@stratum-hq/create 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @stratum-hq/create
 
+## 0.5.0
+
+### Minor Changes
+
+- 4c1686a: Generated servers and Next.js middleware take the tenant from a verified JWT instead of the hostname (GHSA-p4wg-j8hh-9wh8).
+
+## 0.4.1
+
+### Patch Changes
+
+- 7ac4283: `npx @stratum-hq/create <name>` now runs the scaffolder. Before this fix, the command exited 0 and did nothing when npm ran the bin through its `node_modules/.bin` symlink. The `create-stratum` bin is now `dist/bin.js`, which always calls `main()`.
+- 7ac4283: Generated projects now depend on the current `@stratum-hq/*` releases. The CLI took the dependency ranges from a hardcoded `^0.2.0`, which installs releases from before 1.0. The build now reads the ranges from the workspace package versions.
+- 7ac4283: Fix the database setup that the pg, knex and mongoose presets generate, so that it compiles and runs against the published packages.
+
+  - The PostgreSQL `pg` preset passes a tenant function to `createTenantPool`, which expects `() => string`.
+  - The PostgreSQL `knex` preset sets `app.current_tenant_id` with `set_config(..., true)` inside `knex.transaction`. PostgreSQL does not accept a bind parameter in `SET`, and the RLS policies read `app.current_tenant_id`.
+  - The `mongoose` presets no longer import `createTenantConnection`, which `@stratum-hq/mongodb` does not export. They use Mongoose directly, with the database and collection names of the `@stratum-hq/mongodb` adapters.
+  - The MySQL `pg` preset types its query parameters so that `pool.execute` accepts them.
+  - The generated README names the `app.current_tenant_id` setting.
+  - The RLS policy example in the generated `init.sql` uses `NULLIF(current_setting('app.current_tenant_id', true), '')::uuid`. A pooled connection reads the setting as an empty string after a tenant transaction ends, and the old example raised an error there instead of returning no rows.
+
+- 7ac4283: Generated projects now run with the scripts they ship. The express and fastify templates now write a `tsconfig.json`, so `npm run build` compiles `src/` to `dist/` and `npm start` runs `dist/index.js`. The `dev` script of the templates and of every preset except Next.js and NestJS is now `tsx watch --env-file=.env src/<entry>.ts`, because Node 20 cannot run a `.ts` file. The NestJS preset `dev` script is now `tsc-watch --onSuccess "node --env-file=.env dist/main.js"`, because NestJS injection needs the decorator metadata that `tsc` emits. Before this fix, `dev` pointed at `src/index.js`, which the scaffold never wrote. Knex presets now compile from the project root, because `src/stratum-knex.ts` imports `knexfile.ts` from there. Their `start` script runs `dist/src/<entry>.js`. The generated README and the success message now tell you to run `npm run dev`.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -30,17 +30,22 @@ npx @stratum-hq/create my-app [options]
 
 - **express** (default) — Express server with Stratum middleware, tenant-aware routes, and TypeScript config.
 - **fastify** — Fastify server with the Stratum plugin registered.
-- **nextjs** — Next.js project with edge middleware for tenant resolution and server-side helpers.
+- **nextjs** — Next.js project with edge middleware that resolves the tenant from a verified JWT.
 
 ## After Scaffolding
 
 ```bash
 cd my-app
 docker compose up -d   # start PostgreSQL
+cp .env.example .env   # npm run dev reads .env
 npm run dev            # run the app
 ```
 
-The generated project uses `autoMigrate: true`, so Stratum creates its tables automatically on first run — no separate migration step.
+The generated starter code does not create a `Stratum` instance, so it does not create Stratum's tables. To create them, construct `Stratum` with `autoMigrate: true` and call `initialize()` once at startup.
+
+## Tenant resolution
+
+Generated servers (the Express, Fastify, Hono and NestJS presets) and the Next.js middleware take the tenant ID only from the `tenant_id` claim of a bearer token that verifies with `JWT_SECRET` (HS256, using `jose`, which the generated `package.json` lists). A token that does not verify, or has no `tenant_id` claim, is rejected with 401. The tenant is never taken from the hostname or from a client-supplied header such as `x-tenant-id`. In the Next.js middleware the subdomain is forwarded as `x-tenant-slug`, a display hint that does not identify the caller's tenant.
 
 ## Links
 

package/dist/bin.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from "./index.js";
+main(process.argv.slice(2));