@hypequery/cli 1.17.0 → 1.18.1

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AA4PD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAgQD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -142,6 +142,7 @@ program
     .option('--path <path>', 'Analytics directory (derives <path>/datasets.ts)')
     .option('--tables <names>', 'Only generate for specific tables (comma-separated)')
     .option('--exclude-tables <names>', 'Exclude specific tables (comma-separated)')
+    .option('--tenant-column <column>', 'Set tenantKey to this column on tables that have it (requires a trusted runtime tenant scope)')
     .action(runCommand(async (options) => {
     await generateDatasetsCommand(options);
 }));

package/dist/commands/generate-datasets.d.ts

@@ -9,6 +9,7 @@ export interface GenerateDatasetsOptions {
     path?: string;
     tables?: string;
     excludeTables?: string;
+    tenantColumn?: string;
 }
 export declare function generateDatasetsCommand(options?: GenerateDatasetsOptions): Promise<void>;
 //# sourceMappingURL=generate-datasets.d.ts.map

package/dist/commands/generate-datasets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-datasets.d.ts","sourceRoot":"","sources":["../../src/commands/generate-datasets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAqBD,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,uBAA4B,iBA0GlF"}
+{"version":3,"file":"generate-datasets.d.ts","sourceRoot":"","sources":["../../src/commands/generate-datasets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqBD,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,uBAA4B,iBA8GlF"}

package/dist/commands/generate-datasets.js

@@ -10,6 +10,7 @@ import { logger } from '../utils/logger.js';
 import { getTableCount } from '../utils/detect-database.js';
 import { generateDatasets } from '../generators/dataset-generator.js';
 import { redactConnectionUrl } from '../utils/redact-connection-url.js';
+import { logDatasetGenerationWarnings } from '../utils/dataset-generation-warnings.js';
 /**
  * Turns the written path into something pasteable into an import statement:
  * strips the `.ts` extension and makes it explicitly relative.
@@ -58,12 +59,16 @@ export async function generateDatasetsCommand(options = {}) {
             outputPath,
             includeTables: parsedTables,
             excludeTables: excludedTables,
+            // Regeneration replaces the whole file, so a tenant boundary configured at
+            // init has to be restated here or it is dropped on every refresh.
+            tenantColumn: options.tenantColumn,
         });
         const generatedTables = generated?.tables ?? parsedTables ?? [];
         const generatedCount = generatedTables.length || tableCount;
         datasetSpinner.succeed(`Generated dataset definitions for ${generatedCount} ${generatedCount === 1 ? 'table' : 'tables'}`);
         const relativeOutput = path.relative(process.cwd(), outputPath);
         logger.success(`Created ${relativeOutput}`);
+        logDatasetGenerationWarnings(generated?.warnings);
         logger.newline();
         logger.header('Next steps:');
         logger.indent('1. Review and customize the generated datasets');

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQzF,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAqKD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,iBAya1D"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAWzF,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAqKD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,iBAkb1D"}

package/dist/commands/init.js

@@ -10,11 +10,14 @@ import { generateEnvTemplate, appendToEnv } from '../templates/env.js';
 import { generateClientTemplate } from '../templates/client.js';
 import { generateQueriesTemplate } from '../templates/queries.js';
 import { generateApiTemplate } from '../templates/api.js';
+import { CONTEXT_AUTH_TENANT_COLUMN } from '../templates/auth-scaffold.js';
 import { generateDatasetsPlaceholderTemplate } from '../templates/datasets.js';
 import { appendToGitignore } from '../templates/gitignore.js';
 import { getTypeGenerator } from '../generators/index.js';
 import { generateDatasets } from '../generators/dataset-generator.js';
 import { installScaffoldDependencies } from '../utils/dependency-installer.js';
+import { logDatasetGenerationWarnings } from '../utils/dataset-generation-warnings.js';
+import { formatRegenerateDatasetsCommand } from '../utils/regenerate-datasets-command.js';
 function normalizeInitDatabase(database) {
     if (!database || database === 'clickhouse') {
         return 'clickhouse';
@@ -389,22 +392,29 @@ export interface IntrospectedSchema {
         const shouldGenerateDatasets = hasValidConnection && (options.allTables === true ||
             (datasetTables !== undefined && datasetTables.length > 0));
         if (shouldGenerateDatasets) {
-            await generateDatasets({
+            const generated = await generateDatasets({
                 outputPath: datasetsPath,
                 includeTables: options.allTables ? undefined : datasetTables,
                 excludeTables: excludedDatasetTables,
+                // Context auth scaffolds a trusted runtime tenant scope on that column,
+                // so datasets must declare the matching tenantKey or every tenant-scoped
+                // request fails. This is explicit configuration, not a name heuristic.
+                ...(auth === 'context' ? { tenantColumn: CONTEXT_AUTH_TENANT_COLUMN } : {}),
                 ...(database === 'chdb'
                     ? { client: getChdbTypeGenerationClient(chdbPath) }
                     : {}),
             });
+            logDatasetGenerationWarnings(generated?.warnings);
             generatedAnyDatasets = true;
             generatedSelectedDataset = selectedTable !== null && (options.allTables === true ||
                 datasetTables?.includes(selectedTable) === true);
         }
         else {
-            await writeFile(datasetsPath, generateDatasetsPlaceholderTemplate());
+            await writeFile(datasetsPath, generateDatasetsPlaceholderTemplate({ auth }));
             if (hasValidConnection) {
-                logger.info('Skipped dataset generation. Run `hypequery generate:datasets --path ' + outputDir + ' --tables table1,table2` when ready.');
+                logger.info('Skipped dataset generation. Run `'
+                    + formatRegenerateDatasetsCommand({ outputDir, auth, tables: 'table1,table2' })
+                    + '` when ready.');
             }
         }
         logger.success(`Created datasets file (${path.relative(process.cwd(), datasetsPath)})`);
@@ -451,7 +461,7 @@ export interface IntrospectedSchema {
     if (hasValidConnection) {
         if (style === 'datasets' && !generatedAnyDatasets) {
             logger.info('Next:');
-            logger.indent(`hypequery generate:datasets --path ${outputDir} --tables table1,table2`);
+            logger.indent(formatRegenerateDatasetsCommand({ outputDir, auth, tables: 'table1,table2' }));
             logger.newline();
         }
         else if (style === 'datasets' && !generatedSelectedDataset) {

package/dist/generators/dataset-generator.d.ts

@@ -10,7 +10,27 @@ export interface DatasetGeneratorOptions {
     includeTables?: string[];
     excludeTables?: string[];
     client?: TypeGenerationClickHouseClient;
+    /**
+     * Tenant column the caller has already configured as a trusted runtime tenant
+     * scope (for example the `tenant.column` of a scaffolded context-auth API).
+     *
+     * Only an explicit value here activates `tenantKey`; column-name heuristics
+     * never do. Tables that lack the column are reported as warnings instead of
+     * being silently left unscoped.
+     */
+    tenantColumn?: string;
 }
+export type DatasetGenerationWarning = {
+    kind: 'tenant-key-candidate';
+    table: string;
+    columns: string[];
+    message: string;
+} | {
+    kind: 'tenant-column-missing';
+    table: string;
+    column: string;
+    message: string;
+};
 /**
  * Generate dataset definitions from ClickHouse schema
  */
@@ -20,5 +40,6 @@ export declare function generateDatasets(options: DatasetGeneratorOptions): Prom
         table: string;
         exportName: string;
     }[];
+    warnings: DatasetGenerationWarning[];
 }>;
 //# sourceMappingURL=dataset-generator.d.ts.map

package/dist/generators/dataset-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;CACzC;AAuPD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;GAmEtE"}
+{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;IACxC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAkSN;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;;GAsEtE"}

package/dist/generators/dataset-generator.js

@@ -48,9 +48,12 @@ function isTimestampColumn(column) {
         name === 'updated');
 }
 /**
- * Check if a column is likely a tenant ID column
+ * Check if a column name is worth presenting as a possible tenant key.
+ *
+ * A naming match is never enough to activate tenant enforcement. `tenantKey`
+ * is a security boundary that must be chosen explicitly by the application.
  */
-function isTenantColumn(column) {
+function isTenantKeyCandidate(column) {
     const name = column.name.toLowerCase();
     return (name === 'tenant_id' ||
         name === 'organization_id' ||
@@ -79,7 +82,7 @@ function isIdentifierColumn(column) {
         name.endsWith('_id') ||
         originalName.endsWith('Id') ||
         name.includes('uuid') ||
-        isTenantColumn(column));
+        isTenantKeyCandidate(column));
 }
 /**
  * Check if a numeric column is a coordinate that should not be summed or averaged.
@@ -128,7 +131,7 @@ function generateLabel(columnName) {
 /**
  * Generate dataset definition code for a single table
  */
-async function generateDatasetForTable(client, tableName) {
+async function generateDatasetForTable(client, tableName, tenantColumn) {
     // Get column information
     const columnsQuery = await client.query({
         query: `DESCRIBE TABLE ${tableName}`,
@@ -138,8 +141,34 @@ async function generateDatasetForTable(client, tableName) {
     // Determine timeKey (prefer created_at, then any timestamp column)
     const timestampColumns = columns.filter(isTimestampColumn);
     const timeKeyColumn = timestampColumns.find((c) => c.name === 'created_at') || timestampColumns[0];
-    // Determine tenantKey
-    const tenantColumn = columns.find(isTenantColumn);
+    // A tenant column is only honoured when the caller configured one explicitly.
+    // Column-name matches are reported for review and never become policy.
+    const resolvedTenantColumn = tenantColumn
+        ? columns.find((column) => column.name === tenantColumn)?.name
+        : undefined;
+    // Report every match, not just the first — picking the right tenant boundary
+    // needs the full set (e.g. both `organization_id` and `customer_id`).
+    const tenantCandidates = columns.filter(isTenantKeyCandidate).map((column) => column.name);
+    const warnings = [];
+    if (tenantColumn && !resolvedTenantColumn) {
+        warnings.push({
+            kind: 'tenant-column-missing',
+            table: tableName,
+            column: tenantColumn,
+            message: `Dataset "${tableName}" has no "${tenantColumn}" column, so tenant isolation was not applied. ` +
+                'Tenant-scoped requests against it will fail until you set tenantKey to the correct column.',
+        });
+    }
+    if (!resolvedTenantColumn && tenantCandidates.length > 0) {
+        const quoted = tenantCandidates.map((name) => `"${name}"`).join(', ');
+        warnings.push({
+            kind: 'tenant-key-candidate',
+            table: tableName,
+            columns: tenantCandidates,
+            message: `Dataset "${tableName}" has ${tenantCandidates.length === 1 ? 'possible tenant key' : 'possible tenant keys'} ${quoted}. ` +
+                'Review them and add tenantKey explicitly only after configuring trusted runtime tenant scope.',
+        });
+    }
     // Generate dimensions
     const dimensionLines = [];
     for (const column of columns) {
@@ -181,8 +210,13 @@ async function generateDatasetForTable(client, tableName) {
     if (timeKeyColumn) {
         configLines.push(`  timeKey: '${timeKeyColumn.name}',`);
     }
-    if (tenantColumn) {
-        configLines.push(`  tenantKey: '${tenantColumn.name}', // Auto-detected tenant isolation column`);
+    if (resolvedTenantColumn) {
+        configLines.push(`  tenantKey: '${resolvedTenantColumn}',`);
+    }
+    else if (tenantCandidates.length > 0) {
+        const quoted = tenantCandidates.map((name) => `'${name}'`).join(', ');
+        configLines.push(`  // Possible tenant ${tenantCandidates.length === 1 ? 'key' : 'keys'}: ${quoted}.`);
+        configLines.push(`  // Add tenantKey explicitly only after configuring trusted runtime tenant scope.`);
     }
     configLines.push(`  dimensions: {`);
     configLines.push(...dimensionLines);
@@ -190,10 +224,13 @@ async function generateDatasetForTable(client, tableName) {
     configLines.push(`  measures: {`);
     configLines.push(...measureLines);
     configLines.push(`  },`);
-    return `export const ${datasetName}Dataset = dataset('${tableName}', {
+    return {
+        code: `export const ${datasetName}Dataset = dataset('${tableName}', {
 ${configLines.join('\n')}
 });
-`;
+`,
+        warnings,
+    };
 }
 /**
  * Generate dataset definitions from ClickHouse schema
@@ -220,9 +257,11 @@ export async function generateDatasets(options) {
     }
     // Generate dataset definitions
     const datasetDefinitions = [];
+    const warnings = [];
     for (const table of tables) {
-        const datasetCode = await generateDatasetForTable(client, table.name);
-        datasetDefinitions.push(datasetCode);
+        const generated = await generateDatasetForTable(client, table.name, options.tenantColumn);
+        datasetDefinitions.push(generated.code);
+        warnings.push(...generated.warnings);
     }
     // Build the complete output file
     const header = `// Generated by @hypequery/cli
@@ -251,5 +290,6 @@ ${tables.map((table) => `  ${table.name}: ${tableToPascalCase(table.name)}Datase
             table: table.name,
             exportName: `${tableToPascalCase(table.name)}Dataset`,
         })),
+        warnings,
     };
 }

package/dist/templates/auth-scaffold.d.ts

@@ -3,6 +3,12 @@
  * templates so the generated code stays identical across scaffold styles.
  */
 export type AuthTemplateMode = 'none' | 'context';
+/**
+ * Tenant column the context-auth scaffold configures as its trusted runtime
+ * tenant scope. Generated datasets must use the same column for their
+ * `tenantKey`, otherwise tenant-scoped requests fail at runtime.
+ */
+export declare const CONTEXT_AUTH_TENANT_COLUMN = "tenant_id";
 /**
  * Type guards that pull a trusted `HostUser` off the underlying request. The
  * host framework is expected to have already authenticated the request and

package/dist/templates/auth-scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-scaffold.d.ts","sourceRoot":"","sources":["../../src/templates/auth-scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,eAAe,+qBAoBzB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gVAUzB,CAAC"}
+{"version":3,"file":"auth-scaffold.d.ts","sourceRoot":"","sources":["../../src/templates/auth-scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,eAAe,+qBAoBzB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gVAUzB,CAAC"}

package/dist/templates/auth-scaffold.js

@@ -1,3 +1,9 @@
+/**
+ * Tenant column the context-auth scaffold configures as its trusted runtime
+ * tenant scope. Generated datasets must use the same column for their
+ * `tenantKey`, otherwise tenant-scoped requests fail at runtime.
+ */
+export const CONTEXT_AUTH_TENANT_COLUMN = 'tenant_id';
 /**
  * Type guards that pull a trusted `HostUser` off the underlying request. The
  * host framework is expected to have already authenticated the request and
@@ -36,6 +42,6 @@ export const contextAuthConfig = `  auth: fromContext(({ request }) => {
   }),
   tenant: {
     extract: (auth: { tenantId?: string }) => auth.tenantId,
-    column: 'tenant_id',
+    column: '${CONTEXT_AUTH_TENANT_COLUMN}',
     mode: 'auto-inject',
   },`;

package/dist/templates/datasets.d.ts

@@ -1,5 +1,8 @@
+import { type AuthTemplateMode } from './auth-scaffold.js';
 /**
  * Generate placeholder datasets.ts file for no-connection init.
  */
-export declare function generateDatasetsPlaceholderTemplate(): string;
+export declare function generateDatasetsPlaceholderTemplate(options?: {
+    auth?: AuthTemplateMode;
+}): string;
 //# sourceMappingURL=datasets.d.ts.map

package/dist/templates/datasets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"datasets.d.ts","sourceRoot":"","sources":["../../src/templates/datasets.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,mCAAmC,IAAI,MAAM,CAmB5D"}
+{"version":3,"file":"datasets.d.ts","sourceRoot":"","sources":["../../src/templates/datasets.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,oBAAoB,CAAC;AAE5B;;GAEG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACxC,MAAM,CA6BR"}

package/dist/templates/datasets.js

@@ -1,15 +1,25 @@
+import { CONTEXT_AUTH_TENANT_COLUMN, } from './auth-scaffold.js';
 /**
  * Generate placeholder datasets.ts file for no-connection init.
  */
-export function generateDatasetsPlaceholderTemplate() {
+export function generateDatasetsPlaceholderTemplate(options = {}) {
+    // Context auth wires a trusted runtime tenant scope in api.ts, and tenant-scoped
+    // dataset requests fail unless the dataset declares the matching tenantKey.
+    const tenantScoped = options.auth === 'context';
+    const tenantKeyLine = tenantScoped
+        ? `  tenantKey: '${CONTEXT_AUTH_TENANT_COLUMN}',\n`
+        : '';
+    const tenantDimensionLine = tenantScoped
+        ? `    tenantId: dimension.string({ column: '${CONTEXT_AUTH_TENANT_COLUMN}' }),\n`
+        : '';
     return `import { dataset, dimension, measure } from '@hypequery/datasets';
 
 const exampleEvents = dataset('example_events', {
   source: 'example_events',
   timeKey: 'created_at',
-  dimensions: {
+${tenantKeyLine}  dimensions: {
     id: dimension.string(),
-    createdAt: dimension.timestamp({ column: 'created_at' }),
+${tenantDimensionLine}    createdAt: dimension.timestamp({ column: 'created_at' }),
   },
   measures: {
     eventCount: measure.count('id', { label: 'Event Count' }),

package/dist/typegen/generate-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-types.d.ts","sourceRoot":"","sources":["../../src/typegen/generate-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,KAAK,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC;QAChE,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAChD,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,qCAAqC;IACrC,MAAM,EAAE,8BAA8B,CAAC;IACvC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AA2HD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GACjD,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CAYnB"}
+{"version":3,"file":"generate-types.d.ts","sourceRoot":"","sources":["../../src/typegen/generate-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,KAAK,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC;QAChE,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAChD,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,qCAAqC;IACrC,MAAM,EAAE,8BAA8B,CAAC;IACvC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AA0HD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,8BAA8B,EACtC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GACjD,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CAYnB"}

package/dist/typegen/generate-types.js

@@ -61,8 +61,7 @@ export interface IntrospectedSchema {`;
         const columns = await describeTable(client, table.name);
         typeDefinitions += `\n  ${table.name}: {`;
         for (const column of columns) {
-            const clickHouseType = column.type.replace(/'/g, "\\'"); // Escape single quotes, e.g. `DateTime('UTC')`
-            typeDefinitions += `\n    '${column.name}': '${clickHouseType}';`;
+            typeDefinitions += `\n    '${column.name}': ${JSON.stringify(column.type)};`;
         }
         typeDefinitions += '\n  };';
     }
@@ -73,7 +72,7 @@ export interface IntrospectedSchema {`;
         const columns = await describeTable(client, table.name);
         typeDefinitions += `export interface ${capitalizeFirstLetter(table.name)}Record {`;
         for (const column of columns) {
-            const tsType = clickhouseToTsType(column.type).replace(/'/g, '');
+            const tsType = clickhouseToTsType(column.type);
             typeDefinitions += `\n  '${column.name}': ${tsType};`;
         }
         typeDefinitions += '\n}\n\n';

package/dist/typegen/type-parsing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-parsing.d.ts","sourceRoot":"","sources":["../../src/typegen/type-parsing.ts"],"names":[],"mappings":"AAuGA;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAsCjD,CAAC"}
+{"version":3,"file":"type-parsing.d.ts","sourceRoot":"","sources":["../../src/typegen/type-parsing.ts"],"names":[],"mappings":"AAwLA;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MA6CjD,CAAC"}

package/dist/typegen/type-parsing.js

@@ -2,7 +2,27 @@ function splitTopLevelArgs(value) {
     const parts = [];
     let current = '';
     let depth = 0;
+    let quote = null;
+    let escaped = false;
     for (const char of value) {
+        if (quote) {
+            current += char;
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === '\\') {
+                escaped = true;
+            }
+            else if (char === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        if (char === "'" || char === '"' || char === '`') {
+            quote = char;
+            current += char;
+            continue;
+        }
         if (char === '(') {
             depth += 1;
             current += char;
@@ -25,6 +45,50 @@ function splitTopLevelArgs(value) {
     }
     return parts;
 }
+function decodeClickHouseEscape(char) {
+    switch (char) {
+        case 'b': return '\b';
+        case 'f': return '\f';
+        case 'n': return '\n';
+        case 'r': return '\r';
+        case 't': return '\t';
+        case '0': return '\0';
+        default: return char;
+    }
+}
+function parseBacktickTuplePart(part) {
+    let name = '';
+    let escaped = false;
+    for (let index = 1; index < part.length; index += 1) {
+        const char = part[index];
+        if (escaped) {
+            name += decodeClickHouseEscape(char);
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === '`') {
+            const type = part.slice(index + 1);
+            return /^\s+\S/s.test(type) ? { name, type: type.trim() } : null;
+        }
+        name += char;
+    }
+    return null;
+}
+function parseNamedTuplePart(value) {
+    const part = value.trim();
+    if (part.startsWith('`')) {
+        return parseBacktickTuplePart(part);
+    }
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)\s+(.+)$/s.exec(part);
+    return match ? { name: match[1], type: match[2].trim() } : null;
+}
+function formatTypeScriptProperty(name) {
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
+}
 function unwrapType(type, wrapperName) {
     // Trim whitespace and handle case-insensitive matching
     const trimmedType = type.trim();
@@ -104,24 +168,31 @@ function getPrimitiveTsType(type) {
  * equivalent TypeScript type string.
  */
 export const clickhouseToTsType = (type) => {
-    const wrappedArrayType = unwrapType(type, 'Array');
+    const normalizedType = type.trim();
+    const wrappedArrayType = unwrapType(normalizedType, 'Array');
     if (wrappedArrayType) {
         return `Array<${clickhouseToTsType(wrappedArrayType)}>`;
     }
-    const wrappedNullableType = unwrapType(type, 'Nullable');
+    const wrappedNullableType = unwrapType(normalizedType, 'Nullable');
     if (wrappedNullableType) {
         return `${clickhouseToTsType(wrappedNullableType)} | null`;
     }
-    const wrappedLowCardinalityType = unwrapType(type, 'LowCardinality');
+    const wrappedLowCardinalityType = unwrapType(normalizedType, 'LowCardinality');
     if (wrappedLowCardinalityType) {
         return clickhouseToTsType(wrappedLowCardinalityType);
     }
-    const wrappedTupleType = unwrapType(type, 'Tuple');
+    const wrappedTupleType = unwrapType(normalizedType, 'Tuple');
     if (wrappedTupleType) {
         const tupleParts = splitTopLevelArgs(wrappedTupleType);
+        const namedParts = tupleParts.map(parseNamedTuplePart);
+        if (namedParts.length > 0 && namedParts.every((part) => part !== null)) {
+            return `{ ${namedParts
+                .map((part) => `${formatTypeScriptProperty(part.name)}: ${clickhouseToTsType(part.type)}`)
+                .join('; ')} }`;
+        }
         return `[${tupleParts.map((part) => clickhouseToTsType(part)).join(', ')}]`;
     }
-    const wrappedMapType = unwrapType(type, 'Map');
+    const wrappedMapType = unwrapType(normalizedType, 'Map');
     if (wrappedMapType) {
         const mapParts = splitTopLevelArgs(wrappedMapType);
         if (mapParts.length === 2) {
@@ -131,7 +202,7 @@ export const clickhouseToTsType = (type) => {
         }
         return 'Record<string, unknown>';
     }
-    const primitiveType = getPrimitiveTsType(type);
+    const primitiveType = getPrimitiveTsType(normalizedType);
     if (primitiveType)
         return primitiveType;
     // Unsupported or more complex ClickHouse types currently preserve the historical fallback.

package/dist/utils/dataset-generation-warnings.d.ts

@@ -0,0 +1,3 @@
+import type { DatasetGenerationWarning } from '../generators/dataset-generator.js';
+export declare function logDatasetGenerationWarnings(warnings: readonly DatasetGenerationWarning[] | undefined): void;
+//# sourceMappingURL=dataset-generation-warnings.d.ts.map

package/dist/utils/dataset-generation-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-generation-warnings.d.ts","sourceRoot":"","sources":["../../src/utils/dataset-generation-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAGnF,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,SAAS,wBAAwB,EAAE,GAAG,SAAS,GACxD,IAAI,CAUN"}

package/dist/utils/dataset-generation-warnings.js

@@ -0,0 +1,11 @@
+import { logger } from './logger.js';
+export function logDatasetGenerationWarnings(warnings) {
+    if (!warnings?.length) {
+        return;
+    }
+    logger.newline();
+    logger.warn('Review generated dataset tenant isolation:');
+    for (const warning of warnings) {
+        logger.indent(`• ${warning.message}`);
+    }
+}

package/dist/utils/regenerate-datasets-command.d.ts

@@ -0,0 +1,16 @@
+import { type AuthTemplateMode } from '../templates/auth-scaffold.js';
+export interface RegenerateDatasetsCommandOptions {
+    outputDir: string;
+    auth: AuthTemplateMode;
+    /** Comma-separated table list to suggest, if any. */
+    tables?: string;
+}
+/**
+ * The `generate:datasets` invocation to hand a user after `init`.
+ *
+ * Regeneration rewrites the whole file, so a context-auth scaffold has to
+ * repeat its tenant column here. Without it the refresh drops `tenantKey` and
+ * every tenant-scoped request starts failing.
+ */
+export declare function formatRegenerateDatasetsCommand(options: RegenerateDatasetsCommandOptions): string;
+//# sourceMappingURL=regenerate-datasets-command.d.ts.map

package/dist/utils/regenerate-datasets-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regenerate-datasets-command.d.ts","sourceRoot":"","sources":["../../src/utils/regenerate-datasets-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAElG,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,MAAM,CAYR"}

package/dist/utils/regenerate-datasets-command.js

@@ -0,0 +1,18 @@
+import { CONTEXT_AUTH_TENANT_COLUMN } from '../templates/auth-scaffold.js';
+/**
+ * The `generate:datasets` invocation to hand a user after `init`.
+ *
+ * Regeneration rewrites the whole file, so a context-auth scaffold has to
+ * repeat its tenant column here. Without it the refresh drops `tenantKey` and
+ * every tenant-scoped request starts failing.
+ */
+export function formatRegenerateDatasetsCommand(options) {
+    const parts = ['hypequery generate:datasets', `--path ${options.outputDir}`];
+    if (options.tables) {
+        parts.push(`--tables ${options.tables}`);
+    }
+    if (options.auth === 'context') {
+        parts.push(`--tenant-column ${CONTEXT_AUTH_TENANT_COLUMN}`);
+    }
+    return parts.join(' ');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.17.0",
+  "version": "1.18.1",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -45,7 +45,7 @@
     "@vitest/coverage-v8": "^3.2.6",
     "typescript": "^5.7.3",
     "vitest": "^3.2.6",
-    "@hypequery/serve": "0.16.0"
+    "@hypequery/serve": "0.16.1"
   },
   "repository": {
     "type": "git",