@tenora/multi-tenant 0.1.1

package/dist/cli.js

@@ -0,0 +1,1013 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+import fs4 from "fs";
+import knex2 from "knex";
+import path4 from "path";
+
+// src/knexFactory.ts
+import knex from "knex";
+import fs3 from "fs";
+import path3 from "path";
+
+// src/tenantRegistry.ts
+import fs from "fs";
+import path from "path";
+
+// src/password.ts
+import CryptoJS from "crypto-js";
+var encryptPassword = (password, cipherKey) => {
+  if (typeof cipherKey !== "string" || cipherKey.length === 0) {
+    throw new Error("Tenora: cipherKey must be a non-empty string.");
+  }
+  return CryptoJS.AES.encrypt(password, cipherKey).toString();
+};
+var decryptPassword = (encryptedPassword, cipherKey) => {
+  if (typeof cipherKey !== "string" || cipherKey.length === 0) {
+    throw new Error("Tenora: cipherKey must be a non-empty string.");
+  }
+  const bytes = CryptoJS.AES.decrypt(encryptedPassword, cipherKey);
+  return bytes.toString(CryptoJS.enc.Utf8);
+};
+
+// src/tenantRegistry.ts
+var REGISTRY_MARKER = "tenora:registry";
+var DEFAULT_REGISTRY = {
+  table: "tenora_tenants",
+  idColumn: "id",
+  passwordColumn: "password",
+  encryptedPasswordColumn: "encrypted_password",
+  createdAtColumn: "created_at",
+  updatedAtColumn: "updated_at"
+};
+var resolveRegistry = (options) => ({
+  ...DEFAULT_REGISTRY,
+  ...options.registry ?? {}
+});
+var resolveEncrypt = (options) => {
+  if (options.encryptPassword) return options.encryptPassword;
+  const key = process.env.TENORA_KEY;
+  if (key) {
+    return (plain) => encryptPassword(plain, key);
+  }
+  return void 0;
+};
+var resolveDecrypt = (options) => {
+  if (options.decryptPassword) return options.decryptPassword;
+  const key = process.env.TENORA_KEY;
+  if (key) {
+    return (encrypted) => decryptPassword(encrypted, key);
+  }
+  return void 0;
+};
+var listMigrationFiles = (dir) => {
+  if (!fs.existsSync(dir)) return [];
+  return fs.readdirSync(dir).filter((name) => name.endsWith(".js") || name.endsWith(".ts")).map((name) => path.join(dir, name));
+};
+var ensureRegistryMigration = (options) => {
+  const configuredDir = options.base.migrationsDir;
+  const migrationsDir = configuredDir ? path.isAbsolute(configuredDir) ? configuredDir : path.join(process.cwd(), configuredDir) : void 0;
+  if (!migrationsDir) {
+    throw new Error(
+      "Tenora: base.migrationsDir is required to create the tenant registry migration."
+    );
+  }
+  const registry = resolveRegistry(options);
+  const files = listMigrationFiles(migrationsDir);
+  const hasRegistry = files.some((file) => {
+    try {
+      return fs.readFileSync(file, "utf8").includes(REGISTRY_MARKER);
+    } catch {
+      return false;
+    }
+  });
+  if (hasRegistry) {
+    return { created: false };
+  }
+  fs.mkdirSync(migrationsDir, { recursive: true });
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T.Z]/g, "").slice(0, 14);
+  const fileName = `${timestamp}_create_tenant_registry.js`;
+  const filePath = path.join(migrationsDir, fileName);
+  const migration = `// ${REGISTRY_MARKER}
+export const up = (knex) =>
+  knex.schema.createTable("${registry.table}", (t) => {
+    t.string("${registry.idColumn}").primary();
+    t.string("${registry.passwordColumn}");
+    t.string("${registry.encryptedPasswordColumn}");
+    t.timestamp("${registry.createdAtColumn}", { useTz: true }).defaultTo(knex.fn.now());
+    t.timestamp("${registry.updatedAtColumn}", { useTz: true }).defaultTo(knex.fn.now());
+  });
+
+export const down = (knex) => knex.schema.dropTableIfExists("${registry.table}");
+`;
+  fs.writeFileSync(filePath, migration);
+  return { created: true, filePath };
+};
+var ensureRegistryTable = async (base, options) => {
+  const registry = resolveRegistry(options);
+  const exists = await base.schema.hasTable(registry.table);
+  if (!exists) {
+    throw new Error(
+      `Tenora: tenant registry table "${registry.table}" not found. Run 'tenora migrate' to create it.`
+    );
+  }
+};
+var listTenantsFromRegistry = async (base, options) => {
+  const registry = resolveRegistry(options);
+  await ensureRegistryTable(base, options);
+  const rows = await base(registry.table).select({
+    id: registry.idColumn,
+    password: registry.passwordColumn,
+    encryptedPassword: registry.encryptedPasswordColumn
+  });
+  return rows;
+};
+var upsertTenantInRegistry = async (base, options, tenantId, password) => {
+  const registry = resolveRegistry(options);
+  await ensureRegistryTable(base, options);
+  const encrypt = resolveEncrypt(options);
+  const encrypted = password && encrypt ? encrypt(password) : void 0;
+  const record = {
+    [registry.idColumn]: tenantId
+  };
+  if (encrypted) {
+    record[registry.encryptedPasswordColumn] = encrypted;
+  } else if (password) {
+    record[registry.passwordColumn] = password;
+  }
+  await base(registry.table).insert(record).onConflict(registry.idColumn).merge(record);
+};
+
+// src/configLoader.ts
+import fs2 from "fs";
+import path2 from "path";
+import { pathToFileURL } from "url";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var DEFAULT_CONFIG_FILES = [
+  "tenora.config.js",
+  "tenora.config.mjs",
+  "tenora.config.ts"
+];
+var resolveConfigPath = (explicitPath) => {
+  const cwd = process.cwd();
+  if (explicitPath) {
+    return path2.isAbsolute(explicitPath) ? explicitPath : path2.join(cwd, explicitPath);
+  }
+  for (const file of DEFAULT_CONFIG_FILES) {
+    const full = path2.join(cwd, file);
+    if (fs2.existsSync(full)) return full;
+  }
+  throw new Error(
+    `Tenora: no config found. Looked for ${DEFAULT_CONFIG_FILES.join(", ")} in ${cwd}.`
+  );
+};
+var loadConfigModuleSync = (fullPath) => {
+  const ext = path2.extname(fullPath);
+  try {
+    const mod = require2(fullPath);
+    return mod;
+  } catch (err) {
+    if (ext === ".mjs" || err?.code === "ERR_REQUIRE_ESM") {
+      throw new Error(
+        `Tenora: ${path2.basename(fullPath)} is ESM. Use createTenoraFactoryAsync() or pass the config directly.`
+      );
+    }
+    if (ext === ".ts" || err?.code === "ERR_UNKNOWN_FILE_EXTENSION") {
+      throw new Error(
+        `Tenora: ${path2.basename(fullPath)} is TypeScript. Use createTenoraFactoryAsync() with a TS loader (tsx/ts-node), or pass the config directly.`
+      );
+    }
+    throw err;
+  }
+};
+var loadConfigModuleAsync = async (fullPath) => {
+  const href = pathToFileURL(fullPath).href;
+  return import(href);
+};
+var unwrapConfig = (mod) => mod.default ?? mod.config ?? mod;
+
+// src/knexFactory.ts
+var resolveClient = (value) => value ?? "pg";
+var isPostgresClient = (client) => client === "pg" || client === "postgres" || client === "postgresql";
+var isMysqlClient = (client) => client === "mysql" || client === "mysql2" || client === "mariadb";
+var isSqliteClient = (client) => client === "sqlite3" || client === "better-sqlite3" || client === "sqlite";
+var isMssqlClient = (client) => client === "mssql" || client === "sqlserver";
+var normalizePassword = (value) => {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value === "string") return value;
+  return String(value);
+};
+var escapePgIdent = (value) => value.replace(/"/g, '""');
+var escapeMysqlIdent = (value) => value.replace(/`/g, "``");
+var escapeMssqlIdent = (value) => value.replace(/]/g, "]]");
+var escapeSqlString = (value) => value.replace(/'/g, "''");
+var loadDefaultConfig = () => {
+  const explicit = process.env.TENORA_CONFIG;
+  const fullPath = resolveConfigPath(explicit ?? void 0);
+  const module = loadConfigModuleSync(fullPath);
+  const cfg = unwrapConfig(module);
+  if (!cfg) {
+    throw new Error(
+      `Tenora: config file ${path3.basename(fullPath)} did not export a config object.`
+    );
+  }
+  return cfg;
+};
+var defaultPool = { min: 2, max: 10, acquireTimeoutMillis: 6e4, idleTimeoutMillis: 6e4 };
+var buildTenoraFactory = (resolved) => {
+  const { base, tenant = {}, knexOptions = {} } = resolved;
+  const cache = /* @__PURE__ */ new Map();
+  const basePassword = normalizePassword(base.password);
+  const client = resolveClient(base.client);
+  const resolveBaseDatabaseName2 = () => {
+    if (base.connection) {
+      const conn = base.connection;
+      if (isSqliteClient(client)) {
+        const filename = conn.filename ?? base.database;
+        if (!filename) {
+          throw new Error("Tenora: base.database or base.connection.filename is required for SQLite.");
+        }
+        return filename;
+      }
+      const dbName = conn.database ?? base.database;
+      if (!dbName) {
+        throw new Error("Tenora: base.database is required.");
+      }
+      return dbName;
+    }
+    if (!base.database) {
+      throw new Error("Tenora: base.database is required.");
+    }
+    return base.database;
+  };
+  const applyConnectionDefaults2 = (conn) => {
+    if (conn.user === void 0 && base.user !== void 0) conn.user = base.user;
+    if (conn.port === void 0 && base.port !== void 0) conn.port = base.port;
+    if (isMssqlClient(client)) {
+      if (conn.server === void 0 && base.host !== void 0) conn.server = base.host;
+    } else if (conn.host === void 0 && base.host !== void 0) {
+      conn.host = base.host;
+    }
+    if (conn.ssl === void 0 && base.ssl !== void 0) conn.ssl = base.ssl;
+    const normalized = normalizePassword(conn.password ?? basePassword);
+    if (normalized !== void 0) {
+      conn.password = normalized;
+    } else {
+      delete conn.password;
+    }
+  };
+  const buildBaseConnection2 = (databaseOverride) => {
+    if (base.connection) {
+      const conn2 = { ...base.connection };
+      applyConnectionDefaults2(conn2);
+      if (databaseOverride !== void 0) {
+        if (isSqliteClient(client)) {
+          conn2.filename = databaseOverride;
+          delete conn2.database;
+        } else {
+          conn2.database = databaseOverride;
+        }
+      } else if (isSqliteClient(client)) {
+        if (conn2.filename === void 0 && base.database) conn2.filename = base.database;
+      } else if (conn2.database === void 0 && base.database) {
+        conn2.database = base.database;
+      }
+      return conn2;
+    }
+    if (isSqliteClient(client)) {
+      const filename = databaseOverride ?? base.database;
+      if (!filename) {
+        throw new Error("Tenora: base.database is required for SQLite.");
+      }
+      return { filename };
+    }
+    if (!base.host || !base.user || !base.database) {
+      throw new Error("Tenora: base connection is incomplete. Provide base.connection or host/user/database.");
+    }
+    const conn = {
+      ...isMssqlClient(client) ? { server: base.host } : { host: base.host },
+      port: base.port,
+      user: base.user,
+      database: databaseOverride ?? base.database,
+      ssl: base.ssl ?? false
+    };
+    if (basePassword !== void 0) conn.password = basePassword;
+    return conn;
+  };
+  const baseKnexConfig = {
+    client,
+    useNullAsDefault: true,
+    connection: buildBaseConnection2(resolveBaseDatabaseName2()),
+    pool: base.pool ?? defaultPool,
+    migrations: base.migrationsDir ? { directory: base.migrationsDir } : void 0,
+    seeds: base.seedsDir ? { directory: base.seedsDir } : void 0,
+    ...knexOptions
+  };
+  const baseClient = knex(baseKnexConfig);
+  const resolveTenantDatabaseName = (tenantId) => tenant.databaseName ? tenant.databaseName(tenantId) : tenantId;
+  const resolveSqliteTenantFilename = (tenantId) => {
+    const baseDb = resolveBaseDatabaseName2();
+    const baseDir = tenant.databaseDir ?? path3.dirname(baseDb ?? process.cwd());
+    const name = tenant.databaseName ? tenant.databaseName(tenantId) : `${tenantId}${tenant.databaseSuffix ?? ".sqlite"}`;
+    return path3.isAbsolute(name) ? name : path3.join(baseDir, name);
+  };
+  const buildTenantConfig = (tenantId, password) => {
+    const tenantPassword = normalizePassword(password ?? basePassword);
+    const hasTenantPassword = password !== void 0 && password !== null;
+    const tenantDb = isSqliteClient(client) ? resolveSqliteTenantFilename(tenantId) : resolveTenantDatabaseName(tenantId);
+    const connection = buildBaseConnection2(tenantDb);
+    if (!isSqliteClient(client) && hasTenantPassword) {
+      connection.user = `${tenant.userPrefix ?? "user_"}${tenantId}`;
+      if (tenantPassword !== void 0) {
+        connection.password = tenantPassword;
+      } else {
+        delete connection.password;
+      }
+    }
+    if (tenant.ssl !== void 0) {
+      connection.ssl = tenant.ssl;
+    }
+    return {
+      client,
+      useNullAsDefault: true,
+      connection,
+      pool: tenant.pool ?? base.pool ?? defaultPool,
+      migrations: tenant.migrationsDir ? { directory: tenant.migrationsDir } : void 0,
+      seeds: tenant.seedsDir ? { directory: tenant.seedsDir } : void 0,
+      ...knexOptions
+    };
+  };
+  const getTenant = (tenantId, password) => {
+    const cached = cache.get(tenantId);
+    if (cached) return cached;
+    const client2 = knex(buildTenantConfig(tenantId, password));
+    cache.set(tenantId, client2);
+    return client2;
+  };
+  const destroyTenant = async (tenantId) => {
+    const client2 = cache.get(tenantId);
+    if (client2) {
+      await client2.destroy();
+      cache.delete(tenantId);
+    }
+  };
+  const destroyAll = async () => {
+    await Promise.all([...cache.values()].map((k) => k.destroy()));
+    cache.clear();
+    await baseClient.destroy();
+  };
+  const createTenantDb = async (tenantId, password) => {
+    await ensureRegistryTable(baseClient, resolved);
+    const tenantPassword = normalizePassword(password);
+    const hasTenantPassword = password !== void 0 && password !== null;
+    if (isSqliteClient(client)) {
+      const filename = resolveSqliteTenantFilename(tenantId);
+      if (filename !== ":memory:") {
+        fs3.mkdirSync(path3.dirname(filename), { recursive: true });
+        if (!fs3.existsSync(filename)) {
+          fs3.closeSync(fs3.openSync(filename, "a"));
+        }
+      }
+    } else {
+      const adminDb = base.adminDatabase ?? (isPostgresClient(client) ? "postgres" : isMysqlClient(client) ? "mysql" : isMssqlClient(client) ? "master" : resolveBaseDatabaseName2());
+      const admin = knex({
+        ...baseKnexConfig,
+        connection: buildBaseConnection2(adminDb)
+      });
+      try {
+        if (isPostgresClient(client)) {
+          const result = await admin.raw(`SELECT 1 FROM pg_database WHERE datname = ?`, [tenantId]);
+          if (result?.rows?.length) {
+            throw new Error(`Database "${tenantId}" already exists`);
+          }
+          const safeDb = escapePgIdent(tenantId);
+          await admin.raw(`CREATE DATABASE "${safeDb}"`);
+          if (tenantPassword && hasTenantPassword) {
+            const userName = `${tenant.userPrefix ?? "user_"}${tenantId}`;
+            const safeUser = escapePgIdent(userName);
+            const safePwd = escapeSqlString(tenantPassword);
+            await admin.raw(`CREATE USER "${safeUser}" WITH PASSWORD '${safePwd}'`);
+            await admin.raw(`GRANT ALL PRIVILEGES ON DATABASE "${safeDb}" TO "${safeUser}"`);
+          }
+        } else if (isMysqlClient(client)) {
+          const result = await admin.raw(
+            `SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?`,
+            [tenantId]
+          );
+          if (result?.[0]?.length) {
+            throw new Error(`Database "${tenantId}" already exists`);
+          }
+          const safeDb = escapeMysqlIdent(tenantId);
+          await admin.raw(`CREATE DATABASE \`${safeDb}\``);
+          if (tenantPassword && hasTenantPassword) {
+            const userName = `${tenant.userPrefix ?? "user_"}${tenantId}`;
+            const safeUser = escapeSqlString(userName);
+            const safePwd = escapeSqlString(tenantPassword);
+            await admin.raw(`CREATE USER IF NOT EXISTS '${safeUser}'@'%' IDENTIFIED BY '${safePwd}'`);
+            await admin.raw(`GRANT ALL PRIVILEGES ON \`${safeDb}\`.* TO '${safeUser}'@'%'`);
+          }
+        } else if (isMssqlClient(client)) {
+          const safeDb = escapeMssqlIdent(tenantId);
+          await admin.raw(
+            `IF DB_ID(N'${escapeSqlString(tenantId)}') IS NULL CREATE DATABASE [${safeDb}]`
+          );
+          if (tenantPassword && hasTenantPassword) {
+            const userName = `${tenant.userPrefix ?? "user_"}${tenantId}`;
+            const safeUser = escapeMssqlIdent(userName);
+            const safePwd = escapeSqlString(tenantPassword);
+            await admin.raw(
+              `IF NOT EXISTS (SELECT name FROM sys.server_principals WHERE name = N'${escapeSqlString(userName)}') CREATE LOGIN [${safeUser}] WITH PASSWORD = '${safePwd}'`
+            );
+            const tenantAdmin = knex({
+              ...baseKnexConfig,
+              connection: buildBaseConnection2(tenantId)
+            });
+            try {
+              await tenantAdmin.raw(
+                `IF NOT EXISTS (SELECT name FROM sys.database_principals WHERE name = N'${escapeSqlString(userName)}') CREATE USER [${safeUser}] FOR LOGIN [${safeUser}]`
+              );
+              await tenantAdmin.raw(`EXEC sp_addrolemember 'db_owner', '${safeUser}'`);
+            } finally {
+              await tenantAdmin.destroy();
+            }
+          }
+        } else {
+          throw new Error(
+            `Tenora: createTenantDb is only supported for Postgres, MySQL/MariaDB, SQLite, and SQL Server clients (got "${client}").`
+          );
+        }
+      } finally {
+        await admin.destroy();
+      }
+    }
+    const tenantKnex = knex(buildTenantConfig(tenantId, tenantPassword));
+    try {
+      if (tenant.migrationsDir) {
+        await tenantKnex.migrate.latest();
+      }
+      if (tenant.seedsDir) {
+        await tenantKnex.seed.run();
+      }
+    } finally {
+      await tenantKnex.destroy();
+      cache.delete(tenantId);
+    }
+    await upsertTenantInRegistry(baseClient, resolved, tenantId, password);
+  };
+  return {
+    getBase: () => baseClient,
+    getTenant,
+    createTenantDb,
+    destroyTenant,
+    destroyAll
+  };
+};
+var createTenoraFactory = (options) => {
+  const resolved = options ?? loadDefaultConfig();
+  return buildTenoraFactory(resolved);
+};
+
+// src/cli.ts
+var program = new Command();
+var ensureRegistryMigrationIfNeeded = (cfg) => {
+  const result = ensureRegistryMigration(cfg);
+  if (result.created) {
+    console.log(
+      `Tenora: created tenant registry migration at ${result.filePath}. Review it (rename if desired), then run 'tenora migrate' again.`
+    );
+    return true;
+  }
+  return false;
+};
+var findNearestPackageJson = (startDir) => {
+  let current = startDir;
+  while (true) {
+    const candidate = path4.join(current, "package.json");
+    if (fs4.existsSync(candidate)) return candidate;
+    const parent = path4.dirname(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+};
+var detectModuleType = () => {
+  const pkgPath = findNearestPackageJson(process.cwd());
+  if (!pkgPath) return "cjs";
+  try {
+    const raw = fs4.readFileSync(pkgPath, "utf8");
+    const json = JSON.parse(raw);
+    return json.type === "module" ? "esm" : "cjs";
+  } catch {
+    return "cjs";
+  }
+};
+var resolveTemplateModuleType = (opts) => {
+  if (opts.esm && opts.cjs) {
+    throw new Error("Tenora: choose only one of --esm or --cjs.");
+  }
+  if (opts.esm) return "esm";
+  if (opts.cjs) return "cjs";
+  return detectModuleType();
+};
+var resolveClient2 = (value) => value ?? "pg";
+var isPostgresClient2 = (client) => client === "pg" || client === "postgres" || client === "postgresql";
+var isMysqlClient2 = (client) => client === "mysql" || client === "mysql2" || client === "mariadb";
+var isSqliteClient2 = (client) => client === "sqlite3" || client === "better-sqlite3" || client === "sqlite";
+var isMssqlClient2 = (client) => client === "mssql" || client === "sqlserver";
+var normalizePassword2 = (value) => {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value === "string") return value;
+  return String(value);
+};
+var escapePgIdent2 = (value) => value.replace(/"/g, '""');
+var escapeMysqlIdent2 = (value) => value.replace(/`/g, "``");
+var escapeMssqlIdent2 = (value) => value.replace(/]/g, "]]");
+var resolveBaseDatabaseName = (cfg) => {
+  const client = resolveClient2(cfg.base.client);
+  if (cfg.base.connection) {
+    const conn = cfg.base.connection;
+    if (isSqliteClient2(client)) {
+      const filename = conn.filename ?? cfg.base.database;
+      if (!filename) {
+        throw new Error("Tenora: base.database or base.connection.filename is required for SQLite.");
+      }
+      return filename;
+    }
+    const dbName = conn.database ?? cfg.base.database;
+    if (!dbName) throw new Error("Tenora: base.database is required.");
+    return dbName;
+  }
+  if (!cfg.base.database) {
+    throw new Error("Tenora: base.database is required.");
+  }
+  return cfg.base.database;
+};
+var applyConnectionDefaults = (cfg, conn) => {
+  const client = resolveClient2(cfg.base.client);
+  if (conn.user === void 0 && cfg.base.user !== void 0) conn.user = cfg.base.user;
+  if (conn.port === void 0 && cfg.base.port !== void 0) conn.port = cfg.base.port;
+  if (isMssqlClient2(client)) {
+    if (conn.server === void 0 && cfg.base.host !== void 0) conn.server = cfg.base.host;
+  } else if (conn.host === void 0 && cfg.base.host !== void 0) {
+    conn.host = cfg.base.host;
+  }
+  if (conn.ssl === void 0 && cfg.base.ssl !== void 0) conn.ssl = cfg.base.ssl;
+  const normalized = normalizePassword2(conn.password ?? cfg.base.password);
+  if (normalized !== void 0) {
+    conn.password = normalized;
+  } else {
+    delete conn.password;
+  }
+};
+var buildBaseConnection = (cfg, databaseOverride) => {
+  const client = resolveClient2(cfg.base.client);
+  if (cfg.base.connection) {
+    const conn2 = { ...cfg.base.connection };
+    applyConnectionDefaults(cfg, conn2);
+    if (databaseOverride !== void 0) {
+      if (isSqliteClient2(client)) {
+        conn2.filename = databaseOverride;
+        delete conn2.database;
+      } else {
+        conn2.database = databaseOverride;
+      }
+    } else if (isSqliteClient2(client)) {
+      if (conn2.filename === void 0 && cfg.base.database) conn2.filename = cfg.base.database;
+    } else if (conn2.database === void 0 && cfg.base.database) {
+      conn2.database = cfg.base.database;
+    }
+    return conn2;
+  }
+  if (isSqliteClient2(client)) {
+    const filename = databaseOverride ?? cfg.base.database;
+    if (!filename) {
+      throw new Error("Tenora: base.database is required for SQLite.");
+    }
+    return { filename };
+  }
+  if (!cfg.base.host || !cfg.base.user || !cfg.base.database) {
+    throw new Error("Tenora: base connection is incomplete. Provide base.connection or host/user/database.");
+  }
+  const conn = {
+    ...isMssqlClient2(client) ? { server: cfg.base.host } : { host: cfg.base.host },
+    port: cfg.base.port,
+    user: cfg.base.user,
+    database: databaseOverride ?? cfg.base.database,
+    ssl: cfg.base.ssl ?? false
+  };
+  const basePassword = normalizePassword2(cfg.base.password);
+  if (basePassword !== void 0) conn.password = basePassword;
+  return conn;
+};
+var normalizeCreatedPath = (created) => Array.isArray(created) ? created[0] : created;
+var tokenizeName = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+var joinTokens = (tokens) => tokens.join("_");
+var splitColumns = (tokens) => {
+  const columns = [];
+  let current = [];
+  for (const token of tokens) {
+    if (token === "and") {
+      if (current.length) {
+        columns.push(joinTokens(current));
+        current = [];
+      }
+      continue;
+    }
+    current.push(token);
+  }
+  if (current.length) columns.push(joinTokens(current));
+  return columns.filter(Boolean);
+};
+var inferCreateTable = (tokens) => {
+  const tableIdx = tokens.indexOf("table");
+  if (tableIdx > 0) return tokens[tableIdx - 1];
+  const createIdx = tokens.indexOf("create");
+  if (createIdx >= 0 && tokens[createIdx + 1]) return tokens[createIdx + 1];
+  return void 0;
+};
+var inferAlterAdd = (tokens) => {
+  const addIdx = tokens.indexOf("add");
+  const toIdx = tokens.indexOf("to");
+  if (addIdx === -1 || toIdx === -1 || toIdx <= addIdx + 1) return void 0;
+  const cols = splitColumns(tokens.slice(addIdx + 1, toIdx));
+  const tableTokens = tokens.slice(toIdx + 1);
+  if (!cols.length || !tableTokens.length) return void 0;
+  const table = tableTokens[tableTokens.length - 1] === "table" ? joinTokens(tableTokens.slice(0, -1)) : joinTokens(tableTokens);
+  if (!table) return void 0;
+  return { table, columns: cols };
+};
+var inferAlterRemove = (tokens) => {
+  const removeIdx = tokens.indexOf("remove");
+  const dropIdx = tokens.indexOf("drop");
+  const fromIdx = tokens.indexOf("from");
+  const startIdx = removeIdx !== -1 ? removeIdx : dropIdx;
+  if (startIdx === -1 || fromIdx === -1 || fromIdx <= startIdx + 1) return void 0;
+  const cols = splitColumns(tokens.slice(startIdx + 1, fromIdx));
+  const tableTokens = tokens.slice(fromIdx + 1);
+  if (!cols.length || !tableTokens.length) return void 0;
+  const table = tableTokens[tableTokens.length - 1] === "table" ? joinTokens(tableTokens.slice(0, -1)) : joinTokens(tableTokens);
+  if (!table) return void 0;
+  return { table, columns: cols };
+};
+var buildCreateTableTemplate = (table, moduleType) => moduleType === "esm" ? `export const up = (knex) =>
+  knex.schema.createTable("${table}", (t) => {
+    t.increments("id").primary();
+    t.timestamps(true, true);
+  });
+
+export const down = (knex) => knex.schema.dropTableIfExists("${table}");
+` : `exports.up = (knex) =>
+  knex.schema.createTable("${table}", (t) => {
+    t.increments("id").primary();
+    t.timestamps(true, true);
+  });
+
+exports.down = (knex) => knex.schema.dropTableIfExists("${table}");
+`;
+var buildAlterAddTemplate = (table, columns, moduleType) => {
+  const addLines = columns.map((c) => `    t.string("${c}");`).join("\n");
+  const dropLines = columns.map((c) => `    t.dropColumn("${c}");`).join("\n");
+  return moduleType === "esm" ? `export const up = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${addLines}
+  });
+
+export const down = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${dropLines}
+  });
+` : `exports.up = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${addLines}
+  });
+
+exports.down = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${dropLines}
+  });
+`;
+};
+var buildAlterRemoveTemplate = (table, columns, moduleType) => {
+  const dropLines = columns.map((c) => `    t.dropColumn("${c}");`).join("\n");
+  const addLines = columns.map((c) => `    t.string("${c}");`).join("\n");
+  return moduleType === "esm" ? `export const up = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${dropLines}
+  });
+
+export const down = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${addLines}
+  });
+` : `exports.up = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${dropLines}
+  });
+
+exports.down = (knex) =>
+  knex.schema.alterTable("${table}", (t) => {
+${addLines}
+  });
+`;
+};
+var buildDefaultMigrationTemplate = (moduleType) => moduleType === "esm" ? `export const up = (knex) => {
+  // TODO
+};
+
+export const down = (knex) => {
+  // TODO
+};
+` : `exports.up = (knex) => {
+  // TODO
+};
+
+exports.down = (knex) => {
+  // TODO
+};
+`;
+var writeMigrationTemplate = (filePath, moduleType, name) => {
+  const tokens = tokenizeName(name);
+  const createTable = inferCreateTable(tokens);
+  const addPlan = inferAlterAdd(tokens);
+  const removePlan = inferAlterRemove(tokens);
+  const body = createTable ? buildCreateTableTemplate(createTable, moduleType) : addPlan ? buildAlterAddTemplate(addPlan.table, addPlan.columns, moduleType) : removePlan ? buildAlterRemoveTemplate(removePlan.table, removePlan.columns, moduleType) : buildDefaultMigrationTemplate(moduleType);
+  fs4.writeFileSync(filePath, body);
+};
+var writeSeedTemplate = (filePath, moduleType) => {
+  const body = moduleType === "esm" ? `export const seed = async (knex) => {
+  // TODO
+};
+` : `exports.seed = async (knex) => {
+  // TODO
+};
+`;
+  fs4.writeFileSync(filePath, body);
+};
+var makeKnexForDirs = (cfg, migrationsDir, seedsDir) => knex2({
+  client: resolveClient2(cfg.base.client),
+  useNullAsDefault: true,
+  connection: buildBaseConnection(cfg),
+  migrations: migrationsDir ? { directory: migrationsDir } : void 0,
+  seeds: seedsDir ? { directory: seedsDir } : void 0
+});
+var ensureBaseDatabase = async (cfg) => {
+  const client = resolveClient2(cfg.base.client);
+  const baseDb = resolveBaseDatabaseName(cfg);
+  if (isSqliteClient2(client)) {
+    if (baseDb === ":memory:") return;
+    fs4.mkdirSync(path4.dirname(baseDb), { recursive: true });
+    if (!fs4.existsSync(baseDb)) {
+      fs4.closeSync(fs4.openSync(baseDb, "a"));
+      console.log(`Tenora: created base database "${baseDb}"`);
+    }
+    return;
+  }
+  const adminDatabase = cfg.base.adminDatabase ?? (isPostgresClient2(client) ? "postgres" : isMysqlClient2(client) ? "mysql" : isMssqlClient2(client) ? "master" : baseDb);
+  const admin = knex2({
+    client,
+    useNullAsDefault: true,
+    connection: buildBaseConnection(cfg, adminDatabase)
+  });
+  try {
+    if (isPostgresClient2(client)) {
+      const result = await admin.raw(`SELECT 1 FROM pg_database WHERE datname = ?`, [baseDb]);
+      if (result?.rows?.length) return;
+      const safeName = escapePgIdent2(baseDb);
+      await admin.raw(`CREATE DATABASE "${safeName}"`);
+    } else if (isMysqlClient2(client)) {
+      const result = await admin.raw(
+        `SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?`,
+        [baseDb]
+      );
+      if (result?.[0]?.length) return;
+      const safeName = escapeMysqlIdent2(baseDb);
+      await admin.raw(`CREATE DATABASE \`${safeName}\``);
+    } else if (isMssqlClient2(client)) {
+      const result = await admin.raw(`SELECT name FROM sys.databases WHERE name = ?`, [baseDb]);
+      if (result?.[0]?.length) return;
+      const safeName = escapeMssqlIdent2(baseDb);
+      await admin.raw(`CREATE DATABASE [${safeName}]`);
+    } else {
+      throw new Error(
+        `Tenora: --create-base is only supported for Postgres, MySQL/MariaDB, SQLite, and SQL Server clients (got "${client}").`
+      );
+    }
+    console.log(`Tenora: created base database "${baseDb}"`);
+  } finally {
+    await admin.destroy();
+  }
+};
+var loadConfig = async (configPath) => {
+  const isDefault = configPath === "tenora.config.js";
+  let fullPath = path4.isAbsolute(configPath) ? configPath : path4.join(process.cwd(), configPath);
+  if (isDefault && !fs4.existsSync(fullPath)) {
+    fullPath = resolveConfigPath();
+  }
+  const module = await loadConfigModuleAsync(fullPath);
+  const cfg = unwrapConfig(module);
+  if (!cfg) {
+    throw new Error(`No config exported from ${fullPath}`);
+  }
+  return cfg;
+};
+var getTenantPassword = (tenant, decryptPassword2, cfg) => {
+  if (tenant.password) return tenant.password;
+  if (tenant.encryptedPassword) {
+    const resolver = decryptPassword2 ?? (cfg ? resolveDecrypt(cfg) : void 0);
+    if (resolver) return resolver(tenant.encryptedPassword);
+  }
+  return void 0;
+};
+var addBaseCommands = () => {
+  program.command("migrate:base").option("-c, --config <path>", "config file", "tenora.config.js").option("--create-base", "create base database if missing").description("Run base database migrations").action(async (opts) => {
+    const cfg = await loadConfig(opts.config);
+    if (opts.createBase) {
+      await ensureBaseDatabase(cfg);
+    }
+    if (ensureRegistryMigrationIfNeeded(cfg)) return;
+    const manager = createTenoraFactory(cfg);
+    try {
+      const base = manager.getBase();
+      const [, files] = await base.migrate.latest();
+      console.log(files.length ? files.join("\n") : "Base up to date");
+    } finally {
+      await manager.destroyAll();
+    }
+  });
+  program.command("migrate").option("-c, --config <path>", "config file", "tenora.config.js").option("--create-base", "create base database if missing").description("Run base database migrations (alias of migrate:base)").action(async (opts) => {
+    const cfg = await loadConfig(opts.config);
+    if (opts.createBase) {
+      await ensureBaseDatabase(cfg);
+    }
+    if (ensureRegistryMigrationIfNeeded(cfg)) return;
+    const manager = createTenoraFactory(cfg);
+    try {
+      const base = manager.getBase();
+      const [, files] = await base.migrate.latest();
+      console.log(files.length ? files.join("\n") : "Base up to date");
+    } finally {
+      await manager.destroyAll();
+    }
+  });
+  program.command("rollback:base").option("-c, --config <path>", "config file", "tenora.config.js").description("Rollback last base migration batch").action(async (opts) => {
+    const cfg = await loadConfig(opts.config);
+    const manager = createTenoraFactory(cfg);
+    try {
+      const base = manager.getBase();
+      const [, files] = await base.migrate.rollback();
+      console.log(files.length ? files.join("\n") : "Nothing to rollback");
+    } finally {
+      await manager.destroyAll();
+    }
+  });
+  program.command("rollback").option("-c, --config <path>", "config file", "tenora.config.js").description("Rollback last base migration batch (alias of rollback:base)").action(async (opts) => {
+    const cfg = await loadConfig(opts.config);
+    const manager = createTenoraFactory(cfg);
+    try {
+      const base = manager.getBase();
+      const [, files] = await base.migrate.rollback();
+      console.log(files.length ? files.join("\n") : "Nothing to rollback");
+    } finally {
+      await manager.destroyAll();
+    }
+  });
+};
+var addTenantCommands = () => {
+  program.command("migrate:tenants").option("-c, --config <path>", "config file", "tenora.config.js").option("--create-base", "create base database if missing").description("Run tenant database migrations for all tenants").action(async (opts) => {
+    const cfg = await loadConfig(opts.config);
+    if (opts.createBase) {
+      await ensureBaseDatabase(cfg);
+    }
+    if (ensureRegistryMigrationIfNeeded(cfg)) return;
+    const manager = createTenoraFactory(cfg);
+    try {
+      const tenants = await listTenantsFromRegistry(manager.getBase(), cfg);
+      for (const tenant of tenants) {
+        const pwd = getTenantPassword(tenant, cfg.decryptPassword, cfg);
+        const knex3 = manager.getTenant(tenant.id, pwd);
+        const [, files] = await knex3.migrate.latest();
+        console.log(`Tenant ${tenant.id}: ${files.length ? files.join(", ") : "up to date"}`);
+        await knex3.destroy();
+      }
+    } finally {
+      await manager.destroyAll();
+    }
+  });
+  program.command("rollback:tenants").option("-c, --config <path>", "config file", "tenora.config.js").description("Rollback last migration batch for all tenants").action(async (opts) => {
+    const cfg = await loadConfig(opts.config);
+    const manager = createTenoraFactory(cfg);
+    try {
+      const tenants = await listTenantsFromRegistry(manager.getBase(), cfg);
+      for (const tenant of tenants) {
+        const pwd = getTenantPassword(tenant, cfg.decryptPassword, cfg);
+        const knex3 = manager.getTenant(tenant.id, pwd);
+        const [, files] = await knex3.migrate.rollback();
+        console.log(`Tenant ${tenant.id}: ${files.length ? files.join(", ") : "Nothing to rollback"}`);
+        await knex3.destroy();
+      }
+    } finally {
+      await manager.destroyAll();
+    }
+  });
+};
+addBaseCommands();
+addTenantCommands();
+var runMakeMigration = async (scope, name, opts) => {
+  const cfg = await loadConfig(opts.config);
+  const dir = scope === "base" ? cfg.base.migrationsDir : cfg.tenant?.migrationsDir;
+  if (!dir) {
+    throw new Error(
+      `Tenora: ${scope === "base" ? "base.migrationsDir" : "tenant.migrationsDir"} is required to create migrations.`
+    );
+  }
+  const moduleType = resolveTemplateModuleType(opts);
+  const client = makeKnexForDirs(cfg, dir);
+  try {
+    const created = await client.migrate.make(name);
+    const file = normalizeCreatedPath(created);
+    writeMigrationTemplate(file, moduleType, name);
+    console.log(file);
+  } finally {
+    await client.destroy();
+  }
+};
+var runMakeSeed = async (scope, name, opts) => {
+  const cfg = await loadConfig(opts.config);
+  const dir = scope === "base" ? cfg.base.seedsDir : cfg.tenant?.seedsDir;
+  if (!dir) {
+    throw new Error(
+      `Tenora: ${scope === "base" ? "base.seedsDir" : "tenant.seedsDir"} is required to create seeds.`
+    );
+  }
+  const moduleType = resolveTemplateModuleType(opts);
+  const client = makeKnexForDirs(cfg, void 0, dir);
+  try {
+    const created = await client.seed.make(name);
+    const file = normalizeCreatedPath(created);
+    writeSeedTemplate(file, moduleType);
+    console.log(file);
+  } finally {
+    await client.destroy();
+  }
+};
+program.command("make:migration <name>").option("-c, --config <path>", "config file", "tenora.config.js").option("--esm", "force ESM template output").option("--cjs", "force CommonJS template output").description("Create a base migration file (alias of make:migration:base)").action((name, opts) => runMakeMigration("base", name, opts));
+program.command("make:migration:base <name>").option("-c, --config <path>", "config file", "tenora.config.js").option("--esm", "force ESM template output").option("--cjs", "force CommonJS template output").description("Create a base migration file").action((name, opts) => runMakeMigration("base", name, opts));
+program.command("make:migration:tenants <name>").option("-c, --config <path>", "config file", "tenora.config.js").option("--esm", "force ESM template output").option("--cjs", "force CommonJS template output").description("Create a tenant migration file").action((name, opts) => runMakeMigration("tenants", name, opts));
+program.command("make:seed <name>").option("-c, --config <path>", "config file", "tenora.config.js").option("--esm", "force ESM template output").option("--cjs", "force CommonJS template output").description("Create a base seed file (alias of make:seed:base)").action((name, opts) => runMakeSeed("base", name, opts));
+program.command("make:seed:base <name>").option("-c, --config <path>", "config file", "tenora.config.js").option("--esm", "force ESM template output").option("--cjs", "force CommonJS template output").description("Create a base seed file").action((name, opts) => runMakeSeed("base", name, opts));
+program.command("make:seed:tenants <name>").option("-c, --config <path>", "config file", "tenora.config.js").option("--esm", "force ESM template output").option("--cjs", "force CommonJS template output").description("Create a tenant seed file").action((name, opts) => runMakeSeed("tenants", name, opts));
+program.command("seed:run:base").option("-c, --config <path>", "config file", "tenora.config.js").option("--create-base", "create base database if missing").description("Run base database seeds").action(async (opts) => {
+  const cfg = await loadConfig(opts.config);
+  if (opts.createBase) {
+    await ensureBaseDatabase(cfg);
+  }
+  const manager = createTenoraFactory(cfg);
+  try {
+    const base = manager.getBase();
+    const result = await base.seed.run();
+    const files = Array.isArray(result) ? result[0] : [];
+    console.log(files.length ? files.join("\n") : "No seeds executed");
+  } finally {
+    await manager.destroyAll();
+  }
+});
+program.command("seed:run").option("-c, --config <path>", "config file", "tenora.config.js").option("--create-base", "create base database if missing").description("Run base database seeds (alias of seed:run:base)").action(async (opts) => {
+  const cfg = await loadConfig(opts.config);
+  if (opts.createBase) {
+    await ensureBaseDatabase(cfg);
+  }
+  const manager = createTenoraFactory(cfg);
+  try {
+    const base = manager.getBase();
+    const result = await base.seed.run();
+    const files = Array.isArray(result) ? result[0] : [];
+    console.log(files.length ? files.join("\n") : "No seeds executed");
+  } finally {
+    await manager.destroyAll();
+  }
+});
+program.command("seed:run:tenants").option("-c, --config <path>", "config file", "tenora.config.js").option("--create-base", "create base database if missing").description("Run tenant database seeds for all tenants").action(async (opts) => {
+  const cfg = await loadConfig(opts.config);
+  if (opts.createBase) {
+    await ensureBaseDatabase(cfg);
+  }
+  if (ensureRegistryMigrationIfNeeded(cfg)) return;
+  const manager = createTenoraFactory(cfg);
+  try {
+    const tenants = await listTenantsFromRegistry(manager.getBase(), cfg);
+    for (const tenant of tenants) {
+      const pwd = getTenantPassword(tenant, cfg.decryptPassword, cfg);
+      const knex3 = manager.getTenant(tenant.id, pwd);
+      const result = await knex3.seed.run();
+      const files = Array.isArray(result) ? result[0] : [];
+      console.log(`Tenant ${tenant.id}: ${files.length ? files.join(", ") : "No seeds executed"}`);
+      await knex3.destroy();
+    }
+  } finally {
+    await manager.destroyAll();
+  }
+});
+program.command("list").description("List available commands").action(() => program.outputHelp());
+program.parse(process.argv);
+//# sourceMappingURL=cli.js.map