@stratum-hq/create 0.5.0 → 0.6.0

package/package.json

@@ -1,12 +1,26 @@
 {
   "name": "@stratum-hq/create",
-  "version": "0.5.0",
-  "description": "Create a new Stratum multi-tenancy project",
+  "version": "0.6.0",
+  "description": "Scaffold a multi-tenant SaaS starter for Node.js: PostgreSQL, MySQL, or MongoDB with Express, Fastify, Next.js, Hono, or NestJS",
   "keywords": [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
+    "tenant-isolation",
+    "row-level-security",
+    "rls",
+    "postgresql",
+    "mysql",
+    "mongodb",
+    "express",
+    "fastify",
+    "nextjs",
+    "hono",
+    "nestjs",
+    "prisma",
+    "drizzle",
     "create",
     "scaffolding",
     "starter",
@@ -40,7 +54,7 @@
   },
   "license": "MIT",
   "author": "Christian Crank",
-  "homepage": "https://github.com/stratum-hq/Stratum/tree/main/packages/create#readme",
+  "homepage": "https://docs.stratum-hq.org/packages/create/",
   "bugs": "https://github.com/stratum-hq/Stratum/issues",
   "engines": {
     "node": ">=20.0.0"

package/src/generators/db-setup.ts

@@ -128,6 +128,15 @@ export { pool };
     });
   }
 
+  files.push({
+    filename: "src/schema.ts",
+    content: drizzleSchema(preset),
+  });
+
+  // drizzle-kit creates tables, so on PostgreSQL it connects as the superuser
+  // in DATABASE_SUPERUSER_URL, kept for migrations. A table the app role owned
+  // would not be subject to its own RLS policies; init.sql grants the app role
+  // access to the tables the superuser creates.
   files.push({
     filename: "drizzle.config.ts",
     content: `import type { Config } from "drizzle-kit";
@@ -137,7 +146,7 @@ export default {
   out: "./drizzle",
   ${preset.database === "mysql" ? 'dialect: "mysql",' : 'dialect: "postgresql",'}
   dbCredentials: {
-    url: process.env.DATABASE_URL!,
+    url: ${preset.database === "mysql" ? "process.env.DATABASE_URL!" : "(process.env.DATABASE_SUPERUSER_URL ?? process.env.DATABASE_URL)!"},
   },
 } satisfies Config;
 `,
@@ -146,6 +155,39 @@ export default {
   return files;
 }
 
+/** src/schema.ts, the Drizzle table definitions that drizzle.config.ts points at. */
+function drizzleSchema(preset: StackPreset): string {
+  if (preset.database === "mysql") {
+    return `// Drizzle table definitions. drizzle.config.ts reads this file.
+import { mysqlTable, varchar, text, timestamp } from "drizzle-orm/mysql-core";
+
+// An example tenant-scoped table: every row carries the tenant it belongs to.
+export const notes = mysqlTable("notes", {
+  id: varchar("id", { length: 36 }).primaryKey(),
+  tenantId: varchar("tenant_id", { length: 36 }).notNull(),
+  body: text("body").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+`;
+  }
+  return `// Drizzle table definitions. drizzle.config.ts reads this file.
+import { pgTable, uuid, text, timestamp, index } from "drizzle-orm/pg-core";
+
+// An example tenant-scoped table: every row carries the tenant it belongs to.
+// Stratum's own tables, such as tenants, are created by Stratum, not here.
+export const notes = pgTable(
+  "notes",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    tenantId: uuid("tenant_id").notNull(),
+    body: text("body").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [index("notes_tenant_id_idx").on(table.tenantId)],
+);
+`;
+}
+
 function generateSequelizeSetup(preset: StackPreset): DbSetupFile[] {
   const dialect = preset.database === "mysql" ? "mysql" : "postgres";
 

package/src/generators/init-sql.ts

@@ -9,17 +9,37 @@ export function postgresAppRole(dbName: string): string {
 export const POSTGRES_APP_PASSWORD = "dev_app_password";
 
 /**
- * SQL that creates the role the application connects as. POSTGRES_USER is a
- * superuser, and a superuser (or any BYPASSRLS role) ignores every row-level
- * security policy, FORCE included. So the app gets its own role, and the
- * superuser is kept for bootstrap and migrations.
+ * Name of the login Stratum itself connects as: the library's adminPool,
+ * which runs the Stratum migrations. It is a member of the control role of
+ * @stratum-hq/lib migration 032, not a superuser.
+ */
+export function postgresStratumRole(dbName: string): string {
+  return `${dbName}_stratum`;
+}
+
+/** Local development password for the generated Stratum login. */
+export const POSTGRES_STRATUM_PASSWORD = "dev_stratum_password";
+
+/**
+ * SQL that creates the roles of the hardened role model of @stratum-hq/lib
+ * (the "Hardening: separate admin and app roles" guide), as docker/init-db.sql
+ * does. POSTGRES_USER is a superuser, and a superuser (or any BYPASSRLS
+ * role) ignores every row-level security policy, FORCE included. So the app
+ * gets its own role, Stratum gets its own login for its tables, and the
+ * superuser is kept for bootstrap and the application's own migrations.
  */
 export function postgresAppRoleSql(dbName: string, strategy?: string): string {
   const role = postgresAppRole(dbName);
+  const stratum = postgresStratumRole(dbName);
   let strategyGrant = "";
   if (strategy === "schema") {
     strategyGrant = `
--- schema-per-tenant: the app creates one schema per tenant
+-- schema-per-tenant: the app creates one schema per tenant. A schema named
+-- like a login comes first on that login's default search path ("$user",
+-- public), so a schema the app creates could come before public for the
+-- Stratum login or the bootstrap superuser. Both search only public.
+ALTER ROLE ${stratum} IN DATABASE ${dbName} SET search_path = public;
+ALTER ROLE CURRENT_USER IN DATABASE ${dbName} SET search_path = public;
 GRANT CREATE ON DATABASE ${dbName} TO ${role};
 `;
   } else if (strategy === "database") {
@@ -29,15 +49,40 @@ ALTER ROLE ${role} CREATEDB;
 `;
   }
   return `
+-- Stratum's control role (migration 032 of @stratum-hq/lib). Every Stratum
+-- table gets a policy for it, and only its members reach rows across
+-- tenants.
+CREATE ROLE stratum_control NOLOGIN NOSUPERUSER NOBYPASSRLS;
+GRANT USAGE, CREATE ON SCHEMA public TO stratum_control;
+
+-- Stratum's own login: pass it to the library as adminPool, which runs the
+-- Stratum migrations, so it owns the Stratum tables. Not a superuser and no
+-- BYPASSRLS: it reaches them as a member of stratum_control. Do not run the
+-- Stratum migrations as the bootstrap superuser: the default privileges
+-- below would give the app role write access to the Stratum tables. If that
+-- happened, "stratum db roles --apply --app-role ${role}" removes it.
+CREATE ROLE ${stratum} WITH LOGIN PASSWORD '${POSTGRES_STRATUM_PASSWORD}' NOSUPERUSER NOBYPASSRLS;
+GRANT stratum_control TO ${stratum} WITH INHERIT TRUE, SET TRUE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${stratum};
+GRANT USAGE, CREATE ON SCHEMA public TO ${stratum};
+
 -- Application role. The app connects as ${role} (DATABASE_URL), never as the
--- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
--- ignores every row-level security policy, FORCE included. Use the superuser
--- only for bootstrap and migrations.
+-- bootstrap superuser (DATABASE_SUPERUSER_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. It creates no
+-- objects in public: the superuser creates the application's tables (its
+-- migrations), and the app role reads and writes the ones the superuser
+-- creates. It gets nothing on the tables ${stratum} creates; to let it read
+-- Stratum's read list once Stratum has migrated, run:
+--   stratum db roles --apply --admin-role ${stratum} --app-role ${role}
 CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
 GRANT CONNECT ON DATABASE ${dbName} TO ${role};
-GRANT USAGE, CREATE ON SCHEMA public TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+GRANT USAGE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES FOR ROLE ${dbName} IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES FOR ROLE ${dbName} IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+
+-- Only roles granted CREATE by name create objects in public. PostgreSQL 15
+-- and later already start this way; older versions grant it to PUBLIC.
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
 ${strategyGrant}`;
 }
 

package/src/generators/middleware.ts

@@ -50,8 +50,10 @@ const TENANT_REQUIRED = `{ error: "A bearer token with a tenant_id claim is requ
  * x-tenant-id. The subdomain is forwarded as x-tenant-slug, never as the ID.
  */
 export function nextjsTenantMiddleware(): string {
-  return `// middleware.ts (place in project root)
-// Next.js middleware for Stratum tenant resolution
+  return `// src/middleware.ts: Next.js middleware for Stratum tenant resolution
+//
+// Next.js runs middleware only from the directory that holds the app
+// directory: src/middleware.ts for src/app, middleware.ts for app.
 //
 // The tenant ID comes only from the tenant_id claim of a bearer token that
 // verifies with JWT_SECRET, and is forwarded as x-tenant-id. Any copy of the
@@ -127,6 +129,24 @@ export const config = {
 `;
 }
 
+/**
+ * The root layout of a generated Next.js app, src/app/layout.tsx. \`next build\`
+ * refuses an app directory without one.
+ */
+export function nextjsRootLayout(projectName: string): string {
+  return `// app/layout.tsx: ${projectName} root layout
+import type { ReactNode } from "react";
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}
+`;
+}
+
 export function generateMiddleware(projectName: string, preset: StackPreset): MiddlewareFile[] {
   switch (preset.framework) {
     case "express":
@@ -145,10 +165,16 @@ export function generateMiddleware(projectName: string, preset: StackPreset): Mi
 }
 
 function generateExpressMiddleware(projectName: string): MiddlewareFile[] {
-  return [
-    {
-      filename: "src/index.ts",
-      content: `import express from "express";
+  return [{ filename: "src/index.ts", content: expressServer(projectName) }];
+}
+
+/**
+ * src/index.ts of a generated Express server, for the express template and
+ * every express preset: tenant middleware that takes the tenant from a
+ * verified JWT, and a /tenants route that requires a tenant.
+ */
+export function expressServer(projectName: string): string {
+  return `import express from "express";
 ${VERIFIED_TENANT}
 
 const app = express();
@@ -184,16 +210,20 @@ app.get("/tenants", async (req, res) => {
 app.listen(port, () => {
   console.log(\`${projectName} running on http://localhost:\${port}\`);
 });
-`,
-    },
-  ];
+`;
 }
 
 function generateFastifyMiddleware(projectName: string): MiddlewareFile[] {
-  return [
-    {
-      filename: "src/index.ts",
-      content: `import Fastify from "fastify";
+  return [{ filename: "src/index.ts", content: fastifyServer(projectName) }];
+}
+
+/**
+ * src/index.ts of a generated Fastify server, for the fastify template and
+ * every fastify preset: an onRequest hook that takes the tenant from a
+ * verified JWT, and a /tenants route that requires a tenant.
+ */
+export function fastifyServer(projectName: string): string {
+  return `import Fastify from "fastify";
 ${VERIFIED_TENANT}
 
 const fastify = Fastify({ logger: true });
@@ -228,17 +258,19 @@ fastify.listen({ port, host: "0.0.0.0" }, (err) => {
     process.exit(1);
   }
 });
-`,
-    },
-  ];
+`;
 }
 
 function generateNextjsMiddleware(projectName: string): MiddlewareFile[] {
   return [
     {
-      filename: "middleware.ts",
+      filename: "src/middleware.ts",
       content: nextjsTenantMiddleware(),
     },
+    {
+      filename: "src/app/layout.tsx",
+      content: nextjsRootLayout(projectName),
+    },
     {
       filename: "src/app/page.tsx",
       content: `// app/page.tsx - ${projectName} root page
@@ -249,7 +281,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>src/middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>

package/src/generators/package-json.ts

@@ -2,6 +2,16 @@ import type { StackPreset } from "../matrix.js";
 import { rootSources } from "./tsconfig.js";
 import { STRATUM_RANGES } from "../stratum-versions.js";
 
+/**
+ * drizzle-kit 0.31 still depends on the deprecated @esbuild-kit/esm-loader,
+ * whose @esbuild-kit/core-utils pins esbuild ~0.18, which has a published
+ * advisory (GHSA-67mh-4wv8-2f99). drizzle-kit itself uses esbuild ^0.25, so
+ * the override moves the nested copy to that line too.
+ */
+const DRIZZLE_KIT_OVERRIDES = {
+  "@esbuild-kit/core-utils": { esbuild: "^0.25.4" },
+};
+
 export function generatePresetPackageJson(projectName: string, preset: StackPreset): string {
   const deps: Record<string, string> = {
     "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"],
@@ -14,7 +24,7 @@ export function generatePresetPackageJson(projectName: string, preset: StackPres
   if (preset.framework === "nestjs") {
     devDeps["tsc-watch"] = "^7.2.0";
   } else if (preset.framework !== "nextjs") {
-    devDeps["tsx"] = "^4.7.0";
+    devDeps["tsx"] = "^4.19.3";
   }
 
   // Database driver deps
@@ -40,6 +50,7 @@ export function generatePresetPackageJson(projectName: string, preset: StackPres
       scripts,
       dependencies: sortKeys(deps),
       devDependencies: sortKeys(devDeps),
+      ...(preset.orm === "drizzle" ? { overrides: DRIZZLE_KIT_OVERRIDES } : {}),
       engines: {
         node: ">=20.0.0",
       },
@@ -76,7 +87,7 @@ function addDatabaseDeps(deps: Record<string, string>, devDeps: Record<string, s
       break;
     case "mysql":
       if (preset.orm === "drizzle" || preset.orm === "pg") {
-        deps["mysql2"] = "^3.9.0";
+        deps["mysql2"] = "^3.23.1";
       }
       break;
   }
@@ -92,8 +103,8 @@ function addOrmDeps(deps: Record<string, string>, devDeps: Record<string, string
       }
       break;
     case "drizzle":
-      deps["drizzle-orm"] = "^0.30.0";
-      devDeps["drizzle-kit"] = "^0.21.0";
+      deps["drizzle-orm"] = "^0.45.3";
+      devDeps["drizzle-kit"] = "^0.31.11";
       if (preset.database === "postgres") {
         deps["pg"] = "^8.11.0";
       }
@@ -101,7 +112,7 @@ function addOrmDeps(deps: Record<string, string>, devDeps: Record<string, string
     case "sequelize":
       deps["sequelize"] = "^6.37.0";
       if (preset.database === "mysql") {
-        deps["mysql2"] = "^3.9.0";
+        deps["mysql2"] = "^3.23.1";
       } else {
         deps["pg"] = "^8.11.0";
       }
@@ -110,7 +121,7 @@ function addOrmDeps(deps: Record<string, string>, devDeps: Record<string, string
       deps["knex"] = "^3.1.0";
       break;
     case "mongoose":
-      deps["mongoose"] = "^8.2.0";
+      deps["mongoose"] = "^8.24.1";
       break;
     case "pg":
       // pg already handled in addDatabaseDeps
@@ -125,11 +136,11 @@ function addFrameworkDeps(deps: Record<string, string>, devDeps: Record<string,
   }
   switch (preset.framework) {
     case "express":
-      deps["express"] = "^4.18.0";
+      deps["express"] = "^4.22.3";
       devDeps["@types/express"] = "^4.17.21";
       break;
     case "fastify":
-      deps["fastify"] = "^4.26.0";
+      deps["fastify"] = "^5.12.5";
       break;
     case "nextjs":
       deps["next"] = "^15.5.16";
@@ -139,13 +150,13 @@ function addFrameworkDeps(deps: Record<string, string>, devDeps: Record<string,
       devDeps["@types/react-dom"] = "^19.0.0";
       break;
     case "hono":
-      deps["hono"] = "^4.1.0";
-      deps["@hono/node-server"] = "^1.8.0";
+      deps["hono"] = "^4.13.7";
+      deps["@hono/node-server"] = "^1.19.15";
       break;
     case "nestjs":
-      deps["@nestjs/core"] = "^11.0.0";
-      deps["@nestjs/common"] = "^11.0.0";
-      deps["@nestjs/platform-express"] = "^11.0.0";
+      deps["@nestjs/core"] = "^11.1.18";
+      deps["@nestjs/common"] = "^11.1.18";
+      deps["@nestjs/platform-express"] = "^11.1.18";
       deps["reflect-metadata"] = "^0.2.0";
       deps["rxjs"] = "^7.8.0";
       break;

package/src/generators/readme.ts

@@ -73,12 +73,15 @@ npx prisma db push
   }
   if (preset.orm === "drizzle") {
     return `
-### 3b. Run Drizzle migrations
+### 3b. Create the tables
+
+The tables are defined in \`src/schema.ts\`, which \`drizzle.config.ts\` points at.
+drizzle-kit does not read \`.env\`, so load it first:
 
 \`\`\`bash
-npx drizzle-kit push
+node --env-file=.env node_modules/drizzle-kit/bin.cjs push
 \`\`\`
-`;
+${preset.database === "postgres" ? "\nOn PostgreSQL drizzle-kit connects with `DATABASE_SUPERUSER_URL`, the superuser kept for migrations. The app role still reads and writes the new tables, and because it does not own them, their row-level security policies apply to it.\n" : ""}`;
   }
   return "";
 }
@@ -86,23 +89,23 @@ npx drizzle-kit push
 function getStrategyDescription(strategy: string): string {
   switch (strategy) {
     case "rls":
-      return `- **Row-Level Security** -- PostgreSQL RLS policies filter rows by tenant automatically
+      return `- **Row-Level Security**: PostgreSQL RLS policies filter rows by tenant automatically
 - Each query sets \`app.current_tenant_id\` and RLS enforces isolation
 - All tenants share one database and schema`;
     case "schema":
-      return `- **Schema-per-tenant** -- each tenant gets a dedicated PostgreSQL schema
+      return `- **Schema-per-tenant**: each tenant gets a dedicated PostgreSQL schema
 - Queries are routed to the correct schema via search_path
 - Shared database, isolated schemas`;
     case "database":
-      return `- **Database-per-tenant** -- each tenant gets a fully isolated database
+      return `- **Database-per-tenant**: each tenant gets a fully isolated database
 - Connection routing directs queries to the correct database
 - Maximum isolation at the cost of more resource usage`;
     case "collection":
-      return `- **Collection-per-tenant** -- each tenant gets dedicated MongoDB collections
+      return `- **Collection-per-tenant**: each tenant gets dedicated MongoDB collections
 - Collection names are prefixed or namespaced by tenant ID
 - Shared database, isolated collections`;
     case "table-prefix":
-      return `- **Table-prefix** -- tenant-specific tables with a naming prefix
+      return `- **Table-prefix**: tenant-specific tables with a naming prefix
 - Tables are prefixed with the tenant identifier
 - Shared database, prefixed table names`;
     default:

package/src/generators/tsconfig.ts

@@ -24,12 +24,15 @@ export function generateTsconfig(framework: Framework, extraSources: string[] =
     {
       compilerOptions: {
         target: "ESNext",
-        module: "NodeNext",
-        moduleResolution: "NodeNext",
+        // Next.js resolves imports like a bundler: "next/server" has no file
+        // extension, which NodeNext refuses in an ES module package.
+        ...(framework === "nextjs"
+          ? { module: "ESNext", moduleResolution: "Bundler" }
+          : { module: "NodeNext", moduleResolution: "NodeNext" }),
         strict: true,
-        outDir: "dist",
-        rootDir,
-        declaration: true,
+        // next build compiles a Next.js app itself and type-checks the files it
+        // generates under .next/types, which a rootDir of src would reject.
+        ...(framework === "nextjs" ? { noEmit: true } : { outDir: "dist", rootDir, declaration: true }),
         skipLibCheck: true,
         esModuleInterop: true,
         ...(framework === "nestjs"
@@ -39,7 +42,10 @@ export function generateTsconfig(framework: Framework, extraSources: string[] =
           ? { jsx: "preserve", plugins: [{ name: "next" }] }
           : {}),
       },
-      include: ["src", ...extraSources],
+      include:
+        framework === "nextjs"
+          ? ["next-env.d.ts", "src", ...extraSources, ".next/types/**/*.ts"]
+          : ["src", ...extraSources],
       exclude: ["node_modules", "dist"],
     },
     null,