@stratum-hq/create 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,11 +1,8 @@
-#!/usr/bin/env node
-
 // src/index.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
 import crypto2 from "node:crypto";
 import { execSync as execSync2 } from "child_process";
-import { fileURLToPath } from "url";
 
 // src/matrix.ts
 var POSTGRES_STRATEGIES = ["rls", "schema", "database"];
@@ -224,8 +221,11 @@ function generatePostgresInit(projectName, dbName, strategy) {
 --   ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
 --   ALTER TABLE your_table FORCE ROW LEVEL SECURITY;
 --   CREATE POLICY tenant_isolation ON your_table
---     USING (tenant_id = current_setting('app.current_tenant_id')::uuid);
+--     USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);
 --
+-- A pooled connection reads the setting as '' after a tenant transaction ends,
+-- or as NULL before the first one. NULLIF makes both return no rows; a bare
+-- ::uuid cast of '' raises an error.
 -- FORCE makes the policy apply to the table owner too; without it, a table
 -- created by the application role is not isolated for that role.
 -- The Stratum db-adapters package sets app.current_tenant_id automatically.
@@ -446,59 +446,106 @@ export default config;
     },
     {
       filename: "src/stratum-knex.ts",
-      content: `// Knex with Stratum tenant-scoped queries
+      content: preset.database === "postgres" ? KNEX_POSTGRES_SCOPE : knexColumnScope(preset.database)
+    }
+  ];
+}
+var KNEX_POSTGRES_SCOPE = `// Knex with Stratum tenant-scoped queries
+import createKnex, { type Knex } from "knex";
+import config from "../knexfile.js";
+
+const knex = createKnex(config);
+
+// Run fn in a transaction that sets app.current_tenant_id, the setting that
+// the RLS policies read. The setting ends with the transaction, so run every
+// tenant query through trx, not through knex.
+export async function withTenantScope<T>(
+  tenantId: string,
+  fn: (trx: Knex.Transaction) => Promise<T>,
+): Promise<T> {
+  return knex.transaction(async (trx) => {
+    await trx.raw("SELECT set_config('app.current_tenant_id', ?, true)", [tenantId]);
+    return fn(trx);
+  });
+}
+
+// Usage:
+// const orders = await withTenantScope(currentTenantId, (trx) => trx("orders").select());
+
+export { knex };
+`;
+function knexColumnScope(database) {
+  return `// Knex with Stratum tenant-scoped queries
 import Knex from "knex";
 import config from "../knexfile.js";
 
 const knex = Knex(config);
 
 // Create a tenant-scoped query builder.
-// For RLS strategy, set the session variable before queries.
 export async function withTenantScope(tenantId: string, fn: (db: typeof knex) => Promise<void>) {
-${preset.database === "postgres" ? `  await knex.raw("SET app.current_tenant = ?", [tenantId]);` : `  // For ${preset.database}, scope queries by tenant_id column`}
-  try {
-    await fn(knex);
-  } finally {
-${preset.database === "postgres" ? `    await knex.raw("RESET app.current_tenant");` : `    // Scope cleanup not needed for column-based isolation`}
-  }
+  // For ${database}, scope queries by tenant_id column
+  await fn(knex);
 }
 
 export { knex };
-`
-    }
-  ];
+`;
+}
+function generateMongooseSetup(preset) {
+  const tenantAccess = preset.strategy === "collection" ? `// Return the tenant's model for a base collection. The tenant's documents are
+// in the collection {baseCollection}_{tenantSlug}, the name that
+// MongoCollectionAdapter from @stratum-hq/mongodb uses.
+export function getTenantModel<T>(
+  baseCollection: string,
+  schema: mongoose.Schema<T>,
+  tenantSlug: string,
+) {
+  const name = \`\${baseCollection}_\${assertSlug(tenantSlug)}\`;
+  return mainConnection.models[name] ?? mainConnection.model(name, schema, name);
 }
-function generateMongooseSetup(_preset) {
+
+// Usage:
+// const Order = getTenantModel("orders", OrderSchema, "tenant_abc");
+// const orders = await Order.find();` : `// Return a connection to the tenant's own database. The database name is
+// stratum_tenant_{tenantSlug}, the name that MongoDatabaseAdapter from
+// @stratum-hq/mongodb uses. useCache returns the same connection on each call.
+export function getTenantConnection(tenantSlug: string) {
+  return mainConnection.useDb(\`stratum_tenant_\${assertSlug(tenantSlug)}\`, { useCache: true });
+}
+
+// Usage:
+// const conn = getTenantConnection("tenant_abc");
+// const Order = conn.model("Order", OrderSchema);
+// const orders = await Order.find();`;
   return [
     {
       filename: "src/stratum-mongoose.ts",
       content: `// Mongoose with Stratum multi-tenant support
 import mongoose from "mongoose";
-import { createTenantConnection } from "@stratum-hq/mongodb";
 
 // Main connection (used for tenant metadata)
 const mainConnection = mongoose.createConnection(
   process.env.MONGODB_URI || "mongodb://localhost:27017/main",
 );
 
-// Create a tenant-scoped connection.
-// Each tenant gets its own database (database-per-tenant strategy)
-// or collection prefix (collection strategy).
-export function getTenantConnection(tenantId: string) {
-  return createTenantConnection(mainConnection, tenantId);
+// A tenant slug becomes part of a MongoDB name, so it must match the Stratum
+// slug rule: a lowercase letter, then lowercase letters, digits or underscores.
+const SLUG_PATTERN = /^[a-z][a-z0-9_]{0,62}$/;
+
+function assertSlug(tenantSlug: string): string {
+  if (!SLUG_PATTERN.test(tenantSlug)) {
+    throw new Error(\`Invalid tenant slug: "\${tenantSlug}"\`);
+  }
+  return tenantSlug;
 }
 
+${tenantAccess}
+
 // Define schemas that work across tenant connections
 export const TenantSchema = new mongoose.Schema({
   name: { type: String, required: true },
   createdAt: { type: Date, default: Date.now },
 });
 
-// Usage:
-// const conn = getTenantConnection("tenant-abc");
-// const Order = conn.model("Order", OrderSchema);
-// const orders = await Order.find();
-
 export { mainConnection };
 `
     }
@@ -517,7 +564,11 @@ const pool = mysql.createPool({
 });
 
 // Execute a query scoped to a tenant by filtering on tenant_id
-export async function tenantQuery(tenantId: string, sql: string, params: unknown[] = []) {
+export async function tenantQuery(
+  tenantId: string,
+  sql: string,
+  params: (string | number | bigint | boolean | Date | null)[] = [],
+) {
   const [rows] = await pool.execute(sql, [...params, tenantId]);
   return rows;
 }
@@ -542,9 +593,10 @@ const pool = new Pool({
 });
 
 // Create a tenant-scoped pool.
-// Sets app.current_tenant on each connection for RLS enforcement.
+// Each query runs in a transaction that sets app.current_tenant_id, the
+// setting that the RLS policies read.
 export function getTenantPool(tenantId: string) {
-  return createTenantPool(pool, tenantId);
+  return createTenantPool(pool, () => tenantId);
 }
 
 // Usage:
@@ -558,6 +610,114 @@ export { pool };
 }
 
 // src/generators/middleware.ts
+var VERIFIED_TENANT = `import { jwtVerify } from "jose";
+
+const jwtSecret = process.env.JWT_SECRET;
+if (!jwtSecret) {
+  throw new Error("JWT_SECRET must be set: the tenant is taken from a verified JWT.");
+}
+const jwtKey = new TextEncoder().encode(jwtSecret);
+
+/**
+ * The tenant for a request, from the tenant_id claim of a bearer token that
+ * verifies with JWT_SECRET. tenantId is null when there is no bearer token.
+ * invalid is true when a token was sent but does not verify or has no
+ * tenant_id claim. Never take the tenant from the hostname or from a header
+ * such as x-tenant-id: any caller can choose those.
+ */
+async function verifiedTenant(
+  authorization: string | undefined,
+): Promise<{ tenantId: string | null; invalid: boolean }> {
+  if (!authorization?.startsWith("Bearer ")) return { tenantId: null, invalid: false };
+  try {
+    const { payload } = await jwtVerify(authorization.slice("Bearer ".length), jwtKey, {
+      algorithms: ["HS256"],
+    });
+    if (typeof payload.tenant_id === "string") return { tenantId: payload.tenant_id, invalid: false };
+  } catch {
+    // Fall through: a token that does not verify is rejected, never ignored.
+  }
+  return { tenantId: null, invalid: true };
+}`;
+var INVALID_TOKEN = `{ error: "Bearer token is invalid or has no tenant_id claim" }`;
+var TENANT_REQUIRED = `{ error: "A bearer token with a tenant_id claim is required" }`;
+function nextjsTenantMiddleware() {
+  return `// middleware.ts (place in project root)
+// Next.js middleware for Stratum tenant resolution
+//
+// The tenant ID comes only from the tenant_id claim of a bearer token that
+// verifies with JWT_SECRET, and is forwarded as x-tenant-id. Any copy of the
+// tenant headers the client sent is removed first, so server code only ever
+// reads the values set here.
+//
+// The subdomain (acme.app.example.com) is forwarded as x-tenant-slug. It only
+// says which tenant's public pages to show. It does not prove the caller
+// belongs to that tenant, so never use it to read or write tenant data.
+
+import { NextRequest, NextResponse } from "next/server";
+import { jwtVerify } from "jose";
+
+const TENANT_ID_HEADER = "x-tenant-id";
+const TENANT_SLUG_HEADER = "x-tenant-slug";
+
+/**
+ * The tenant_id claim of a token that verifies with JWT_SECRET, or null when
+ * the token is invalid, expired, or has no string tenant_id claim.
+ */
+async function verifiedTenantId(token: string): Promise<string | null> {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    throw new Error("JWT_SECRET must be set: the tenant is taken from a verified JWT.");
+  }
+  try {
+    const { payload } = await jwtVerify(token, new TextEncoder().encode(secret), {
+      algorithms: ["HS256"],
+    });
+    return typeof payload.tenant_id === "string" ? payload.tenant_id : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function middleware(request: NextRequest): Promise<NextResponse> {
+  // Only this middleware may set the tenant headers.
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
+  requestHeaders.delete(TENANT_SLUG_HEADER);
+
+  // A bearer token that does not verify is rejected, never ignored.
+  const authorization = request.headers.get("authorization");
+  if (authorization?.startsWith("Bearer ")) {
+    const tenantId = await verifiedTenantId(authorization.slice("Bearer ".length));
+    if (!tenantId) {
+      return NextResponse.json(
+        { error: { code: "INVALID_TOKEN", message: "Bearer token is invalid or has no tenant_id claim" } },
+        { status: 401 },
+      );
+    }
+    requestHeaders.set(TENANT_ID_HEADER, tenantId);
+  }
+
+  // Subdomain, e.g. "acme" from "acme.app.example.com": a slug, not an identity.
+  const hostname = (request.headers.get("host") ?? "").split(":")[0];
+  const rootDomain = process.env.ROOT_DOMAIN ?? "app.example.com";
+  if (hostname.endsWith(\`.\${rootDomain}\`)) {
+    const subdomain = hostname.slice(0, hostname.length - rootDomain.length - 1);
+    if (subdomain && subdomain !== "www") {
+      requestHeaders.set(TENANT_SLUG_HEADER, subdomain);
+    }
+  }
+
+  // With no verified tenant the request continues without x-tenant-id. Each
+  // route decides whether to require a tenant or serve a public page.
+  return NextResponse.next({ request: { headers: requestHeaders } });
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+`;
+}
 function generateMiddleware(projectName, preset) {
   switch (preset.framework) {
     case "express":
@@ -579,19 +739,21 @@ function generateExpressMiddleware(projectName) {
     {
       filename: "src/index.ts",
       content: `import express from "express";
+${VERIFIED_TENANT}
 
 const app = express();
 const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
-app.use((req, _res, next) => {
-  const tenantId = req.hostname.split(".")[0];
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
+app.use(async (req, res, next) => {
+  const { tenantId, invalid } = await verifiedTenant(req.headers.authorization);
+  if (invalid) {
+    res.status(401).json(${INVALID_TOKEN});
+    return;
+  }
   (req as any).tenantId = tenantId;
   next();
 });
@@ -602,6 +764,10 @@ app.get("/health", (_req, res) => {
 
 app.get("/tenants", async (req, res) => {
   const tenantId = (req as any).tenantId;
+  if (!tenantId) {
+    res.status(401).json(${TENANT_REQUIRED});
+    return;
+  }
   res.json({ tenantId, message: "Replace with your tenant queries" });
 });
 
@@ -617,18 +783,19 @@ function generateFastifyMiddleware(projectName) {
     {
       filename: "src/index.ts",
       content: `import Fastify from "fastify";
+${VERIFIED_TENANT}
 
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction hook. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
-fastify.decorateRequest("tenantId", "");
-fastify.addHook("onRequest", async (request) => {
-  const tenantId = request.hostname?.split(".")[0] ?? "";
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
+fastify.decorateRequest("tenantId", null);
+fastify.addHook("onRequest", async (request, reply) => {
+  const { tenantId, invalid } = await verifiedTenant(request.headers.authorization);
+  if (invalid) {
+    return reply.status(401).send(${INVALID_TOKEN});
+  }
   (request as any).tenantId = tenantId;
 });
 
@@ -636,8 +803,11 @@ fastify.get("/health", async () => {
   return { status: "ok", project: "${projectName}" };
 });
 
-fastify.get("/tenants", async (request) => {
+fastify.get("/tenants", async (request, reply) => {
   const tenantId = (request as any).tenantId;
+  if (!tenantId) {
+    return reply.status(401).send(${TENANT_REQUIRED});
+  }
   return { tenantId, message: "Replace with your tenant queries" };
 });
 
@@ -655,30 +825,7 @@ function generateNextjsMiddleware(projectName) {
   return [
     {
       filename: "middleware.ts",
-      content: `// Next.js edge middleware for tenant resolution
-import { NextRequest, NextResponse } from "next/server";
-
-export function middleware(request: NextRequest) {
-  // The tenant comes from the subdomain the request was routed to. Any
-  // x-tenant-id the client sent is removed first, so server code that reads
-  // x-tenant-id only ever sees the value set here. Once you add
-  // authentication, check that the signed-in user belongs to this tenant.
-  const hostname = request.headers.get("host") || "";
-  const tenantId = hostname.split(".")[0];
-
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.delete("x-tenant-id");
-  if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
-    requestHeaders.set("x-tenant-id", tenantId);
-  }
-
-  return NextResponse.next({ request: { headers: requestHeaders } });
-}
-
-export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-};
-`
+      content: nextjsTenantMiddleware()
     },
     {
       filename: "src/app/page.tsx",
@@ -690,7 +837,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -706,16 +853,17 @@ function generateHonoMiddleware(projectName) {
       filename: "src/index.ts",
       content: `import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+${VERIFIED_TENANT}
 
-const app = new Hono();
+const app = new Hono<{ Variables: { tenantId: string | null } }>();
 
-// Tenant extraction middleware. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
 app.use("*", async (c, next) => {
-  const tenantId = new URL(c.req.url).hostname.split(".")[0];
+  const { tenantId, invalid } = await verifiedTenant(c.req.header("authorization"));
+  if (invalid) {
+    return c.json(${INVALID_TOKEN}, 401);
+  }
   c.set("tenantId", tenantId);
   await next();
 });
@@ -726,6 +874,9 @@ app.get("/health", (c) => {
 
 app.get("/tenants", (c) => {
   const tenantId = c.get("tenantId");
+  if (!tenantId) {
+    return c.json(${TENANT_REQUIRED}, 401);
+  }
   return c.json({ tenantId, message: "Replace with your tenant queries" });
 });
 
@@ -770,7 +921,7 @@ export class AppModule {}
     },
     {
       filename: "src/app.controller.ts",
-      content: `import { Controller, Get, Req } from "@nestjs/common";
+      content: `import { Controller, Get, Req, UnauthorizedException } from "@nestjs/common";
 
 @Controller()
 export class AppController {
@@ -781,6 +932,9 @@ export class AppController {
 
   @Get("tenants")
   tenants(@Req() req: any) {
+    if (!req.tenantId) {
+      throw new UnauthorizedException("A bearer token with a tenant_id claim is required");
+    }
     return { tenantId: req.tenantId, message: "Replace with your tenant queries" };
   }
 }
@@ -788,18 +942,22 @@ export class AppController {
     },
     {
       filename: "src/tenant.guard.ts",
-      content: `import { Injectable, CanActivate, ExecutionContext } from "@nestjs/common";
+      content: `import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from "@nestjs/common";
+${VERIFIED_TENANT}
 
+/**
+ * Sets request.tenantId from a verified bearer token, or null when there is
+ * no token. A token that does not verify is rejected with 401.
+ */
 @Injectable()
 export class TenantGuard implements CanActivate {
-  canActivate(context: ExecutionContext): boolean {
+  async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest();
-    // The tenant comes from the subdomain the request was routed to. Do not
-    // take it from a client-supplied header such as x-tenant-id: any caller
-    // can set one and pick another tenant. Once you add authentication, check
-    // that the signed-in user belongs to this tenant here.
-    const tenantId = request.hostname?.split(".")[0];
-    request.tenantId = tenantId || null;
+    const { tenantId, invalid } = await verifiedTenant(request.headers?.authorization);
+    if (invalid) {
+      throw new UnauthorizedException("Bearer token is invalid or has no tenant_id claim");
+    }
+    request.tenantId = tenantId;
     return true;
   }
 }
@@ -822,16 +980,516 @@ console.log("Add tenant resolution logic for your use case");
   ];
 }
 
+// src/generators/tsconfig.ts
+function rootSources(preset) {
+  return preset.orm === "knex" ? ["knexfile.ts"] : [];
+}
+function generateTsconfig(framework, extraSources = []) {
+  const rootDir = extraSources.length > 0 ? "." : "src";
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ESNext",
+        module: "NodeNext",
+        moduleResolution: "NodeNext",
+        strict: true,
+        outDir: "dist",
+        rootDir,
+        declaration: true,
+        skipLibCheck: true,
+        esModuleInterop: true,
+        ...framework === "nestjs" ? { experimentalDecorators: true, emitDecoratorMetadata: true } : {},
+        ...framework === "nextjs" ? { jsx: "preserve", plugins: [{ name: "next" }] } : {}
+      },
+      include: ["src", ...extraSources],
+      exclude: ["node_modules", "dist"]
+    },
+    null,
+    2
+  );
+}
+
+// ../hono/package.json
+var package_default = {
+  name: "@stratum-hq/hono",
+  version: "1.2.0",
+  description: "Stratum Hono integration \u2014 tenant extraction middleware with ALS context",
+  keywords: [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "tenant",
+    "hono",
+    "middleware",
+    "typescript",
+    "stratum"
+  ],
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc",
+    test: "vitest run",
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    clean: "rm -rf dist"
+  },
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  },
+  peerDependencies: {
+    "@stratum-hq/core": "^1.0.0",
+    "@stratum-hq/sdk": "^1.2.0",
+    hono: ">=4.0.0"
+  },
+  devDependencies: {
+    "@stratum-hq/core": "*",
+    "@stratum-hq/sdk": "*",
+    hono: "^4.13.9",
+    typescript: "^5.4.0",
+    vitest: "^4.1.11"
+  },
+  license: "MIT",
+  author: "Christian Crank",
+  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/hono#readme",
+  bugs: "https://github.com/stratum-hq/Stratum/issues",
+  engines: {
+    node: ">=20.0.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/stratum-hq/Stratum.git",
+    directory: "packages/hono"
+  }
+};
+
+// ../db-adapters/package.json
+var package_default2 = {
+  name: "@stratum-hq/db-adapters",
+  version: "1.2.0",
+  description: "Stratum PostgreSQL adapters for tenant-scoped query isolation",
+  keywords: [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "tenant",
+    "tenant-isolation",
+    "postgresql",
+    "postgres",
+    "row-level-security",
+    "rls",
+    "schema-isolation",
+    "database",
+    "stratum"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc",
+    test: "vitest run",
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    clean: "rm -rf dist"
+  },
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  },
+  dependencies: {
+    "@stratum-hq/core": "^1.4.0",
+    pg: "^8.11.0"
+  },
+  peerDependencies: {
+    "drizzle-orm": ">=0.29.0"
+  },
+  peerDependenciesMeta: {
+    "drizzle-orm": {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@prisma/client": "^5.10.0",
+    "@types/pg": "^8.11.0",
+    "drizzle-orm": "^0.45.3",
+    typescript: "^5.4.0",
+    vitest: "^4.1.11"
+  },
+  license: "MIT",
+  author: "Christian Crank",
+  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/db-adapters#readme",
+  bugs: "https://github.com/stratum-hq/Stratum/issues",
+  engines: {
+    node: ">=20.0.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/stratum-hq/Stratum.git",
+    directory: "packages/db-adapters"
+  }
+};
+
+// ../lib/package.json
+var package_default3 = {
+  name: "@stratum-hq/lib",
+  version: "1.5.0",
+  description: "Stratum tenant management library - framework-agnostic business logic",
+  keywords: [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "b2b",
+    "tenant",
+    "tenant-management",
+    "tenant-isolation",
+    "node",
+    "typescript",
+    "postgresql",
+    "row-level-security",
+    "rls",
+    "schema-isolation",
+    "config-inheritance",
+    "gdpr",
+    "stratum"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc && node ../../scripts/copy-dir.mjs src/migrations dist/migrations",
+    test: "vitest run",
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    clean: "rm -rf dist"
+  },
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  },
+  dependencies: {
+    "@opentelemetry/api": "^1.9.0",
+    "@stratum-hq/core": "^1.5.0",
+    "@stratum-hq/db-adapters": "^1.2.0",
+    "@stratum-hq/sdk": "^1.3.0",
+    pg: "^8.11.0"
+  },
+  peerDependencies: {
+    "@opentelemetry/api": "^1.0.0"
+  },
+  peerDependenciesMeta: {
+    "@opentelemetry/api": {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@types/pg": "^8.11.0",
+    typescript: "^5.4.0",
+    vitest: "^4.1.11"
+  },
+  license: "MIT",
+  author: "Christian Crank",
+  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/lib#readme",
+  bugs: "https://github.com/stratum-hq/Stratum/issues",
+  engines: {
+    node: ">=20.0.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/stratum-hq/Stratum.git",
+    directory: "packages/lib"
+  }
+};
+
+// ../mongodb/package.json
+var package_default4 = {
+  name: "@stratum-hq/mongodb",
+  version: "0.5.0",
+  description: "MongoDB tenant isolation for Stratum \u2014 shared collection, collection-per-tenant, and database-per-tenant strategies",
+  keywords: [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "tenant",
+    "tenant-isolation",
+    "mongodb",
+    "mongoose",
+    "database",
+    "stratum"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc",
+    test: "vitest run",
+    "test:watch": "vitest",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    clean: "rm -rf dist"
+  },
+  dependencies: {
+    "@stratum-hq/core": "^1.5.0",
+    "@stratum-hq/sdk": "^1.3.0"
+  },
+  peerDependencies: {
+    mongodb: "^6.0.0 || ^7.0.0"
+  },
+  peerDependenciesMeta: {
+    mongoose: {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@stratum-hq/test-utils": "*",
+    mongodb: "^7.6.0",
+    mongoose: "^8.0.0",
+    typescript: "^5.9.0",
+    vitest: "^4.1.11"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  license: "MIT",
+  author: "Christian Crank",
+  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/mongodb#readme",
+  bugs: "https://github.com/stratum-hq/Stratum/issues",
+  engines: {
+    node: ">=20.0.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/stratum-hq/Stratum.git",
+    directory: "packages/mongodb"
+  }
+};
+
+// ../mysql/package.json
+var package_default5 = {
+  name: "@stratum-hq/mysql",
+  version: "0.5.0",
+  description: "MySQL tenant isolation for Stratum \u2014 shared table, table-per-tenant, and database-per-tenant strategies",
+  keywords: [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "tenant",
+    "tenant-isolation",
+    "mysql",
+    "database",
+    "typeorm",
+    "knex",
+    "sequelize",
+    "stratum"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc",
+    test: "vitest run",
+    "test:watch": "vitest",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    clean: "rm -rf dist"
+  },
+  dependencies: {
+    "@stratum-hq/core": "^1.5.0",
+    "@stratum-hq/sdk": "^1.3.0"
+  },
+  peerDependencies: {
+    mysql2: "^3.0.0",
+    knex: ">=3.0.0",
+    typeorm: "^1.0.0",
+    sequelize: "^6.0.0"
+  },
+  peerDependenciesMeta: {
+    typeorm: {
+      optional: true
+    },
+    knex: {
+      optional: true
+    },
+    sequelize: {
+      optional: true
+    }
+  },
+  devDependencies: {
+    knex: "^3.3.0",
+    mysql2: "^3.24.4",
+    typeorm: "^1.1.1",
+    typescript: "^5.9.0",
+    vitest: "^4.1.11"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  license: "MIT",
+  author: "Christian Crank",
+  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/mysql#readme",
+  bugs: "https://github.com/stratum-hq/Stratum/issues",
+  engines: {
+    node: ">=20.0.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/stratum-hq/Stratum.git",
+    directory: "packages/mysql"
+  }
+};
+
+// ../nestjs/package.json
+var package_default6 = {
+  name: "@stratum-hq/nestjs",
+  version: "1.3.0",
+  description: "Stratum NestJS integration \u2014 StratumGuard, @Tenant() decorator, and StratumModule",
+  keywords: [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "tenant",
+    "nestjs",
+    "nest",
+    "guard",
+    "decorator",
+    "middleware",
+    "typescript",
+    "stratum"
+  ],
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsc",
+    test: "vitest run",
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    clean: "rm -rf dist"
+  },
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  },
+  peerDependencies: {
+    "@nestjs/common": ">=10.0.0",
+    "@nestjs/core": ">=10.0.0",
+    "@stratum-hq/core": "^1.0.0",
+    "@stratum-hq/sdk": "^1.3.0",
+    "reflect-metadata": ">=0.1.13"
+  },
+  devDependencies: {
+    "@nestjs/common": "^12.1.2",
+    "@nestjs/core": "^12.1.2",
+    "@nestjs/testing": "^12.1.2",
+    "@stratum-hq/core": "*",
+    "@stratum-hq/sdk": "*",
+    "reflect-metadata": "^0.2.2",
+    typescript: "^5.4.0",
+    vitest: "^4.1.11"
+  },
+  license: "MIT",
+  author: "Christian Crank",
+  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/nestjs#readme",
+  bugs: "https://github.com/stratum-hq/Stratum/issues",
+  engines: {
+    node: ">=20.0.0"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/stratum-hq/Stratum.git",
+    directory: "packages/nestjs"
+  }
+};
+
+// src/stratum-versions.ts
+var STRATUM_RANGES = {
+  "@stratum-hq/db-adapters": `^${package_default2.version}`,
+  "@stratum-hq/hono": `^${package_default.version}`,
+  "@stratum-hq/lib": `^${package_default3.version}`,
+  "@stratum-hq/mongodb": `^${package_default4.version}`,
+  "@stratum-hq/mysql": `^${package_default5.version}`,
+  "@stratum-hq/nestjs": `^${package_default6.version}`
+};
+
 // src/generators/package-json.ts
 function generatePresetPackageJson(projectName, preset) {
   const deps = {
-    "@stratum-hq/lib": "^0.2.0"
+    "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"]
   };
   const devDeps = {
     typescript: "^5.3.0",
     "@types/node": "^20.11.0"
   };
-  addDatabaseDeps(deps, preset);
+  if (preset.framework === "nestjs") {
+    devDeps["tsc-watch"] = "^7.2.0";
+  } else if (preset.framework !== "nextjs") {
+    devDeps["tsx"] = "^4.7.0";
+  }
+  addDatabaseDeps(deps, devDeps, preset);
   addOrmDeps(deps, devDeps, preset);
   addFrameworkDeps(deps, devDeps, preset);
   addStratumDeps(deps, preset);
@@ -853,9 +1511,12 @@ function generatePresetPackageJson(projectName, preset) {
     2
   );
 }
-function addDatabaseDeps(deps, preset) {
+function addDatabaseDeps(deps, devDeps, preset) {
   switch (preset.database) {
     case "postgres":
+      if (preset.orm === "pg" || preset.orm === "prisma" || preset.orm === "drizzle") {
+        devDeps["@types/pg"] = "^8.11.0";
+      }
       if (preset.orm !== "prisma" && preset.orm !== "drizzle" && preset.orm !== "sequelize") {
         deps["pg"] = "^8.11.0";
       }
@@ -913,6 +1574,9 @@ function addOrmDeps(deps, devDeps, preset) {
   }
 }
 function addFrameworkDeps(deps, devDeps, preset) {
+  if (preset.framework !== "none") {
+    deps["jose"] = "^6.2.12";
+  }
   switch (preset.framework) {
     case "express":
       deps["express"] = "^4.18.0";
@@ -945,29 +1609,29 @@ function addFrameworkDeps(deps, devDeps, preset) {
 }
 function addStratumDeps(deps, preset) {
   if (preset.database === "postgres" && preset.orm !== "mongoose") {
-    deps["@stratum-hq/db-adapters"] = "^0.2.0";
+    deps["@stratum-hq/db-adapters"] = STRATUM_RANGES["@stratum-hq/db-adapters"];
   }
   if (preset.database === "mongodb") {
-    deps["@stratum-hq/mongodb"] = "^0.2.0";
+    deps["@stratum-hq/mongodb"] = STRATUM_RANGES["@stratum-hq/mongodb"];
   }
   if (preset.database === "mysql") {
-    deps["@stratum-hq/mysql"] = "^0.2.0";
+    deps["@stratum-hq/mysql"] = STRATUM_RANGES["@stratum-hq/mysql"];
   }
   if (preset.framework === "hono") {
-    deps["@stratum-hq/hono"] = "^0.2.0";
+    deps["@stratum-hq/hono"] = STRATUM_RANGES["@stratum-hq/hono"];
   }
   if (preset.framework === "nestjs") {
-    deps["@stratum-hq/nestjs"] = "^0.2.0";
+    deps["@stratum-hq/nestjs"] = STRATUM_RANGES["@stratum-hq/nestjs"];
   }
 }
 function getScripts(preset) {
   if (preset.framework === "nextjs") {
     return { dev: "next dev", build: "next build", start: "next start" };
   }
-  if (preset.framework === "nestjs") {
-    return { dev: "node --watch src/main.ts", build: "tsc", start: "node dist/main.js" };
-  }
-  return { dev: "node --watch src/index.js", build: "tsc", start: "node dist/index.js" };
+  const entry = preset.framework === "nestjs" ? "main" : "index";
+  const emittedDir = rootSources(preset).length > 0 ? "dist/src" : "dist";
+  const dev = preset.framework === "nestjs" ? `tsc-watch --onSuccess "node --env-file=.env ${emittedDir}/${entry}.js"` : `tsx watch --env-file=.env src/${entry}.ts`;
+  return { dev, build: "tsc", start: `node ${emittedDir}/${entry}.js` };
 }
 function sortKeys(obj) {
   const sorted = {};
@@ -979,7 +1643,6 @@ function sortKeys(obj) {
 
 // src/generators/readme.ts
 function generatePresetReadme(projectName, preset) {
-  const devCmd = getDevCommand(preset);
   const dbStartCmd = getDbStartInfo(preset);
   const dbSetupNote = getDbSetupNote(preset);
   return `# ${projectName}
@@ -1014,7 +1677,7 @@ ${dbSetupNote}
 ### 4. Run the app
 
 \`\`\`bash
-${devCmd}
+npm run dev
 \`\`\`
 
 ## Multi-tenancy
@@ -1026,12 +1689,6 @@ ${getStrategyDescription(preset.strategy)}
 See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference.
 `;
 }
-function getDevCommand(preset) {
-  if (preset.framework === "nextjs") return "npm run dev";
-  if (preset.framework === "nestjs") return "node --env-file=.env src/main.ts";
-  if (preset.framework === "none") return "node --env-file=.env src/index.ts";
-  return "node --env-file=.env src/index.ts";
-}
 function getDbStartInfo(preset) {
   switch (preset.database) {
     case "postgres":
@@ -1068,7 +1725,7 @@ function getStrategyDescription(strategy) {
   switch (strategy) {
     case "rls":
       return `- **Row-Level Security** -- PostgreSQL RLS policies filter rows by tenant automatically
-- Each query sets \`app.current_tenant\` and RLS enforces isolation
+- Each query sets \`app.current_tenant_id\` and RLS enforces isolation
 - All tenants share one database and schema`;
     case "schema":
       return `- **Schema-per-tenant** -- each tenant gets a dedicated PostgreSQL schema
@@ -1172,27 +1829,7 @@ Creating ${projectName} with preset ${presetLabel}...
   );
   writeFile(
     path.join(targetDir, "tsconfig.json"),
-    JSON.stringify(
-      {
-        compilerOptions: {
-          target: "ESNext",
-          module: "NodeNext",
-          moduleResolution: "NodeNext",
-          strict: true,
-          outDir: "dist",
-          rootDir: "src",
-          declaration: true,
-          skipLibCheck: true,
-          esModuleInterop: true,
-          ...preset.framework === "nestjs" ? { experimentalDecorators: true, emitDecoratorMetadata: true } : {},
-          ...preset.framework === "nextjs" ? { jsx: "preserve", plugins: [{ name: "next" }] } : {}
-        },
-        include: ["src"],
-        exclude: ["node_modules", "dist"]
-      },
-      null,
-      2
-    )
+    generateTsconfig(preset.framework, rootSources(preset))
   );
   if (!skipInstall) {
     console.log("\nInstalling dependencies...\n");
@@ -1291,11 +1928,13 @@ function generatePackageJson(projectName, template) {
       react: "^19.0.0",
       "react-dom": "^19.0.0",
       "@types/react": "^19.0.0",
-      "@types/react-dom": "^19.0.0"
+      "@types/react-dom": "^19.0.0",
+      // The middleware verifies the tenant JWT with jose.
+      jose: "^6.2.12"
     }
   };
   const deps = {
-    "@stratum-hq/lib": "^0.2.0",
+    "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"],
     pg: "^8.11.0",
     ...frameworkDeps[template]
   };
@@ -1305,11 +1944,15 @@ function generatePackageJson(projectName, template) {
       version: "0.1.0",
       private: true,
       type: "module",
-      scripts: template === "nextjs" ? { dev: "next dev", build: "next build", start: "next start" } : { dev: "node --watch src/index.js", build: "tsc", start: "node dist/index.js" },
+      scripts: template === "nextjs" ? { dev: "next dev", build: "next build", start: "next start" } : (
+        // Node 20 cannot run a .ts file, so dev runs the source through tsx.
+        { dev: "tsx watch --env-file=.env src/index.ts", build: "tsc", start: "node dist/index.js" }
+      ),
       dependencies: deps,
       devDependencies: {
         typescript: "^5.3.0",
-        "@types/node": "^20.11.0"
+        "@types/node": "^20.11.0",
+        ...template === "nextjs" ? {} : { tsx: "^4.7.0", "@types/pg": "^8.11.0" }
       },
       engines: {
         node: ">=20.0.0"
@@ -1458,7 +2101,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -1466,34 +2109,7 @@ export default function Home() {
 }
 `;
 }
-function generateNextjsMiddleware2() {
-  return `// middleware.ts \u2014 tenant resolution via subdomain
-import { NextRequest, NextResponse } from "next/server";
-
-export function middleware(request: NextRequest) {
-  // The tenant comes from the subdomain the request was routed to. Any
-  // x-tenant-id the client sent is removed first, so server code that reads
-  // x-tenant-id only ever sees the value set here. Once you add
-  // authentication, check that the signed-in user belongs to this tenant.
-  const hostname = request.headers.get("host") || "";
-  const tenantId = hostname.split(".")[0];
-
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.delete("x-tenant-id");
-  if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
-    requestHeaders.set("x-tenant-id", tenantId);
-  }
-
-  return NextResponse.next({ request: { headers: requestHeaders } });
-}
-
-export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-};
-`;
-}
 function generateReadme(projectName, template) {
-  const devCmd = template === "nextjs" ? "npm run dev" : "node --env-file=.env src/index.ts";
   return `# ${projectName}
 
 A multi-tenant application built with [Stratum](https://github.com/stratum-hq/Stratum).
@@ -1522,7 +2138,7 @@ npm install
 ### 4. Run the app
 
 \`\`\`bash
-${devCmd}
+npm run dev
 \`\`\`
 
 ## Project structure
@@ -1533,14 +2149,14 @@ ${projectName}/
 \u251C\u2500\u2500 docker-compose.yml
 \u251C\u2500\u2500 init.sql          # DB extensions (uuid-ossp, ltree)
 \u251C\u2500\u2500 .env.example
-\u2514\u2500\u2500 package.json
+${template === "nextjs" ? "" : "\u251C\u2500\u2500 tsconfig.json\n"}\u2514\u2500\u2500 package.json
 \`\`\`
 
 ## Multi-tenancy
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** \u2014 via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
+- **Tenant resolution** \u2014 from the \`tenant_id\` claim of a bearer token verified with \`JWT_SECRET\` (see \`middleware.ts\`); the subdomain is only a display slug
 - **Config inheritance** \u2014 settings flow down the tenant tree with override support
 - **Permission ABAC** \u2014 role-based permissions with tenant-scoped enforcement
 
@@ -1560,11 +2176,13 @@ Creating ${projectName} with ${template} template...
   writeFile2(path2.join(targetDir, ".env.example"), generateEnv(projectName));
   if (template === "express") {
     writeFile2(path2.join(targetDir, "src", "index.ts"), generateExpressServer(projectName));
+    writeFile2(path2.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "fastify") {
     writeFile2(path2.join(targetDir, "src", "index.ts"), generateFastifyServer(projectName));
+    writeFile2(path2.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "nextjs") {
     writeFile2(path2.join(targetDir, "src", "app", "page.tsx"), generateNextjsPage(projectName));
-    writeFile2(path2.join(targetDir, "middleware.ts"), generateNextjsMiddleware2());
+    writeFile2(path2.join(targetDir, "middleware.ts"), nextjsTenantMiddleware());
   }
   writeFile2(path2.join(targetDir, "README.md"), generateReadme(projectName, template));
   if (!skipInstall) {
@@ -1639,26 +2257,9 @@ Success! Created ${projectName} at ${targetDir}
   if (skipInstall) {
     console.log("  npm install");
   }
-  if (preset) {
-    const parsed = parsePresetString(preset);
-    if (parsed.framework === "nextjs") {
-      console.log("  npm run dev");
-    } else if (parsed.framework === "nestjs") {
-      console.log("  node --env-file=.env src/main.ts");
-    } else {
-      console.log("  node --env-file=.env src/index.ts");
-    }
-  } else if (template === "nextjs") {
-    console.log("  npm run dev");
-  } else {
-    console.log("  node --env-file=.env src/index.ts");
-  }
+  console.log("  npm run dev");
   console.log("");
 }
-var __filename = fileURLToPath(import.meta.url);
-if (process.argv[1] === __filename) {
-  main(process.argv.slice(2));
-}
 export {
   createProject,
   main,