@usebetterdev/tenant-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 usebetter
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,45 @@
+# @better-tenant/cli
+
+CLI for multi-tenancy setup: migrate (tenants table + RLS), add-table, generate, check, seed.
+
+## Install
+
+```bash
+pnpm add @better-tenant/cli
+```
+
+## Usage
+
+```bash
+npx better-tenant migrate [--dry-run] [-o <dir>]
+npx better-tenant add-table <tableName> [--dry-run] [-o <dir>]
+npx better-tenant generate [--output <dir>]
+npx better-tenant check
+npx better-tenant seed [--dry-run]
+```
+
+Loads config from `better-tenant.config.ts` (or `.js`) in the project root.
+
+## Programmatic API
+
+Subpath exports for use in scripts or custom tooling:
+
+```ts
+import { generateMigrationSql } from "@better-tenant/cli/migrate";
+import { runCheck } from "@better-tenant/cli/check";
+import { runSeed } from "@better-tenant/cli/seed";
+```
+
+## Future: @usebetterdev/cli
+
+Planned consolidation: a single `@usebetterdev/cli` package will support all usebetter products. Tenant commands will be invoked as:
+
+```bash
+npx @usebetterdev/cli tenant migrate
+npx @usebetterdev/cli tenant add-table <tableName>
+npx @usebetterdev/cli tenant generate
+npx @usebetterdev/cli tenant check
+npx @usebetterdev/cli tenant seed
+```
+
+This package (`@better-tenant/cli` / `@usebetterdev/tenant-cli`) will be folded into that unified CLI. For now, use the commands above.

package/dist/check.d.ts

@@ -0,0 +1,14 @@
+import { BetterTenantCliConfig } from './config.js';
+
+interface CheckResult {
+    check: string;
+    passed: boolean;
+    message?: string;
+}
+interface CheckOutput {
+    passed: boolean;
+    results: CheckResult[];
+}
+declare function runCheck(databaseUrl: string, config: BetterTenantCliConfig): Promise<CheckOutput>;
+
+export { type CheckOutput, type CheckResult, runCheck };

package/dist/check.js

@@ -0,0 +1,7 @@
+import {
+  runCheck
+} from "./chunk-VJ2YHTHF.js";
+export {
+  runCheck
+};
+//# sourceMappingURL=check.js.map

package/dist/check.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-64RQTBD5.js

@@ -0,0 +1,98 @@
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var CONFIG_FILE = "better-tenant.config.json";
+var NO_CONFIG_MESSAGE_PREFIX = "better-tenant: No config found.";
+function defaultTenantTables(suggested) {
+  if (suggested.length > 0) return suggested;
+  return ["projects"];
+}
+function buildNoConfigMessage(cwd, suggestedTables) {
+  const tables = defaultTenantTables(suggestedTables ?? []);
+  const configJson = JSON.stringify(
+    { tenantTables: tables },
+    null,
+    2
+  );
+  const pkgSnippet = tables.length === 1 ? `"betterTenant": { "tenantTables": ["${tables[0]}"] }` : `"betterTenant": { "tenantTables": ${JSON.stringify(tables)} }`;
+  return [
+    NO_CONFIG_MESSAGE_PREFIX,
+    "",
+    "Step 1 \u2014 Create a config file in your project root:",
+    "",
+    `  touch ${CONFIG_FILE}`,
+    "",
+    "Step 2 \u2014 Paste this into better-tenant.config.json (adjust tenantTables to your table names):",
+    "",
+    configJson,
+    "",
+    'Alternatively, add a "betterTenant" key to your package.json:',
+    "",
+    `  ${pkgSnippet}`,
+    "",
+    `(Looked in: ${cwd})`
+  ].join("\n");
+}
+function loadConfig(cwd = process.cwd()) {
+  const configPath = join(cwd, CONFIG_FILE);
+  if (existsSync(configPath)) {
+    return loadJsonConfig(configPath);
+  }
+  const pkgPath = join(cwd, "package.json");
+  const config = loadPackageJsonConfig(pkgPath);
+  if (config) return config;
+  throw new Error(buildNoConfigMessage(cwd, void 0));
+}
+function loadJsonConfig(path) {
+  const content = readFileSync(path, "utf-8");
+  let raw;
+  try {
+    raw = JSON.parse(content);
+  } catch (e) {
+    throw new Error(
+      `better-tenant: Invalid JSON in ${path}: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  return normalizeConfig(raw);
+}
+function loadPackageJsonConfig(pkgPath) {
+  if (!existsSync(pkgPath)) return null;
+  const content = readFileSync(pkgPath, "utf-8");
+  let pkg;
+  try {
+    pkg = JSON.parse(content);
+  } catch {
+    return null;
+  }
+  if (!pkg.betterTenant || typeof pkg.betterTenant !== "object") return null;
+  return normalizeConfig(pkg.betterTenant);
+}
+function isConfigObject(x) {
+  return x != null && typeof x === "object" && !Array.isArray(x);
+}
+function isStringArray(x) {
+  return Array.isArray(x) && x.every((t) => typeof t === "string");
+}
+function normalizeConfig(raw) {
+  if (!isConfigObject(raw)) {
+    throw new Error("better-tenant: config must be an object");
+  }
+  const tenantTables = raw.tenantTables;
+  if (!isStringArray(tenantTables)) {
+    throw new Error(
+      "better-tenant: config must have tenantTables (string[])"
+    );
+  }
+  return {
+    tenantTables,
+    schemaDir: typeof raw.schemaDir === "string" ? raw.schemaDir : void 0,
+    migrationsDir: typeof raw.migrationsDir === "string" ? raw.migrationsDir : void 0
+  };
+}
+
+export {
+  NO_CONFIG_MESSAGE_PREFIX,
+  buildNoConfigMessage,
+  loadConfig
+};
+//# sourceMappingURL=chunk-64RQTBD5.js.map

package/dist/chunk-64RQTBD5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\n/**\n * CLI config shape. Matches core's BetterTenantConfig subset needed for migrate/generate/check.\n */\nexport interface BetterTenantCliConfig {\n  tenantTables: string[];\n  schemaDir?: string;\n  migrationsDir?: string;\n}\n\nconst CONFIG_FILE = \"better-tenant.config.json\";\n\n/** Prefix of the \"no config\" error message. Use to detect and enrich the error in commands that have a DB URL. */\nexport const NO_CONFIG_MESSAGE_PREFIX = \"better-tenant: No config found.\";\n\nfunction defaultTenantTables(suggested: string[]): string[] {\n  if (suggested.length > 0) return suggested;\n  return [\"projects\"];\n}\n\n/**\n * Build the \"no config\" error message. When suggestedTables is provided (e.g. from getSuggestedTables),\n * the snippet uses those table names instead of the default.\n */\nexport function buildNoConfigMessage(\n  cwd: string,\n  suggestedTables?: string[],\n): string {\n  const tables = defaultTenantTables(suggestedTables ?? []);\n  const configJson = JSON.stringify(\n    { tenantTables: tables },\n    null,\n    2,\n  );\n  const pkgSnippet =\n    tables.length === 1\n      ? `\"betterTenant\": { \"tenantTables\": [\"${tables[0]}\"] }`\n      : `\"betterTenant\": { \"tenantTables\": ${JSON.stringify(tables)} }`;\n\n  return [\n    NO_CONFIG_MESSAGE_PREFIX,\n    \"\",\n    \"Step 1 — Create a config file in your project root:\",\n    \"\",\n    `  touch ${CONFIG_FILE}`,\n    \"\",\n    \"Step 2 — Paste this into better-tenant.config.json (adjust tenantTables to your table names):\",\n    \"\",\n    configJson,\n    \"\",\n    \"Alternatively, add a \\\"betterTenant\\\" key to your package.json:\",\n    \"\",\n    `  ${pkgSnippet}`,\n    \"\",\n    `(Looked in: ${cwd})`,\n  ].join(\"\\n\");\n}\n\n/**\n * Discover and load config from cwd.\n * 1. Look for better-tenant.config.json in cwd\n * 2. Fall back to package.json \"betterTenant\" key\n */\nexport function loadConfig(cwd: string = process.cwd()): BetterTenantCliConfig {\n  const configPath = join(cwd, CONFIG_FILE);\n  if (existsSync(configPath)) {\n    return loadJsonConfig(configPath);\n  }\n\n  const pkgPath = join(cwd, \"package.json\");\n  const config = loadPackageJsonConfig(pkgPath);\n  if (config) return config;\n\n  throw new Error(buildNoConfigMessage(cwd, undefined));\n}\n\nfunction loadJsonConfig(path: string): BetterTenantCliConfig {\n  const content = readFileSync(path, \"utf-8\");\n  let raw: unknown;\n  try {\n    raw = JSON.parse(content);\n  } catch (e) {\n    throw new Error(\n      `better-tenant: Invalid JSON in ${path}: ${e instanceof Error ? e.message : String(e)}`,\n    );\n  }\n  return normalizeConfig(raw);\n}\n\nfunction loadPackageJsonConfig(pkgPath: string): BetterTenantCliConfig | null {\n  if (!existsSync(pkgPath)) return null;\n\n  const content = readFileSync(pkgPath, \"utf-8\");\n  let pkg: { betterTenant?: unknown };\n  try {\n    pkg = JSON.parse(content);\n  } catch {\n    return null;\n  }\n  if (!pkg.betterTenant || typeof pkg.betterTenant !== \"object\") return null;\n\n  return normalizeConfig(pkg.betterTenant);\n}\n\nfunction isConfigObject(x: unknown): x is Record<string, unknown> {\n  return x != null && typeof x === \"object\" && !Array.isArray(x);\n}\n\nfunction isStringArray(x: unknown): x is string[] {\n  return Array.isArray(x) && x.every((t) => typeof t === \"string\");\n}\n\nfunction normalizeConfig(raw: unknown): BetterTenantCliConfig {\n  if (!isConfigObject(raw)) {\n    throw new Error(\"better-tenant: config must be an object\");\n  }\n\n  const tenantTables = raw.tenantTables;\n  if (!isStringArray(tenantTables)) {\n    throw new Error(\n      \"better-tenant: config must have tenantTables (string[])\",\n    );\n  }\n\n  return {\n    tenantTables,\n    schemaDir: typeof raw.schemaDir === \"string\" ? raw.schemaDir : undefined,\n    migrationsDir:\n      typeof raw.migrationsDir === \"string\" ? raw.migrationsDir : undefined,\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAAY;AAWrB,IAAM,cAAc;AAGb,IAAM,2BAA2B;AAExC,SAAS,oBAAoB,WAA+B;AAC1D,MAAI,UAAU,SAAS,EAAG,QAAO;AACjC,SAAO,CAAC,UAAU;AACpB;AAMO,SAAS,qBACd,KACA,iBACQ;AACR,QAAM,SAAS,oBAAoB,mBAAmB,CAAC,CAAC;AACxD,QAAM,aAAa,KAAK;AAAA,IACtB,EAAE,cAAc,OAAO;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AACA,QAAM,aACJ,OAAO,WAAW,IACd,uCAAuC,OAAO,CAAC,CAAC,SAChD,qCAAqC,KAAK,UAAU,MAAM,CAAC;AAEjE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,IACf;AAAA,IACA,eAAe,GAAG;AAAA,EACpB,EAAE,KAAK,IAAI;AACb;AAOO,SAAS,WAAW,MAAc,QAAQ,IAAI,GAA0B;AAC7E,QAAM,aAAa,KAAK,KAAK,WAAW;AACxC,MAAI,WAAW,UAAU,GAAG;AAC1B,WAAO,eAAe,UAAU;AAAA,EAClC;AAEA,QAAM,UAAU,KAAK,KAAK,cAAc;AACxC,QAAM,SAAS,sBAAsB,OAAO;AAC5C,MAAI,OAAQ,QAAO;AAEnB,QAAM,IAAI,MAAM,qBAAqB,KAAK,MAAS,CAAC;AACtD;AAEA,SAAS,eAAe,MAAqC;AAC3D,QAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI;AAAA,MACR,kCAAkC,IAAI,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO,gBAAgB,GAAG;AAC5B;AAEA,SAAS,sBAAsB,SAA+C;AAC5E,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AAEjC,QAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,IAAI,gBAAgB,OAAO,IAAI,iBAAiB,SAAU,QAAO;AAEtE,SAAO,gBAAgB,IAAI,YAAY;AACzC;AAEA,SAAS,eAAe,GAA0C;AAChE,SAAO,KAAK,QAAQ,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC;AAC/D;AAEA,SAAS,cAAc,GAA2B;AAChD,SAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AACjE;AAEA,SAAS,gBAAgB,KAAqC;AAC5D,MAAI,CAAC,eAAe,GAAG,GAAG;AACxB,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,eAAe,IAAI;AACzB,MAAI,CAAC,cAAc,YAAY,GAAG;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;AAAA,IAC/D,eACE,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB;AAAA,EAChE;AACF;","names":[]}

package/dist/chunk-LXS6CXJ3.js

@@ -0,0 +1,40 @@
+// src/seed.ts
+import { Pool } from "pg";
+function slugFromName(name) {
+  return name.toLowerCase().trim().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "");
+}
+async function runSeed(databaseUrl, options) {
+  const slug = options.slug ?? slugFromName(options.name);
+  if (!slug) {
+    throw new Error("seed: slug is required (provide --slug or use a name that yields a non-empty slug)");
+  }
+  const pool = new Pool({ connectionString: databaseUrl });
+  const client = await pool.connect();
+  try {
+    await client.query("BEGIN");
+    await client.query("SET LOCAL app.bypass_rls = 'true'");
+    const r = await client.query(
+      `INSERT INTO tenants (name, slug) VALUES ($1, $2)
+       RETURNING id::text AS id, name, slug`,
+      [options.name, slug]
+    );
+    await client.query("COMMIT");
+    const row = r.rows[0];
+    if (!row) {
+      throw new Error("seed: insert did not return row");
+    }
+    return { id: row.id, name: row.name, slug: row.slug };
+  } catch (err) {
+    await client.query("ROLLBACK");
+    throw err;
+  } finally {
+    client.release();
+    await pool.end();
+  }
+}
+
+export {
+  slugFromName,
+  runSeed
+};
+//# sourceMappingURL=chunk-LXS6CXJ3.js.map

package/dist/chunk-LXS6CXJ3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/seed.ts"],"sourcesContent":["import { Pool } from \"pg\";\n\nexport interface SeedOptions {\n  name: string;\n  slug?: string;\n}\n\n/**\n * Derive a URL-safe slug from name (e.g. \"Test Org\" -> \"test-org\").\n */\nexport function slugFromName(name: string): string {\n  return name\n    .toLowerCase()\n    .trim()\n    .replace(/\\s+/g, \"-\")\n    .replace(/[^a-z0-9-]/g, \"\");\n}\n\nexport interface SeedResult {\n  id: string;\n  name: string;\n  slug: string;\n}\n\n/**\n * Insert one tenant using bypass_rls so RLS allows the insert (no superuser).\n * Uses SET LOCAL app.bypass_rls = 'true' in a transaction.\n */\nexport async function runSeed(\n  databaseUrl: string,\n  options: SeedOptions,\n): Promise<SeedResult> {\n  const slug = options.slug ?? slugFromName(options.name);\n  if (!slug) {\n    throw new Error(\"seed: slug is required (provide --slug or use a name that yields a non-empty slug)\");\n  }\n\n  const pool = new Pool({ connectionString: databaseUrl });\n  const client = await pool.connect();\n\n  try {\n    await client.query(\"BEGIN\");\n    await client.query(\"SET LOCAL app.bypass_rls = 'true'\");\n\n    const r = await client.query(\n      `INSERT INTO tenants (name, slug) VALUES ($1, $2)\n       RETURNING id::text AS id, name, slug`,\n      [options.name, slug],\n    );\n\n    await client.query(\"COMMIT\");\n\n    const row = r.rows[0] as { id: string; name: string; slug: string } | undefined;\n    if (!row) {\n      throw new Error(\"seed: insert did not return row\");\n    }\n    return { id: row.id, name: row.name, slug: row.slug };\n  } catch (err) {\n    await client.query(\"ROLLBACK\");\n    throw err;\n  } finally {\n    client.release();\n    await pool.end();\n  }\n}\n"],"mappings":";AAAA,SAAS,YAAY;AAUd,SAAS,aAAa,MAAsB;AACjD,SAAO,KACJ,YAAY,EACZ,KAAK,EACL,QAAQ,QAAQ,GAAG,EACnB,QAAQ,eAAe,EAAE;AAC9B;AAYA,eAAsB,QACpB,aACA,SACqB;AACrB,QAAM,OAAO,QAAQ,QAAQ,aAAa,QAAQ,IAAI;AACtD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,oFAAoF;AAAA,EACtG;AAEA,QAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;AACvD,QAAM,SAAS,MAAM,KAAK,QAAQ;AAElC,MAAI;AACF,UAAM,OAAO,MAAM,OAAO;AAC1B,UAAM,OAAO,MAAM,mCAAmC;AAEtD,UAAM,IAAI,MAAM,OAAO;AAAA,MACrB;AAAA;AAAA,MAEA,CAAC,QAAQ,MAAM,IAAI;AAAA,IACrB;AAEA,UAAM,OAAO,MAAM,QAAQ;AAE3B,UAAM,MAAM,EAAE,KAAK,CAAC;AACpB,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,WAAO,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,MAAM,IAAI,KAAK;AAAA,EACtD,SAAS,KAAK;AACZ,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM;AAAA,EACR,UAAE;AACA,WAAO,QAAQ;AACf,UAAM,KAAK,IAAI;AAAA,EACjB;AACF;","names":[]}

package/dist/chunk-VJ2YHTHF.js

@@ -0,0 +1,133 @@
+// src/check.ts
+import { Pool } from "pg";
+var TENANTS_COLUMNS = ["id", "name", "slug", "created_at"];
+async function checkTenantsTable(pool) {
+  const results = [];
+  const r = await pool.query(
+    `
+    SELECT column_name FROM information_schema.columns
+    WHERE table_schema = 'public' AND table_name = 'tenants'
+    ORDER BY ordinal_position
+    `
+  );
+  const cols = r.rows.map((row) => row.column_name);
+  if (cols.length === 0) {
+    results.push({ check: "tenants table exists", passed: false, message: "tenants table not found" });
+    return results;
+  }
+  results.push({ check: "tenants table exists", passed: true });
+  for (const col of TENANTS_COLUMNS) {
+    const ok = cols.includes(col);
+    results.push({
+      check: `tenants.${col} column`,
+      passed: ok,
+      message: ok ? void 0 : `tenants table missing column: ${col}`
+    });
+  }
+  return results;
+}
+async function checkTenantTable(pool, tableName) {
+  const results = [];
+  const prefix = `table ${tableName}`;
+  const tableExists = await pool.query(
+    `SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = $1`,
+    [tableName]
+  );
+  if (tableExists.rows.length === 0) {
+    results.push({ check: `${prefix} exists`, passed: false, message: `table ${tableName} not found` });
+    return results;
+  }
+  results.push({ check: `${prefix} exists`, passed: true });
+  const cols = await pool.query(
+    `SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1`,
+    [tableName]
+  );
+  const colNames = cols.rows.map((r) => r.column_name);
+  const hasTenantId = colNames.includes("tenant_id");
+  results.push({
+    check: `${prefix}.tenant_id`,
+    passed: hasTenantId,
+    message: hasTenantId ? void 0 : `column tenant_id not found`
+  });
+  const rls = await pool.query(
+    `SELECT relrowsecurity, relforcerowsecurity FROM pg_class c
+     JOIN pg_namespace n ON c.relnamespace = n.oid
+     WHERE n.nspname = 'public' AND c.relname = $1`,
+    [tableName]
+  );
+  const rlsRow = rls.rows[0];
+  const rlsOn = rlsRow?.relrowsecurity === true;
+  const forceRls = rlsRow?.relforcerowsecurity === true;
+  results.push({
+    check: `${prefix} RLS enabled`,
+    passed: rlsOn,
+    message: rlsOn ? void 0 : "ROW LEVEL SECURITY not enabled"
+  });
+  results.push({
+    check: `${prefix} FORCE ROW LEVEL SECURITY`,
+    passed: forceRls,
+    message: forceRls ? void 0 : "FORCE ROW LEVEL SECURITY not enabled"
+  });
+  const policies = await pool.query(
+    `SELECT qual, with_check FROM pg_policies WHERE schemaname = 'public' AND tablename = $1`,
+    [tableName]
+  );
+  const hasPolicy = policies.rows.length > 0;
+  const policyRow = policies.rows[0];
+  const hasUsing = hasPolicy && policyRow?.qual != null && policyRow.qual.length > 0;
+  const hasWithCheck = hasPolicy && policyRow?.with_check != null && policyRow.with_check.length > 0;
+  const hasBypass = hasPolicy && ((policyRow?.qual?.includes("bypass_rls") ?? false) || (policyRow?.with_check?.includes("bypass_rls") ?? false));
+  results.push({
+    check: `${prefix} policy exists`,
+    passed: hasPolicy,
+    message: hasPolicy ? void 0 : "no RLS policy found"
+  });
+  results.push({
+    check: `${prefix} policy USING clause`,
+    passed: hasUsing,
+    message: hasUsing ? void 0 : "policy missing USING expression"
+  });
+  results.push({
+    check: `${prefix} policy WITH CHECK clause`,
+    passed: hasWithCheck,
+    message: hasWithCheck ? void 0 : "policy missing WITH CHECK expression"
+  });
+  results.push({
+    check: `${prefix} bypass_rls in policy`,
+    passed: hasBypass,
+    message: hasBypass ? void 0 : "policy should allow bypass_rls for runAsSystem"
+  });
+  const trigger = await pool.query(
+    `SELECT 1 FROM pg_trigger t
+     JOIN pg_class c ON t.tgrelid = c.oid
+     JOIN pg_namespace n ON c.relnamespace = n.oid
+     WHERE n.nspname = 'public' AND c.relname = $1 AND t.tgname = 'set_tenant_id_trigger'`,
+    [tableName]
+  );
+  const hasTrigger = trigger.rows.length > 0;
+  results.push({
+    check: `${prefix} set_tenant_id trigger`,
+    passed: hasTrigger,
+    message: hasTrigger ? void 0 : "trigger set_tenant_id_trigger not found"
+  });
+  return results;
+}
+async function runCheck(databaseUrl, config) {
+  const pool = new Pool({ connectionString: databaseUrl });
+  const results = [];
+  try {
+    results.push(...await checkTenantsTable(pool));
+    for (const table of config.tenantTables) {
+      results.push(...await checkTenantTable(pool, table));
+    }
+  } finally {
+    await pool.end();
+  }
+  const passed = results.every((r) => r.passed);
+  return { passed, results };
+}
+
+export {
+  runCheck
+};
+//# sourceMappingURL=chunk-VJ2YHTHF.js.map

package/dist/chunk-VJ2YHTHF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/check.ts"],"sourcesContent":["import { Pool } from \"pg\";\nimport type { BetterTenantCliConfig } from \"./config.js\";\n\nexport interface CheckResult {\n  check: string;\n  passed: boolean;\n  message?: string;\n}\n\nconst TENANTS_COLUMNS = [\"id\", \"name\", \"slug\", \"created_at\"];\n\nasync function checkTenantsTable(pool: Pool): Promise<CheckResult[]> {\n  const results: CheckResult[] = [];\n  const r = await pool.query(\n    `\n    SELECT column_name FROM information_schema.columns\n    WHERE table_schema = 'public' AND table_name = 'tenants'\n    ORDER BY ordinal_position\n    `,\n  );\n  const cols = (r.rows as { column_name: string }[]).map((row) => row.column_name);\n\n  if (cols.length === 0) {\n    results.push({ check: \"tenants table exists\", passed: false, message: \"tenants table not found\" });\n    return results;\n  }\n  results.push({ check: \"tenants table exists\", passed: true });\n\n  for (const col of TENANTS_COLUMNS) {\n    const ok = cols.includes(col);\n    results.push({\n      check: `tenants.${col} column`,\n      passed: ok,\n      message: ok ? undefined : `tenants table missing column: ${col}`,\n    });\n  }\n  return results;\n}\n\nasync function checkTenantTable(\n  pool: Pool,\n  tableName: string,\n): Promise<CheckResult[]> {\n  const results: CheckResult[] = [];\n  const prefix = `table ${tableName}`;\n\n  // Table exists?\n  const tableExists = await pool.query(\n    `SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = $1`,\n    [tableName],\n  );\n  if (tableExists.rows.length === 0) {\n    results.push({ check: `${prefix} exists`, passed: false, message: `table ${tableName} not found` });\n    return results;\n  }\n  results.push({ check: `${prefix} exists`, passed: true });\n\n  // tenant_id column\n  const cols = await pool.query(\n    `SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1`,\n    [tableName],\n  );\n  const colNames = (cols.rows as { column_name: string }[]).map((r) => r.column_name);\n  const hasTenantId = colNames.includes(\"tenant_id\");\n  results.push({\n    check: `${prefix}.tenant_id`,\n    passed: hasTenantId,\n    message: hasTenantId ? undefined : `column tenant_id not found`,\n  });\n\n  // RLS enabled\n  const rls = await pool.query(\n    `SELECT relrowsecurity, relforcerowsecurity FROM pg_class c\n     JOIN pg_namespace n ON c.relnamespace = n.oid\n     WHERE n.nspname = 'public' AND c.relname = $1`,\n    [tableName],\n  );\n  const rlsRow = rls.rows[0] as { relrowsecurity: boolean; relforcerowsecurity: boolean } | undefined;\n  const rlsOn = rlsRow?.relrowsecurity === true;\n  const forceRls = rlsRow?.relforcerowsecurity === true;\n  results.push({\n    check: `${prefix} RLS enabled`,\n    passed: rlsOn,\n    message: rlsOn ? undefined : \"ROW LEVEL SECURITY not enabled\",\n  });\n  results.push({\n    check: `${prefix} FORCE ROW LEVEL SECURITY`,\n    passed: forceRls,\n    message: forceRls ? undefined : \"FORCE ROW LEVEL SECURITY not enabled\",\n  });\n\n  // Policy with USING and WITH CHECK\n  const policies = await pool.query(\n    `SELECT qual, with_check FROM pg_policies WHERE schemaname = 'public' AND tablename = $1`,\n    [tableName],\n  );\n  const hasPolicy = policies.rows.length > 0;\n  const policyRow = policies.rows[0] as { qual: string | null; with_check: string | null } | undefined;\n  const hasUsing = hasPolicy && policyRow?.qual != null && policyRow.qual.length > 0;\n  const hasWithCheck = hasPolicy && policyRow?.with_check != null && policyRow.with_check.length > 0;\n  const hasBypass = hasPolicy && (\n    (policyRow?.qual?.includes(\"bypass_rls\") ?? false) ||\n    (policyRow?.with_check?.includes(\"bypass_rls\") ?? false)\n  );\n\n  results.push({\n    check: `${prefix} policy exists`,\n    passed: hasPolicy,\n    message: hasPolicy ? undefined : \"no RLS policy found\",\n  });\n  results.push({\n    check: `${prefix} policy USING clause`,\n    passed: hasUsing,\n    message: hasUsing ? undefined : \"policy missing USING expression\",\n  });\n  results.push({\n    check: `${prefix} policy WITH CHECK clause`,\n    passed: hasWithCheck,\n    message: hasWithCheck ? undefined : \"policy missing WITH CHECK expression\",\n  });\n  results.push({\n    check: `${prefix} bypass_rls in policy`,\n    passed: hasBypass,\n    message: hasBypass ? undefined : \"policy should allow bypass_rls for runAsSystem\",\n  });\n\n  // Trigger\n  const trigger = await pool.query(\n    `SELECT 1 FROM pg_trigger t\n     JOIN pg_class c ON t.tgrelid = c.oid\n     JOIN pg_namespace n ON c.relnamespace = n.oid\n     WHERE n.nspname = 'public' AND c.relname = $1 AND t.tgname = 'set_tenant_id_trigger'`,\n    [tableName],\n  );\n  const hasTrigger = trigger.rows.length > 0;\n  results.push({\n    check: `${prefix} set_tenant_id trigger`,\n    passed: hasTrigger,\n    message: hasTrigger ? undefined : \"trigger set_tenant_id_trigger not found\",\n  });\n\n  return results;\n}\n\nexport interface CheckOutput {\n  passed: boolean;\n  results: CheckResult[];\n}\n\nexport async function runCheck(\n  databaseUrl: string,\n  config: BetterTenantCliConfig,\n): Promise<CheckOutput> {\n  const pool = new Pool({ connectionString: databaseUrl });\n  const results: CheckResult[] = [];\n\n  try {\n    results.push(...(await checkTenantsTable(pool)));\n    for (const table of config.tenantTables) {\n      results.push(...(await checkTenantTable(pool, table)));\n    }\n  } finally {\n    await pool.end();\n  }\n\n  const passed = results.every((r) => r.passed);\n  return { passed, results };\n}\n"],"mappings":";AAAA,SAAS,YAAY;AASrB,IAAM,kBAAkB,CAAC,MAAM,QAAQ,QAAQ,YAAY;AAE3D,eAAe,kBAAkB,MAAoC;AACnE,QAAM,UAAyB,CAAC;AAChC,QAAM,IAAI,MAAM,KAAK;AAAA,IACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF;AACA,QAAM,OAAQ,EAAE,KAAmC,IAAI,CAAC,QAAQ,IAAI,WAAW;AAE/E,MAAI,KAAK,WAAW,GAAG;AACrB,YAAQ,KAAK,EAAE,OAAO,wBAAwB,QAAQ,OAAO,SAAS,0BAA0B,CAAC;AACjG,WAAO;AAAA,EACT;AACA,UAAQ,KAAK,EAAE,OAAO,wBAAwB,QAAQ,KAAK,CAAC;AAE5D,aAAW,OAAO,iBAAiB;AACjC,UAAM,KAAK,KAAK,SAAS,GAAG;AAC5B,YAAQ,KAAK;AAAA,MACX,OAAO,WAAW,GAAG;AAAA,MACrB,QAAQ;AAAA,MACR,SAAS,KAAK,SAAY,iCAAiC,GAAG;AAAA,IAChE,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,iBACb,MACA,WACwB;AACxB,QAAM,UAAyB,CAAC;AAChC,QAAM,SAAS,SAAS,SAAS;AAGjC,QAAM,cAAc,MAAM,KAAK;AAAA,IAC7B;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AACA,MAAI,YAAY,KAAK,WAAW,GAAG;AACjC,YAAQ,KAAK,EAAE,OAAO,GAAG,MAAM,WAAW,QAAQ,OAAO,SAAS,SAAS,SAAS,aAAa,CAAC;AAClG,WAAO;AAAA,EACT;AACA,UAAQ,KAAK,EAAE,OAAO,GAAG,MAAM,WAAW,QAAQ,KAAK,CAAC;AAGxD,QAAM,OAAO,MAAM,KAAK;AAAA,IACtB;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AACA,QAAM,WAAY,KAAK,KAAmC,IAAI,CAAC,MAAM,EAAE,WAAW;AAClF,QAAM,cAAc,SAAS,SAAS,WAAW;AACjD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,cAAc,SAAY;AAAA,EACrC,CAAC;AAGD,QAAM,MAAM,MAAM,KAAK;AAAA,IACrB;AAAA;AAAA;AAAA,IAGA,CAAC,SAAS;AAAA,EACZ;AACA,QAAM,SAAS,IAAI,KAAK,CAAC;AACzB,QAAM,QAAQ,QAAQ,mBAAmB;AACzC,QAAM,WAAW,QAAQ,wBAAwB;AACjD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,QAAQ,SAAY;AAAA,EAC/B,CAAC;AACD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,WAAW,SAAY;AAAA,EAClC,CAAC;AAGD,QAAM,WAAW,MAAM,KAAK;AAAA,IAC1B;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AACA,QAAM,YAAY,SAAS,KAAK,SAAS;AACzC,QAAM,YAAY,SAAS,KAAK,CAAC;AACjC,QAAM,WAAW,aAAa,WAAW,QAAQ,QAAQ,UAAU,KAAK,SAAS;AACjF,QAAM,eAAe,aAAa,WAAW,cAAc,QAAQ,UAAU,WAAW,SAAS;AACjG,QAAM,YAAY,eACf,WAAW,MAAM,SAAS,YAAY,KAAK,WAC3C,WAAW,YAAY,SAAS,YAAY,KAAK;AAGpD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,YAAY,SAAY;AAAA,EACnC,CAAC;AACD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,WAAW,SAAY;AAAA,EAClC,CAAC;AACD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,eAAe,SAAY;AAAA,EACtC,CAAC;AACD,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,YAAY,SAAY;AAAA,EACnC,CAAC;AAGD,QAAM,UAAU,MAAM,KAAK;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA,IAIA,CAAC,SAAS;AAAA,EACZ;AACA,QAAM,aAAa,QAAQ,KAAK,SAAS;AACzC,UAAQ,KAAK;AAAA,IACX,OAAO,GAAG,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,aAAa,SAAY;AAAA,EACpC,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,SACpB,aACA,QACsB;AACtB,QAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;AACvD,QAAM,UAAyB,CAAC;AAEhC,MAAI;AACF,YAAQ,KAAK,GAAI,MAAM,kBAAkB,IAAI,CAAE;AAC/C,eAAW,SAAS,OAAO,cAAc;AACvC,cAAQ,KAAK,GAAI,MAAM,iBAAiB,MAAM,KAAK,CAAE;AAAA,IACvD;AAAA,EACF,UAAE;AACA,UAAM,KAAK,IAAI;AAAA,EACjB;AAEA,QAAM,SAAS,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM;AAC5C,SAAO,EAAE,QAAQ,QAAQ;AAC3B;","names":[]}

package/dist/chunk-VZCKMMJZ.js

@@ -0,0 +1,45 @@
+// src/migrate.ts
+import { readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+var __dirname = dirname(fileURLToPath(import.meta.url));
+function loadSql(name) {
+  return readFileSync(join(__dirname, "sql", name), "utf-8");
+}
+function quoteIdent(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function tableRlsSql(tableName) {
+  const tableQuoted = quoteIdent(tableName);
+  const policyName = `rls_tenant_${tableName.replace(/[^a-zA-Z0-9_]/g, "_")}`;
+  return loadSql("table_rls.sql").replace(/\{\{TABLE_QUOTED\}\}/g, tableQuoted).replace(/\{\{POLICY_NAME\}\}/g, policyName).replace(/\{\{TABLE\}\}/g, tableName);
+}
+function generateMigrationSql(config) {
+  const parts = [
+    "-- Better Tenant migration",
+    "-- Apply with: psql $DATABASE_URL -f this_file.sql",
+    "",
+    loadSql("tenants.sql"),
+    loadSql("set_tenant_id_function.sql")
+  ];
+  for (const table of config.tenantTables) {
+    parts.push(tableRlsSql(table));
+  }
+  return parts.join("\n");
+}
+function generateAddTableSql(tableName) {
+  const parts = [
+    `-- Better Tenant: add-table ${tableName}`,
+    "-- Assumes tenants table exists. Run migrate first if needed.",
+    "",
+    loadSql("set_tenant_id_function.sql"),
+    tableRlsSql(tableName)
+  ];
+  return parts.join("\n");
+}
+
+export {
+  generateMigrationSql,
+  generateAddTableSql
+};
+//# sourceMappingURL=chunk-VZCKMMJZ.js.map

package/dist/chunk-VZCKMMJZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { join, dirname } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { BetterTenantCliConfig } from \"./config.js\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n\nfunction loadSql(name: string): string {\n  return readFileSync(join(__dirname, \"sql\", name), \"utf-8\");\n}\n\nfunction quoteIdent(name: string): string {\n  return `\"${name.replace(/\"/g, '\"\"')}\"`;\n}\n\nfunction tableRlsSql(tableName: string): string {\n  const tableQuoted = quoteIdent(tableName);\n  const policyName = `rls_tenant_${tableName.replace(/[^a-zA-Z0-9_]/g, \"_\")}`;\n  return loadSql(\"table_rls.sql\")\n    .replace(/\\{\\{TABLE_QUOTED\\}\\}/g, tableQuoted)\n    .replace(/\\{\\{POLICY_NAME\\}\\}/g, policyName)\n    .replace(/\\{\\{TABLE\\}\\}/g, tableName);\n}\n\nexport function generateMigrationSql(config: BetterTenantCliConfig): string {\n  const parts: string[] = [\n    \"-- Better Tenant migration\",\n    \"-- Apply with: psql $DATABASE_URL -f this_file.sql\",\n    \"\",\n    loadSql(\"tenants.sql\"),\n    loadSql(\"set_tenant_id_function.sql\"),\n  ];\n  for (const table of config.tenantTables) {\n    parts.push(tableRlsSql(table));\n  }\n  return parts.join(\"\\n\");\n}\n\n/**\n * Generate SQL to add tenant_id, RLS, policy, and trigger for a single table.\n * Idempotent: uses IF NOT EXISTS for column, DROP IF EXISTS for policy/trigger.\n * Assumes tenants table and set_tenant_id() function exist (run migrate first).\n */\nexport function generateAddTableSql(tableName: string): string {\n  const parts: string[] = [\n    `-- Better Tenant: add-table ${tableName}`,\n    \"-- Assumes tenants table exists. Run migrate first if needed.\",\n    \"\",\n    loadSql(\"set_tenant_id_function.sql\"),\n    tableRlsSql(tableName),\n  ];\n  return parts.join(\"\\n\");\n}\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,MAAM,eAAe;AAC9B,SAAS,qBAAqB;AAG9B,IAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAExD,SAAS,QAAQ,MAAsB;AACrC,SAAO,aAAa,KAAK,WAAW,OAAO,IAAI,GAAG,OAAO;AAC3D;AAEA,SAAS,WAAW,MAAsB;AACxC,SAAO,IAAI,KAAK,QAAQ,MAAM,IAAI,CAAC;AACrC;AAEA,SAAS,YAAY,WAA2B;AAC9C,QAAM,cAAc,WAAW,SAAS;AACxC,QAAM,aAAa,cAAc,UAAU,QAAQ,kBAAkB,GAAG,CAAC;AACzE,SAAO,QAAQ,eAAe,EAC3B,QAAQ,yBAAyB,WAAW,EAC5C,QAAQ,wBAAwB,UAAU,EAC1C,QAAQ,kBAAkB,SAAS;AACxC;AAEO,SAAS,qBAAqB,QAAuC;AAC1E,QAAM,QAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,aAAa;AAAA,IACrB,QAAQ,4BAA4B;AAAA,EACtC;AACA,aAAW,SAAS,OAAO,cAAc;AACvC,UAAM,KAAK,YAAY,KAAK,CAAC;AAAA,EAC/B;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAOO,SAAS,oBAAoB,WAA2B;AAC7D,QAAM,QAAkB;AAAA,IACtB,+BAA+B,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA,QAAQ,4BAA4B;AAAA,IACpC,YAAY,SAAS;AAAA,EACvB;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/cli.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+
+declare const program: Command;
+
+export { program };

package/dist/cli.js

@@ -0,0 +1,322 @@
+#!/usr/bin/env node
+import {
+  runCheck
+} from "./chunk-VJ2YHTHF.js";
+import {
+  NO_CONFIG_MESSAGE_PREFIX,
+  buildNoConfigMessage,
+  loadConfig
+} from "./chunk-64RQTBD5.js";
+import {
+  generateAddTableSql,
+  generateMigrationSql
+} from "./chunk-VZCKMMJZ.js";
+import {
+  runSeed
+} from "./chunk-LXS6CXJ3.js";
+
+// src/cli.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { Command } from "commander";
+import { sendCliTelemetry } from "@usebetterdev/tenant-core";
+
+// src/suggested-tables.ts
+import { Pool } from "pg";
+var TABLE_PRIORITY = [
+  "users",
+  "projects",
+  "tasks",
+  "organizations",
+  "members",
+  "workspaces",
+  "teams",
+  "issues",
+  "posts",
+  "products",
+  "orders",
+  "accounts",
+  "invitations"
+];
+var SUGGESTED_LIMIT = 5;
+function sortTablesByPriority(tables) {
+  const order = new Map(TABLE_PRIORITY.map((t, i) => [t, i]));
+  return [...tables].sort((a, b) => {
+    const ia = order.get(a) ?? TABLE_PRIORITY.length;
+    const ib = order.get(b) ?? TABLE_PRIORITY.length;
+    if (ia !== ib) return ia - ib;
+    return a.localeCompare(b);
+  });
+}
+async function getSuggestedTables(databaseUrl) {
+  const pool = new Pool({ connectionString: databaseUrl });
+  try {
+    const r = await pool.query(
+      `SELECT table_name FROM information_schema.tables
+       WHERE table_schema = 'public' AND table_type = 'BASE TABLE'
+       AND table_name != 'tenants'
+       ORDER BY table_name`
+    );
+    const names = (r.rows ?? []).map((row) => row.table_name);
+    const sorted = sortTablesByPriority(names);
+    return sorted.slice(0, SUGGESTED_LIMIT);
+  } catch {
+    return [];
+  } finally {
+    await pool.end();
+  }
+}
+
+// src/generate.ts
+function toTableVar(tableName) {
+  const base = tableName.replace(/[^a-zA-Z0-9]/g, "_");
+  return `${base}Table`;
+}
+function generateDrizzleSchema(config) {
+  const lines = [
+    "// Better Tenant: Drizzle schema snippet",
+    "// Add tenantId column and relations to each tenant-scoped table.",
+    "// The .default(sql`...`) tells Drizzle that tenant_id is auto-populated",
+    "// by the set_tenant_id trigger, so you can omit it from .insert().values().",
+    "// Merge into your schema. Import tenantsTable from your tenants definition.",
+    "",
+    "import { sql, relations } from 'drizzle-orm';",
+    "import { uuid } from 'drizzle-orm/pg-core';",
+    "import { tenantsTable } from './tenants'; // adjust import path",
+    ""
+  ];
+  for (const tableName of config.tenantTables) {
+    const tableVar = toTableVar(tableName);
+    const relationsName = `${tableName.replace(/[^a-zA-Z0-9]/g, "_")}Relations`;
+    lines.push(`// --- Table: ${tableName} ---`);
+    lines.push(`// Add to ${tableVar} pgTable definition:`);
+    lines.push(
+      "//   tenantId: uuid(\"tenant_id\").notNull().default(sql`(current_setting('app.current_tenant', true))::uuid`),"
+    );
+    lines.push("");
+    lines.push(`// Relations for ${tableName}:`);
+    lines.push(
+      `export const ${relationsName} = relations(${tableVar}, ({ one }) => ({`
+    );
+    lines.push(`  tenant: one(tenantsTable),`);
+    lines.push(`}));`);
+    lines.push("");
+  }
+  return lines.join("\n").trimEnd();
+}
+
+// src/cli.ts
+function formatDate() {
+  const d = /* @__PURE__ */ new Date();
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}${m}${day}`;
+}
+var program = new Command();
+program.name("better-tenant").description("Multi-tenancy for Postgres").version("0.1.0");
+program.command("migrate").description("Generate SQL migration for tenants table and RLS").option("--dry-run", "Print SQL to stdout").option("-o, --output <dir>", "Write migration file to directory").action(async (opts) => {
+  try {
+    const cwd = process.cwd();
+    const config = loadConfig(cwd);
+    const sql = generateMigrationSql(config);
+    if (opts.dryRun) {
+      process.stdout.write(sql);
+      sendCliTelemetry("cli_migrate", "no_changes", config);
+      return;
+    }
+    if (opts.output) {
+      mkdirSync(opts.output, { recursive: true });
+      const filename = `${formatDate()}_better_tenant.sql`;
+      const path = join(opts.output, filename);
+      const existed = existsSync(path);
+      writeFileSync(path, sql, "utf-8");
+      console.log(`Wrote ${path}`);
+      sendCliTelemetry(
+        "cli_migrate",
+        existed ? "overwritten" : "migrated",
+        config
+      );
+      return;
+    }
+    process.stdout.write(sql);
+    sendCliTelemetry("cli_migrate", "no_changes", config);
+  } catch (err) {
+    try {
+      const config = loadConfig(process.cwd());
+      const sent = sendCliTelemetry("cli_migrate", "aborted", config, {
+        wait: true
+      });
+      await (sent ?? Promise.resolve());
+    } catch {
+    }
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+});
+program.command("add-table <tableName>").description(
+  "Generate SQL to add tenant_id, RLS, policy, and trigger for one table"
+).option("--dry-run", "Print SQL to stdout").option("-o, --output <dir>", "Write migration file to directory").action(
+  async (tableName, opts) => {
+    try {
+      if (!tableName || typeof tableName !== "string") {
+        console.error("add-table requires a table name");
+        process.exit(1);
+      }
+      const config = loadConfig(process.cwd());
+      const sql = generateAddTableSql(tableName);
+      if (opts.dryRun) {
+        process.stdout.write(sql);
+        sendCliTelemetry("cli_migrate", "no_changes", config);
+        return;
+      }
+      if (opts.output) {
+        mkdirSync(opts.output, { recursive: true });
+        const safeName = tableName.replace(/[^a-zA-Z0-9_]/g, "_");
+        const filename = `${formatDate()}_add_table_${safeName}.sql`;
+        const path = join(opts.output, filename);
+        const existed = existsSync(path);
+        writeFileSync(path, sql, "utf-8");
+        console.log(`Wrote ${path}`);
+        sendCliTelemetry(
+          "cli_migrate",
+          existed ? "overwritten" : "migrated",
+          config
+        );
+        return;
+      }
+      process.stdout.write(sql);
+      sendCliTelemetry("cli_migrate", "no_changes", config);
+    } catch (err) {
+      try {
+        const config = loadConfig(process.cwd());
+        const sent = sendCliTelemetry("cli_migrate", "aborted", config, {
+          wait: true
+        });
+        await (sent ?? Promise.resolve());
+      } catch {
+      }
+      console.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+);
+program.command("generate").description("Generate Drizzle schema snippet (tenant_id + relations)").option("--dry-run", "Print schema snippet to stdout").option("-o, --output <path>", "Write to file (e.g. schema/better-tenant.ts)").action(async (opts) => {
+  try {
+    const cwd = process.cwd();
+    const config = loadConfig(cwd);
+    const schema = generateDrizzleSchema(config);
+    if (opts.dryRun) {
+      process.stdout.write(schema);
+      sendCliTelemetry("cli_generate", "no_changes", config);
+      return;
+    }
+    if (opts.output) {
+      const dir = dirname(opts.output);
+      mkdirSync(dir, { recursive: true });
+      const existed = existsSync(opts.output);
+      writeFileSync(opts.output, schema, "utf-8");
+      console.log(`Wrote ${opts.output}`);
+      sendCliTelemetry(
+        "cli_generate",
+        existed ? "overwritten" : "generated",
+        config
+      );
+      return;
+    }
+    process.stdout.write(schema);
+    sendCliTelemetry("cli_generate", "no_changes", config);
+  } catch (err) {
+    try {
+      const config = loadConfig(process.cwd());
+      const sent = sendCliTelemetry("cli_generate", "aborted", config, {
+        wait: true
+      });
+      await (sent ?? Promise.resolve());
+    } catch {
+    }
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+});
+program.command("check").description("Verify tenants table, RLS, policies, and triggers in database").option("--database-url <url>", "Database URL (default: DATABASE_URL env)").action(async (opts) => {
+  const url = opts.databaseUrl ?? process.env.DATABASE_URL;
+  if (!url || typeof url !== "string") {
+    console.error(
+      "check requires --database-url or DATABASE_URL environment variable"
+    );
+    process.exit(1);
+  }
+  const cwd = process.cwd();
+  try {
+    const config = loadConfig(cwd);
+    const { passed, results } = await runCheck(url, config);
+    for (const r of results) {
+      const icon = r.passed ? "\u2713" : "\u2717";
+      const msg = r.message ? ` ${r.message}` : "";
+      console.log(`${icon} ${r.check}${msg}`);
+    }
+    sendCliTelemetry("cli_check", passed ? "passed" : "failed", config);
+    if (!passed) {
+      process.exit(1);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.startsWith(NO_CONFIG_MESSAGE_PREFIX) && url) {
+      const suggestedTables = await getSuggestedTables(url);
+      const enrichedMessage = buildNoConfigMessage(cwd, suggestedTables);
+      console.error(enrichedMessage);
+      process.exit(1);
+    }
+    try {
+      const config = loadConfig(process.cwd());
+      const sent = sendCliTelemetry("cli_check", "aborted", config, {
+        wait: true
+      });
+      await (sent ?? Promise.resolve());
+    } catch {
+    }
+    console.error(message);
+    process.exit(1);
+  }
+});
+program.command("seed").description("Insert one tenant (uses bypass_rls; no superuser)").requiredOption("--name <name>", "Tenant display name").option("--slug <slug>", "URL-safe slug (default: derived from name)").option("--database-url <url>", "Database URL (default: DATABASE_URL env)").action(
+  async (opts) => {
+    try {
+      const url = opts.databaseUrl ?? process.env.DATABASE_URL;
+      if (!url || typeof url !== "string") {
+        console.error(
+          "seed requires --database-url or DATABASE_URL environment variable"
+        );
+        process.exit(1);
+      }
+      const config = loadConfig(process.cwd());
+      const result = await runSeed(url, {
+        name: opts.name,
+        slug: opts.slug
+      });
+      sendCliTelemetry("cli_seed", "created", config);
+      console.log(`Created tenant: ${result.name} (${result.slug})`);
+      console.log(result.id);
+    } catch (err) {
+      try {
+        const config = loadConfig(process.cwd());
+        const sent = sendCliTelemetry("cli_seed", "aborted", config, {
+          wait: true
+        });
+        await (sent ?? Promise.resolve());
+      } catch {
+      }
+      console.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+);
+var isMain = typeof process !== "undefined" && process.argv[1] !== void 0 && (process.argv[1].endsWith("cli.js") || process.argv[1].endsWith("cli.ts"));
+if (isMain) {
+  program.parse();
+}
+export {
+  program
+};
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts","../src/suggested-tables.ts","../src/generate.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { Command } from \"commander\";\nimport { sendCliTelemetry } from \"@usebetterdev/tenant-core\";\nimport {\n  loadConfig,\n  buildNoConfigMessage,\n  NO_CONFIG_MESSAGE_PREFIX,\n} from \"./config.js\";\nimport { getSuggestedTables } from \"./suggested-tables.js\";\nimport { runCheck } from \"./check.js\";\nimport { runSeed } from \"./seed.js\";\nimport { generateDrizzleSchema } from \"./generate.js\";\nimport { generateAddTableSql, generateMigrationSql } from \"./migrate.js\";\n\nfunction formatDate(): string {\n  const d = new Date();\n  const y = d.getFullYear();\n  const m = String(d.getMonth() + 1).padStart(2, \"0\");\n  const day = String(d.getDate()).padStart(2, \"0\");\n  return `${y}${m}${day}`;\n}\n\nconst program = new Command();\n\nprogram\n  .name(\"better-tenant\")\n  .description(\"Multi-tenancy for Postgres\")\n  .version(\"0.1.0\");\n\nprogram\n  .command(\"migrate\")\n  .description(\"Generate SQL migration for tenants table and RLS\")\n  .option(\"--dry-run\", \"Print SQL to stdout\")\n  .option(\"-o, --output <dir>\", \"Write migration file to directory\")\n  .action(async (opts: { dryRun?: boolean; output?: string }) => {\n    try {\n      const cwd = process.cwd();\n      const config = loadConfig(cwd);\n      const sql = generateMigrationSql(config);\n\n      if (opts.dryRun) {\n        process.stdout.write(sql);\n        sendCliTelemetry(\"cli_migrate\", \"no_changes\", config);\n        return;\n      }\n\n      if (opts.output) {\n        mkdirSync(opts.output, { recursive: true });\n        const filename = `${formatDate()}_better_tenant.sql`;\n        const path = join(opts.output, filename);\n        const existed = existsSync(path);\n        writeFileSync(path, sql, \"utf-8\");\n        console.log(`Wrote ${path}`);\n        sendCliTelemetry(\n          \"cli_migrate\",\n          existed ? \"overwritten\" : \"migrated\",\n          config,\n        );\n        return;\n      }\n\n      process.stdout.write(sql);\n      sendCliTelemetry(\"cli_migrate\", \"no_changes\", config);\n    } catch (err) {\n      try {\n        const config = loadConfig(process.cwd());\n        const sent = sendCliTelemetry(\"cli_migrate\", \"aborted\", config, {\n          wait: true,\n        });\n        await (sent ?? Promise.resolve());\n      } catch {\n        /* config load failed, skip telemetry */\n      }\n      console.error(err instanceof Error ? err.message : String(err));\n      process.exit(1);\n    }\n  });\n\nprogram\n  .command(\"add-table <tableName>\")\n  .description(\n    \"Generate SQL to add tenant_id, RLS, policy, and trigger for one table\",\n  )\n  .option(\"--dry-run\", \"Print SQL to stdout\")\n  .option(\"-o, --output <dir>\", \"Write migration file to directory\")\n  .action(\n    async (tableName: string, opts: { dryRun?: boolean; output?: string }) => {\n      try {\n        if (!tableName || typeof tableName !== \"string\") {\n          console.error(\"add-table requires a table name\");\n          process.exit(1);\n        }\n        const config = loadConfig(process.cwd());\n        const sql = generateAddTableSql(tableName);\n\n        if (opts.dryRun) {\n          process.stdout.write(sql);\n          sendCliTelemetry(\"cli_migrate\", \"no_changes\", config);\n          return;\n        }\n\n        if (opts.output) {\n          mkdirSync(opts.output, { recursive: true });\n          const safeName = tableName.replace(/[^a-zA-Z0-9_]/g, \"_\");\n          const filename = `${formatDate()}_add_table_${safeName}.sql`;\n          const path = join(opts.output, filename);\n          const existed = existsSync(path);\n          writeFileSync(path, sql, \"utf-8\");\n          console.log(`Wrote ${path}`);\n          sendCliTelemetry(\n            \"cli_migrate\",\n            existed ? \"overwritten\" : \"migrated\",\n            config,\n          );\n          return;\n        }\n\n        process.stdout.write(sql);\n        sendCliTelemetry(\"cli_migrate\", \"no_changes\", config);\n      } catch (err) {\n        try {\n          const config = loadConfig(process.cwd());\n          const sent = sendCliTelemetry(\"cli_migrate\", \"aborted\", config, {\n            wait: true,\n          });\n          await (sent ?? Promise.resolve());\n        } catch {\n          /* skip telemetry */\n        }\n        console.error(err instanceof Error ? err.message : String(err));\n        process.exit(1);\n      }\n    },\n  );\n\nprogram\n  .command(\"generate\")\n  .description(\"Generate Drizzle schema snippet (tenant_id + relations)\")\n  .option(\"--dry-run\", \"Print schema snippet to stdout\")\n  .option(\"-o, --output <path>\", \"Write to file (e.g. schema/better-tenant.ts)\")\n  .action(async (opts: { dryRun?: boolean; output?: string }) => {\n    try {\n      const cwd = process.cwd();\n      const config = loadConfig(cwd);\n      const schema = generateDrizzleSchema(config);\n\n      if (opts.dryRun) {\n        process.stdout.write(schema);\n        sendCliTelemetry(\"cli_generate\", \"no_changes\", config);\n        return;\n      }\n\n      if (opts.output) {\n        const dir = dirname(opts.output);\n        mkdirSync(dir, { recursive: true });\n        const existed = existsSync(opts.output);\n        writeFileSync(opts.output, schema, \"utf-8\");\n        console.log(`Wrote ${opts.output}`);\n        sendCliTelemetry(\n          \"cli_generate\",\n          existed ? \"overwritten\" : \"generated\",\n          config,\n        );\n        return;\n      }\n\n      process.stdout.write(schema);\n      sendCliTelemetry(\"cli_generate\", \"no_changes\", config);\n    } catch (err) {\n      try {\n        const config = loadConfig(process.cwd());\n        const sent = sendCliTelemetry(\"cli_generate\", \"aborted\", config, {\n          wait: true,\n        });\n        await (sent ?? Promise.resolve());\n      } catch {\n        /* skip telemetry */\n      }\n      console.error(err instanceof Error ? err.message : String(err));\n      process.exit(1);\n    }\n  });\n\nprogram\n  .command(\"check\")\n  .description(\"Verify tenants table, RLS, policies, and triggers in database\")\n  .option(\"--database-url <url>\", \"Database URL (default: DATABASE_URL env)\")\n  .action(async (opts: { databaseUrl?: string }) => {\n    const url = opts.databaseUrl ?? process.env.DATABASE_URL;\n    if (!url || typeof url !== \"string\") {\n      console.error(\n        \"check requires --database-url or DATABASE_URL environment variable\",\n      );\n      process.exit(1);\n    }\n    const cwd = process.cwd();\n    try {\n      const config = loadConfig(cwd);\n      const { passed, results } = await runCheck(url, config);\n\n      for (const r of results) {\n        const icon = r.passed ? \"✓\" : \"✗\";\n        const msg = r.message ? ` ${r.message}` : \"\";\n        console.log(`${icon} ${r.check}${msg}`);\n      }\n      sendCliTelemetry(\"cli_check\", passed ? \"passed\" : \"failed\", config);\n      if (!passed) {\n        process.exit(1);\n      }\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      if (\n        message.startsWith(NO_CONFIG_MESSAGE_PREFIX) &&\n        url\n      ) {\n        const suggestedTables = await getSuggestedTables(url);\n        const enrichedMessage = buildNoConfigMessage(cwd, suggestedTables);\n        console.error(enrichedMessage);\n        process.exit(1);\n      }\n      try {\n        const config = loadConfig(process.cwd());\n        const sent = sendCliTelemetry(\"cli_check\", \"aborted\", config, {\n          wait: true,\n        });\n        await (sent ?? Promise.resolve());\n      } catch {\n        /* skip telemetry */\n      }\n      console.error(message);\n      process.exit(1);\n    }\n  });\n\nprogram\n  .command(\"seed\")\n  .description(\"Insert one tenant (uses bypass_rls; no superuser)\")\n  .requiredOption(\"--name <name>\", \"Tenant display name\")\n  .option(\"--slug <slug>\", \"URL-safe slug (default: derived from name)\")\n  .option(\"--database-url <url>\", \"Database URL (default: DATABASE_URL env)\")\n  .action(\n    async (opts: { name: string; slug?: string; databaseUrl?: string }) => {\n      try {\n        const url = opts.databaseUrl ?? process.env.DATABASE_URL;\n        if (!url || typeof url !== \"string\") {\n          console.error(\n            \"seed requires --database-url or DATABASE_URL environment variable\",\n          );\n          process.exit(1);\n        }\n        const config = loadConfig(process.cwd());\n        const result = await runSeed(url, {\n          name: opts.name,\n          slug: opts.slug,\n        });\n        sendCliTelemetry(\"cli_seed\", \"created\", config);\n        console.log(`Created tenant: ${result.name} (${result.slug})`);\n        console.log(result.id);\n      } catch (err) {\n        try {\n          const config = loadConfig(process.cwd());\n          const sent = sendCliTelemetry(\"cli_seed\", \"aborted\", config, {\n            wait: true,\n          });\n          await (sent ?? Promise.resolve());\n        } catch {\n          /* skip telemetry */\n        }\n        console.error(err instanceof Error ? err.message : String(err));\n        process.exit(1);\n      }\n    },\n  );\n\nconst isMain =\n  typeof process !== \"undefined\" &&\n  process.argv[1] !== undefined &&\n  (process.argv[1].endsWith(\"cli.js\") || process.argv[1].endsWith(\"cli.ts\"));\nif (isMain) {\n  program.parse();\n}\n\nexport { program };\n","import { Pool } from \"pg\";\n\n/** Preferred table names (first match wins); used to order suggestions from the DB. */\nexport const TABLE_PRIORITY = [\n  \"users\",\n  \"projects\",\n  \"tasks\",\n  \"organizations\",\n  \"members\",\n  \"workspaces\",\n  \"teams\",\n  \"issues\",\n  \"posts\",\n  \"products\",\n  \"orders\",\n  \"accounts\",\n  \"invitations\",\n];\n\nexport const SUGGESTED_LIMIT = 5;\n\n/**\n * Sort table names: priority list first (by TABLE_PRIORITY order), then the rest alphabetically.\n */\nexport function sortTablesByPriority(tables: string[]): string[] {\n  const order = new Map(TABLE_PRIORITY.map((t, i) => [t, i]));\n  return [...tables].sort((a, b) => {\n    const ia = order.get(a) ?? TABLE_PRIORITY.length;\n    const ib = order.get(b) ?? TABLE_PRIORITY.length;\n    if (ia !== ib) return ia - ib;\n    return a.localeCompare(b);\n  });\n}\n\n/**\n * Connect to the database and return up to SUGGESTED_LIMIT table names from public schema,\n * prioritized by common names (users, projects, tasks, etc.). Excludes \"tenants\".\n * Returns [] on any connection/query error.\n */\nexport async function getSuggestedTables(\n  databaseUrl: string,\n): Promise<string[]> {\n  const pool = new Pool({ connectionString: databaseUrl });\n  try {\n    const r = await pool.query<{ table_name: string }>(\n      `SELECT table_name FROM information_schema.tables\n       WHERE table_schema = 'public' AND table_type = 'BASE TABLE'\n       AND table_name != 'tenants'\n       ORDER BY table_name`,\n    );\n    const names = (r.rows ?? []).map((row) => row.table_name);\n    const sorted = sortTablesByPriority(names);\n    return sorted.slice(0, SUGGESTED_LIMIT);\n  } catch {\n    return [];\n  } finally {\n    await pool.end();\n  }\n}\n","import type { BetterTenantCliConfig } from \"./config.js\";\n\n/**\n * Convert table name (e.g. \"projects\") to a typical Drizzle table variable name (e.g. \"projectsTable\").\n */\nfunction toTableVar(tableName: string): string {\n  const base = tableName.replace(/[^a-zA-Z0-9]/g, \"_\");\n  return `${base}Table`;\n}\n\n/**\n * Generate a Drizzle schema snippet for tenant-scoped tables.\n * Outputs tenant_id column definition and relations for each table.\n * User merges this into their schema file.\n */\nexport function generateDrizzleSchema(config: BetterTenantCliConfig): string {\n  const lines: string[] = [\n    \"// Better Tenant: Drizzle schema snippet\",\n    \"// Add tenantId column and relations to each tenant-scoped table.\",\n    \"// The .default(sql`...`) tells Drizzle that tenant_id is auto-populated\",\n    \"// by the set_tenant_id trigger, so you can omit it from .insert().values().\",\n    \"// Merge into your schema. Import tenantsTable from your tenants definition.\",\n    \"\",\n    \"import { sql, relations } from 'drizzle-orm';\",\n    \"import { uuid } from 'drizzle-orm/pg-core';\",\n    \"import { tenantsTable } from './tenants'; // adjust import path\",\n    \"\",\n  ];\n\n  for (const tableName of config.tenantTables) {\n    const tableVar = toTableVar(tableName);\n    const relationsName = `${tableName.replace(/[^a-zA-Z0-9]/g, \"_\")}Relations`;\n    lines.push(`// --- Table: ${tableName} ---`);\n    lines.push(`// Add to ${tableVar} pgTable definition:`);\n    lines.push(\n      \"//   tenantId: uuid(\\\"tenant_id\\\").notNull().default(sql`(current_setting('app.current_tenant', true))::uuid`),\",\n    );\n    lines.push(\"\");\n    lines.push(`// Relations for ${tableName}:`);\n    lines.push(\n      `export const ${relationsName} = relations(${tableVar}, ({ one }) => ({`,\n    );\n    lines.push(`  tenant: one(tenantsTable),`);\n    lines.push(`}));`);\n    lines.push(\"\");\n  }\n\n  return lines.join(\"\\n\").trimEnd();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AACA,SAAS,YAAY,WAAW,qBAAqB;AACrD,SAAS,SAAS,YAAY;AAC9B,SAAS,eAAe;AACxB,SAAS,wBAAwB;;;ACJjC,SAAS,YAAY;AAGd,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,kBAAkB;AAKxB,SAAS,qBAAqB,QAA4B;AAC/D,QAAM,QAAQ,IAAI,IAAI,eAAe,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAChC,UAAM,KAAK,MAAM,IAAI,CAAC,KAAK,eAAe;AAC1C,UAAM,KAAK,MAAM,IAAI,CAAC,KAAK,eAAe;AAC1C,QAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,WAAO,EAAE,cAAc,CAAC;AAAA,EAC1B,CAAC;AACH;AAOA,eAAsB,mBACpB,aACmB;AACnB,QAAM,OAAO,IAAI,KAAK,EAAE,kBAAkB,YAAY,CAAC;AACvD,MAAI;AACF,UAAM,IAAI,MAAM,KAAK;AAAA,MACnB;AAAA;AAAA;AAAA;AAAA,IAIF;AACA,UAAM,SAAS,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU;AACxD,UAAM,SAAS,qBAAqB,KAAK;AACzC,WAAO,OAAO,MAAM,GAAG,eAAe;AAAA,EACxC,QAAQ;AACN,WAAO,CAAC;AAAA,EACV,UAAE;AACA,UAAM,KAAK,IAAI;AAAA,EACjB;AACF;;;ACrDA,SAAS,WAAW,WAA2B;AAC7C,QAAM,OAAO,UAAU,QAAQ,iBAAiB,GAAG;AACnD,SAAO,GAAG,IAAI;AAChB;AAOO,SAAS,sBAAsB,QAAuC;AAC3E,QAAM,QAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,aAAW,aAAa,OAAO,cAAc;AAC3C,UAAM,WAAW,WAAW,SAAS;AACrC,UAAM,gBAAgB,GAAG,UAAU,QAAQ,iBAAiB,GAAG,CAAC;AAChE,UAAM,KAAK,iBAAiB,SAAS,MAAM;AAC3C,UAAM,KAAK,aAAa,QAAQ,sBAAsB;AACtD,UAAM;AAAA,MACJ;AAAA,IACF;AACA,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,oBAAoB,SAAS,GAAG;AAC3C,UAAM;AAAA,MACJ,gBAAgB,aAAa,gBAAgB,QAAQ;AAAA,IACvD;AACA,UAAM,KAAK,8BAA8B;AACzC,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,SAAO,MAAM,KAAK,IAAI,EAAE,QAAQ;AAClC;;;AFhCA,SAAS,aAAqB;AAC5B,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,IAAI,EAAE,YAAY;AACxB,QAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AAClD,QAAM,MAAM,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,GAAG;AAC/C,SAAO,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG;AACvB;AAEA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,eAAe,EACpB,YAAY,4BAA4B,EACxC,QAAQ,OAAO;AAElB,QACG,QAAQ,SAAS,EACjB,YAAY,kDAAkD,EAC9D,OAAO,aAAa,qBAAqB,EACzC,OAAO,sBAAsB,mCAAmC,EAChE,OAAO,OAAO,SAAgD;AAC7D,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAS,WAAW,GAAG;AAC7B,UAAM,MAAM,qBAAqB,MAAM;AAEvC,QAAI,KAAK,QAAQ;AACf,cAAQ,OAAO,MAAM,GAAG;AACxB,uBAAiB,eAAe,cAAc,MAAM;AACpD;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ;AACf,gBAAU,KAAK,QAAQ,EAAE,WAAW,KAAK,CAAC;AAC1C,YAAM,WAAW,GAAG,WAAW,CAAC;AAChC,YAAM,OAAO,KAAK,KAAK,QAAQ,QAAQ;AACvC,YAAM,UAAU,WAAW,IAAI;AAC/B,oBAAc,MAAM,KAAK,OAAO;AAChC,cAAQ,IAAI,SAAS,IAAI,EAAE;AAC3B;AAAA,QACE;AAAA,QACA,UAAU,gBAAgB;AAAA,QAC1B;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ,OAAO,MAAM,GAAG;AACxB,qBAAiB,eAAe,cAAc,MAAM;AAAA,EACtD,SAAS,KAAK;AACZ,QAAI;AACF,YAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,YAAM,OAAO,iBAAiB,eAAe,WAAW,QAAQ;AAAA,QAC9D,MAAM;AAAA,MACR,CAAC;AACD,aAAO,QAAQ,QAAQ,QAAQ;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,YAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,QACG,QAAQ,uBAAuB,EAC/B;AAAA,EACC;AACF,EACC,OAAO,aAAa,qBAAqB,EACzC,OAAO,sBAAsB,mCAAmC,EAChE;AAAA,EACC,OAAO,WAAmB,SAAgD;AACxE,QAAI;AACF,UAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,gBAAQ,MAAM,iCAAiC;AAC/C,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,YAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,YAAM,MAAM,oBAAoB,SAAS;AAEzC,UAAI,KAAK,QAAQ;AACf,gBAAQ,OAAO,MAAM,GAAG;AACxB,yBAAiB,eAAe,cAAc,MAAM;AACpD;AAAA,MACF;AAEA,UAAI,KAAK,QAAQ;AACf,kBAAU,KAAK,QAAQ,EAAE,WAAW,KAAK,CAAC;AAC1C,cAAM,WAAW,UAAU,QAAQ,kBAAkB,GAAG;AACxD,cAAM,WAAW,GAAG,WAAW,CAAC,cAAc,QAAQ;AACtD,cAAM,OAAO,KAAK,KAAK,QAAQ,QAAQ;AACvC,cAAM,UAAU,WAAW,IAAI;AAC/B,sBAAc,MAAM,KAAK,OAAO;AAChC,gBAAQ,IAAI,SAAS,IAAI,EAAE;AAC3B;AAAA,UACE;AAAA,UACA,UAAU,gBAAgB;AAAA,UAC1B;AAAA,QACF;AACA;AAAA,MACF;AAEA,cAAQ,OAAO,MAAM,GAAG;AACxB,uBAAiB,eAAe,cAAc,MAAM;AAAA,IACtD,SAAS,KAAK;AACZ,UAAI;AACF,cAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,cAAM,OAAO,iBAAiB,eAAe,WAAW,QAAQ;AAAA,UAC9D,MAAM;AAAA,QACR,CAAC;AACD,eAAO,QAAQ,QAAQ,QAAQ;AAAA,MACjC,QAAQ;AAAA,MAER;AACA,cAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEF,QACG,QAAQ,UAAU,EAClB,YAAY,yDAAyD,EACrE,OAAO,aAAa,gCAAgC,EACpD,OAAO,uBAAuB,8CAA8C,EAC5E,OAAO,OAAO,SAAgD;AAC7D,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAS,WAAW,GAAG;AAC7B,UAAM,SAAS,sBAAsB,MAAM;AAE3C,QAAI,KAAK,QAAQ;AACf,cAAQ,OAAO,MAAM,MAAM;AAC3B,uBAAiB,gBAAgB,cAAc,MAAM;AACrD;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ;AACf,YAAM,MAAM,QAAQ,KAAK,MAAM;AAC/B,gBAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,YAAM,UAAU,WAAW,KAAK,MAAM;AACtC,oBAAc,KAAK,QAAQ,QAAQ,OAAO;AAC1C,cAAQ,IAAI,SAAS,KAAK,MAAM,EAAE;AAClC;AAAA,QACE;AAAA,QACA,UAAU,gBAAgB;AAAA,QAC1B;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ,OAAO,MAAM,MAAM;AAC3B,qBAAiB,gBAAgB,cAAc,MAAM;AAAA,EACvD,SAAS,KAAK;AACZ,QAAI;AACF,YAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,YAAM,OAAO,iBAAiB,gBAAgB,WAAW,QAAQ;AAAA,QAC/D,MAAM;AAAA,MACR,CAAC;AACD,aAAO,QAAQ,QAAQ,QAAQ;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,YAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,+DAA+D,EAC3E,OAAO,wBAAwB,0CAA0C,EACzE,OAAO,OAAO,SAAmC;AAChD,QAAM,MAAM,KAAK,eAAe,QAAQ,IAAI;AAC5C,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI;AACF,UAAM,SAAS,WAAW,GAAG;AAC7B,UAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,SAAS,KAAK,MAAM;AAEtD,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,EAAE,SAAS,WAAM;AAC9B,YAAM,MAAM,EAAE,UAAU,IAAI,EAAE,OAAO,KAAK;AAC1C,cAAQ,IAAI,GAAG,IAAI,IAAI,EAAE,KAAK,GAAG,GAAG,EAAE;AAAA,IACxC;AACA,qBAAiB,aAAa,SAAS,WAAW,UAAU,MAAM;AAClE,QAAI,CAAC,QAAQ;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QACE,QAAQ,WAAW,wBAAwB,KAC3C,KACA;AACA,YAAM,kBAAkB,MAAM,mBAAmB,GAAG;AACpD,YAAM,kBAAkB,qBAAqB,KAAK,eAAe;AACjE,cAAQ,MAAM,eAAe;AAC7B,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI;AACF,YAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,YAAM,OAAO,iBAAiB,aAAa,WAAW,QAAQ;AAAA,QAC5D,MAAM;AAAA,MACR,CAAC;AACD,aAAO,QAAQ,QAAQ,QAAQ;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,YAAQ,MAAM,OAAO;AACrB,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,QACG,QAAQ,MAAM,EACd,YAAY,mDAAmD,EAC/D,eAAe,iBAAiB,qBAAqB,EACrD,OAAO,iBAAiB,4CAA4C,EACpE,OAAO,wBAAwB,0CAA0C,EACzE;AAAA,EACC,OAAO,SAAgE;AACrE,QAAI;AACF,YAAM,MAAM,KAAK,eAAe,QAAQ,IAAI;AAC5C,UAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,gBAAQ;AAAA,UACN;AAAA,QACF;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,YAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,YAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,QAChC,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,MACb,CAAC;AACD,uBAAiB,YAAY,WAAW,MAAM;AAC9C,cAAQ,IAAI,mBAAmB,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAC7D,cAAQ,IAAI,OAAO,EAAE;AAAA,IACvB,SAAS,KAAK;AACZ,UAAI;AACF,cAAM,SAAS,WAAW,QAAQ,IAAI,CAAC;AACvC,cAAM,OAAO,iBAAiB,YAAY,WAAW,QAAQ;AAAA,UAC3D,MAAM;AAAA,QACR,CAAC;AACD,eAAO,QAAQ,QAAQ,QAAQ;AAAA,MACjC,QAAQ;AAAA,MAER;AACA,cAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEF,IAAM,SACJ,OAAO,YAAY,eACnB,QAAQ,KAAK,CAAC,MAAM,WACnB,QAAQ,KAAK,CAAC,EAAE,SAAS,QAAQ,KAAK,QAAQ,KAAK,CAAC,EAAE,SAAS,QAAQ;AAC1E,IAAI,QAAQ;AACV,UAAQ,MAAM;AAChB;","names":[]}

package/dist/config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * CLI config shape. Matches core's BetterTenantConfig subset needed for migrate/generate/check.
+ */
+interface BetterTenantCliConfig {
+    tenantTables: string[];
+    schemaDir?: string;
+    migrationsDir?: string;
+}
+/** Prefix of the "no config" error message. Use to detect and enrich the error in commands that have a DB URL. */
+declare const NO_CONFIG_MESSAGE_PREFIX = "better-tenant: No config found.";
+/**
+ * Build the "no config" error message. When suggestedTables is provided (e.g. from getSuggestedTables),
+ * the snippet uses those table names instead of the default.
+ */
+declare function buildNoConfigMessage(cwd: string, suggestedTables?: string[]): string;
+/**
+ * Discover and load config from cwd.
+ * 1. Look for better-tenant.config.json in cwd
+ * 2. Fall back to package.json "betterTenant" key
+ */
+declare function loadConfig(cwd?: string): BetterTenantCliConfig;
+
+export { type BetterTenantCliConfig, NO_CONFIG_MESSAGE_PREFIX, buildNoConfigMessage, loadConfig };

package/dist/config.js

@@ -0,0 +1,11 @@
+import {
+  NO_CONFIG_MESSAGE_PREFIX,
+  buildNoConfigMessage,
+  loadConfig
+} from "./chunk-64RQTBD5.js";
+export {
+  NO_CONFIG_MESSAGE_PREFIX,
+  buildNoConfigMessage,
+  loadConfig
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/migrate.d.ts

@@ -0,0 +1,11 @@
+import { BetterTenantCliConfig } from './config.js';
+
+declare function generateMigrationSql(config: BetterTenantCliConfig): string;
+/**
+ * Generate SQL to add tenant_id, RLS, policy, and trigger for a single table.
+ * Idempotent: uses IF NOT EXISTS for column, DROP IF EXISTS for policy/trigger.
+ * Assumes tenants table and set_tenant_id() function exist (run migrate first).
+ */
+declare function generateAddTableSql(tableName: string): string;
+
+export { generateAddTableSql, generateMigrationSql };

package/dist/migrate.js

@@ -0,0 +1,9 @@
+import {
+  generateAddTableSql,
+  generateMigrationSql
+} from "./chunk-VZCKMMJZ.js";
+export {
+  generateAddTableSql,
+  generateMigrationSql
+};
+//# sourceMappingURL=migrate.js.map

package/dist/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/seed.d.ts

@@ -0,0 +1,20 @@
+interface SeedOptions {
+    name: string;
+    slug?: string;
+}
+/**
+ * Derive a URL-safe slug from name (e.g. "Test Org" -> "test-org").
+ */
+declare function slugFromName(name: string): string;
+interface SeedResult {
+    id: string;
+    name: string;
+    slug: string;
+}
+/**
+ * Insert one tenant using bypass_rls so RLS allows the insert (no superuser).
+ * Uses SET LOCAL app.bypass_rls = 'true' in a transaction.
+ */
+declare function runSeed(databaseUrl: string, options: SeedOptions): Promise<SeedResult>;
+
+export { type SeedOptions, type SeedResult, runSeed, slugFromName };

package/dist/seed.js

@@ -0,0 +1,9 @@
+import {
+  runSeed,
+  slugFromName
+} from "./chunk-LXS6CXJ3.js";
+export {
+  runSeed,
+  slugFromName
+};
+//# sourceMappingURL=seed.js.map

package/dist/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sql/set_tenant_id_function.sql

@@ -0,0 +1,10 @@
+-- Better Tenant: trigger function for auto-populating tenant_id
+CREATE OR REPLACE FUNCTION set_tenant_id()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.tenant_id IS NULL AND current_setting('app.current_tenant', true) IS NOT NULL THEN
+    NEW.tenant_id := current_setting('app.current_tenant', true)::uuid;
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;

package/dist/sql/table_rls.sql

@@ -0,0 +1,21 @@
+-- Better Tenant: RLS for {{TABLE}}
+ALTER TABLE {{TABLE_QUOTED}} ADD COLUMN IF NOT EXISTS tenant_id UUID NOT NULL REFERENCES tenants(id);
+ALTER TABLE {{TABLE_QUOTED}} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE {{TABLE_QUOTED}} FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS "{{POLICY_NAME}}" ON {{TABLE_QUOTED}};
+CREATE POLICY "{{POLICY_NAME}}" ON {{TABLE_QUOTED}}
+  FOR ALL
+  USING (
+    (tenant_id)::text = current_setting('app.current_tenant', true)
+    OR current_setting('app.bypass_rls', true) = 'true'
+  )
+  WITH CHECK (
+    (tenant_id)::text = current_setting('app.current_tenant', true)
+    OR current_setting('app.bypass_rls', true) = 'true'
+  );
+
+DROP TRIGGER IF EXISTS set_tenant_id_trigger ON {{TABLE_QUOTED}};
+CREATE TRIGGER set_tenant_id_trigger
+  BEFORE INSERT ON {{TABLE_QUOTED}}
+  FOR EACH ROW
+  EXECUTE PROCEDURE set_tenant_id();

package/dist/sql/tenants.sql

@@ -0,0 +1,7 @@
+-- Better Tenant: tenants table
+CREATE TABLE IF NOT EXISTS tenants (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@usebetterdev/tenant-cli",
+  "version": "0.1.0",
+  "repository": "github:usebetter-dev/usebetter",
+  "bugs": "https://github.com/usebetter-dev/usebetter/issues",
+  "homepage": "https://github.com/usebetter-dev/usebetter#readme",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "main": "./dist/cli.js",
+  "exports": {
+    ".": "./dist/cli.js",
+    "./migrate": {
+      "import": "./dist/migrate.js",
+      "types": "./dist/migrate.d.ts"
+    },
+    "./check": {
+      "import": "./dist/check.js",
+      "types": "./dist/check.d.ts"
+    },
+    "./seed": {
+      "import": "./dist/seed.js",
+      "types": "./dist/seed.d.ts"
+    },
+    "./config": {
+      "import": "./dist/config.js",
+      "types": "./dist/config.d.ts"
+    }
+  },
+  "bin": {
+    "better-tenant": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^12.1.0",
+    "pg": "^8.13.0",
+    "@usebetterdev/tenant-core": "0.1.0"
+  },
+  "devDependencies": {
+    "@testcontainers/postgresql": "^11.11.0",
+    "@types/node": "^22.10.0",
+    "@types/pg": "^8.11.0",
+    "pg": "^8.13.0",
+    "tsup": "^8.3.5",
+    "typescript": "~5.7.2",
+    "vitest": "^2.1.6"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsup && mkdir -p dist/sql && cp src/sql/*.sql dist/sql/",
+    "lint": "oxlint",
+    "test": "vitest run",
+    "test:integration": "vitest run -c vitest.integration.config.ts",
+    "typecheck": "tsc --noEmit"
+  }
+}