When customers need tenants inside tenants, resellers, agencies, enterprise org trees, a tenant_id column stops working. Stratum is the full tenant layer: hierarchy, config inheritance, isolation strategies, and compliance. Start flat, grow deep.
npm install @stratum-hq/lib @stratum-hq/core pg
Every feature maps to a real problem in multi-tenant SaaS, not a marketing checklist.
Tree-structured tenants backed by a PostgreSQL ltree materialized path. Advisory locks serialize create and move so concurrent writes cannot corrupt the tree. Ancestor and subtree queries resolve from the path, not recursive joins.
Values flow root to leaf automatically. Children inherit, override, or are blocked by a locked key. Batch updates apply with partial success, so one bad key does not abort the whole transaction.
Shared tables with RLS, schema-per-tenant, or database-per-tenant. Choose per tenant, and mix strategies in a single deployment as compliance requirements evolve.
LOCKED, INHERITED, or DELEGATED modes. Cascade, soft, or permanent revocation. Fine-grained control at every node of the tree.
AES-256-GCM for sensitive values at rest. Data export (Article 20) and hard purge (Article 17). Consent tracking with an audit trail.
Every mutation logged with actor identity. Optional OpenTelemetry tracing. Redis-backed rate limiting and webhook delivery with a dead-letter queue.
Connect a Postgres pool, create tenants with parent references, and config resolves automatically up the tree. No migrations to hand-write, no join tables to manage.
import { Pool } from "pg";
import { Stratum } from "@stratum-hq/lib";
const stratum = new Stratum({ pool: new Pool(), autoMigrate: true });
await stratum.initialize();
// Create a hierarchy
const root = await stratum.createTenant({ name: "AcmeSec", slug: "acmesec" });
const msp = await stratum.createTenant({ name: "NorthStar", slug: "northstar", parent_id: root.id });
// Config resolves up the ancestry chain
await stratum.setConfig(root.id, "max_users", { value: 1000, locked: false });
const config = await stratum.resolveConfig(msp.id);All published to npm under @stratum-hq/*
| @stratum-hq/core | Shared types, Zod schemas, error classes. Everything depends on it.foundation | npm → |
| @stratum-hq/lib | The core library: tenants, config, ABAC, permissions, audit, GDPR, webhooks, crypto.start here | npm → |
| @stratum-hq/control-plane | Fastify v5 REST API with auth, scopes, OpenTelemetry, and Redis rate limiting. | npm → |
| @stratum-hq/sdk | HTTP client for the control plane, LRU cache, Express and Fastify middleware. | npm → |
| @stratum-hq/db-adapters | PostgreSQL: raw pg, Prisma, Sequelize, Drizzle, plus RLS and schema isolation. | npm → |
| @stratum-hq/mongodb | MongoDB tenant isolation with a Mongoose plugin. | npm → |
| @stratum-hq/mysql | MySQL isolation with TypeORM, Knex, and Sequelize helpers.new | npm → |
| @stratum-hq/nestjs | NestJS guard, @Tenant() decorator, DI module. | npm → |
| @stratum-hq/hono | Hono middleware with AsyncLocalStorage context. | npm → |
| @stratum-hq/test-utils | Cross-tenant isolation test assertions. | npm → |
| @stratum-hq/react | React admin components: tenant tree, config editor, permission editor. | npm → |
| @stratum-hq/cli | Project init, migrate, scaffold, doctor. | npm → |
| @stratum-hq/create | Project scaffolding: npx @stratum-hq/create my-app. | npm → |