@hypequery/cli 1.18.0 → 1.18.2

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AA4PD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAgQD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -142,6 +142,7 @@ program
     .option('--path <path>', 'Analytics directory (derives <path>/datasets.ts)')
     .option('--tables <names>', 'Only generate for specific tables (comma-separated)')
     .option('--exclude-tables <names>', 'Exclude specific tables (comma-separated)')
+    .option('--tenant-column <column>', 'Set tenantKey to this column on tables that have it (requires a trusted runtime tenant scope)')
     .action(runCommand(async (options) => {
     await generateDatasetsCommand(options);
 }));

package/dist/commands/generate-datasets.d.ts

@@ -9,6 +9,7 @@ export interface GenerateDatasetsOptions {
     path?: string;
     tables?: string;
     excludeTables?: string;
+    tenantColumn?: string;
 }
 export declare function generateDatasetsCommand(options?: GenerateDatasetsOptions): Promise<void>;
 //# sourceMappingURL=generate-datasets.d.ts.map

package/dist/commands/generate-datasets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-datasets.d.ts","sourceRoot":"","sources":["../../src/commands/generate-datasets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAqBD,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,uBAA4B,iBA0GlF"}
+{"version":3,"file":"generate-datasets.d.ts","sourceRoot":"","sources":["../../src/commands/generate-datasets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqBD,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,uBAA4B,iBA8GlF"}

package/dist/commands/generate-datasets.js

@@ -10,6 +10,7 @@ import { logger } from '../utils/logger.js';
 import { getTableCount } from '../utils/detect-database.js';
 import { generateDatasets } from '../generators/dataset-generator.js';
 import { redactConnectionUrl } from '../utils/redact-connection-url.js';
+import { logDatasetGenerationWarnings } from '../utils/dataset-generation-warnings.js';
 /**
  * Turns the written path into something pasteable into an import statement:
  * strips the `.ts` extension and makes it explicitly relative.
@@ -58,12 +59,16 @@ export async function generateDatasetsCommand(options = {}) {
             outputPath,
             includeTables: parsedTables,
             excludeTables: excludedTables,
+            // Regeneration replaces the whole file, so a tenant boundary configured at
+            // init has to be restated here or it is dropped on every refresh.
+            tenantColumn: options.tenantColumn,
         });
         const generatedTables = generated?.tables ?? parsedTables ?? [];
         const generatedCount = generatedTables.length || tableCount;
         datasetSpinner.succeed(`Generated dataset definitions for ${generatedCount} ${generatedCount === 1 ? 'table' : 'tables'}`);
         const relativeOutput = path.relative(process.cwd(), outputPath);
         logger.success(`Created ${relativeOutput}`);
+        logDatasetGenerationWarnings(generated?.warnings);
         logger.newline();
         logger.header('Next steps:');
         logger.indent('1. Review and customize the generated datasets');

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQzF,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAqKD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,iBAya1D"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAWzF,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAqKD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,iBAkb1D"}

package/dist/commands/init.js

@@ -10,11 +10,14 @@ import { generateEnvTemplate, appendToEnv } from '../templates/env.js';
 import { generateClientTemplate } from '../templates/client.js';
 import { generateQueriesTemplate } from '../templates/queries.js';
 import { generateApiTemplate } from '../templates/api.js';
+import { CONTEXT_AUTH_TENANT_COLUMN } from '../templates/auth-scaffold.js';
 import { generateDatasetsPlaceholderTemplate } from '../templates/datasets.js';
 import { appendToGitignore } from '../templates/gitignore.js';
 import { getTypeGenerator } from '../generators/index.js';
 import { generateDatasets } from '../generators/dataset-generator.js';
 import { installScaffoldDependencies } from '../utils/dependency-installer.js';
+import { logDatasetGenerationWarnings } from '../utils/dataset-generation-warnings.js';
+import { formatRegenerateDatasetsCommand } from '../utils/regenerate-datasets-command.js';
 function normalizeInitDatabase(database) {
     if (!database || database === 'clickhouse') {
         return 'clickhouse';
@@ -389,22 +392,29 @@ export interface IntrospectedSchema {
         const shouldGenerateDatasets = hasValidConnection && (options.allTables === true ||
             (datasetTables !== undefined && datasetTables.length > 0));
         if (shouldGenerateDatasets) {
-            await generateDatasets({
+            const generated = await generateDatasets({
                 outputPath: datasetsPath,
                 includeTables: options.allTables ? undefined : datasetTables,
                 excludeTables: excludedDatasetTables,
+                // Context auth scaffolds a trusted runtime tenant scope on that column,
+                // so datasets must declare the matching tenantKey or every tenant-scoped
+                // request fails. This is explicit configuration, not a name heuristic.
+                ...(auth === 'context' ? { tenantColumn: CONTEXT_AUTH_TENANT_COLUMN } : {}),
                 ...(database === 'chdb'
                     ? { client: getChdbTypeGenerationClient(chdbPath) }
                     : {}),
             });
+            logDatasetGenerationWarnings(generated?.warnings);
             generatedAnyDatasets = true;
             generatedSelectedDataset = selectedTable !== null && (options.allTables === true ||
                 datasetTables?.includes(selectedTable) === true);
         }
         else {
-            await writeFile(datasetsPath, generateDatasetsPlaceholderTemplate());
+            await writeFile(datasetsPath, generateDatasetsPlaceholderTemplate({ auth }));
             if (hasValidConnection) {
-                logger.info('Skipped dataset generation. Run `hypequery generate:datasets --path ' + outputDir + ' --tables table1,table2` when ready.');
+                logger.info('Skipped dataset generation. Run `'
+                    + formatRegenerateDatasetsCommand({ outputDir, auth, tables: 'table1,table2' })
+                    + '` when ready.');
             }
         }
         logger.success(`Created datasets file (${path.relative(process.cwd(), datasetsPath)})`);
@@ -451,7 +461,7 @@ export interface IntrospectedSchema {
     if (hasValidConnection) {
         if (style === 'datasets' && !generatedAnyDatasets) {
             logger.info('Next:');
-            logger.indent(`hypequery generate:datasets --path ${outputDir} --tables table1,table2`);
+            logger.indent(formatRegenerateDatasetsCommand({ outputDir, auth, tables: 'table1,table2' }));
             logger.newline();
         }
         else if (style === 'datasets' && !generatedSelectedDataset) {

package/dist/generators/dataset-generator.d.ts

@@ -10,7 +10,27 @@ export interface DatasetGeneratorOptions {
     includeTables?: string[];
     excludeTables?: string[];
     client?: TypeGenerationClickHouseClient;
+    /**
+     * Tenant column the caller has already configured as a trusted runtime tenant
+     * scope (for example the `tenant.column` of a scaffolded context-auth API).
+     *
+     * Only an explicit value here activates `tenantKey`; column-name heuristics
+     * never do. Tables that lack the column are reported as warnings instead of
+     * being silently left unscoped.
+     */
+    tenantColumn?: string;
 }
+export type DatasetGenerationWarning = {
+    kind: 'tenant-key-candidate';
+    table: string;
+    columns: string[];
+    message: string;
+} | {
+    kind: 'tenant-column-missing';
+    table: string;
+    column: string;
+    message: string;
+};
 /**
  * Generate dataset definitions from ClickHouse schema
  */
@@ -20,5 +40,6 @@ export declare function generateDatasets(options: DatasetGeneratorOptions): Prom
         table: string;
         exportName: string;
     }[];
+    warnings: DatasetGenerationWarning[];
 }>;
 //# sourceMappingURL=dataset-generator.d.ts.map

package/dist/generators/dataset-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;CACzC;AAuPD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;GAmEtE"}
+{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;IACxC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAkSN;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;;GAsEtE"}

package/dist/generators/dataset-generator.js

@@ -48,9 +48,12 @@ function isTimestampColumn(column) {
         name === 'updated');
 }
 /**
- * Check if a column is likely a tenant ID column
+ * Check if a column name is worth presenting as a possible tenant key.
+ *
+ * A naming match is never enough to activate tenant enforcement. `tenantKey`
+ * is a security boundary that must be chosen explicitly by the application.
  */
-function isTenantColumn(column) {
+function isTenantKeyCandidate(column) {
     const name = column.name.toLowerCase();
     return (name === 'tenant_id' ||
         name === 'organization_id' ||
@@ -79,7 +82,7 @@ function isIdentifierColumn(column) {
         name.endsWith('_id') ||
         originalName.endsWith('Id') ||
         name.includes('uuid') ||
-        isTenantColumn(column));
+        isTenantKeyCandidate(column));
 }
 /**
  * Check if a numeric column is a coordinate that should not be summed or averaged.
@@ -128,7 +131,7 @@ function generateLabel(columnName) {
 /**
  * Generate dataset definition code for a single table
  */
-async function generateDatasetForTable(client, tableName) {
+async function generateDatasetForTable(client, tableName, tenantColumn) {
     // Get column information
     const columnsQuery = await client.query({
         query: `DESCRIBE TABLE ${tableName}`,
@@ -138,8 +141,34 @@ async function generateDatasetForTable(client, tableName) {
     // Determine timeKey (prefer created_at, then any timestamp column)
     const timestampColumns = columns.filter(isTimestampColumn);
     const timeKeyColumn = timestampColumns.find((c) => c.name === 'created_at') || timestampColumns[0];
-    // Determine tenantKey
-    const tenantColumn = columns.find(isTenantColumn);
+    // A tenant column is only honoured when the caller configured one explicitly.
+    // Column-name matches are reported for review and never become policy.
+    const resolvedTenantColumn = tenantColumn
+        ? columns.find((column) => column.name === tenantColumn)?.name
+        : undefined;
+    // Report every match, not just the first — picking the right tenant boundary
+    // needs the full set (e.g. both `organization_id` and `customer_id`).
+    const tenantCandidates = columns.filter(isTenantKeyCandidate).map((column) => column.name);
+    const warnings = [];
+    if (tenantColumn && !resolvedTenantColumn) {
+        warnings.push({
+            kind: 'tenant-column-missing',
+            table: tableName,
+            column: tenantColumn,
+            message: `Dataset "${tableName}" has no "${tenantColumn}" column, so tenant isolation was not applied. ` +
+                'Tenant-scoped requests against it will fail until you set tenantKey to the correct column.',
+        });
+    }
+    if (!resolvedTenantColumn && tenantCandidates.length > 0) {
+        const quoted = tenantCandidates.map((name) => `"${name}"`).join(', ');
+        warnings.push({
+            kind: 'tenant-key-candidate',
+            table: tableName,
+            columns: tenantCandidates,
+            message: `Dataset "${tableName}" has ${tenantCandidates.length === 1 ? 'possible tenant key' : 'possible tenant keys'} ${quoted}. ` +
+                'Review them and add tenantKey explicitly only after configuring trusted runtime tenant scope.',
+        });
+    }
     // Generate dimensions
     const dimensionLines = [];
     for (const column of columns) {
@@ -181,8 +210,13 @@ async function generateDatasetForTable(client, tableName) {
     if (timeKeyColumn) {
         configLines.push(`  timeKey: '${timeKeyColumn.name}',`);
     }
-    if (tenantColumn) {
-        configLines.push(`  tenantKey: '${tenantColumn.name}', // Auto-detected tenant isolation column`);
+    if (resolvedTenantColumn) {
+        configLines.push(`  tenantKey: '${resolvedTenantColumn}',`);
+    }
+    else if (tenantCandidates.length > 0) {
+        const quoted = tenantCandidates.map((name) => `'${name}'`).join(', ');
+        configLines.push(`  // Possible tenant ${tenantCandidates.length === 1 ? 'key' : 'keys'}: ${quoted}.`);
+        configLines.push(`  // Add tenantKey explicitly only after configuring trusted runtime tenant scope.`);
     }
     configLines.push(`  dimensions: {`);
     configLines.push(...dimensionLines);
@@ -190,10 +224,13 @@ async function generateDatasetForTable(client, tableName) {
     configLines.push(`  measures: {`);
     configLines.push(...measureLines);
     configLines.push(`  },`);
-    return `export const ${datasetName}Dataset = dataset('${tableName}', {
+    return {
+        code: `export const ${datasetName}Dataset = dataset('${tableName}', {
 ${configLines.join('\n')}
 });
-`;
+`,
+        warnings,
+    };
 }
 /**
  * Generate dataset definitions from ClickHouse schema
@@ -220,9 +257,11 @@ export async function generateDatasets(options) {
     }
     // Generate dataset definitions
     const datasetDefinitions = [];
+    const warnings = [];
     for (const table of tables) {
-        const datasetCode = await generateDatasetForTable(client, table.name);
-        datasetDefinitions.push(datasetCode);
+        const generated = await generateDatasetForTable(client, table.name, options.tenantColumn);
+        datasetDefinitions.push(generated.code);
+        warnings.push(...generated.warnings);
     }
     // Build the complete output file
     const header = `// Generated by @hypequery/cli
@@ -251,5 +290,6 @@ ${tables.map((table) => `  ${table.name}: ${tableToPascalCase(table.name)}Datase
             table: table.name,
             exportName: `${tableToPascalCase(table.name)}Dataset`,
         })),
+        warnings,
     };
 }

package/dist/templates/auth-scaffold.d.ts

@@ -3,6 +3,12 @@
  * templates so the generated code stays identical across scaffold styles.
  */
 export type AuthTemplateMode = 'none' | 'context';
+/**
+ * Tenant column the context-auth scaffold configures as its trusted runtime
+ * tenant scope. Generated datasets must use the same column for their
+ * `tenantKey`, otherwise tenant-scoped requests fail at runtime.
+ */
+export declare const CONTEXT_AUTH_TENANT_COLUMN = "tenant_id";
 /**
  * Type guards that pull a trusted `HostUser` off the underlying request. The
  * host framework is expected to have already authenticated the request and

package/dist/templates/auth-scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-scaffold.d.ts","sourceRoot":"","sources":["../../src/templates/auth-scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,eAAe,+qBAoBzB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gVAUzB,CAAC"}
+{"version":3,"file":"auth-scaffold.d.ts","sourceRoot":"","sources":["../../src/templates/auth-scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,eAAe,+qBAoBzB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,iBAAiB,gVAUzB,CAAC"}

package/dist/templates/auth-scaffold.js

@@ -1,3 +1,9 @@
+/**
+ * Tenant column the context-auth scaffold configures as its trusted runtime
+ * tenant scope. Generated datasets must use the same column for their
+ * `tenantKey`, otherwise tenant-scoped requests fail at runtime.
+ */
+export const CONTEXT_AUTH_TENANT_COLUMN = 'tenant_id';
 /**
  * Type guards that pull a trusted `HostUser` off the underlying request. The
  * host framework is expected to have already authenticated the request and
@@ -36,6 +42,6 @@ export const contextAuthConfig = `  auth: fromContext(({ request }) => {
   }),
   tenant: {
     extract: (auth: { tenantId?: string }) => auth.tenantId,
-    column: 'tenant_id',
+    column: '${CONTEXT_AUTH_TENANT_COLUMN}',
     mode: 'auto-inject',
   },`;

package/dist/templates/datasets.d.ts

@@ -1,5 +1,8 @@
+import { type AuthTemplateMode } from './auth-scaffold.js';
 /**
  * Generate placeholder datasets.ts file for no-connection init.
  */
-export declare function generateDatasetsPlaceholderTemplate(): string;
+export declare function generateDatasetsPlaceholderTemplate(options?: {
+    auth?: AuthTemplateMode;
+}): string;
 //# sourceMappingURL=datasets.d.ts.map

package/dist/templates/datasets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"datasets.d.ts","sourceRoot":"","sources":["../../src/templates/datasets.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,mCAAmC,IAAI,MAAM,CAmB5D"}
+{"version":3,"file":"datasets.d.ts","sourceRoot":"","sources":["../../src/templates/datasets.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,oBAAoB,CAAC;AAE5B;;GAEG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACxC,MAAM,CA6BR"}

package/dist/templates/datasets.js

@@ -1,15 +1,25 @@
+import { CONTEXT_AUTH_TENANT_COLUMN, } from './auth-scaffold.js';
 /**
  * Generate placeholder datasets.ts file for no-connection init.
  */
-export function generateDatasetsPlaceholderTemplate() {
+export function generateDatasetsPlaceholderTemplate(options = {}) {
+    // Context auth wires a trusted runtime tenant scope in api.ts, and tenant-scoped
+    // dataset requests fail unless the dataset declares the matching tenantKey.
+    const tenantScoped = options.auth === 'context';
+    const tenantKeyLine = tenantScoped
+        ? `  tenantKey: '${CONTEXT_AUTH_TENANT_COLUMN}',\n`
+        : '';
+    const tenantDimensionLine = tenantScoped
+        ? `    tenantId: dimension.string({ column: '${CONTEXT_AUTH_TENANT_COLUMN}' }),\n`
+        : '';
     return `import { dataset, dimension, measure } from '@hypequery/datasets';
 
 const exampleEvents = dataset('example_events', {
   source: 'example_events',
   timeKey: 'created_at',
-  dimensions: {
+${tenantKeyLine}  dimensions: {
     id: dimension.string(),
-    createdAt: dimension.timestamp({ column: 'created_at' }),
+${tenantDimensionLine}    createdAt: dimension.timestamp({ column: 'created_at' }),
   },
   measures: {
     eventCount: measure.count('id', { label: 'Event Count' }),

package/dist/utils/dataset-generation-warnings.d.ts

@@ -0,0 +1,3 @@
+import type { DatasetGenerationWarning } from '../generators/dataset-generator.js';
+export declare function logDatasetGenerationWarnings(warnings: readonly DatasetGenerationWarning[] | undefined): void;
+//# sourceMappingURL=dataset-generation-warnings.d.ts.map

package/dist/utils/dataset-generation-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-generation-warnings.d.ts","sourceRoot":"","sources":["../../src/utils/dataset-generation-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAGnF,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,SAAS,wBAAwB,EAAE,GAAG,SAAS,GACxD,IAAI,CAUN"}

package/dist/utils/dataset-generation-warnings.js

@@ -0,0 +1,11 @@
+import { logger } from './logger.js';
+export function logDatasetGenerationWarnings(warnings) {
+    if (!warnings?.length) {
+        return;
+    }
+    logger.newline();
+    logger.warn('Review generated dataset tenant isolation:');
+    for (const warning of warnings) {
+        logger.indent(`• ${warning.message}`);
+    }
+}

package/dist/utils/regenerate-datasets-command.d.ts

@@ -0,0 +1,16 @@
+import { type AuthTemplateMode } from '../templates/auth-scaffold.js';
+export interface RegenerateDatasetsCommandOptions {
+    outputDir: string;
+    auth: AuthTemplateMode;
+    /** Comma-separated table list to suggest, if any. */
+    tables?: string;
+}
+/**
+ * The `generate:datasets` invocation to hand a user after `init`.
+ *
+ * Regeneration rewrites the whole file, so a context-auth scaffold has to
+ * repeat its tenant column here. Without it the refresh drops `tenantKey` and
+ * every tenant-scoped request starts failing.
+ */
+export declare function formatRegenerateDatasetsCommand(options: RegenerateDatasetsCommandOptions): string;
+//# sourceMappingURL=regenerate-datasets-command.d.ts.map

package/dist/utils/regenerate-datasets-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regenerate-datasets-command.d.ts","sourceRoot":"","sources":["../../src/utils/regenerate-datasets-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAElG,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,MAAM,CAYR"}

package/dist/utils/regenerate-datasets-command.js

@@ -0,0 +1,18 @@
+import { CONTEXT_AUTH_TENANT_COLUMN } from '../templates/auth-scaffold.js';
+/**
+ * The `generate:datasets` invocation to hand a user after `init`.
+ *
+ * Regeneration rewrites the whole file, so a context-auth scaffold has to
+ * repeat its tenant column here. Without it the refresh drops `tenantKey` and
+ * every tenant-scoped request starts failing.
+ */
+export function formatRegenerateDatasetsCommand(options) {
+    const parts = ['hypequery generate:datasets', `--path ${options.outputDir}`];
+    if (options.tables) {
+        parts.push(`--tables ${options.tables}`);
+    }
+    if (options.auth === 'context') {
+        parts.push(`--tenant-column ${CONTEXT_AUTH_TENANT_COLUMN}`);
+    }
+    return parts.join(' ');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.18.0",
+  "version": "1.18.2",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -30,8 +30,8 @@
     "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.7.3",
-    "@hypequery/protocol": "0.11.0"
+    "@hypequery/deployment": "0.7.4",
+    "@hypequery/protocol": "0.11.1"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"
@@ -45,7 +45,7 @@
     "@vitest/coverage-v8": "^3.2.6",
     "typescript": "^5.7.3",
     "vitest": "^3.2.6",
-    "@hypequery/serve": "0.16.0"
+    "@hypequery/serve": "0.16.2"
   },
   "repository": {
     "type": "git",