@stratum-hq/create 0.4.1 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @stratum-hq/create
 
+## 0.5.1
+
+### Patch Changes
+
+- b737034: Improve the npm metadata so that npm search finds the packages. Each `description` now starts with the problem the package solves. Each package carries the same multi-tenancy keywords, including `multitenancy`. The `homepage` field now points at the package's page on https://docs.stratum-hq.org instead of a GitHub folder. The first lines of each README link the documentation. No code changes.
+- a1bd9aa: Replace em dashes in user-visible text with ordinary punctuation. This touches READMEs, package descriptions, CLI output, control plane startup log messages, the text that `@stratum-hq/create` writes into generated projects, and the assertion messages in `@stratum-hq/test-utils`. The CLI `health` and `migrate` tables now print `no` instead of a dash for an unset flag. No behavior changes.
+
+## 0.5.0
+
+### Minor Changes
+
+- 4c1686a: Generated servers and Next.js middleware take the tenant from a verified JWT instead of the hostname (GHSA-p4wg-j8hh-9wh8).
+
 ## 0.4.1
 
 ### Patch Changes

package/README.md

@@ -1,6 +1,8 @@
 # @stratum-hq/create
 
-Scaffold a complete [Stratum](https://github.com/stratum-hq/Stratum) multi-tenancy project with one command — package.json, Docker Compose, environment files, and framework-specific starter code.
+Scaffold a complete [Stratum](https://github.com/stratum-hq/Stratum) multi-tenancy project with one command: package.json, Docker Compose, environment files, and framework-specific starter code.
+
+Read the documentation at [docs.stratum-hq.org/packages/create](https://docs.stratum-hq.org/packages/create/).
 
 ## Usage
 
@@ -28,9 +30,9 @@ npx @stratum-hq/create my-app [options]
 
 ## Templates
 
-- **express** (default) — Express server with Stratum middleware, tenant-aware routes, and TypeScript config.
-- **fastify** — Fastify server with the Stratum plugin registered.
-- **nextjs** — Next.js project with edge middleware for tenant resolution and server-side helpers.
+- **express** (default): Express server with Stratum middleware, tenant-aware routes, and TypeScript config.
+- **fastify**: Fastify server with the Stratum plugin registered.
+- **nextjs**: Next.js project with edge middleware that resolves the tenant from a verified JWT.
 
 ## After Scaffolding
 
@@ -43,6 +45,10 @@ npm run dev            # run the app
 
 The generated starter code does not create a `Stratum` instance, so it does not create Stratum's tables. To create them, construct `Stratum` with `autoMigrate: true` and call `initialize()` once at startup.
 
+## Tenant resolution
+
+Generated servers (the Express, Fastify, Hono and NestJS presets) and the Next.js middleware take the tenant ID only from the `tenant_id` claim of a bearer token that verifies with `JWT_SECRET` (HS256, using `jose`, which the generated `package.json` lists). A token that does not verify, or has no `tenant_id` claim, is rejected with 401. The tenant is never taken from the hostname or from a client-supplied header such as `x-tenant-id`. In the Next.js middleware the subdomain is forwarded as `x-tenant-slug`, a display hint that does not identify the caller's tenant.
+
 ## Links
 
 - Documentation: https://docs.stratum-hq.org/packages/create/

package/dist/index.js

@@ -610,6 +610,114 @@ export { pool };
 }
 
 // src/generators/middleware.ts
+var VERIFIED_TENANT = `import { jwtVerify } from "jose";
+
+const jwtSecret = process.env.JWT_SECRET;
+if (!jwtSecret) {
+  throw new Error("JWT_SECRET must be set: the tenant is taken from a verified JWT.");
+}
+const jwtKey = new TextEncoder().encode(jwtSecret);
+
+/**
+ * The tenant for a request, from the tenant_id claim of a bearer token that
+ * verifies with JWT_SECRET. tenantId is null when there is no bearer token.
+ * invalid is true when a token was sent but does not verify or has no
+ * tenant_id claim. Never take the tenant from the hostname or from a header
+ * such as x-tenant-id: any caller can choose those.
+ */
+async function verifiedTenant(
+  authorization: string | undefined,
+): Promise<{ tenantId: string | null; invalid: boolean }> {
+  if (!authorization?.startsWith("Bearer ")) return { tenantId: null, invalid: false };
+  try {
+    const { payload } = await jwtVerify(authorization.slice("Bearer ".length), jwtKey, {
+      algorithms: ["HS256"],
+    });
+    if (typeof payload.tenant_id === "string") return { tenantId: payload.tenant_id, invalid: false };
+  } catch {
+    // Fall through: a token that does not verify is rejected, never ignored.
+  }
+  return { tenantId: null, invalid: true };
+}`;
+var INVALID_TOKEN = `{ error: "Bearer token is invalid or has no tenant_id claim" }`;
+var TENANT_REQUIRED = `{ error: "A bearer token with a tenant_id claim is required" }`;
+function nextjsTenantMiddleware() {
+  return `// middleware.ts (place in project root)
+// Next.js middleware for Stratum tenant resolution
+//
+// The tenant ID comes only from the tenant_id claim of a bearer token that
+// verifies with JWT_SECRET, and is forwarded as x-tenant-id. Any copy of the
+// tenant headers the client sent is removed first, so server code only ever
+// reads the values set here.
+//
+// The subdomain (acme.app.example.com) is forwarded as x-tenant-slug. It only
+// says which tenant's public pages to show. It does not prove the caller
+// belongs to that tenant, so never use it to read or write tenant data.
+
+import { NextRequest, NextResponse } from "next/server";
+import { jwtVerify } from "jose";
+
+const TENANT_ID_HEADER = "x-tenant-id";
+const TENANT_SLUG_HEADER = "x-tenant-slug";
+
+/**
+ * The tenant_id claim of a token that verifies with JWT_SECRET, or null when
+ * the token is invalid, expired, or has no string tenant_id claim.
+ */
+async function verifiedTenantId(token: string): Promise<string | null> {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    throw new Error("JWT_SECRET must be set: the tenant is taken from a verified JWT.");
+  }
+  try {
+    const { payload } = await jwtVerify(token, new TextEncoder().encode(secret), {
+      algorithms: ["HS256"],
+    });
+    return typeof payload.tenant_id === "string" ? payload.tenant_id : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function middleware(request: NextRequest): Promise<NextResponse> {
+  // Only this middleware may set the tenant headers.
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
+  requestHeaders.delete(TENANT_SLUG_HEADER);
+
+  // A bearer token that does not verify is rejected, never ignored.
+  const authorization = request.headers.get("authorization");
+  if (authorization?.startsWith("Bearer ")) {
+    const tenantId = await verifiedTenantId(authorization.slice("Bearer ".length));
+    if (!tenantId) {
+      return NextResponse.json(
+        { error: { code: "INVALID_TOKEN", message: "Bearer token is invalid or has no tenant_id claim" } },
+        { status: 401 },
+      );
+    }
+    requestHeaders.set(TENANT_ID_HEADER, tenantId);
+  }
+
+  // Subdomain, e.g. "acme" from "acme.app.example.com": a slug, not an identity.
+  const hostname = (request.headers.get("host") ?? "").split(":")[0];
+  const rootDomain = process.env.ROOT_DOMAIN ?? "app.example.com";
+  if (hostname.endsWith(\`.\${rootDomain}\`)) {
+    const subdomain = hostname.slice(0, hostname.length - rootDomain.length - 1);
+    if (subdomain && subdomain !== "www") {
+      requestHeaders.set(TENANT_SLUG_HEADER, subdomain);
+    }
+  }
+
+  // With no verified tenant the request continues without x-tenant-id. Each
+  // route decides whether to require a tenant or serve a public page.
+  return NextResponse.next({ request: { headers: requestHeaders } });
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+`;
+}
 function generateMiddleware(projectName, preset) {
   switch (preset.framework) {
     case "express":
@@ -631,19 +739,21 @@ function generateExpressMiddleware(projectName) {
     {
       filename: "src/index.ts",
       content: `import express from "express";
+${VERIFIED_TENANT}
 
 const app = express();
 const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
-app.use((req, _res, next) => {
-  const tenantId = req.hostname.split(".")[0];
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
+app.use(async (req, res, next) => {
+  const { tenantId, invalid } = await verifiedTenant(req.headers.authorization);
+  if (invalid) {
+    res.status(401).json(${INVALID_TOKEN});
+    return;
+  }
   (req as any).tenantId = tenantId;
   next();
 });
@@ -654,6 +764,10 @@ app.get("/health", (_req, res) => {
 
 app.get("/tenants", async (req, res) => {
   const tenantId = (req as any).tenantId;
+  if (!tenantId) {
+    res.status(401).json(${TENANT_REQUIRED});
+    return;
+  }
   res.json({ tenantId, message: "Replace with your tenant queries" });
 });
 
@@ -669,18 +783,19 @@ function generateFastifyMiddleware(projectName) {
     {
       filename: "src/index.ts",
       content: `import Fastify from "fastify";
+${VERIFIED_TENANT}
 
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction hook. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
-fastify.decorateRequest("tenantId", "");
-fastify.addHook("onRequest", async (request) => {
-  const tenantId = request.hostname?.split(".")[0] ?? "";
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
+fastify.decorateRequest("tenantId", null);
+fastify.addHook("onRequest", async (request, reply) => {
+  const { tenantId, invalid } = await verifiedTenant(request.headers.authorization);
+  if (invalid) {
+    return reply.status(401).send(${INVALID_TOKEN});
+  }
   (request as any).tenantId = tenantId;
 });
 
@@ -688,8 +803,11 @@ fastify.get("/health", async () => {
   return { status: "ok", project: "${projectName}" };
 });
 
-fastify.get("/tenants", async (request) => {
+fastify.get("/tenants", async (request, reply) => {
   const tenantId = (request as any).tenantId;
+  if (!tenantId) {
+    return reply.status(401).send(${TENANT_REQUIRED});
+  }
   return { tenantId, message: "Replace with your tenant queries" };
 });
 
@@ -707,30 +825,7 @@ function generateNextjsMiddleware(projectName) {
   return [
     {
       filename: "middleware.ts",
-      content: `// Next.js edge middleware for tenant resolution
-import { NextRequest, NextResponse } from "next/server";
-
-export function middleware(request: NextRequest) {
-  // The tenant comes from the subdomain the request was routed to. Any
-  // x-tenant-id the client sent is removed first, so server code that reads
-  // x-tenant-id only ever sees the value set here. Once you add
-  // authentication, check that the signed-in user belongs to this tenant.
-  const hostname = request.headers.get("host") || "";
-  const tenantId = hostname.split(".")[0];
-
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.delete("x-tenant-id");
-  if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
-    requestHeaders.set("x-tenant-id", tenantId);
-  }
-
-  return NextResponse.next({ request: { headers: requestHeaders } });
-}
-
-export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-};
-`
+      content: nextjsTenantMiddleware()
     },
     {
       filename: "src/app/page.tsx",
@@ -742,7 +837,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -758,16 +853,17 @@ function generateHonoMiddleware(projectName) {
       filename: "src/index.ts",
       content: `import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+${VERIFIED_TENANT}
 
-const app = new Hono();
+const app = new Hono<{ Variables: { tenantId: string | null } }>();
 
-// Tenant extraction middleware. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
 app.use("*", async (c, next) => {
-  const tenantId = new URL(c.req.url).hostname.split(".")[0];
+  const { tenantId, invalid } = await verifiedTenant(c.req.header("authorization"));
+  if (invalid) {
+    return c.json(${INVALID_TOKEN}, 401);
+  }
   c.set("tenantId", tenantId);
   await next();
 });
@@ -778,6 +874,9 @@ app.get("/health", (c) => {
 
 app.get("/tenants", (c) => {
   const tenantId = c.get("tenantId");
+  if (!tenantId) {
+    return c.json(${TENANT_REQUIRED}, 401);
+  }
   return c.json({ tenantId, message: "Replace with your tenant queries" });
 });
 
@@ -822,7 +921,7 @@ export class AppModule {}
     },
     {
       filename: "src/app.controller.ts",
-      content: `import { Controller, Get, Req } from "@nestjs/common";
+      content: `import { Controller, Get, Req, UnauthorizedException } from "@nestjs/common";
 
 @Controller()
 export class AppController {
@@ -833,6 +932,9 @@ export class AppController {
 
   @Get("tenants")
   tenants(@Req() req: any) {
+    if (!req.tenantId) {
+      throw new UnauthorizedException("A bearer token with a tenant_id claim is required");
+    }
     return { tenantId: req.tenantId, message: "Replace with your tenant queries" };
   }
 }
@@ -840,18 +942,22 @@ export class AppController {
     },
     {
       filename: "src/tenant.guard.ts",
-      content: `import { Injectable, CanActivate, ExecutionContext } from "@nestjs/common";
+      content: `import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from "@nestjs/common";
+${VERIFIED_TENANT}
 
+/**
+ * Sets request.tenantId from a verified bearer token, or null when there is
+ * no token. A token that does not verify is rejected with 401.
+ */
 @Injectable()
 export class TenantGuard implements CanActivate {
-  canActivate(context: ExecutionContext): boolean {
+  async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest();
-    // The tenant comes from the subdomain the request was routed to. Do not
-    // take it from a client-supplied header such as x-tenant-id: any caller
-    // can set one and pick another tenant. Once you add authentication, check
-    // that the signed-in user belongs to this tenant here.
-    const tenantId = request.hostname?.split(".")[0];
-    request.tenantId = tenantId || null;
+    const { tenantId, invalid } = await verifiedTenant(request.headers?.authorization);
+    if (invalid) {
+      throw new UnauthorizedException("Bearer token is invalid or has no tenant_id claim");
+    }
+    request.tenantId = tenantId;
     return true;
   }
 }
@@ -906,14 +1012,17 @@ function generateTsconfig(framework, extraSources = []) {
 // ../hono/package.json
 var package_default = {
   name: "@stratum-hq/hono",
-  version: "1.1.0",
-  description: "Stratum Hono integration \u2014 tenant extraction middleware with ALS context",
+  version: "1.3.1",
+  description: "Hono multi-tenancy middleware: tenant resolution with AsyncLocalStorage context",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
+    "tenant-isolation",
     "hono",
+    "asynclocalstorage",
     "middleware",
     "typescript",
     "stratum"
@@ -957,7 +1066,7 @@ var package_default = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/hono#readme",
+  homepage: "https://docs.stratum-hq.org/packages/hono/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -972,18 +1081,27 @@ var package_default = {
 // ../db-adapters/package.json
 var package_default2 = {
   name: "@stratum-hq/db-adapters",
-  version: "1.2.0",
-  description: "Stratum PostgreSQL adapters for tenant-scoped query isolation",
+  version: "1.4.0",
+  description: "Multi-tenant PostgreSQL row-level security for pg, Prisma, Drizzle, and Sequelize, plus schema-per-tenant and database-per-tenant isolation",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
     "tenant-isolation",
-    "postgresql",
-    "postgres",
     "row-level-security",
     "rls",
+    "postgresql",
+    "prisma",
+    "drizzle",
+    "drizzle-orm",
+    "sequelize",
+    "pg",
+    "node-postgres",
+    "schema-per-tenant",
+    "database-per-tenant",
+    "postgres",
     "schema-isolation",
     "database",
     "stratum"
@@ -994,6 +1112,10 @@ var package_default2 = {
     ".": {
       types: "./dist/index.d.ts",
       default: "./dist/index.js"
+    },
+    "./pglite": {
+      types: "./dist/pglite/index.d.ts",
+      default: "./dist/pglite/index.js"
     }
   },
   files: [
@@ -1013,18 +1135,23 @@ var package_default2 = {
     registry: "https://registry.npmjs.org/"
   },
   dependencies: {
-    "@stratum-hq/core": "^1.4.0",
+    "@stratum-hq/core": "^1.5.1",
     pg: "^8.11.0"
   },
   peerDependencies: {
+    "@electric-sql/pglite": "^0.4.2",
     "drizzle-orm": ">=0.29.0"
   },
   peerDependenciesMeta: {
+    "@electric-sql/pglite": {
+      optional: true
+    },
     "drizzle-orm": {
       optional: true
     }
   },
   devDependencies: {
+    "@electric-sql/pglite": "^0.4.6",
     "@prisma/client": "^5.10.0",
     "@types/pg": "^8.11.0",
     "drizzle-orm": "^0.45.3",
@@ -1033,7 +1160,7 @@ var package_default2 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/db-adapters#readme",
+  homepage: "https://docs.stratum-hq.org/packages/db-adapters/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1048,21 +1175,28 @@ var package_default2 = {
 // ../lib/package.json
 var package_default3 = {
   name: "@stratum-hq/lib",
-  version: "1.4.0",
-  description: "Stratum tenant management library - framework-agnostic business logic",
+  version: "1.7.0",
+  description: "Multi-tenancy for Node.js and PostgreSQL: tenant hierarchy, config inheritance, row-level security, ABAC, audit log, and GDPR tooling",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
-    "b2b",
     "tenant",
-    "tenant-management",
     "tenant-isolation",
-    "node",
-    "typescript",
-    "postgresql",
     "row-level-security",
     "rls",
+    "postgresql",
+    "tenant-hierarchy",
+    "ltree",
+    "abac",
+    "audit-log",
+    "encryption",
+    "webhooks",
+    "b2b",
+    "tenant-management",
+    "node",
+    "typescript",
     "schema-isolation",
     "config-inheritance",
     "gdpr",
@@ -1093,10 +1227,10 @@ var package_default3 = {
     registry: "https://registry.npmjs.org/"
   },
   dependencies: {
-    "@opentelemetry/api": "^1.9.0",
-    "@stratum-hq/core": "^1.4.0",
-    "@stratum-hq/db-adapters": "^1.2.0",
-    "@stratum-hq/sdk": "^1.2.0",
+    "@opentelemetry/api": "^1.0.0",
+    "@stratum-hq/core": "^1.5.1",
+    "@stratum-hq/db-adapters": "^1.4.0",
+    "@stratum-hq/sdk": "^1.3.1",
     pg: "^8.11.0"
   },
   peerDependencies: {
@@ -1108,13 +1242,14 @@ var package_default3 = {
     }
   },
   devDependencies: {
+    "@electric-sql/pglite": "^0.4.6",
     "@types/pg": "^8.11.0",
     typescript: "^5.4.0",
     vitest: "^4.1.11"
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/lib#readme",
+  homepage: "https://docs.stratum-hq.org/packages/lib/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1129,10 +1264,11 @@ var package_default3 = {
 // ../mongodb/package.json
 var package_default4 = {
   name: "@stratum-hq/mongodb",
-  version: "0.4.0",
-  description: "MongoDB tenant isolation for Stratum \u2014 shared collection, collection-per-tenant, and database-per-tenant strategies",
+  version: "0.6.1",
+  description: "MongoDB tenant isolation for Stratum: shared collection, collection-per-tenant, and database-per-tenant strategies",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
@@ -1165,8 +1301,8 @@ var package_default4 = {
     clean: "rm -rf dist"
   },
   dependencies: {
-    "@stratum-hq/core": "^1.4.0",
-    "@stratum-hq/sdk": "^1.2.0"
+    "@stratum-hq/core": "^1.5.1",
+    "@stratum-hq/sdk": "^1.3.1"
   },
   peerDependencies: {
     mongodb: "^6.0.0 || ^7.0.0"
@@ -1188,7 +1324,7 @@ var package_default4 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/mongodb#readme",
+  homepage: "https://docs.stratum-hq.org/packages/mongodb/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1203,10 +1339,11 @@ var package_default4 = {
 // ../mysql/package.json
 var package_default5 = {
   name: "@stratum-hq/mysql",
-  version: "0.4.0",
-  description: "MySQL tenant isolation for Stratum \u2014 shared table, table-per-tenant, and database-per-tenant strategies",
+  version: "0.6.1",
+  description: "MySQL tenant isolation for Stratum: shared table, table-per-tenant, and database-per-tenant strategies",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
@@ -1241,8 +1378,8 @@ var package_default5 = {
     clean: "rm -rf dist"
   },
   dependencies: {
-    "@stratum-hq/core": "^1.4.0",
-    "@stratum-hq/sdk": "^1.2.0"
+    "@stratum-hq/core": "^1.5.1",
+    "@stratum-hq/sdk": "^1.3.1"
   },
   peerDependencies: {
     mysql2: "^3.0.0",
@@ -1264,6 +1401,7 @@ var package_default5 = {
   devDependencies: {
     knex: "^3.3.0",
     mysql2: "^3.24.4",
+    sequelize: "^6.37.8",
     typeorm: "^1.1.1",
     typescript: "^5.9.0",
     vitest: "^4.1.11"
@@ -1273,7 +1411,7 @@ var package_default5 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/mysql#readme",
+  homepage: "https://docs.stratum-hq.org/packages/mysql/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1288,13 +1426,15 @@ var package_default5 = {
 // ../nestjs/package.json
 var package_default6 = {
   name: "@stratum-hq/nestjs",
-  version: "1.2.0",
-  description: "Stratum NestJS integration \u2014 StratumGuard, @Tenant() decorator, and StratumModule",
+  version: "1.3.1",
+  description: "NestJS multi-tenancy: tenant guard, @Tenant() decorator, and module for Stratum",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
+    "tenant-isolation",
     "nestjs",
     "nest",
     "guard",
@@ -1332,7 +1472,7 @@ var package_default6 = {
     "@nestjs/common": ">=10.0.0",
     "@nestjs/core": ">=10.0.0",
     "@stratum-hq/core": "^1.0.0",
-    "@stratum-hq/sdk": "^1.2.0",
+    "@stratum-hq/sdk": "^1.3.0",
     "reflect-metadata": ">=0.1.13"
   },
   devDependencies: {
@@ -1347,7 +1487,7 @@ var package_default6 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/nestjs#readme",
+  homepage: "https://docs.stratum-hq.org/packages/nestjs/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1468,6 +1608,9 @@ function addOrmDeps(deps, devDeps, preset) {
   }
 }
 function addFrameworkDeps(deps, devDeps, preset) {
+  if (preset.framework !== "none") {
+    deps["jose"] = "^6.2.12";
+  }
   switch (preset.framework) {
     case "express":
       deps["express"] = "^4.18.0";
@@ -1615,23 +1758,23 @@ npx drizzle-kit push
 function getStrategyDescription(strategy) {
   switch (strategy) {
     case "rls":
-      return `- **Row-Level Security** -- PostgreSQL RLS policies filter rows by tenant automatically
+      return `- **Row-Level Security**: PostgreSQL RLS policies filter rows by tenant automatically
 - Each query sets \`app.current_tenant_id\` and RLS enforces isolation
 - All tenants share one database and schema`;
     case "schema":
-      return `- **Schema-per-tenant** -- each tenant gets a dedicated PostgreSQL schema
+      return `- **Schema-per-tenant**: each tenant gets a dedicated PostgreSQL schema
 - Queries are routed to the correct schema via search_path
 - Shared database, isolated schemas`;
     case "database":
-      return `- **Database-per-tenant** -- each tenant gets a fully isolated database
+      return `- **Database-per-tenant**: each tenant gets a fully isolated database
 - Connection routing directs queries to the correct database
 - Maximum isolation at the cost of more resource usage`;
     case "collection":
-      return `- **Collection-per-tenant** -- each tenant gets dedicated MongoDB collections
+      return `- **Collection-per-tenant**: each tenant gets dedicated MongoDB collections
 - Collection names are prefixed or namespaced by tenant ID
 - Shared database, isolated collections`;
     case "table-prefix":
-      return `- **Table-prefix** -- tenant-specific tables with a naming prefix
+      return `- **Table-prefix**: tenant-specific tables with a naming prefix
 - Tables are prefixed with the tenant identifier
 - Shared database, prefixed table names`;
     default:
@@ -1819,7 +1962,9 @@ function generatePackageJson(projectName, template) {
       react: "^19.0.0",
       "react-dom": "^19.0.0",
       "@types/react": "^19.0.0",
-      "@types/react-dom": "^19.0.0"
+      "@types/react-dom": "^19.0.0",
+      // The middleware verifies the tenant JWT with jose.
+      jose: "^6.2.12"
     }
   };
   const deps = {
@@ -1982,7 +2127,7 @@ fastify.listen({ port, host: "0.0.0.0" }, (err) => {
 `;
 }
 function generateNextjsPage(projectName) {
-  return `// app/page.tsx \u2014 ${projectName} root page
+  return `// app/page.tsx: ${projectName} root page
 export default function Home() {
   return (
     <main style={{ padding: "2rem", fontFamily: "sans-serif" }}>
@@ -1990,7 +2135,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -1998,32 +2143,6 @@ export default function Home() {
 }
 `;
 }
-function generateNextjsMiddleware2() {
-  return `// middleware.ts \u2014 tenant resolution via subdomain
-import { NextRequest, NextResponse } from "next/server";
-
-export function middleware(request: NextRequest) {
-  // The tenant comes from the subdomain the request was routed to. Any
-  // x-tenant-id the client sent is removed first, so server code that reads
-  // x-tenant-id only ever sees the value set here. Once you add
-  // authentication, check that the signed-in user belongs to this tenant.
-  const hostname = request.headers.get("host") || "";
-  const tenantId = hostname.split(".")[0];
-
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.delete("x-tenant-id");
-  if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
-    requestHeaders.set("x-tenant-id", tenantId);
-  }
-
-  return NextResponse.next({ request: { headers: requestHeaders } });
-}
-
-export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-};
-`;
-}
 function generateReadme(projectName, template) {
   return `# ${projectName}
 
@@ -2041,7 +2160,7 @@ docker compose up -d
 
 \`\`\`bash
 cp .env.example .env
-# Edit .env \u2014 update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
+# Edit .env: update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
 \`\`\`
 
 ### 3. Install dependencies
@@ -2071,9 +2190,9 @@ ${template === "nextjs" ? "" : "\u251C\u2500\u2500 tsconfig.json\n"}\u2514\u2500
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** \u2014 via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
-- **Config inheritance** \u2014 settings flow down the tenant tree with override support
-- **Permission ABAC** \u2014 role-based permissions with tenant-scoped enforcement
+- **Tenant resolution**: from the \`tenant_id\` claim of a bearer token verified with \`JWT_SECRET\` (see \`middleware.ts\`); the subdomain is only a display slug
+- **Config inheritance**: settings flow down the tenant tree with override support
+- **Permission ABAC**: role-based permissions with tenant-scoped enforcement
 
 See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference.
 `;
@@ -2097,7 +2216,7 @@ Creating ${projectName} with ${template} template...
     writeFile2(path2.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "nextjs") {
     writeFile2(path2.join(targetDir, "src", "app", "page.tsx"), generateNextjsPage(projectName));
-    writeFile2(path2.join(targetDir, "middleware.ts"), generateNextjsMiddleware2());
+    writeFile2(path2.join(targetDir, "middleware.ts"), nextjsTenantMiddleware());
   }
   writeFile2(path2.join(targetDir, "README.md"), generateReadme(projectName, template));
   if (!skipInstall) {

package/package.json

@@ -1,12 +1,26 @@
 {
   "name": "@stratum-hq/create",
-  "version": "0.4.1",
-  "description": "Create a new Stratum multi-tenancy project",
+  "version": "0.5.1",
+  "description": "Scaffold a multi-tenant SaaS starter for Node.js: PostgreSQL, MySQL, or MongoDB with Express, Fastify, Next.js, Hono, or NestJS",
   "keywords": [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
+    "tenant-isolation",
+    "row-level-security",
+    "rls",
+    "postgresql",
+    "mysql",
+    "mongodb",
+    "express",
+    "fastify",
+    "nextjs",
+    "hono",
+    "nestjs",
+    "prisma",
+    "drizzle",
     "create",
     "scaffolding",
     "starter",
@@ -40,7 +54,7 @@
   },
   "license": "MIT",
   "author": "Christian Crank",
-  "homepage": "https://github.com/stratum-hq/Stratum/tree/main/packages/create#readme",
+  "homepage": "https://docs.stratum-hq.org/packages/create/",
   "bugs": "https://github.com/stratum-hq/Stratum/issues",
   "engines": {
     "node": ">=20.0.0"

package/src/generators/middleware.ts

@@ -5,6 +5,128 @@ export interface MiddlewareFile {
   content: string;
 }
 
+/**
+ * Verifies the bearer token and returns its tenant_id claim. Inserted into
+ * every generated server so the project needs nothing but jose. The tenant
+ * never comes from the hostname or a header such as x-tenant-id: any caller
+ * can choose those.
+ */
+const VERIFIED_TENANT = `import { jwtVerify } from "jose";
+
+const jwtSecret = process.env.JWT_SECRET;
+if (!jwtSecret) {
+  throw new Error("JWT_SECRET must be set: the tenant is taken from a verified JWT.");
+}
+const jwtKey = new TextEncoder().encode(jwtSecret);
+
+/**
+ * The tenant for a request, from the tenant_id claim of a bearer token that
+ * verifies with JWT_SECRET. tenantId is null when there is no bearer token.
+ * invalid is true when a token was sent but does not verify or has no
+ * tenant_id claim. Never take the tenant from the hostname or from a header
+ * such as x-tenant-id: any caller can choose those.
+ */
+async function verifiedTenant(
+  authorization: string | undefined,
+): Promise<{ tenantId: string | null; invalid: boolean }> {
+  if (!authorization?.startsWith("Bearer ")) return { tenantId: null, invalid: false };
+  try {
+    const { payload } = await jwtVerify(authorization.slice("Bearer ".length), jwtKey, {
+      algorithms: ["HS256"],
+    });
+    if (typeof payload.tenant_id === "string") return { tenantId: payload.tenant_id, invalid: false };
+  } catch {
+    // Fall through: a token that does not verify is rejected, never ignored.
+  }
+  return { tenantId: null, invalid: true };
+}`;
+
+const INVALID_TOKEN = `{ error: "Bearer token is invalid or has no tenant_id claim" }`;
+const TENANT_REQUIRED = `{ error: "A bearer token with a tenant_id claim is required" }`;
+
+/**
+ * Next.js middleware, following examples/with-nextjs: the tenant ID comes only
+ * from the tenant_id claim of a verified bearer token and is forwarded as
+ * x-tenant-id. The subdomain is forwarded as x-tenant-slug, never as the ID.
+ */
+export function nextjsTenantMiddleware(): string {
+  return `// middleware.ts (place in project root)
+// Next.js middleware for Stratum tenant resolution
+//
+// The tenant ID comes only from the tenant_id claim of a bearer token that
+// verifies with JWT_SECRET, and is forwarded as x-tenant-id. Any copy of the
+// tenant headers the client sent is removed first, so server code only ever
+// reads the values set here.
+//
+// The subdomain (acme.app.example.com) is forwarded as x-tenant-slug. It only
+// says which tenant's public pages to show. It does not prove the caller
+// belongs to that tenant, so never use it to read or write tenant data.
+
+import { NextRequest, NextResponse } from "next/server";
+import { jwtVerify } from "jose";
+
+const TENANT_ID_HEADER = "x-tenant-id";
+const TENANT_SLUG_HEADER = "x-tenant-slug";
+
+/**
+ * The tenant_id claim of a token that verifies with JWT_SECRET, or null when
+ * the token is invalid, expired, or has no string tenant_id claim.
+ */
+async function verifiedTenantId(token: string): Promise<string | null> {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    throw new Error("JWT_SECRET must be set: the tenant is taken from a verified JWT.");
+  }
+  try {
+    const { payload } = await jwtVerify(token, new TextEncoder().encode(secret), {
+      algorithms: ["HS256"],
+    });
+    return typeof payload.tenant_id === "string" ? payload.tenant_id : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function middleware(request: NextRequest): Promise<NextResponse> {
+  // Only this middleware may set the tenant headers.
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
+  requestHeaders.delete(TENANT_SLUG_HEADER);
+
+  // A bearer token that does not verify is rejected, never ignored.
+  const authorization = request.headers.get("authorization");
+  if (authorization?.startsWith("Bearer ")) {
+    const tenantId = await verifiedTenantId(authorization.slice("Bearer ".length));
+    if (!tenantId) {
+      return NextResponse.json(
+        { error: { code: "INVALID_TOKEN", message: "Bearer token is invalid or has no tenant_id claim" } },
+        { status: 401 },
+      );
+    }
+    requestHeaders.set(TENANT_ID_HEADER, tenantId);
+  }
+
+  // Subdomain, e.g. "acme" from "acme.app.example.com": a slug, not an identity.
+  const hostname = (request.headers.get("host") ?? "").split(":")[0];
+  const rootDomain = process.env.ROOT_DOMAIN ?? "app.example.com";
+  if (hostname.endsWith(\`.\${rootDomain}\`)) {
+    const subdomain = hostname.slice(0, hostname.length - rootDomain.length - 1);
+    if (subdomain && subdomain !== "www") {
+      requestHeaders.set(TENANT_SLUG_HEADER, subdomain);
+    }
+  }
+
+  // With no verified tenant the request continues without x-tenant-id. Each
+  // route decides whether to require a tenant or serve a public page.
+  return NextResponse.next({ request: { headers: requestHeaders } });
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+`;
+}
+
 export function generateMiddleware(projectName: string, preset: StackPreset): MiddlewareFile[] {
   switch (preset.framework) {
     case "express":
@@ -27,19 +149,21 @@ function generateExpressMiddleware(projectName: string): MiddlewareFile[] {
     {
       filename: "src/index.ts",
       content: `import express from "express";
+${VERIFIED_TENANT}
 
 const app = express();
 const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
-app.use((req, _res, next) => {
-  const tenantId = req.hostname.split(".")[0];
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
+app.use(async (req, res, next) => {
+  const { tenantId, invalid } = await verifiedTenant(req.headers.authorization);
+  if (invalid) {
+    res.status(401).json(${INVALID_TOKEN});
+    return;
+  }
   (req as any).tenantId = tenantId;
   next();
 });
@@ -50,6 +174,10 @@ app.get("/health", (_req, res) => {
 
 app.get("/tenants", async (req, res) => {
   const tenantId = (req as any).tenantId;
+  if (!tenantId) {
+    res.status(401).json(${TENANT_REQUIRED});
+    return;
+  }
   res.json({ tenantId, message: "Replace with your tenant queries" });
 });
 
@@ -66,18 +194,19 @@ function generateFastifyMiddleware(projectName: string): MiddlewareFile[] {
     {
       filename: "src/index.ts",
       content: `import Fastify from "fastify";
+${VERIFIED_TENANT}
 
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction hook. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
-fastify.decorateRequest("tenantId", "");
-fastify.addHook("onRequest", async (request) => {
-  const tenantId = request.hostname?.split(".")[0] ?? "";
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
+fastify.decorateRequest("tenantId", null);
+fastify.addHook("onRequest", async (request, reply) => {
+  const { tenantId, invalid } = await verifiedTenant(request.headers.authorization);
+  if (invalid) {
+    return reply.status(401).send(${INVALID_TOKEN});
+  }
   (request as any).tenantId = tenantId;
 });
 
@@ -85,8 +214,11 @@ fastify.get("/health", async () => {
   return { status: "ok", project: "${projectName}" };
 });
 
-fastify.get("/tenants", async (request) => {
+fastify.get("/tenants", async (request, reply) => {
   const tenantId = (request as any).tenantId;
+  if (!tenantId) {
+    return reply.status(401).send(${TENANT_REQUIRED});
+  }
   return { tenantId, message: "Replace with your tenant queries" };
 });
 
@@ -105,30 +237,7 @@ function generateNextjsMiddleware(projectName: string): MiddlewareFile[] {
   return [
     {
       filename: "middleware.ts",
-      content: `// Next.js edge middleware for tenant resolution
-import { NextRequest, NextResponse } from "next/server";
-
-export function middleware(request: NextRequest) {
-  // The tenant comes from the subdomain the request was routed to. Any
-  // x-tenant-id the client sent is removed first, so server code that reads
-  // x-tenant-id only ever sees the value set here. Once you add
-  // authentication, check that the signed-in user belongs to this tenant.
-  const hostname = request.headers.get("host") || "";
-  const tenantId = hostname.split(".")[0];
-
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.delete("x-tenant-id");
-  if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
-    requestHeaders.set("x-tenant-id", tenantId);
-  }
-
-  return NextResponse.next({ request: { headers: requestHeaders } });
-}
-
-export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-};
-`,
+      content: nextjsTenantMiddleware(),
     },
     {
       filename: "src/app/page.tsx",
@@ -140,7 +249,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -157,16 +266,17 @@ function generateHonoMiddleware(projectName: string): MiddlewareFile[] {
       filename: "src/index.ts",
       content: `import { Hono } from "hono";
 import { serve } from "@hono/node-server";
+${VERIFIED_TENANT}
 
-const app = new Hono();
+const app = new Hono<{ Variables: { tenantId: string | null } }>();
 
-// Tenant extraction middleware. The tenant comes from the subdomain the
-// request was routed to. Do not take it from a client-supplied header such as
-// x-tenant-id: any caller can set one and pick another tenant. Once you add
-// authentication, check that the signed-in user belongs to this tenant, or
-// derive the tenant from the verified session or JWT instead.
+// Tenant resolution. The tenant comes only from a verified bearer token;
+// a token that does not verify is rejected with 401.
 app.use("*", async (c, next) => {
-  const tenantId = new URL(c.req.url).hostname.split(".")[0];
+  const { tenantId, invalid } = await verifiedTenant(c.req.header("authorization"));
+  if (invalid) {
+    return c.json(${INVALID_TOKEN}, 401);
+  }
   c.set("tenantId", tenantId);
   await next();
 });
@@ -177,6 +287,9 @@ app.get("/health", (c) => {
 
 app.get("/tenants", (c) => {
   const tenantId = c.get("tenantId");
+  if (!tenantId) {
+    return c.json(${TENANT_REQUIRED}, 401);
+  }
   return c.json({ tenantId, message: "Replace with your tenant queries" });
 });
 
@@ -222,7 +335,7 @@ export class AppModule {}
     },
     {
       filename: "src/app.controller.ts",
-      content: `import { Controller, Get, Req } from "@nestjs/common";
+      content: `import { Controller, Get, Req, UnauthorizedException } from "@nestjs/common";
 
 @Controller()
 export class AppController {
@@ -233,6 +346,9 @@ export class AppController {
 
   @Get("tenants")
   tenants(@Req() req: any) {
+    if (!req.tenantId) {
+      throw new UnauthorizedException("A bearer token with a tenant_id claim is required");
+    }
     return { tenantId: req.tenantId, message: "Replace with your tenant queries" };
   }
 }
@@ -240,18 +356,22 @@ export class AppController {
     },
     {
       filename: "src/tenant.guard.ts",
-      content: `import { Injectable, CanActivate, ExecutionContext } from "@nestjs/common";
+      content: `import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from "@nestjs/common";
+${VERIFIED_TENANT}
 
+/**
+ * Sets request.tenantId from a verified bearer token, or null when there is
+ * no token. A token that does not verify is rejected with 401.
+ */
 @Injectable()
 export class TenantGuard implements CanActivate {
-  canActivate(context: ExecutionContext): boolean {
+  async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest();
-    // The tenant comes from the subdomain the request was routed to. Do not
-    // take it from a client-supplied header such as x-tenant-id: any caller
-    // can set one and pick another tenant. Once you add authentication, check
-    // that the signed-in user belongs to this tenant here.
-    const tenantId = request.hostname?.split(".")[0];
-    request.tenantId = tenantId || null;
+    const { tenantId, invalid } = await verifiedTenant(request.headers?.authorization);
+    if (invalid) {
+      throw new UnauthorizedException("Bearer token is invalid or has no tenant_id claim");
+    }
+    request.tenantId = tenantId;
     return true;
   }
 }

package/src/generators/package-json.ts

@@ -119,6 +119,10 @@ function addOrmDeps(deps: Record<string, string>, devDeps: Record<string, string
 }
 
 function addFrameworkDeps(deps: Record<string, string>, devDeps: Record<string, string>, preset: StackPreset): void {
+  // The generated tenant resolution verifies the tenant JWT with jose.
+  if (preset.framework !== "none") {
+    deps["jose"] = "^6.2.12";
+  }
   switch (preset.framework) {
     case "express":
       deps["express"] = "^4.18.0";

package/src/generators/readme.ts

@@ -86,23 +86,23 @@ npx drizzle-kit push
 function getStrategyDescription(strategy: string): string {
   switch (strategy) {
     case "rls":
-      return `- **Row-Level Security** -- PostgreSQL RLS policies filter rows by tenant automatically
+      return `- **Row-Level Security**: PostgreSQL RLS policies filter rows by tenant automatically
 - Each query sets \`app.current_tenant_id\` and RLS enforces isolation
 - All tenants share one database and schema`;
     case "schema":
-      return `- **Schema-per-tenant** -- each tenant gets a dedicated PostgreSQL schema
+      return `- **Schema-per-tenant**: each tenant gets a dedicated PostgreSQL schema
 - Queries are routed to the correct schema via search_path
 - Shared database, isolated schemas`;
     case "database":
-      return `- **Database-per-tenant** -- each tenant gets a fully isolated database
+      return `- **Database-per-tenant**: each tenant gets a fully isolated database
 - Connection routing directs queries to the correct database
 - Maximum isolation at the cost of more resource usage`;
     case "collection":
-      return `- **Collection-per-tenant** -- each tenant gets dedicated MongoDB collections
+      return `- **Collection-per-tenant**: each tenant gets dedicated MongoDB collections
 - Collection names are prefixed or namespaced by tenant ID
 - Shared database, isolated collections`;
     case "table-prefix":
-      return `- **Table-prefix** -- tenant-specific tables with a naming prefix
+      return `- **Table-prefix**: tenant-specific tables with a naming prefix
 - Tables are prefixed with the tenant identifier
 - Shared database, prefixed table names`;
     default:

package/src/index.ts

@@ -7,6 +7,7 @@ import { createPresetProject } from "./preset-project.js";
 import { STRATUM_RANGES } from "./stratum-versions.js";
 import { postgresAppRole, postgresAppRoleSql, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
 import { generateTsconfig } from "./generators/tsconfig.js";
+import { nextjsTenantMiddleware } from "./generators/middleware.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -122,6 +123,8 @@ function generatePackageJson(projectName: string, template: Template): string {
       "react-dom": "^19.0.0",
       "@types/react": "^19.0.0",
       "@types/react-dom": "^19.0.0",
+      // The middleware verifies the tenant JWT with jose.
+      jose: "^6.2.12",
     },
   };
 
@@ -293,7 +296,7 @@ fastify.listen({ port, host: "0.0.0.0" }, (err) => {
 }
 
 function generateNextjsPage(projectName: string): string {
-  return `// app/page.tsx — ${projectName} root page
+  return `// app/page.tsx: ${projectName} root page
 export default function Home() {
   return (
     <main style={{ padding: "2rem", fontFamily: "sans-serif" }}>
@@ -301,7 +304,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -310,33 +313,6 @@ export default function Home() {
 `;
 }
 
-function generateNextjsMiddleware(): string {
-  return `// middleware.ts — tenant resolution via subdomain
-import { NextRequest, NextResponse } from "next/server";
-
-export function middleware(request: NextRequest) {
-  // The tenant comes from the subdomain the request was routed to. Any
-  // x-tenant-id the client sent is removed first, so server code that reads
-  // x-tenant-id only ever sees the value set here. Once you add
-  // authentication, check that the signed-in user belongs to this tenant.
-  const hostname = request.headers.get("host") || "";
-  const tenantId = hostname.split(".")[0];
-
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.delete("x-tenant-id");
-  if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
-    requestHeaders.set("x-tenant-id", tenantId);
-  }
-
-  return NextResponse.next({ request: { headers: requestHeaders } });
-}
-
-export const config = {
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-};
-`;
-}
-
 function generateReadme(projectName: string, template: Template): string {
   return `# ${projectName}
 
@@ -354,7 +330,7 @@ docker compose up -d
 
 \`\`\`bash
 cp .env.example .env
-# Edit .env — update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
+# Edit .env: update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
 \`\`\`
 
 ### 3. Install dependencies
@@ -384,9 +360,9 @@ ${template === "nextjs" ? "" : "├── tsconfig.json\n"}└── package.jso
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** — via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
-- **Config inheritance** — settings flow down the tenant tree with override support
-- **Permission ABAC** — role-based permissions with tenant-scoped enforcement
+- **Tenant resolution**: from the \`tenant_id\` claim of a bearer token verified with \`JWT_SECRET\` (see \`middleware.ts\`); the subdomain is only a display slug
+- **Config inheritance**: settings flow down the tenant tree with override support
+- **Permission ABAC**: role-based permissions with tenant-scoped enforcement
 
 See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference.
 `;
@@ -426,7 +402,7 @@ export function createProject(
     writeFile(path.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "nextjs") {
     writeFile(path.join(targetDir, "src", "app", "page.tsx"), generateNextjsPage(projectName));
-    writeFile(path.join(targetDir, "middleware.ts"), generateNextjsMiddleware());
+    writeFile(path.join(targetDir, "middleware.ts"), nextjsTenantMiddleware());
   }
 
   // README

package/src/matrix.ts

@@ -75,7 +75,7 @@ export function parsePresetString(s: string): StackPreset | null {
 
   const parts = s.toLowerCase().split("-");
 
-  // Handle "table-prefix" which contains a hyphen -- it will split into
+  // Handle "table-prefix" which contains a hyphen; it will split into
   // 5 parts: [db, strategy1, "table", "prefix", orm, framework] or similar.
   // We need to reconstruct multi-word tokens.
   // Format: {database}-{strategy}-{orm}-{framework}