rejects an imported file outside rootDir with TS6059.
+  const rootDir = extraSources.length > 0 ? "." : "src";
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ESNext",
+        module: "NodeNext",
+        moduleResolution: "NodeNext",
+        strict: true,
+        outDir: "dist",
+        rootDir,
+        declaration: true,
+        skipLibCheck: true,
+        esModuleInterop: true,
+        ...(framework === "nestjs"
+          ? { experimentalDecorators: true, emitDecoratorMetadata: true }
+          : {}),
+        ...(framework === "nextjs"
+          ? { jsx: "preserve", plugins: [{ name: "next" }] }
+          : {}),
+      },
+      include: ["src", ...extraSources],
+      exclude: ["node_modules", "dist"],
+    },
+    null,
+    2,
+  );
+}