@stratum-hq/create 0.5.0 → 0.6.0

package/src/index.ts

@@ -2,12 +2,23 @@ import * as fs from "fs";
 import * as path from "path";
 import crypto from "node:crypto";
 import { execSync } from "child_process";
-import { parsePresetString, isValidPreset } from "./matrix.js";
+import { parsePresetString, isValidPreset, type StackPreset } from "./matrix.js";
 import { createPresetProject } from "./preset-project.js";
 import { STRATUM_RANGES } from "./stratum-versions.js";
-import { postgresAppRole, postgresAppRoleSql, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
+import {
+  postgresAppRole,
+  postgresAppRoleSql,
+  postgresStratumRole,
+  POSTGRES_APP_PASSWORD,
+  POSTGRES_STRATUM_PASSWORD,
+} from "./generators/init-sql.js";
 import { generateTsconfig } from "./generators/tsconfig.js";
-import { nextjsTenantMiddleware } from "./generators/middleware.js";
+import {
+  expressServer,
+  fastifyServer,
+  nextjsRootLayout,
+  nextjsTenantMiddleware,
+} from "./generators/middleware.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -111,11 +122,11 @@ function writeFile(filePath: string, content: string): void {
 function generatePackageJson(projectName: string, template: Template): string {
   const frameworkDeps: Record<Template, Record<string, string>> = {
     express: {
-      express: "^4.18.0",
+      express: "^4.22.3",
       "@types/express": "^4.17.21",
     },
     fastify: {
-      fastify: "^4.26.0",
+      fastify: "^5.12.5",
     },
     nextjs: {
       next: "^15.5.16",
@@ -123,14 +134,14 @@ function generatePackageJson(projectName: string, template: Template): string {
       "react-dom": "^19.0.0",
       "@types/react": "^19.0.0",
       "@types/react-dom": "^19.0.0",
-      // The middleware verifies the tenant JWT with jose.
-      jose: "^6.2.12",
     },
   };
 
   const deps = {
     "@stratum-hq/lib": STRATUM_RANGES["@stratum-hq/lib"],
     pg: "^8.11.0",
+    // Every template verifies the tenant JWT with jose.
+    jose: "^6.2.12",
     ...frameworkDeps[template],
   };
 
@@ -149,7 +160,7 @@ function generatePackageJson(projectName: string, template: Template): string {
       devDependencies: {
         typescript: "^5.3.0",
         "@types/node": "^20.11.0",
-        ...(template === "nextjs" ? {} : { tsx: "^4.7.0", "@types/pg": "^8.11.0" }),
+        ...(template === "nextjs" ? {} : { tsx: "^4.19.3", "@types/pg": "^8.11.0" }),
       },
       engines: {
         node: ">=20.0.0",
@@ -213,7 +224,10 @@ function generateEnv(projectName: string): string {
 DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
 
 # Superuser: bootstrap and migrations only. It bypasses row-level security.
-DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+DATABASE_SUPERUSER_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+
+# Stratum's own login: the library's adminPool, which runs the Stratum migrations (see init.sql).
+STRATUM_ADMIN_DATABASE_URL=postgres://${postgresStratumRole(dbName)}:${POSTGRES_STRATUM_PASSWORD}@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -226,77 +240,8 @@ NODE_ENV=development
 `;
 }
 
-function generateExpressServer(projectName: string): string {
-  return `import express from "express";
-import { Pool } from "pg";
-
-const app = express();
-const port = process.env.PORT || 3000;
-
-const pool = new Pool({
-  connectionString: process.env.DATABASE_URL,
-});
-
-app.use(express.json());
-
-app.get("/health", (_req, res) => {
-  res.json({ status: "ok", project: "${projectName}" });
-});
-
-app.get("/tenants", async (_req, res) => {
-  try {
-    // Example: query your tenant table
-    // const { rows } = await pool.query("SELECT * FROM tenants LIMIT 20");
-    // res.json(rows);
-    res.json({ message: "Replace this with your tenant queries", pool: !!pool });
-  } catch (err) {
-    res.status(500).json({ error: String(err) });
-  }
-});
-
-app.listen(port, () => {
-  console.log(\`${projectName} server running on http://localhost:\${port}\`);
-});
-`;
-}
-
-function generateFastifyServer(projectName: string): string {
-  return `import Fastify from "fastify";
-import { Pool } from "pg";
-
-const fastify = Fastify({ logger: true });
-const port = Number(process.env.PORT) || 3000;
-
-const pool = new Pool({
-  connectionString: process.env.DATABASE_URL,
-});
-
-fastify.get("/health", async () => {
-  return { status: "ok", project: "${projectName}" };
-});
-
-fastify.get("/tenants", async (_request, reply) => {
-  try {
-    // Example: query your tenant table
-    // const { rows } = await pool.query("SELECT * FROM tenants LIMIT 20");
-    // return rows;
-    return { message: "Replace this with your tenant queries", pool: !!pool };
-  } catch (err) {
-    return reply.status(500).send({ error: String(err) });
-  }
-});
-
-fastify.listen({ port, host: "0.0.0.0" }, (err) => {
-  if (err) {
-    fastify.log.error(err);
-    process.exit(1);
-  }
-});
-`;
-}
-
 function generateNextjsPage(projectName: string): string {
-  return `// app/page.tsx — ${projectName} root page
+  return `// app/page.tsx: ${projectName} root page
 export default function Home() {
   return (
     <main style={{ padding: "2rem", fontFamily: "sans-serif" }}>
@@ -304,7 +249,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>The tenant comes from a verified JWT in <code>middleware.ts</code></li>
+        <li>The tenant comes from a verified JWT in <code>src/middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -330,7 +275,7 @@ docker compose up -d
 
 \`\`\`bash
 cp .env.example .env
-# Edit .env — update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
+# Edit .env: update DATABASE_URL, JWT_SECRET, and STRATUM_API_KEY
 \`\`\`
 
 ### 3. Install dependencies
@@ -360,9 +305,13 @@ ${template === "nextjs" ? "" : "├── tsconfig.json\n"}└── package.jso
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** — from the \`tenant_id\` claim of a bearer token verified with \`JWT_SECRET\` (see \`middleware.ts\`); the subdomain is only a display slug
-- **Config inheritance** — settings flow down the tenant tree with override support
-- **Permission ABAC** — role-based permissions with tenant-scoped enforcement
+${
+    template === "nextjs"
+      ? "- **Tenant resolution**: from the `tenant_id` claim of a bearer token verified with `JWT_SECRET` (see `src/middleware.ts`); the subdomain is only a display slug"
+      : "- **Tenant resolution**: the tenant middleware in `src/index.ts` takes the tenant from the `tenant_id` claim of a bearer token verified with `JWT_SECRET` (HS256, using `jose`). A token that does not verify is rejected with 401, and `GET /tenants` answers 401 without a tenant. The hostname and headers such as `x-tenant-id` are never used"
+  }
+- **Config inheritance**: settings flow down the tenant tree with override support
+- **Permission ABAC**: role-based permissions with tenant-scoped enforcement
 
 See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference.
 `;
@@ -395,14 +344,15 @@ export function createProject(
 
   // Server starter file
   if (template === "express") {
-    writeFile(path.join(targetDir, "src", "index.ts"), generateExpressServer(projectName));
+    writeFile(path.join(targetDir, "src", "index.ts"), expressServer(projectName));
     writeFile(path.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "fastify") {
-    writeFile(path.join(targetDir, "src", "index.ts"), generateFastifyServer(projectName));
+    writeFile(path.join(targetDir, "src", "index.ts"), fastifyServer(projectName));
     writeFile(path.join(targetDir, "tsconfig.json"), generateTsconfig(template));
   } else if (template === "nextjs") {
+    writeFile(path.join(targetDir, "src", "app", "layout.tsx"), nextjsRootLayout(projectName));
     writeFile(path.join(targetDir, "src", "app", "page.tsx"), generateNextjsPage(projectName));
-    writeFile(path.join(targetDir, "middleware.ts"), nextjsTenantMiddleware());
+    writeFile(path.join(targetDir, "src", "middleware.ts"), nextjsTenantMiddleware());
   }
 
   // README
@@ -453,6 +403,25 @@ export function main(argv: string[]): void {
     process.exit(1);
   }
 
+  // Check the preset before touching the file system, so an invalid preset
+  // neither leaves an empty directory nor removes one under --force.
+  let parsedPreset: StackPreset | null = null;
+  if (preset) {
+    parsedPreset = parsePresetString(preset);
+    if (!parsedPreset) {
+      console.error(`Error: Invalid preset string "${preset}".`);
+      console.error("Format: {database}-{strategy}-{orm}-{framework}");
+      console.error("Example: postgres-rls-prisma-express, mongodb-database-mongoose-hono");
+      process.exit(1);
+    }
+    if (!isValidPreset(parsedPreset)) {
+      console.error(`Error: Invalid preset combination "${preset}".`);
+      console.error(`${parsedPreset.database} does not support ${parsedPreset.strategy}/${parsedPreset.orm} together.`);
+      console.error("Run with --help to see valid combinations.");
+      process.exit(1);
+    }
+  }
+
   const targetDir = path.resolve(process.cwd(), projectName);
 
   if (fs.existsSync(targetDir) && !force) {
@@ -468,21 +437,8 @@ export function main(argv: string[]): void {
   fs.mkdirSync(targetDir, { recursive: true });
 
   // Preset path: full stack generation
-  if (preset) {
-    const parsed = parsePresetString(preset);
-    if (!parsed) {
-      console.error(`Error: Invalid preset string "${preset}".`);
-      console.error("Format: {database}-{strategy}-{orm}-{framework}");
-      console.error("Example: postgres-rls-prisma-express, mongodb-database-mongoose-hono");
-      process.exit(1);
-    }
-    if (!isValidPreset(parsed)) {
-      console.error(`Error: Invalid preset combination "${preset}".`);
-      console.error(`${parsed.database} does not support ${parsed.strategy}/${parsed.orm} together.`);
-      console.error("Run with --help to see valid combinations.");
-      process.exit(1);
-    }
-    createPresetProject(projectName, parsed, targetDir, skipInstall);
+  if (parsedPreset) {
+    createPresetProject(projectName, parsedPreset, targetDir, skipInstall);
   } else {
     // Template path: existing behavior, untouched
     createProject(projectName, template, targetDir, skipInstall);

package/src/matrix.ts

@@ -75,7 +75,7 @@ export function parsePresetString(s: string): StackPreset | null {
 
   const parts = s.toLowerCase().split("-");
 
-  // Handle "table-prefix" which contains a hyphen -- it will split into
+  // Handle "table-prefix" which contains a hyphen; it will split into
   // 5 parts: [db, strategy1, "table", "prefix", orm, framework] or similar.
   // We need to reconstruct multi-word tokens.
   // Format: {database}-{strategy}-{orm}-{framework}

package/src/preset-project.ts

@@ -4,7 +4,13 @@ import crypto from "node:crypto";
 import { execSync } from "child_process";
 import type { StackPreset } from "./matrix.js";
 import { generatePresetDockerCompose } from "./generators/docker-compose.js";
-import { generatePresetInitSql, postgresAppRole, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
+import {
+  generatePresetInitSql,
+  postgresAppRole,
+  postgresStratumRole,
+  POSTGRES_APP_PASSWORD,
+  POSTGRES_STRATUM_PASSWORD,
+} from "./generators/init-sql.js";
 import { generateDbSetup } from "./generators/db-setup.js";
 import { generateMiddleware } from "./generators/middleware.js";
 import { generatePresetPackageJson } from "./generators/package-json.js";
@@ -32,7 +38,9 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
       // row-level security applies to it. The superuser URL is for bootstrap
       // and migrations only.
       dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
-      adminUrlLine = `\n# Superuser: bootstrap and migrations only. It bypasses row-level security.\nDATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}\n`;
+      adminUrlLine = `\n# Superuser: bootstrap and migrations only. It bypasses row-level security.\nDATABASE_SUPERUSER_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}\n` +
+        `\n# Stratum's own login: the library's adminPool, which runs the Stratum migrations (see init.sql).\n` +
+        `STRATUM_ADMIN_DATABASE_URL=postgres://${postgresStratumRole(dbName)}:${POSTGRES_STRATUM_PASSWORD}@localhost:5432/${dbName}\n`;
       break;
     case "mongodb":
       dbUrl = `mongodb://${dbName}:dev_password@localhost:27017/${dbName}?authSource=admin`;