@stratum-hq/create 0.5.0 → 0.6.0

package/dist/index.js

@@ -174,12 +174,22 @@ function postgresAppRole(dbName) {
   return `${dbName}_app`;
 }
 var POSTGRES_APP_PASSWORD = "dev_app_password";
+function postgresStratumRole(dbName) {
+  return `${dbName}_stratum`;
+}
+var POSTGRES_STRATUM_PASSWORD = "dev_stratum_password";
 function postgresAppRoleSql(dbName, strategy) {
   const role = postgresAppRole(dbName);
+  const stratum = postgresStratumRole(dbName);
   let strategyGrant = "";
   if (strategy === "schema") {
     strategyGrant = `
--- schema-per-tenant: the app creates one schema per tenant
+-- schema-per-tenant: the app creates one schema per tenant. A schema named
+-- like a login comes first on that login's default search path ("$user",
+-- public), so a schema the app creates could come before public for the
+-- Stratum login or the bootstrap superuser. Both search only public.
+ALTER ROLE ${stratum} IN DATABASE ${dbName} SET search_path = public;
+ALTER ROLE CURRENT_USER IN DATABASE ${dbName} SET search_path = public;
 GRANT CREATE ON DATABASE ${dbName} TO ${role};
 `;
   } else if (strategy === "database") {
@@ -189,15 +199,40 @@ ALTER ROLE ${role} CREATEDB;
 `;
   }
   return `
+-- Stratum's control role (migration 032 of @stratum-hq/lib). Every Stratum
+-- table gets a policy for it, and only its members reach rows across
+-- tenants.
+CREATE ROLE stratum_control NOLOGIN NOSUPERUSER NOBYPASSRLS;
+GRANT USAGE, CREATE ON SCHEMA public TO stratum_control;
+
+-- Stratum's own login: pass it to the library as adminPool, which runs the
+-- Stratum migrations, so it owns the Stratum tables. Not a superuser and no
+-- BYPASSRLS: it reaches them as a member of stratum_control. Do not run the
+-- Stratum migrations as the bootstrap superuser: the default privileges
+-- below would give the app role write access to the Stratum tables. If that
+-- happened, "stratum db roles --apply --app-role ${role}" removes it.
+CREATE ROLE ${stratum} WITH LOGIN PASSWORD '${POSTGRES_STRATUM_PASSWORD}' NOSUPERUSER NOBYPASSRLS;
+GRANT stratum_control TO ${stratum} WITH INHERIT TRUE, SET TRUE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${stratum};
+GRANT USAGE, CREATE ON SCHEMA public TO ${stratum};
+
 -- Application role. The app connects as ${role} (DATABASE_URL), never as the
--- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
--- ignores every row-level security policy, FORCE included. Use the superuser
--- only for bootstrap and migrations.
+-- bootstrap superuser (DATABASE_SUPERUSER_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. It creates no
+-- objects in public: the superuser creates the application's tables (its
+-- migrations), and the app role reads and writes the ones the superuser
+-- creates. It gets nothing on the tables ${stratum} creates; to let it read
+-- Stratum's read list once Stratum has migrated, run:
+--   stratum db roles --apply --admin-role ${stratum} --app-role ${role}
 CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
 GRANT CONNECT ON DATABASE ${dbName} TO ${role};
-GRANT USAGE, CREATE ON SCHEMA public TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+GRANT USAGE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES FOR ROLE ${dbName} IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES FOR ROLE ${dbName} IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+
+-- Only roles granted CREATE by name create objects in public. PostgreSQL 15
+-- and later already start this way; older versions grant it to PUBLIC.
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
 ${strategyGrant}`;
 }
 function generatePresetInitSql(projectName, preset) {
@@ -376,6 +411,10 @@ export { pool };
 `
     });
   }
+  files.push({
+    filename: "src/schema.ts",
+    content: drizzleSchema(preset)
+  });
   files.push({
     filename: "drizzle.config.ts",
     content: `import type { Config } from "drizzle-kit";
@@ -385,13 +424,44 @@ export default {
   out: "./drizzle",
   ${preset.database === "mysql" ? 'dialect: "mysql",' : 'dialect: "postgresql",'}
   dbCredentials: {
-    url: process.env.DATABASE_URL!,
+    url: ${preset.database === "mysql" ? "process.env.DATABASE_URL!" : "(process.env.DATABASE_SUPERUSER_URL ?? process.env.DATABASE_URL)!"},
   },
 } satisfies Config;
 `
   });
   return files;
 }
+function drizzleSchema(preset) {
+  if (preset.database === "mysql") {
+    return `// Drizzle table definitions. drizzle.config.ts reads this file.
+import { mysqlTable, varchar, text, timestamp } from "drizzle-orm/mysql-core";
+
+// An example tenant-scoped table: every row carries the tenant it belongs to.
+export const notes = mysqlTable("notes", {
+  id: varchar("id", { length: 36 }).primaryKey(),
+  tenantId: varchar("tenant_id", { length: 36 }).notNull(),
+  body: text("body").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+`;
+  }
+  return `// Drizzle table definitions. drizzle.config.ts reads this file.
+import { pgTable, uuid, text, timestamp, index } from "drizzle-orm/pg-core";
+
+// An example tenant-scoped table: every row carries the tenant it belongs to.
+// Stratum's own tables, such as tenants, are created by Stratum, not here.
+export const notes = pgTable(
+  "notes",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    tenantId: uuid("tenant_id").notNull(),
+    body: text("body").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [index("notes_tenant_id_idx").on(table.tenantId)],
+);
+`;
+}
 function generateSequelizeSetup(preset) {
   const dialect = preset.database === "mysql" ? "mysql" : "postgres";
   return [
@@ -642,8 +712,10 @@ async function verifiedTenant(
 var INVALID_TOKEN = `{ error: "Bearer token is invalid or has no tenant_id claim" }`;
 var TENANT_REQUIRED = `{ error: "A bearer token with a tenant_id claim is required" }`;
 function nextjsTenantMiddleware() {
-  return `// middleware.ts (place in project root)
-// Next.js middleware for Stratum tenant resolution
+  return `// src/middleware.ts: Next.js middleware for Stratum tenant resolution
+//
+// Next.js runs middleware only from the directory that holds the app
+// directory: src/middleware.ts for src/app, middleware.ts for app.
 //
 // The tenant ID comes only from the tenant_id claim of a bearer token that
 // verifies with JWT_SECRET, and is forwarded as x-tenant-id. Any copy of the
@@ -718,6 +790,19 @@ export const config = {
 };
 `;
 }
+function nextjsRootLayout(projectName) {
+  return `// app/layout.tsx: ${projectName} root layout
+import type { ReactNode } from "react";
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}
+`;
+}
 function generateMiddleware(projectName, preset) {
   switch (preset.framework) {
     case "express":
@@ -735,10 +820,10 @@ function generateMiddleware(projectName, preset) {
   }
 }
 function generateExpressMiddleware(projectName) {
-  return [
-    {
-      filename: "src/index.ts",
-      content: `import express from "express";
+  return [{ filename: "src/index.ts", content: expressServer(projectName) }];
+}
+function expressServer(projectName) {
+  return `import express from "express";
 ${VERIFIED_TENANT}
 
 const app = express();
@@ -774,15 +859,13 @@ app.get("/tenants", async (req, res) => {
 app.listen(port, () => {
   console.log(\`${projectName} running on http://localhost:\${port}\`);
 });
-`
-    }
-  ];
+`;
 }
 function generateFastifyMiddleware(projectName) {
-  return [
-    {
-      filename: "src/index.ts",
-      content: `import Fastify from "fastify";
+  return [{ filename: "src/index.ts", content: fastifyServer(projectName) }];
+}
+function fastifyServer(projectName) {
+  return `import Fastify from "fastify";
 ${VERIFIED_TENANT}
 
 const fastify = Fastify({ logger: true });
@@ -817,16 +900,18 @@ fastify.listen({ port, host: "0.0.0.0" }, (err) => {
     process.exit(1);
   }
 });
-`
-    }
-  ];
+`;
 }
 function generateNextjsMiddleware(projectName) {
   return [
     {
-      filename: "middleware.ts",
+      filename: "src/middleware.ts",
       content: nextjsTenantMiddleware()
     },
+    {
+      filename: "src/app/layout.tsx",
+      content: nextjsRootLayout(projectName)
+    },
     {
       filename: "src/app/page.tsx",
       content: `// app/page.tsx - ${projectName} root page
@@ -837,7 +922,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>src/middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -990,18 +1075,19 @@ function generateTsconfig(framework, extraSources = []) {
     {
       compilerOptions: {
         target: "ESNext",
-        module: "NodeNext",
-        moduleResolution: "NodeNext",
+        // Next.js resolves imports like a bundler: "next/server" has no file
+        // extension, which NodeNext refuses in an ES module package.
+        ...framework === "nextjs" ? { module: "ESNext", moduleResolution: "Bundler" } : { module: "NodeNext", moduleResolution: "NodeNext" },
         strict: true,
-        outDir: "dist",
-        rootDir,
-        declaration: true,
+        // next build compiles a Next.js app itself and type-checks the files it
+        // generates under .next/types, which a rootDir of src would reject.
+        ...framework === "nextjs" ? { noEmit: true } : { outDir: "dist", rootDir, declaration: true },
         skipLibCheck: true,
         esModuleInterop: true,
         ...framework === "nestjs" ? { experimentalDecorators: true, emitDecoratorMetadata: true } : {},
         ...framework === "nextjs" ? { jsx: "preserve", plugins: [{ name: "next" }] } : {}
       },
-      include: ["src", ...extraSources],
+      include: framework === "nextjs" ? ["next-env.d.ts", "src", ...extraSources, ".next/types/**/*.ts"] : ["src", ...extraSources],
       exclude: ["node_modules", "dist"]
     },
     null,
@@ -1012,14 +1098,17 @@ function generateTsconfig(framework, extraSources = []) {
 // ../hono/package.json
 var package_default = {
   name: "@stratum-hq/hono",
-  version: "1.2.0",
-  description: "Stratum Hono integration \u2014 tenant extraction middleware with ALS context",
+  version: "1.3.2",
+  description: "Hono multi-tenancy middleware: tenant resolution with AsyncLocalStorage context",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
+    "tenant-isolation",
     "hono",
+    "asynclocalstorage",
     "middleware",
     "typescript",
     "stratum"
@@ -1063,7 +1152,7 @@ var package_default = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/hono#readme",
+  homepage: "https://docs.stratum-hq.org/packages/hono/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1078,18 +1167,27 @@ var package_default = {
 // ../db-adapters/package.json
 var package_default2 = {
   name: "@stratum-hq/db-adapters",
-  version: "1.2.0",
-  description: "Stratum PostgreSQL adapters for tenant-scoped query isolation",
+  version: "1.5.0",
+  description: "Multi-tenant PostgreSQL row-level security for pg, Prisma, Drizzle, and Sequelize, plus schema-per-tenant and database-per-tenant isolation",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
     "tenant-isolation",
-    "postgresql",
-    "postgres",
     "row-level-security",
     "rls",
+    "postgresql",
+    "prisma",
+    "drizzle",
+    "drizzle-orm",
+    "sequelize",
+    "pg",
+    "node-postgres",
+    "schema-per-tenant",
+    "database-per-tenant",
+    "postgres",
     "schema-isolation",
     "database",
     "stratum"
@@ -1100,6 +1198,10 @@ var package_default2 = {
     ".": {
       types: "./dist/index.d.ts",
       default: "./dist/index.js"
+    },
+    "./pglite": {
+      types: "./dist/pglite/index.d.ts",
+      default: "./dist/pglite/index.js"
     }
   },
   files: [
@@ -1119,18 +1221,23 @@ var package_default2 = {
     registry: "https://registry.npmjs.org/"
   },
   dependencies: {
-    "@stratum-hq/core": "^1.4.0",
+    "@stratum-hq/core": "^1.6.0",
     pg: "^8.11.0"
   },
   peerDependencies: {
+    "@electric-sql/pglite": "^0.4.2",
     "drizzle-orm": ">=0.29.0"
   },
   peerDependenciesMeta: {
+    "@electric-sql/pglite": {
+      optional: true
+    },
     "drizzle-orm": {
       optional: true
     }
   },
   devDependencies: {
+    "@electric-sql/pglite": "^0.4.6",
     "@prisma/client": "^5.10.0",
     "@types/pg": "^8.11.0",
     "drizzle-orm": "^0.45.3",
@@ -1139,7 +1246,7 @@ var package_default2 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/db-adapters#readme",
+  homepage: "https://docs.stratum-hq.org/packages/db-adapters/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1154,21 +1261,28 @@ var package_default2 = {
 // ../lib/package.json
 var package_default3 = {
   name: "@stratum-hq/lib",
-  version: "1.5.0",
-  description: "Stratum tenant management library - framework-agnostic business logic",
+  version: "1.8.0",
+  description: "Multi-tenancy for Node.js and PostgreSQL: tenant hierarchy, config inheritance, row-level security, ABAC, audit log, and GDPR tooling",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
-    "b2b",
     "tenant",
-    "tenant-management",
     "tenant-isolation",
-    "node",
-    "typescript",
-    "postgresql",
     "row-level-security",
     "rls",
+    "postgresql",
+    "tenant-hierarchy",
+    "ltree",
+    "abac",
+    "audit-log",
+    "encryption",
+    "webhooks",
+    "b2b",
+    "tenant-management",
+    "node",
+    "typescript",
     "schema-isolation",
     "config-inheritance",
     "gdpr",
@@ -1190,7 +1304,7 @@ var package_default3 = {
   scripts: {
     build: "tsc && node ../../scripts/copy-dir.mjs src/migrations dist/migrations",
     test: "vitest run",
-    typecheck: "tsc --noEmit",
+    typecheck: "tsc --noEmit && tsc -p tsconfig.types.json",
     lint: "eslint .",
     clean: "rm -rf dist"
   },
@@ -1199,10 +1313,10 @@ var package_default3 = {
     registry: "https://registry.npmjs.org/"
   },
   dependencies: {
-    "@opentelemetry/api": "^1.9.0",
-    "@stratum-hq/core": "^1.5.0",
-    "@stratum-hq/db-adapters": "^1.2.0",
-    "@stratum-hq/sdk": "^1.3.0",
+    "@opentelemetry/api": "^1.0.0",
+    "@stratum-hq/core": "^1.6.0",
+    "@stratum-hq/db-adapters": "^1.5.0",
+    "@stratum-hq/sdk": "^1.4.0",
     pg: "^8.11.0"
   },
   peerDependencies: {
@@ -1214,13 +1328,14 @@ var package_default3 = {
     }
   },
   devDependencies: {
+    "@electric-sql/pglite": "^0.4.6",
     "@types/pg": "^8.11.0",
     typescript: "^5.4.0",
     vitest: "^4.1.11"
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/lib#readme",
+  homepage: "https://docs.stratum-hq.org/packages/lib/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1235,10 +1350,11 @@ var package_default3 = {
 // ../mongodb/package.json
 var package_default4 = {
   name: "@stratum-hq/mongodb",
-  version: "0.5.0",
-  description: "MongoDB tenant isolation for Stratum \u2014 shared collection, collection-per-tenant, and database-per-tenant strategies",
+  version: "0.7.0",
+  description: "MongoDB tenant isolation for Stratum: shared collection, collection-per-tenant, and database-per-tenant strategies",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
@@ -1265,17 +1381,18 @@ var package_default4 = {
     build: "tsc",
     test: "vitest run",
     "test:watch": "vitest",
-    "test:integration": "vitest run --config vitest.integration.config.ts",
-    typecheck: "tsc --noEmit",
+    "test:integration": "vitest run --config vitest.integration.config.ts && vitest run --config vitest.integration.mongoose9.config.ts",
+    typecheck: "tsc --noEmit && tsc -p tsconfig.types.json",
     lint: "eslint .",
     clean: "rm -rf dist"
   },
   dependencies: {
-    "@stratum-hq/core": "^1.5.0",
-    "@stratum-hq/sdk": "^1.3.0"
+    "@stratum-hq/core": "^1.6.0",
+    "@stratum-hq/sdk": "^1.4.0"
   },
   peerDependencies: {
-    mongodb: "^6.0.0 || ^7.0.0"
+    mongodb: "^6.0.0 || ^7.0.0",
+    mongoose: "^8.0.0 || ^9.0.0"
   },
   peerDependenciesMeta: {
     mongoose: {
@@ -1283,9 +1400,14 @@ var package_default4 = {
     }
   },
   devDependencies: {
+    "@stratum-hq/lib": "*",
     "@stratum-hq/test-utils": "*",
+    "@types/express": "^4.17.0",
+    "@types/jsonwebtoken": "^9.0.0",
+    "@types/pg": "^8.11.0",
     mongodb: "^7.6.0",
     mongoose: "^8.0.0",
+    mongoose9: "npm:mongoose@^9.10.3",
     typescript: "^5.9.0",
     vitest: "^4.1.11"
   },
@@ -1294,7 +1416,7 @@ var package_default4 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/mongodb#readme",
+  homepage: "https://docs.stratum-hq.org/packages/mongodb/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1309,10 +1431,11 @@ var package_default4 = {
 // ../mysql/package.json
 var package_default5 = {
   name: "@stratum-hq/mysql",
-  version: "0.5.0",
-  description: "MySQL tenant isolation for Stratum \u2014 shared table, table-per-tenant, and database-per-tenant strategies",
+  version: "0.7.0",
+  description: "MySQL tenant isolation for Stratum: shared table, table-per-tenant, and database-per-tenant strategies",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
@@ -1342,13 +1465,13 @@ var package_default5 = {
     test: "vitest run",
     "test:watch": "vitest",
     "test:integration": "vitest run --config vitest.integration.config.ts",
-    typecheck: "tsc --noEmit",
+    typecheck: "tsc --noEmit && tsc -p tsconfig.types.json",
     lint: "eslint .",
     clean: "rm -rf dist"
   },
   dependencies: {
-    "@stratum-hq/core": "^1.5.0",
-    "@stratum-hq/sdk": "^1.3.0"
+    "@stratum-hq/core": "^1.6.0",
+    "@stratum-hq/sdk": "^1.4.0"
   },
   peerDependencies: {
     mysql2: "^3.0.0",
@@ -1368,8 +1491,11 @@ var package_default5 = {
     }
   },
   devDependencies: {
+    "@stratum-hq/lib": "*",
+    "@types/pg": "^8.11.0",
     knex: "^3.3.0",
     mysql2: "^3.24.4",
+    sequelize: "^6.37.8",
     typeorm: "^1.1.1",
     typescript: "^5.9.0",
     vitest: "^4.1.11"
@@ -1379,7 +1505,7 @@ var package_default5 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/mysql#readme",
+  homepage: "https://docs.stratum-hq.org/packages/mysql/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1394,13 +1520,15 @@ var package_default5 = {
 // ../nestjs/package.json
 var package_default6 = {
   name: "@stratum-hq/nestjs",
-  version: "1.3.0",
-  description: "Stratum NestJS integration \u2014 StratumGuard, @Tenant() decorator, and StratumModule",
+  version: "1.3.2",
+  description: "NestJS multi-tenancy: tenant guard, @Tenant() decorator, and module for Stratum",
   keywords: [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
+    "tenant-isolation",
     "nestjs",
     "nest",
     "guard",
@@ -1444,6 +1572,7 @@ var package_default6 = {
   devDependencies: {
     "@nestjs/common": "^12.1.2",
     "@nestjs/core": "^12.1.2",
+    "@nestjs/platform-express": "^12.1.2",
     "@nestjs/testing": "^12.1.2",
     "@stratum-hq/core": "*",
     "@stratum-hq/sdk": "*",
@@ -1453,7 +1582,7 @@ var package_default6 = {
   },
   license: "MIT",
   author: "Christian Crank",
-  homepage: "https://github.com/stratum-hq/Stratum/tree/main/packages/nestjs#readme",
+  homepage: "https://docs.stratum-hq.org/packages/nestjs/",
   bugs: "https://github.com/stratum-hq/Stratum/issues",
   engines: {
     node: ">=20.0.0"
@@ -1476,6 +1605,9 @@ var STRATUM_RANGES = {
 };
 
 // src/generators/package-json.ts
+var DRIZZLE_KIT_OVERRIDES = {
+  "@esbuild-kit/core-utils": { esbuild: "^0.25.4" }
+};
 function generatePresetPackageJson(projectName, preset) {
   const deps = {
     "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"]
@@ -1487,7 +1619,7 @@ function generatePresetPackageJson(projectName, preset) {
   if (preset.framework === "nestjs") {
     devDeps["tsc-watch"] = "^7.2.0";
   } else if (preset.framework !== "nextjs") {
-    devDeps["tsx"] = "^4.7.0";
+    devDeps["tsx"] = "^4.19.3";
   }
   addDatabaseDeps(deps, devDeps, preset);
   addOrmDeps(deps, devDeps, preset);
@@ -1503,6 +1635,7 @@ function generatePresetPackageJson(projectName, preset) {
       scripts,
       dependencies: sortKeys(deps),
       devDependencies: sortKeys(devDeps),
+      ...preset.orm === "drizzle" ? { overrides: DRIZZLE_KIT_OVERRIDES } : {},
       engines: {
         node: ">=20.0.0"
       }
@@ -1534,7 +1667,7 @@ function addDatabaseDeps(deps, devDeps, preset) {
       break;
     case "mysql":
       if (preset.orm === "drizzle" || preset.orm === "pg") {
-        deps["mysql2"] = "^3.9.0";
+        deps["mysql2"] = "^3.23.1";
       }
       break;
   }
@@ -1549,8 +1682,8 @@ function addOrmDeps(deps, devDeps, preset) {
       }
       break;
     case "drizzle":
-      deps["drizzle-orm"] = "^0.30.0";
-      devDeps["drizzle-kit"] = "^0.21.0";
+      deps["drizzle-orm"] = "^0.45.3";
+      devDeps["drizzle-kit"] = "^0.31.11";
       if (preset.database === "postgres") {
         deps["pg"] = "^8.11.0";
       }
@@ -1558,7 +1691,7 @@ function addOrmDeps(deps, devDeps, preset) {
     case "sequelize":
       deps["sequelize"] = "^6.37.0";
       if (preset.database === "mysql") {
-        deps["mysql2"] = "^3.9.0";
+        deps["mysql2"] = "^3.23.1";
       } else {
         deps["pg"] = "^8.11.0";
       }
@@ -1567,7 +1700,7 @@ function addOrmDeps(deps, devDeps, preset) {
       deps["knex"] = "^3.1.0";
       break;
     case "mongoose":
-      deps["mongoose"] = "^8.2.0";
+      deps["mongoose"] = "^8.24.1";
       break;
     case "pg":
       break;
@@ -1579,11 +1712,11 @@ function addFrameworkDeps(deps, devDeps, preset) {
   }
   switch (preset.framework) {
     case "express":
-      deps["express"] = "^4.18.0";
+      deps["express"] = "^4.22.3";
       devDeps["@types/express"] = "^4.17.21";
       break;
     case "fastify":
-      deps["fastify"] = "^4.26.0";
+      deps["fastify"] = "^5.12.5";
       break;
     case "nextjs":
       deps["next"] = "^15.5.16";
@@ -1593,13 +1726,13 @@ function addFrameworkDeps(deps, devDeps, preset) {
       devDeps["@types/react-dom"] = "^19.0.0";
       break;
     case "hono":
-      deps["hono"] = "^4.1.0";
-      deps["@hono/node-server"] = "^1.8.0";
+      deps["hono"] = "^4.13.7";
+      deps["@hono/node-server"] = "^1.19.15";
       break;
     case "nestjs":
-      deps["@nestjs/core"] = "^11.0.0";
-      deps["@nestjs/common"] = "^11.0.0";
-      deps["@nestjs/platform-express"] = "^11.0.0";
+      deps["@nestjs/core"] = "^11.1.18";
+      deps["@nestjs/common"] = "^11.1.18";
+      deps["@nestjs/platform-express"] = "^11.1.18";
       deps["reflect-metadata"] = "^0.2.0";
       deps["rxjs"] = "^7.8.0";
       break;
@@ -1712,35 +1845,38 @@ npx prisma db push
   }
   if (preset.orm === "drizzle") {
     return `
-### 3b. Run Drizzle migrations
+### 3b. Create the tables
+
+The tables are defined in \`src/schema.ts\`, which \`drizzle.config.ts\` points at.
+drizzle-kit does not read \`.env\`, so load it first:
 
 \`\`\`bash
-npx drizzle-kit push
+node --env-file=.env node_modules/drizzle-kit/bin.cjs push
 \`\`\`
-`;
+${preset.database === "postgres" ? "\nOn PostgreSQL drizzle-kit connects with `DATABASE_SUPERUSER_URL`, the superuser kept for migrations. The app role still reads and writes the new tables, and because it does not own them, their row-level security policies apply to it.\n" : ""}`;
   }
   return "";
 }
 function getStrategyDescription(strategy) {
   switch (strategy) {
     case "rls":
-      return `- **Row-Level Security** -- PostgreSQL RLS policies filter rows by tenant automatically
+      return `- **Row-Level Security**: PostgreSQL RLS policies filter rows by tenant automatically
 - Each query sets \`app.current_tenant_id\` and RLS enforces isolation
 - All tenants share one database and schema`;
     case "schema":
-      return `- **Schema-per-tenant** -- each tenant gets a dedicated PostgreSQL schema
+      return `- **Schema-per-tenant**: each tenant gets a dedicated PostgreSQL schema
 - Queries are routed to the correct schema via search_path
 - Shared database, isolated schemas`;
     case "database":
-      return `- **Database-per-tenant** -- each tenant gets a fully isolated database
+      return `- **Database-per-tenant**: each tenant gets a fully isolated database
 - Connection routing directs queries to the correct database
 - Maximum isolation at the cost of more resource usage`;
     case "collection":
-      return `- **Collection-per-tenant** -- each tenant gets dedicated MongoDB collections
+      return `- **Collection-per-tenant**: each tenant gets dedicated MongoDB collections
 - Collection names are prefixed or namespaced by tenant ID
 - Shared database, isolated collections`;
     case "table-prefix":
-      return `- **Table-prefix** -- tenant-specific tables with a naming prefix
+      return `- **Table-prefix**: tenant-specific tables with a naming prefix
 - Tables are prefixed with the tenant identifier
 - Shared database, prefixed table names`;
     default:
@@ -1767,7 +1903,10 @@ function generatePresetEnv(projectName, preset) {
       dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
       adminUrlLine = `
 # Superuser: bootstrap and migrations only. It bypasses row-level security.
-DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+DATABASE_SUPERUSER_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+
+# Stratum's own login: the library's adminPool, which runs the Stratum migrations (see init.sql).
+STRATUM_ADMIN_DATABASE_URL=postgres://${postgresStratumRole(dbName)}:${POSTGRES_STRATUM_PASSWORD}@localhost:5432/${dbName}
 `;
       break;
     case "mongodb":
@@ -1917,25 +2056,25 @@ function writeFile2(filePath, content) {
 function generatePackageJson(projectName, template) {
   const frameworkDeps = {
     express: {
-      express: "^4.18.0",
+      express: "^4.22.3",
       "@types/express": "^4.17.21"
     },
     fastify: {
-      fastify: "^4.26.0"
+      fastify: "^5.12.5"
     },
     nextjs: {
       next: "^15.5.16",
       react: "^19.0.0",
       "react-dom": "^19.0.0",
       "@types/react": "^19.0.0",
-      "@types/react-dom": "^19.0.0",
-      // The middleware verifies the tenant JWT with jose.
-      jose: "^6.2.12"
+      "@types/react-dom": "^19.0.0"
     }
   };
   const deps = {
     "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"],
     pg: "^8.11.0",
+    // Every template verifies the tenant JWT with jose.
+    jose: "^6.2.12",
     ...frameworkDeps[template]
   };
   return JSON.stringify(
@@ -1952,7 +2091,7 @@ function generatePackageJson(projectName, template) {
       devDependencies: {
         typescript: "^5.3.0",
         "@types/node": "^20.11.0",
-        ...template === "nextjs" ? {} : { tsx: "^4.7.0", "@types/pg": "^8.11.0" }
+        ...template === "nextjs" ? {} : { tsx: "^4.19.3", "@types/pg": "^8.11.0" }
       },
       engines: {
         node: ">=20.0.0"
@@ -2013,7 +2152,10 @@ function generateEnv(projectName) {
 DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
 
 # Superuser: bootstrap and migrations only. It bypasses row-level security.
-DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+DATABASE_SUPERUSER_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+
+# Stratum's own login: the library's adminPool, which runs the Stratum migrations (see init.sql).
+STRATUM_ADMIN_DATABASE_URL=postgres://${postgresStratumRole(dbName)}:${POSTGRES_STRATUM_PASSWORD}@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -2025,75 +2167,8 @@ STRATUM_API_KEY=sk_test_your_key_here
 NODE_ENV=development
 `;
 }
-function generateExpressServer(projectName) {
-  return `import express from "express";
-import { Pool } from "pg";
-
-const app = express();
-const port = process.env.PORT || 3000;
-
-const pool = new Pool({
-  connectionString: process.env.DATABASE_URL,
-});
-
-app.use(express.json());
-
-app.get("/health", (_req, res) => {
-  res.json({ status: "ok", project: "${projectName}" });
-});
-
-app.get("/tenants", async (_req, res) => {
-  try {
-    // Example: query your tenant table
-    // const { rows } = await pool.query("SELECT * FROM tenants LIMIT 20");
-    // res.json(rows);
-    res.json({ message: "Replace this with your tenant queries", pool: !!pool });
-  } catch (err) {
-    res.status(500).json({ error: String(err) });
-  }
-});
-
-app.listen(port, () => {
-  console.log(\`${projectName} server running on http://localhost:\${port}\`);
-});
-`;
-}
-function generateFastifyServer(projectName) {
-  return `import Fastify from "fastify";
-import { Pool } from "pg";
-
-const fastify = Fastify({ logger: true });
-const port = Number(process.env.PORT) || 3000;
-
-const pool = new Pool({
-  connectionString: process.env.DATABASE_URL,
-});
-
-fastify.get("/health", async () => {
-  return { status: "ok", project: "${projectName}" };
-});
-
-fastify.get("/tenants", async (_request, reply) => {
-  try {
-    // Example: query your tenant table
-    // const { rows } = await pool.query("SELECT * FROM tenants LIMIT 20");
-    // return rows;
-    return { message: "Replace this with your tenant queries", pool: !!pool };
-  } catch (err) {
-    return reply.status(500).send({ error: String(err) });
-  }
-});
-
-fastify.listen({ port, host: "0.0.0.0" }, (err) => {
-  if (err) {
-    fastify.log.error(err);
-    process.exit(1);
-  }
-});
-`;
-}
 function generateNextjsPage(projectName) {
-  return `// app/page.tsx \u2014 ${projectName} root page
+  return `// app/page.tsx: ${projectName} root page
 export default function Home() {
   return (
     <main style={{ padding: "2rem", fontFamily: "sans-serif" }}>
@@ -2101,7 +2176,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>src/middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -2126,7 +2201,7 @@ docker compose up -d
 
 \`\`\`bash
 cp .env.example .env
-# Edit .env \u2014 update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
+# Edit .env: update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
 \`\`\`
 
 ### 3. Install dependencies
@@ -2156,9 +2231,9 @@ ${template === "nextjs" ? "" : "\u251C\u2500\u2500 tsconfig.json\n"}\u2514\u2500
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** \u2014 from the \`tenant_id\` claim of a bearer token verified with \`JWT_SECRET\` (see \`middleware.ts\`); the subdomain is only a display slug
-- **Config inheritance** \u2014 settings flow down the tenant tree with override support
-- **Permission ABAC** \u2014 role-based permissions with tenant-scoped enforcement
+${template === "nextjs" ? "- **Tenant resolution**: from the `tenant_id` claim of a bearer token verified with `JWT_SECRET` (see `src/middleware.ts`); the subdomain is only a display slug" : "- **Tenant resolution**: the tenant middleware in `src/index.ts` takes the tenant from the `tenant_id` claim of a bearer token verified with `JWT_SECRET` (HS256, using `jose`). A token that does not verify is rejected with 401, and `GET /tenants` answers 401 without a tenant. The hostname and headers such as `x-tenant-id` are never used"}
+- **Config inheritance**: settings flow down the tenant tree with override support
+- **Permission ABAC**: role-based permissions with tenant-scoped enforcement
 
 See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference.
 `;
@@ -2175,14 +2250,15 @@ Creating ${projectName} with ${template} template...
   writeFile2(path2.join(targetDir, "init.sql"), generateInitSql(projectName));
   writeFile2(path2.join(targetDir, ".env.example"), generateEnv(projectName));
   if (template === "express") {
-    writeFile2(path2.join(targetDir, "src", "index.ts"), generateExpressServer(projectName));
+    writeFile2(path2.join(targetDir, "src", "index.ts"), expressServer(projectName));
     writeFile2(path2.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "fastify") {
-    writeFile2(path2.join(targetDir, "src", "index.ts"), generateFastifyServer(projectName));
+    writeFile2(path2.join(targetDir, "src", "index.ts"), fastifyServer(projectName));
     writeFile2(path2.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "nextjs") {
+    writeFile2(path2.join(targetDir, "src", "app", "layout.tsx"), nextjsRootLayout(projectName));
     writeFile2(path2.join(targetDir, "src", "app", "page.tsx"), generateNextjsPage(projectName));
-    writeFile2(path2.join(targetDir, "middleware.ts"), nextjsTenantMiddleware());
+    writeFile2(path2.join(targetDir, "src", "middleware.ts"), nextjsTenantMiddleware());
   }
   writeFile2(path2.join(targetDir, "README.md"), generateReadme(projectName, template));
   if (!skipInstall) {
@@ -2219,31 +2295,34 @@ function main(argv) {
     console.error(`Error: ${validationError}`);
     process.exit(1);
   }
-  const targetDir = path2.resolve(process.cwd(), projectName);
-  if (fs2.existsSync(targetDir) && !force) {
-    console.error(`Error: Directory "${projectName}" already exists.`);
-    console.error(`Use --force to overwrite.`);
-    process.exit(1);
-  }
-  if (fs2.existsSync(targetDir) && force) {
-    fs2.rmSync(targetDir, { recursive: true, force: true });
-  }
-  fs2.mkdirSync(targetDir, { recursive: true });
+  let parsedPreset = null;
   if (preset) {
-    const parsed = parsePresetString(preset);
-    if (!parsed) {
+    parsedPreset = parsePresetString(preset);
+    if (!parsedPreset) {
       console.error(`Error: Invalid preset string "${preset}".`);
       console.error("Format: {database}-{strategy}-{orm}-{framework}");
       console.error("Example: postgres-rls-prisma-express, mongodb-database-mongoose-hono");
       process.exit(1);
     }
-    if (!isValidPreset(parsed)) {
+    if (!isValidPreset(parsedPreset)) {
       console.error(`Error: Invalid preset combination "${preset}".`);
-      console.error(`${parsed.database} does not support ${parsed.strategy}/${parsed.orm} together.`);
+      console.error(`${parsedPreset.database} does not support ${parsedPreset.strategy}/${parsedPreset.orm} together.`);
       console.error("Run with --help to see valid combinations.");
       process.exit(1);
     }
-    createPresetProject(projectName, parsed, targetDir, skipInstall);
+  }
+  const targetDir = path2.resolve(process.cwd(), projectName);
+  if (fs2.existsSync(targetDir) && !force) {
+    console.error(`Error: Directory "${projectName}" already exists.`);
+    console.error(`Use --force to overwrite.`);
+    process.exit(1);
+  }
+  if (fs2.existsSync(targetDir) && force) {
+    fs2.rmSync(targetDir, { recursive: true, force: true });
+  }
+  fs2.mkdirSync(targetDir, { recursive: true });
+  if (parsedPreset) {
+    createPresetProject(projectName, parsedPreset, targetDir, skipInstall);
   } else {
     createProject(projectName, template, targetDir, skipInstall);
   }