@stratum-hq/create 0.3.1 → 0.4.1

package/src/index.ts

@@ -1,12 +1,12 @@
-#!/usr/bin/env node
-
 import * as fs from "fs";
 import * as path from "path";
 import crypto from "node:crypto";
 import { execSync } from "child_process";
-import { fileURLToPath } from "url";
-import { parsePresetString, isValidPreset, formatPresetString } from "./matrix.js";
+import { parsePresetString, isValidPreset } from "./matrix.js";
 import { createPresetProject } from "./preset-project.js";
+import { STRATUM_RANGES } from "./stratum-versions.js";
+import { postgresAppRole, postgresAppRoleSql, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
+import { generateTsconfig } from "./generators/tsconfig.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -126,7 +126,7 @@ function generatePackageJson(projectName: string, template: Template): string {
   };
 
   const deps = {
-    "@stratum-hq/lib": "^0.2.0",
+    "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"],
     pg: "^8.11.0",
     ...frameworkDeps[template],
   };
@@ -140,11 +140,13 @@ function generatePackageJson(projectName: string, template: Template): string {
       scripts:
         template === "nextjs"
           ? { dev: "next dev", build: "next build", start: "next start" }
-          : { dev: "node --watch src/index.js", build: "tsc", start: "node dist/index.js" },
+          : // Node 20 cannot run a .ts file, so dev runs the source through tsx.
+            { dev: "tsx watch --env-file=.env src/index.ts", build: "tsc", start: "node dist/index.js" },
       dependencies: deps,
       devDependencies: {
         typescript: "^5.3.0",
         "@types/node": "^20.11.0",
+        ...(template === "nextjs" ? {} : { tsx: "^4.7.0", "@types/pg": "^8.11.0" }),
       },
       engines: {
         node: ">=20.0.0",
@@ -194,7 +196,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-`;
+${postgresAppRoleSql(dbName)}`;
 }
 
 function generateEnv(projectName: string): string {
@@ -203,8 +205,12 @@ function generateEnv(projectName: string): string {
   return `# Environment variables for ${projectName}
 # Copy to .env and fill in values
 
-# Database
-DATABASE_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+# Database. The app connects as the non-superuser role created in init.sql,
+# so row-level security applies to it.
+DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
+
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -295,7 +301,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -305,18 +311,19 @@ export default function Home() {
 }
 
 function generateNextjsMiddleware(): string {
-  return `// middleware.ts — tenant resolution via subdomain or header
+  return `// middleware.ts — tenant resolution via subdomain
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -331,9 +338,6 @@ export const config = {
 }
 
 function generateReadme(projectName: string, template: Template): string {
-  const devCmd =
-    template === "nextjs" ? "npm run dev" : "node --env-file=.env src/index.ts";
-
   return `# ${projectName}
 
 A multi-tenant application built with [Stratum](https://github.com/stratum-hq/Stratum).
@@ -362,7 +366,7 @@ npm install
 ### 4. Run the app
 
 \`\`\`bash
-${devCmd}
+npm run dev
 \`\`\`
 
 ## Project structure
@@ -373,14 +377,14 @@ ${projectName}/
 ├── docker-compose.yml
 ├── init.sql          # DB extensions (uuid-ossp, ltree)
 ├── .env.example
-└── package.json
+${template === "nextjs" ? "" : "├── tsconfig.json\n"}└── package.json
 \`\`\`
 
 ## Multi-tenancy
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** — via JWT claim, subdomain, or \`x-tenant-id\` header
+- **Tenant resolution** — via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
 - **Config inheritance** — settings flow down the tenant tree with override support
 - **Permission ABAC** — role-based permissions with tenant-scoped enforcement
 
@@ -416,8 +420,10 @@ export function createProject(
   // Server starter file
   if (template === "express") {
     writeFile(path.join(targetDir, "src", "index.ts"), generateExpressServer(projectName));
+    writeFile(path.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "fastify") {
     writeFile(path.join(targetDir, "src", "index.ts"), generateFastifyServer(projectName));
+    writeFile(path.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "nextjs") {
     writeFile(path.join(targetDir, "src", "app", "page.tsx"), generateNextjsPage(projectName));
     writeFile(path.join(targetDir, "middleware.ts"), generateNextjsMiddleware());
@@ -514,25 +520,6 @@ export function main(argv: string[]): void {
   if (skipInstall) {
     console.log("  npm install");
   }
-  if (preset) {
-    const parsed = parsePresetString(preset)!;
-    if (parsed.framework === "nextjs") {
-      console.log("  npm run dev");
-    } else if (parsed.framework === "nestjs") {
-      console.log("  node --env-file=.env src/main.ts");
-    } else {
-      console.log("  node --env-file=.env src/index.ts");
-    }
-  } else if (template === "nextjs") {
-    console.log("  npm run dev");
-  } else {
-    console.log("  node --env-file=.env src/index.ts");
-  }
+  console.log("  npm run dev");
   console.log("");
 }
-
-// Run when executed directly (not when imported by tests)
-const __filename = fileURLToPath(import.meta.url);
-if (process.argv[1] === __filename) {
-  main(process.argv.slice(2));
-}

package/src/preset-project.ts

@@ -4,11 +4,12 @@ import crypto from "node:crypto";
 import { execSync } from "child_process";
 import type { StackPreset } from "./matrix.js";
 import { generatePresetDockerCompose } from "./generators/docker-compose.js";
-import { generatePresetInitSql } from "./generators/init-sql.js";
+import { generatePresetInitSql, postgresAppRole, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
 import { generateDbSetup } from "./generators/db-setup.js";
 import { generateMiddleware } from "./generators/middleware.js";
 import { generatePresetPackageJson } from "./generators/package-json.js";
 import { generatePresetReadme } from "./generators/readme.js";
+import { generateTsconfig, rootSources } from "./generators/tsconfig.js";
 
 function writeFile(filePath: string, content: string): void {
   const dir = path.dirname(filePath);
@@ -24,9 +25,14 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
   const jwtSecret = crypto.randomBytes(32).toString("base64url");
 
   let dbUrl: string;
+  let adminUrlLine = "";
   switch (preset.database) {
     case "postgres":
-      dbUrl = `postgres://${dbName}:dev_password@localhost:5432/${dbName}`;
+      // The app connects as the non-superuser role created in init.sql, so
+      // row-level security applies to it. The superuser URL is for bootstrap
+      // and migrations only.
+      dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
+      adminUrlLine = `\n# Superuser: bootstrap and migrations only. It bypasses row-level security.\nDATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}\n`;
       break;
     case "mongodb":
       dbUrl = `mongodb://${dbName}:dev_password@localhost:27017/${dbName}?authSource=admin`;
@@ -43,7 +49,7 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
 
 # Database
 ${urlKey}=${dbUrl}
-
+${adminUrlLine}
 # Authentication
 JWT_SECRET=${jwtSecret}
 
@@ -109,31 +115,7 @@ export function createPresetProject(
   // tsconfig.json
   writeFile(
     path.join(targetDir, "tsconfig.json"),
-    JSON.stringify(
-      {
-        compilerOptions: {
-          target: "ESNext",
-          module: "NodeNext",
-          moduleResolution: "NodeNext",
-          strict: true,
-          outDir: "dist",
-          rootDir: "src",
-          declaration: true,
-          skipLibCheck: true,
-          esModuleInterop: true,
-          ...(preset.framework === "nestjs"
-            ? { experimentalDecorators: true, emitDecoratorMetadata: true }
-            : {}),
-          ...(preset.framework === "nextjs"
-            ? { jsx: "preserve", plugins: [{ name: "next" }] }
-            : {}),
-        },
-        include: ["src"],
-        exclude: ["node_modules", "dist"],
-      },
-      null,
-      2,
-    ),
+    generateTsconfig(preset.framework, rootSources(preset)),
   );
 
   // npm install

package/src/stratum-versions.ts

@@ -0,0 +1,20 @@
+// esbuild inlines these files when it bundles the CLI, so the published package carries
+// the versions of the workspace it was built from. The ranges are fixed at create's build
+// time. When a pinned package gets a major bump, or a minor bump while at 0.x, release
+// create again, or new projects keep the old range.
+import hono from "../../hono/package.json" with { type: "json" };
+import dbAdapters from "../../db-adapters/package.json" with { type: "json" };
+import lib from "../../lib/package.json" with { type: "json" };
+import mongodb from "../../mongodb/package.json" with { type: "json" };
+import mysql from "../../mysql/package.json" with { type: "json" };
+import nestjs from "../../nestjs/package.json" with { type: "json" };
+
+/** Caret ranges on the current workspace versions of the packages a generated project uses. */
+export const STRATUM_RANGES = {
+  "@stratum-hq/db-adapters": `^${dbAdapters.version}`,
+  "@stratum-hq/hono": `^${hono.version}`,
+  "@stratum-hq/lib": `^${lib.version}`,
+  "@stratum-hq/mongodb": `^${mongodb.version}`,
+  "@stratum-hq/mysql": `^${mysql.version}`,
+  "@stratum-hq/nestjs": `^${nestjs.version}`,
+} as const;

package/turbo.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://turbo.build/schema.json",
+  "extends": ["//"],
+  "tasks": {
+    "build": {
+      "inputs": ["$TURBO_DEFAULT$", "$TURBO_ROOT$/packages/*/package.json"]
+    },
+    "typecheck": {
+      "inputs": ["$TURBO_DEFAULT$", "$TURBO_ROOT$/packages/*/package.json"]
+    },
+    "test": {
+      "inputs": [
+        "$TURBO_DEFAULT$",
+        "$TURBO_ROOT$/packages/*/package.json",
+        "$TURBO_ROOT$/packages/{core,db-adapters,mysql,mongodb}/src/**"
+      ]
+    }
+  }
+}