@hypequery/cli 1.19.0 → 1.20.0

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAqRD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AA6QD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -170,13 +170,6 @@ program
     .command('deployment:build <api>')
     .description('Build a verified deployment bundle')
     .option('--bundle-output <directory>', 'Bundle directory (default: analytics/hypequery-deployment)')
-    .option('-o, --output <path>', 'Output JSON file (default: analytics/hypequery-deployment.json)')
-    .option('--runtime <runtime>', 'Runtime for non-portable handlers: node or python (default: node)')
-    .option('--runtime-artifact <sha256>', 'Use a prebuilt runtime artifact with this SHA-256 identity')
-    .option('--runtime-file <path>', 'Include the bytes for a prebuilt runtime artifact')
-    .option('--runtime-output <path>', 'Bundled Node runtime path (default: beside deployment JSON)')
-    .option('--entrypoint-prefix <prefix>', 'Runtime entrypoint prefix (default: queries)')
-    .option('--hash-output <path>', 'Deployment identity sidecar path (default: <output>.sha256)')
     .option('--no-source', 'Exclude project source files from the deployment bundle')
     .option('--allow-unsupported-config', 'Deploy even though some Serve config will not be honoured in Cloud')
     .action(runCommand(async (api, options) => {
@@ -184,7 +177,7 @@ program
 }));
 program
     .command('deployment:validate <artifact>')
-    .description('Verify a deployment bundle or validate a legacy deployment JSON file')
+    .description('Verify a deployment bundle or validate a deployment contract JSON file')
     .action(runCommand(async (artifact) => {
     await validateDeploymentCommand(artifact);
 }));
@@ -213,7 +206,6 @@ program
     .option('--release-output <path>', 'Release JSON path (default: beside the bundle)')
     .option('--project <project>', 'Target project identifier (advanced override)')
     .option('--environment <environment>', 'Target environment identifier (advanced override)')
-    .option('--release <path>', 'Submit a prebuilt bundle with this release (legacy)')
     .option('--no-source', 'Exclude project source files from the deployment bundle')
     .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .option('--replace-restored', 'Intentionally replace a restored live release')

package/dist/commands/deploy.d.ts

@@ -7,7 +7,9 @@ export interface SubmitDeploymentOptions {
     endpoint?: string;
     replaceRestored?: boolean;
 }
-export interface DeployOptions extends SubmitDeploymentOptions {
+export interface DeployOptions {
+    endpoint?: string;
+    replaceRestored?: boolean;
     project?: string;
     environment?: string;
     bundleOutput?: string;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAc,SAAQ,uBAAuB;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA0EvC;AAmDD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAyDvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA0EvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAwCvC"}

package/dist/commands/deploy.js

@@ -140,43 +140,11 @@ async function rejectBundleDirectorySource(sourcePath) {
         + 'To upload this bundle, use `hypequery deployment:submit '
         + `${sourcePath} --release <file>\`.`);
 }
-/**
- * `deploy` exposes no runtime flags, so a runtime error from the shared build
- * command would otherwise point at flags this command does not accept.
- */
-function withRuntimeFlagHint(error) {
-    if (!(error instanceof Error) || !error.message.includes('--runtime'))
-        return error;
-    return new Error(`${error.message}\n\n`
-        + 'Runtime overrides are not available on `hypequery deploy`. Build with '
-        + '`hypequery deployment:build` (which accepts --runtime, --runtime-artifact, '
-        + 'and --runtime-file), then upload with `hypequery deployment:submit`.');
-}
-function rejectLegacyOrchestrationOptions(options) {
-    if (options.project !== undefined
-        || options.environment !== undefined
-        || options.bundleOutput !== undefined
-        || options.releaseOutput !== undefined) {
-        throw new Error('--release selects prebuilt submission mode and cannot be combined with '
-            + '--project, --environment, --bundle-output, or --release-output. '
-            + 'Use `hypequery deployment:submit` for explicit prebuilt uploads.');
-    }
-}
 export async function deployCommand(sourcePath, options = {}, dependencies = {}) {
     if (!sourcePath) {
         throw new Error('Missing API module path.\n\n'
             + 'Usage: hypequery deploy analytics/api.ts');
     }
-    if (options.release !== undefined) {
-        rejectLegacyOrchestrationOptions(options);
-        logger.warn('`hypequery deploy <bundle> --release <file>` is deprecated. '
-            + 'Use `hypequery deployment:submit <bundle> --release <file>` instead.');
-        return submitDeploymentCommand(sourcePath, {
-            release: options.release,
-            endpoint: options.endpoint,
-            replaceRestored: options.replaceRestored,
-        }, dependencies);
-    }
     await rejectBundleDirectorySource(sourcePath);
     const bundlePath = options.bundleOutput ?? DEFAULT_BUNDLE_PATH;
     const releasePath = options.releaseOutput
@@ -188,16 +156,11 @@ export async function deployCommand(sourcePath, options = {}, dependencies = {})
     // Resolve credentials up front. Submission is the last step, so without this
     // a missing or expired login only surfaces after a full bundle build.
     await resolveDeploymentCredential(options.endpoint, dependencies);
-    try {
-        await build(sourcePath, {
-            bundleOutput: bundlePath,
-            source: options.source,
-            allowUnsupportedConfig: options.allowUnsupportedConfig,
-        });
-    }
-    catch (error) {
-        throw withRuntimeFlagHint(error);
-    }
+    await build(sourcePath, {
+        bundleOutput: bundlePath,
+        source: options.source,
+        allowUnsupportedConfig: options.allowUnsupportedConfig,
+    });
     await prepareRelease(bundlePath, {
         project: options.project,
         environment: options.environment,

package/dist/commands/deployment.d.ts

@@ -2,13 +2,6 @@ import { type ProtocolDeploymentContract, type ProtocolDeploymentReleaseEnvelope
 import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
 export interface BuildDeploymentOptions {
     bundleOutput?: string;
-    output?: string;
-    runtime?: 'node' | 'python';
-    runtimeArtifact?: string;
-    runtimeFile?: string;
-    runtimeOutput?: string;
-    entrypointPrefix?: string;
-    hashOutput?: string;
     source?: boolean;
     allowUnsupportedConfig?: boolean;
 }

package/dist/commands/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAgB7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAI5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAsDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA0JrC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CA2ErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAYD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAyCrC;AAUD,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}

package/dist/commands/deployment.js

@@ -1,177 +1,49 @@
-import { createHash } from 'node:crypto';
 import { lstat, mkdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { prepareProtocolDeploymentReleaseEnvelope, prepareProtocolDeploymentContract, } from '@hypequery/protocol';
-import { writeDeploymentBundle, verifyDeploymentBundle, readDeploymentRuntimeFile, } from '../utils/deployment-bundle.js';
-import { buildNodeRuntimeArtifact, getDeploymentRuntimeEntrypoints, } from '../utils/deployment-runtime-artifact.js';
+import { writeDeploymentBundle, verifyDeploymentBundle, } from '../utils/deployment-bundle.js';
 import { captureDeploymentSourceSnapshot } from '../utils/deployment-source-snapshot.js';
 import { loadApiModule } from '../utils/load-api.js';
 import { logger } from '../utils/logger.js';
 import { reportCloudDiagnostic } from '../utils/cloud-diagnostic.js';
 import { loadCloudCredential, } from '../utils/cloud-credential-store.js';
-const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const DEFAULT_BUNDLE_OUTPUT = 'analytics/hypequery-deployment';
-function runtimeName(options) {
-    const runtime = options.runtime ?? 'node';
-    if (runtime !== 'node' && runtime !== 'python') {
-        throw new Error('--runtime must be either node or python.');
-    }
-    return runtime;
-}
-function configuredRuntimeArtifact(options, runtime) {
-    if (options.runtimeArtifact === undefined)
-        return undefined;
-    if (!SHA256_PATTERN.test(options.runtimeArtifact)) {
-        throw new Error('--runtime-artifact must be a lowercase 64-character SHA-256 digest.');
-    }
-    return {
-        runtime,
-        artifactSha256: options.runtimeArtifact,
-        ...(options.entrypointPrefix !== undefined
-            ? { entrypointPrefix: options.entrypointPrefix }
-            : {}),
-    };
-}
-function assertDistinctOutputPaths(paths) {
-    const seen = new Map();
-    for (const [label, value] of Object.entries(paths)) {
-        if (value === undefined)
-            continue;
-        const resolved = path.resolve(value);
-        const existing = seen.get(resolved);
-        if (existing) {
-            throw new Error(`${label} must use a different path from ${existing}.`);
-        }
-        seen.set(resolved, label);
-    }
-}
 export async function buildDeploymentCommand(apiPath, options = {}) {
     if (!apiPath) {
         throw new Error('Missing API module path.\n\n'
             + 'Usage: hypequery deployment:build analytics/api.ts');
     }
-    const runtime = runtimeName(options);
-    const configuredArtifact = configuredRuntimeArtifact(options, runtime);
-    const legacyOutputRequested = options.output !== undefined
-        || options.hashOutput !== undefined
-        || options.runtimeOutput !== undefined;
-    if (options.bundleOutput !== undefined && legacyOutputRequested) {
-        throw new Error('--bundle-output cannot be combined with --output, --hash-output, or --runtime-output.');
-    }
-    const bundleOutput = options.bundleOutput
-        ?? (legacyOutputRequested ? undefined : DEFAULT_BUNDLE_OUTPUT);
-    if (options.runtimeFile !== undefined && configuredArtifact === undefined) {
-        throw new Error('--runtime-file requires --runtime-artifact.');
-    }
-    if (options.runtimeFile !== undefined && bundleOutput === undefined) {
-        throw new Error('--runtime-file is only supported when building a deployment bundle.');
-    }
-    if (configuredArtifact && bundleOutput !== undefined && options.runtimeFile === undefined) {
-        throw new Error('A complete deployment bundle requires --runtime-file with a prebuilt --runtime-artifact.');
-    }
-    if (configuredArtifact && options.runtimeOutput !== undefined) {
-        throw new Error('--runtime-output cannot be used with a prebuilt --runtime-artifact.');
-    }
-    const outputPath = options.output ?? 'analytics/hypequery-deployment.json';
-    const hashOutputPath = options.hashOutput ?? `${outputPath}.sha256`;
-    if (options.runtimeOutput !== undefined) {
-        assertDistinctOutputPaths({
-            '--output': outputPath,
-            '--hash-output': hashOutputPath,
-            '--runtime-output': options.runtimeOutput,
-        });
-    }
+    const bundleOutput = options.bundleOutput ?? DEFAULT_BUNDLE_OUTPUT;
     const api = await loadApiModule(apiPath);
     if (typeof api.deploymentContract !== 'function') {
         throw new Error(`Invalid API module: ${apiPath}\n\n`
             + 'The exported API must provide deploymentContract(). '
             + 'Upgrade @hypequery/serve and export the value returned by createAPI() or serve().');
     }
-    let builtArtifact;
-    let artifact = configuredArtifact;
-    if (!artifact) {
-        const runtimeEntrypoints = getDeploymentRuntimeEntrypoints(api);
-        if (runtimeEntrypoints.length > 0) {
-            if (runtime !== 'node') {
-                throw new Error('Automatic runtime artifact builds currently support Node only. '
-                    + 'Provide --runtime-artifact for Python deployments.');
-            }
-            builtArtifact = await buildNodeRuntimeArtifact(apiPath, runtimeEntrypoints, options.entrypointPrefix);
-            artifact = {
-                runtime: 'node',
-                artifactSha256: builtArtifact.artifactSha256,
-                entrypointPrefix: builtArtifact.entrypointPrefix,
-            };
-        }
-    }
     const contract = api.deploymentContract({
-        ...(artifact ? { runtimeArtifact: artifact } : {}),
         ...(options.allowUnsupportedConfig ? { allowUnsupportedConfig: true } : {}),
         onCloudDiagnostic: diagnostic => reportCloudDiagnostic(diagnostic, options.allowUnsupportedConfig === true),
     });
     const prepared = prepareProtocolDeploymentContract(contract);
-    const { canonical, contract: validated, identity: digest } = prepared;
-    if (bundleOutput !== undefined) {
-        const runtimeFiles = [];
-        if (builtArtifact) {
-            runtimeFiles.push({
-                runtime: 'node',
-                sha256: builtArtifact.artifactSha256,
-                bytes: builtArtifact.bytes,
-            });
-        }
-        else if (configuredArtifact && options.runtimeFile) {
-            const bytes = await readDeploymentRuntimeFile(options.runtimeFile);
-            const actualSha256 = createHash('sha256').update(bytes).digest('hex');
-            if (actualSha256 !== configuredArtifact.artifactSha256) {
-                throw new Error(`Prebuilt runtime artifact SHA-256 mismatch: ${options.runtimeFile}\n\n`
-                    + `Expected: ${configuredArtifact.artifactSha256}\nActual: ${actualSha256}`);
-            }
-            runtimeFiles.push({ runtime, sha256: actualSha256, bytes });
-        }
-        const sourceSnapshot = options.source === false
-            ? undefined
-            : await captureDeploymentSourceSnapshot(apiPath);
-        const bundle = await writeDeploymentBundle(bundleOutput, prepared, runtimeFiles, sourceSnapshot);
-        logger.success(`Deployment bundle written to ${bundle.directory}`);
-        if (bundle.manifest.source) {
-            logger.info(`Captured ${bundle.manifest.source.files.length} source `
-                + `${bundle.manifest.source.files.length === 1 ? 'file' : 'files'}`);
-        }
-        logger.info(`Bundle identity: ${bundle.identity}`);
-        logger.info(`Deployment identity: ${digest}`);
-        return validated;
-    }
-    const runtimeOutputPath = builtArtifact
-        ? options.runtimeOutput ?? path.join(path.dirname(outputPath), 'hypequery-runtime.mjs')
-        : undefined;
-    assertDistinctOutputPaths({
-        '--output': outputPath,
-        '--hash-output': hashOutputPath,
-        '--runtime-output': runtimeOutputPath,
-    });
-    const identitySidecar = [
-        '# Hypequery deployment identity v1; not a file checksum or sha256sum input.',
-        '# SHA-256(UTF-8("hypequery:deployment:v1") || 0x00 || RFC 8785 canonical bytes); '
-            + 'the output newline is excluded.',
-        `${digest}  ${path.basename(outputPath)}`,
-        '',
-    ].join('\n');
-    await mkdir(path.dirname(outputPath), { recursive: true });
-    await mkdir(path.dirname(hashOutputPath), { recursive: true });
-    if (runtimeOutputPath && builtArtifact) {
-        await mkdir(path.dirname(runtimeOutputPath), { recursive: true });
-        await writeFile(runtimeOutputPath, builtArtifact.bytes);
-    }
-    await writeFile(outputPath, `${canonical}\n`, 'utf8');
-    await writeFile(hashOutputPath, identitySidecar, 'utf8');
-    if (runtimeOutputPath && builtArtifact) {
-        logger.success(`Runtime artifact written to ${runtimeOutputPath}`);
-        logger.info(`Runtime artifact SHA-256: ${builtArtifact.artifactSha256}`);
-    }
-    logger.success(`Deployment contract written to ${outputPath}`);
-    logger.info(`Identity: ${digest}`);
-    return validated;
+    const sourceSnapshot = options.source === false
+        ? undefined
+        : await captureDeploymentSourceSnapshot(apiPath);
+    const bundle = await writeDeploymentBundle(bundleOutput, prepared, sourceSnapshot);
+    logger.success(`Deployment bundle written to ${bundle.directory}`);
+    if (bundle.manifest.source) {
+        logger.info(`Captured ${bundle.manifest.source.files.length} source `
+            + `${bundle.manifest.source.files.length === 1 ? 'file' : 'files'}`);
+    }
+    logger.info(`${prepared.contract.datasets.length} `
+        + `${prepared.contract.datasets.length === 1 ? 'dataset' : 'datasets'}, 0 runtime artifacts`);
+    logger.info(`Bundle identity: ${bundle.identity}`);
+    logger.info(`Deployment identity: ${prepared.identity}`);
+    return prepared.contract;
+}
+function describeContract(contract) {
+    const datasets = `${contract.datasets.length} `
+        + `${contract.datasets.length === 1 ? 'dataset' : 'datasets'}`;
+    return datasets;
 }
 export async function validateDeploymentCommand(artifactPath) {
     if (!artifactPath) {
@@ -194,8 +66,7 @@ export async function validateDeploymentCommand(artifactPath) {
             const bundle = await verifyDeploymentBundle(artifactPath);
             const contract = bundle.contract;
             logger.success(`Valid deployment bundle: ${artifactPath}`);
-            logger.info(`${contract.datasets.length} datasets, ${contract.queries.length} queries, `
-                + `${contract.artifacts.length} runtime artifacts`);
+            logger.info(describeContract(contract));
             logger.info(`Bundle identity: ${bundle.identity}`);
             logger.info(`Deployment identity: ${bundle.manifest.deployment.identity}`);
             return contract;
@@ -226,8 +97,7 @@ export async function validateDeploymentCommand(artifactPath) {
     }
     const { contract, identity: digest } = prepared;
     logger.success(`Valid deployment contract: ${artifactPath}`);
-    logger.info(`${contract.datasets.length} datasets, ${contract.queries.length} queries, `
-        + `${contract.artifacts.length} runtime artifacts`);
+    logger.info(describeContract(contract));
     logger.info(`Identity: ${digest}`);
     return contract;
 }

package/dist/utils/deployment-bundle.d.ts

@@ -1,13 +1,8 @@
-import { type PreparedProtocolDeploymentContract, type ProtocolDeploymentBundleManifest, type ProtocolDeploymentContract } from '@hypequery/protocol';
+import { type PreparedProtocolDeploymentContract, type ProtocolDeploymentContract, type ProtocolDeploymentBundleManifest } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_CONTRACT, DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle } from '@hypequery/deployment';
 import type { VerifiedDeploymentBundle } from '@hypequery/deployment';
 export { DEPLOYMENT_BUNDLE_CONTRACT, DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, };
 export type { VerifiedDeploymentBundle };
-export interface DeploymentBundleRuntimeFile {
-    readonly runtime: 'node' | 'python';
-    readonly sha256: string;
-    readonly bytes: Uint8Array;
-}
 export interface DeploymentBundleSourceFile {
     readonly path: string;
     readonly bytes: Uint8Array;
@@ -28,6 +23,5 @@ export interface WrittenDeploymentBundle {
     readonly identity: string;
     readonly contract: ProtocolDeploymentContract;
 }
-export declare function writeDeploymentBundle(outputDirectory: string, prepared: PreparedProtocolDeploymentContract, runtimeFiles: readonly DeploymentBundleRuntimeFile[], sourceSnapshot?: DeploymentBundleSourceSnapshot): Promise<WrittenDeploymentBundle>;
-export declare function readDeploymentRuntimeFile(filePath: string): Promise<Uint8Array>;
+export declare function writeDeploymentBundle(outputDirectory: string, prepared: PreparedProtocolDeploymentContract, sourceSnapshot?: DeploymentBundleSourceSnapshot): Promise<WrittenDeploymentBundle>;
 //# sourceMappingURL=deployment-bundle.d.ts.map

package/dist/utils/deployment-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-bundle.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-bundle.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,CAAC;AACF,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AA0ID,wBAAsB,qBAAqB,CACzC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,kCAAkC,EAC5C,YAAY,EAAE,SAAS,2BAA2B,EAAE,EACpD,cAAc,CAAC,EAAE,8BAA8B,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CA+FlC;AAoCD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAMrF"}
+{"version":3,"file":"deployment-bundle.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-bundle.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACtC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,CAAC;AACF,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AA4ED,wBAAsB,qBAAqB,CACzC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,kCAAkC,EAC5C,cAAc,CAAC,EAAE,8BAA8B,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAkFlC"}

package/dist/utils/deployment-bundle.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { constants, lstat, mkdir, mkdtemp, open, rename, rm, writeFile, } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, rename, rm, writeFile, } from 'node:fs/promises';
 import path from 'node:path';
 import { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, prepareProtocolDeploymentBundleManifest, } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_CONTRACT, DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, } from '@hypequery/deployment';
@@ -9,9 +9,6 @@ const utf8Encoder = new TextEncoder();
 function sha256(bytes) {
     return createHash('sha256').update(bytes).digest('hex');
 }
-function runtimeArtifactPath(runtime, digest) {
-    return `artifacts/${digest}.${runtime === 'node' ? 'mjs' : 'pyz'}`;
-}
 const SOURCE_ROOT = 'source';
 function errorCode(error) {
     return typeof error === 'object' && error !== null && 'code' in error
@@ -37,53 +34,6 @@ async function existingVerifiedBundle(outputDirectory) {
     }
     return true;
 }
-function validateRuntimeFiles(prepared, files) {
-    requireClosedContractArtifactSet(prepared.contract);
-    const declared = new Map(prepared.contract.artifacts.map(artifact => [artifact.artifactSha256, artifact.runtime]));
-    const supplied = new Map();
-    for (const file of files) {
-        if (sha256(file.bytes) !== file.sha256) {
-            throw new Error(`Runtime artifact bytes do not match SHA-256 ${file.sha256}.`);
-        }
-        if (declared.get(file.sha256) !== file.runtime) {
-            throw new Error(`Runtime artifact ${file.sha256} is not declared by the deployment contract as ${file.runtime}.`);
-        }
-        if (supplied.has(file.sha256)) {
-            throw new Error(`Duplicate runtime artifact bytes supplied for ${file.sha256}.`);
-        }
-        if (file.bytes.byteLength < 1
-            || file.bytes.byteLength > DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxArtifactBytes) {
-            throw new Error(`Runtime artifact ${file.sha256} exceeds the bundle byte limits.`);
-        }
-        supplied.set(file.sha256, file.runtime);
-    }
-    for (const [digest, runtime] of declared) {
-        if (supplied.get(digest) !== runtime) {
-            throw new Error(`Deployment bundle is missing ${runtime} runtime artifact ${digest}.`);
-        }
-    }
-    return Object.freeze([...files].sort((left, right) => {
-        const leftPath = runtimeArtifactPath(left.runtime, left.sha256);
-        const rightPath = runtimeArtifactPath(right.runtime, right.sha256);
-        return leftPath < rightPath ? -1 : leftPath > rightPath ? 1 : 0;
-    }));
-}
-function requireClosedContractArtifactSet(contract) {
-    const referenced = new Map();
-    for (const query of contract.queries) {
-        if (query.implementation.kind === 'runtime-reference') {
-            referenced.set(query.implementation.artifactSha256, query.implementation.runtime);
-        }
-    }
-    if (referenced.size !== contract.artifacts.length) {
-        throw new Error('Deployment contract contains missing or unreferenced runtime artifacts.');
-    }
-    for (const artifact of contract.artifacts) {
-        if (referenced.get(artifact.artifactSha256) !== artifact.runtime) {
-            throw new Error(`Deployment runtime artifact ${artifact.artifactSha256} is not referenced by a named query.`);
-        }
-    }
-}
 function validateSourceSnapshot(source) {
     if (!source)
         return undefined;
@@ -122,12 +72,11 @@ function validateSourceSnapshot(source) {
         ...(source.revision ? { revision: Object.freeze({ ...source.revision }) } : {}),
     });
 }
-export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFiles, sourceSnapshot) {
+export async function writeDeploymentBundle(outputDirectory, prepared, sourceSnapshot) {
     const destination = path.resolve(outputDirectory);
     if (destination === path.parse(destination).root) {
         throw new Error('The deployment bundle output cannot be a filesystem root.');
     }
-    const files = validateRuntimeFiles(prepared, runtimeFiles);
     const source = validateSourceSnapshot(sourceSnapshot);
     const deploymentBytes = utf8Encoder.encode(`${prepared.canonical}\n`);
     const manifestInput = {
@@ -139,12 +88,8 @@ export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFi
             sha256: sha256(deploymentBytes),
             byteLength: deploymentBytes.byteLength,
         },
-        artifacts: files.map(file => ({
-            runtime: file.runtime,
-            path: runtimeArtifactPath(file.runtime, file.sha256),
-            sha256: file.sha256,
-            byteLength: file.bytes.byteLength,
-        })),
+        // A deployment carries datasets: there is nothing else to put here.
+        artifacts: [],
         ...(source ? {
             source: {
                 root: SOURCE_ROOT,
@@ -164,12 +109,7 @@ export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFi
     await mkdir(parent, { recursive: true });
     const staging = await mkdtemp(path.join(parent, `.${path.basename(destination)}.tmp-`));
     try {
-        if (files.length > 0)
-            await mkdir(path.join(staging, 'artifacts'));
         await writeFile(path.join(staging, DEPLOYMENT_BUNDLE_CONTRACT), deploymentBytes, { flag: 'wx' });
-        for (const file of files) {
-            await writeFile(path.join(staging, runtimeArtifactPath(file.runtime, file.sha256)), file.bytes, { flag: 'wx' });
-        }
         for (const file of source?.files ?? []) {
             const outputPath = path.join(staging, SOURCE_ROOT, ...file.path.split('/'));
             await mkdir(path.dirname(outputPath), { recursive: true });
@@ -209,38 +149,3 @@ export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFi
         contract: prepared.contract,
     });
 }
-async function readBoundedAbsoluteRegularFile(absolutePath, displayPath, maximum) {
-    let handle;
-    try {
-        const initialStat = await lstat(absolutePath);
-        if (initialStat.isSymbolicLink()) {
-            throw new Error(`Bundle entry must not be a symbolic link: ${displayPath}`);
-        }
-        if (!initialStat.isFile()) {
-            throw new Error(`Bundle entry is not a regular file: ${displayPath}`);
-        }
-        if (initialStat.size < 1 || initialStat.size > maximum) {
-            throw new Error(`Bundle entry exceeds its byte limit: ${displayPath}`);
-        }
-        handle = await open(absolutePath, constants.O_RDONLY | constants.O_NOFOLLOW);
-        const stat = await handle.stat();
-        if (!stat.isFile())
-            throw new Error(`Bundle entry is not a regular file: ${displayPath}`);
-        if (stat.size < 1 || stat.size > maximum) {
-            throw new Error(`Bundle entry exceeds its byte limit: ${displayPath}`);
-        }
-        return await handle.readFile();
-    }
-    catch (error) {
-        if (errorCode(error) === 'ELOOP') {
-            throw new Error(`Bundle entry must not be a symbolic link: ${displayPath}`);
-        }
-        throw error;
-    }
-    finally {
-        await handle?.close();
-    }
-}
-export async function readDeploymentRuntimeFile(filePath) {
-    return readBoundedAbsoluteRegularFile(path.resolve(filePath), filePath, DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxArtifactBytes);
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -30,8 +30,8 @@
     "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.7.5",
-    "@hypequery/protocol": "0.12.0"
+    "@hypequery/deployment": "0.9.0",
+    "@hypequery/protocol": "0.14.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"
@@ -51,8 +51,8 @@
     "@vitest/coverage-v8": "^3.2.6",
     "typescript": "^5.7.3",
     "vitest": "^3.2.6",
-    "@hypequery/mcp": "0.6.0",
-    "@hypequery/serve": "0.17.0"
+    "@hypequery/mcp": "0.8.1",
+    "@hypequery/serve": "0.18.0"
   },
   "repository": {
     "type": "git",

package/dist/utils/deployment-runtime-artifact.d.ts

@@ -1,9 +0,0 @@
-export interface NodeRuntimeArtifact {
-    readonly bytes: Uint8Array;
-    readonly artifactSha256: string;
-    readonly entrypointPrefix: string;
-    readonly runtimeEntrypoints: readonly string[];
-}
-export declare function getDeploymentRuntimeEntrypoints(input: unknown): readonly string[];
-export declare function buildNodeRuntimeArtifact(apiPath: string, runtimeEntrypoints: readonly string[], entrypointPrefix?: string): Promise<NodeRuntimeArtifact>;
-//# sourceMappingURL=deployment-runtime-artifact.d.ts.map

package/dist/utils/deployment-runtime-artifact.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deployment-runtime-artifact.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-runtime-artifact.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AASD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CA6BjF;AAiED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,SAAY,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAmD9B"}

package/dist/utils/deployment-runtime-artifact.js

@@ -1,162 +0,0 @@
-import { createHash } from 'node:crypto';
-import path from 'node:path';
-import { parseProtocolIdentifier, parseProtocolQualifiedIdentifier, } from '@hypequery/protocol';
-import { build } from 'esbuild';
-import { findNearestTsconfig } from './load-api.js';
-const deploymentBuildSourceSymbol = Symbol.for('hypequery.deployment-build-source.v1');
-function executableQuery(query) {
-    return typeof query === 'function'
-        || (typeof query === 'object'
-            && query !== null
-            && typeof query.run === 'function');
-}
-export function getDeploymentRuntimeEntrypoints(input) {
-    if (typeof input !== 'object' || input === null) {
-        throw new Error('Invalid API module: deployment build metadata is unavailable.');
-    }
-    const api = input;
-    const source = api[deploymentBuildSourceSymbol];
-    if (source?.version !== 1 || !Array.isArray(source.runtimeEntrypoints)) {
-        throw new Error('The exported API does not expose deployment build metadata. '
-            + 'Upgrade @hypequery/serve before building runtime artifacts.');
-    }
-    const names = source.runtimeEntrypoints.map((name) => {
-        try {
-            return parseProtocolIdentifier(name);
-        }
-        catch {
-            throw new Error(`Invalid runtime entrypoint name: ${String(name)}`);
-        }
-    });
-    if (new Set(names).size !== names.length) {
-        throw new Error('Deployment build metadata contains duplicate runtime entrypoints.');
-    }
-    for (const name of names) {
-        if (!executableQuery(api.queries?.[name]?.query)) {
-            throw new Error(`Serve query "${name}" does not expose an executable runtime handler.`);
-        }
-    }
-    return Object.freeze([...names].sort());
-}
-function projectRelativeImport(apiPath) {
-    const resolved = path.resolve(process.cwd(), apiPath);
-    const relative = path.relative(process.cwd(), resolved);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-        throw new Error('The API module must be inside the current project for deterministic bundling.');
-    }
-    const portable = relative.split(path.sep).join('/');
-    return {
-        resolved,
-        specifier: portable.startsWith('.') ? portable : `./${portable}`,
-    };
-}
-function runtimeEntrySource(apiSpecifier, runtimeEntrypoints, entrypointPrefix) {
-    const prefix = parseProtocolQualifiedIdentifier(entrypointPrefix).split('.');
-    const names = JSON.stringify(runtimeEntrypoints);
-    let registryExpression = 'runtimeEntries';
-    for (let index = prefix.length - 1; index >= 1; index -= 1) {
-        registryExpression = `Object.freeze({ ${prefix[index]}: ${registryExpression} })`;
-    }
-    return [
-        `import * as apiModule from ${JSON.stringify(apiSpecifier)};`,
-        'const api = apiModule.api ?? Reflect.get(apiModule, "default");',
-        'if (!api || typeof api !== "object") throw new Error("Runtime API export is unavailable.");',
-        'const resolveQuery = (name) => {',
-        '  if (typeof api.execute === "function") {',
-        '    // Serve entrypoint names are validated against api.queries before bundling.',
-        '    return (argument = {}) => api.execute(name, {',
-        '      input: argument.input,',
-        '      ...(argument.context === undefined ? {} : { context: argument.context }),',
-        '      ...(argument.request === undefined ? {} : { request: argument.request }),',
-        '      ...(argument.requestId === undefined ? {} : { requestId: argument.requestId }),',
-        // A null principal means "no trusted principal"; forwarding it would skip the
-        // API's own auth strategies instead of falling through to them.
-        '      ...(argument.trustedAuth == null ? {} : { trustedAuth: argument.trustedAuth }),',
-        '    });',
-        '  }',
-        '  const entry = api.queries?.[name];',
-        '  const query = entry?.query;',
-        '  let run;',
-        '  if (typeof query === "function") run = query;',
-        '  else if (query && typeof query === "object" && typeof query.run === "function") run = query.run.bind(query);',
-        '  if (!run) throw new Error(`Runtime entrypoint ${name} is unavailable.`);',
-        '  // Without a Serve execute() pipeline there is nothing to enforce roles, scopes,',
-        '  // or tenancy, so refuse a trusted principal instead of silently ignoring it.',
-        '  return (argument = {}) => {',
-        '    if (argument?.trustedAuth != null) {',
-        '      throw new Error(`Runtime entrypoint ${name} cannot enforce a trusted principal without a Serve execute() pipeline.`);',
-        '    }',
-        '    return run(argument);',
-        '  };',
-        '};',
-        `const runtimeEntries = Object.freeze(Object.fromEntries(${names}.map(name => [name, resolveQuery(name)])));`,
-        `export const ${prefix[0]} = ${registryExpression};`,
-        '',
-    ].join('\n');
-}
-export async function buildNodeRuntimeArtifact(apiPath, runtimeEntrypoints, entrypointPrefix = 'queries') {
-    if (runtimeEntrypoints.length === 0) {
-        throw new Error('Cannot build a runtime artifact without Serve query entrypoints.');
-    }
-    const names = getValidatedEntrypointNames(runtimeEntrypoints);
-    const { resolved, specifier } = projectRelativeImport(apiPath);
-    let source;
-    try {
-        source = runtimeEntrySource(specifier, names, entrypointPrefix);
-    }
-    catch {
-        throw new Error(`Invalid runtime entrypoint prefix: ${entrypointPrefix}`);
-    }
-    try {
-        const result = await build({
-            stdin: {
-                contents: source,
-                loader: 'ts',
-                resolveDir: process.cwd(),
-                sourcefile: 'hypequery-runtime-entry.ts',
-            },
-            absWorkingDir: process.cwd(),
-            bundle: true,
-            charset: 'utf8',
-            format: 'esm',
-            legalComments: 'none',
-            logLevel: 'warning',
-            minify: true,
-            platform: 'node',
-            sourcemap: false,
-            target: ['node18'],
-            treeShaking: true,
-            tsconfig: await findNearestTsconfig(resolved) ?? undefined,
-            write: false,
-        });
-        const output = result.outputFiles?.find(file => file.path.endsWith('.js'))
-            ?? result.outputFiles?.[0];
-        if (!output)
-            throw new Error('esbuild produced no output');
-        const bytes = output.contents;
-        return Object.freeze({
-            bytes,
-            artifactSha256: createHash('sha256').update(bytes).digest('hex'),
-            entrypointPrefix,
-            runtimeEntrypoints: names,
-        });
-    }
-    catch (error) {
-        throw new Error(`Failed to build the Node runtime artifact from ${apiPath}.\n`
-            + `Original error: ${error instanceof Error ? error.message : String(error)}`);
-    }
-}
-function getValidatedEntrypointNames(input) {
-    const names = input.map((name) => {
-        try {
-            return parseProtocolIdentifier(name);
-        }
-        catch {
-            throw new Error(`Invalid runtime entrypoint name: ${name}`);
-        }
-    });
-    if (new Set(names).size !== names.length) {
-        throw new Error('Runtime entrypoint names must be unique.');
-    }
-    return Object.freeze([...names].sort());
-}