@hypequery/cli 1.19.1 → 1.21.0

package/README.md

@@ -18,8 +18,29 @@ For a semantic layer:
 
 ```bash
 npx hypequery init --style datasets
+npx hypequery login
+npx hypequery deploy analytics/cloud.ts
 ```
 
+The dataset scaffold writes `analytics/cloud.ts` alongside the local
+`analytics/api.ts`. Its Cloud publication is explicit:
+
+```ts
+import { publishToCloud } from '@hypequery/datasets';
+import { datasets } from './datasets.js';
+
+export const cloud = publishToCloud({
+  datasets,
+  access: { roles: [], scopes: [] },
+});
+```
+
+`api.ts` remains the local Serve entrypoint. Cloud deployment builds from
+`cloud.ts` and does not load Serve configuration. This first Cloud publisher
+accepts datasets only; it rejects named metrics rather than dropping them.
+The required access policy makes the authenticated roles and scopes visible
+before an existing project moves away from Serve-based publishing.
+
 For embedded analytics without a ClickHouse server:
 
 ```bash
@@ -38,7 +59,7 @@ npx hypequery init \
 | `hypequery generate:datasets` | Dataset definitions scaffolded from tables |
 | `hypequery generate:manifest` | A browser-safe route manifest for React hooks |
 | `hypequery login` | An authenticated Cloud target |
-| `hypequery deploy` | A verified deployment of the analytics API |
+| `hypequery deploy analytics/cloud.ts` | A verified dataset-only Cloud deployment |
 | `hypequery pull` / `diff` | Live source inspection and comparison |
 
 Non-interactive ClickHouse commands read `CLICKHOUSE_URL`, `CLICKHOUSE_DATABASE`, `CLICKHOUSE_USERNAME`, and `CLICKHOUSE_PASSWORD`.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAqRD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAqQD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -167,24 +167,16 @@ program
     await generateManifestCommand(api, options);
 }));
 program
-    .command('deployment:build <api>')
-    .description('Build a verified deployment bundle')
+    .command('deployment:build <cloud>')
+    .description('Build a verified dataset-only Cloud deployment bundle')
     .option('--bundle-output <directory>', 'Bundle directory (default: analytics/hypequery-deployment)')
-    .option('-o, --output <path>', 'Output JSON file (default: analytics/hypequery-deployment.json)')
-    .option('--runtime <runtime>', 'Runtime for non-portable handlers: node or python (default: node)')
-    .option('--runtime-artifact <sha256>', 'Use a prebuilt runtime artifact with this SHA-256 identity')
-    .option('--runtime-file <path>', 'Include the bytes for a prebuilt runtime artifact')
-    .option('--runtime-output <path>', 'Bundled Node runtime path (default: beside deployment JSON)')
-    .option('--entrypoint-prefix <prefix>', 'Runtime entrypoint prefix (default: queries)')
-    .option('--hash-output <path>', 'Deployment identity sidecar path (default: <output>.sha256)')
     .option('--no-source', 'Exclude project source files from the deployment bundle')
-    .option('--allow-unsupported-config', 'Deploy even though some Serve config will not be honoured in Cloud')
-    .action(runCommand(async (api, options) => {
-    await buildDeploymentCommand(api, options);
+    .action(runCommand(async (cloud, options) => {
+    await buildDeploymentCommand(cloud, options);
 }));
 program
     .command('deployment:validate <artifact>')
-    .description('Verify a deployment bundle or validate a legacy deployment JSON file')
+    .description('Verify a deployment bundle or validate a deployment contract JSON file')
     .action(runCommand(async (artifact) => {
     await validateDeploymentCommand(artifact);
 }));
@@ -208,16 +200,14 @@ program
 }));
 program
     .command('deploy <source>')
-    .description('Build, prepare, and deploy a Hypequery API module')
+    .description('Build, prepare, and deploy a dataset-only Cloud publication')
     .option('--bundle-output <directory>', 'Bundle directory (default: analytics/hypequery-deployment)')
     .option('--release-output <path>', 'Release JSON path (default: beside the bundle)')
     .option('--project <project>', 'Target project identifier (advanced override)')
     .option('--environment <environment>', 'Target environment identifier (advanced override)')
-    .option('--release <path>', 'Submit a prebuilt bundle with this release (legacy)')
     .option('--no-source', 'Exclude project source files from the deployment bundle')
     .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .option('--replace-restored', 'Intentionally replace a restored live release')
-    .option('--allow-unsupported-config', 'Deploy even though some Serve config will not be honoured in Cloud')
     .action(runCommand(async (source, options) => {
     await deployCommand(source, options);
 }));
@@ -253,9 +243,9 @@ program.on('--help', () => {
     console.log('  hypequery generate:types --output analytics/schema.ts');
     console.log('  hypequery generate:datasets');
     console.log('  hypequery generate:manifest analytics/api.ts --output analytics/hypequery-manifest.json');
-    console.log('  hypequery deploy analytics/api.ts');
-    console.log('  hypequery deploy analytics/api.ts --project my-project --environment production');
-    console.log('  hypequery deployment:build analytics/api.ts');
+    console.log('  hypequery deploy analytics/cloud.ts');
+    console.log('  hypequery deploy analytics/cloud.ts --project my-project --environment production');
+    console.log('  hypequery deployment:build analytics/cloud.ts');
     console.log('  hypequery deployment:validate analytics/hypequery-deployment');
     console.log('  hypequery deployment:release analytics/hypequery-deployment --project my-project --environment production');
     console.log('  hypequery deployment:submit analytics/hypequery-deployment --release analytics/hypequery-deployment.release.json');

package/dist/commands/deploy.d.ts

@@ -7,13 +7,14 @@ export interface SubmitDeploymentOptions {
     endpoint?: string;
     replaceRestored?: boolean;
 }
-export interface DeployOptions extends SubmitDeploymentOptions {
+export interface DeployOptions {
+    endpoint?: string;
+    replaceRestored?: boolean;
     project?: string;
     environment?: string;
     bundleOutput?: string;
     releaseOutput?: string;
     source?: boolean;
-    allowUnsupportedConfig?: boolean;
 }
 export interface SubmitDeploymentDependencies {
     readonly env?: Readonly<Record<string, string | undefined>>;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAc,SAAQ,uBAAuB;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA0EvC;AAmDD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAyDvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA0EvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAuCvC"}

package/dist/commands/deploy.js

@@ -123,7 +123,7 @@ export async function submitDeploymentCommand(bundlePath, options = {}, dependen
     return result;
 }
 /**
- * `deploy` takes an API module, but the deprecated form took a bundle
+ * `deploy` takes a Cloud publication module, but the deprecated form took a bundle
  * directory. Dropping `--release` from an existing script would otherwise hand
  * a bundle to the module loader and fail inside esbuild.
  */
@@ -135,47 +135,15 @@ async function rejectBundleDirectorySource(sourcePath) {
         return;
     }
     throw new Error(`Cannot deploy a prebuilt bundle directory: ${sourcePath}\n\n`
-        + '`hypequery deploy` takes the API module to build, for example '
-        + '`hypequery deploy analytics/api.ts`.\n'
+        + '`hypequery deploy` takes a Cloud publication module, for example '
+        + '`hypequery deploy analytics/cloud.ts`.\n'
         + 'To upload this bundle, use `hypequery deployment:submit '
         + `${sourcePath} --release <file>\`.`);
 }
-/**
- * `deploy` exposes no runtime flags, so a runtime error from the shared build
- * command would otherwise point at flags this command does not accept.
- */
-function withRuntimeFlagHint(error) {
-    if (!(error instanceof Error) || !error.message.includes('--runtime'))
-        return error;
-    return new Error(`${error.message}\n\n`
-        + 'Runtime overrides are not available on `hypequery deploy`. Build with '
-        + '`hypequery deployment:build` (which accepts --runtime, --runtime-artifact, '
-        + 'and --runtime-file), then upload with `hypequery deployment:submit`.');
-}
-function rejectLegacyOrchestrationOptions(options) {
-    if (options.project !== undefined
-        || options.environment !== undefined
-        || options.bundleOutput !== undefined
-        || options.releaseOutput !== undefined) {
-        throw new Error('--release selects prebuilt submission mode and cannot be combined with '
-            + '--project, --environment, --bundle-output, or --release-output. '
-            + 'Use `hypequery deployment:submit` for explicit prebuilt uploads.');
-    }
-}
 export async function deployCommand(sourcePath, options = {}, dependencies = {}) {
     if (!sourcePath) {
-        throw new Error('Missing API module path.\n\n'
-            + 'Usage: hypequery deploy analytics/api.ts');
-    }
-    if (options.release !== undefined) {
-        rejectLegacyOrchestrationOptions(options);
-        logger.warn('`hypequery deploy <bundle> --release <file>` is deprecated. '
-            + 'Use `hypequery deployment:submit <bundle> --release <file>` instead.');
-        return submitDeploymentCommand(sourcePath, {
-            release: options.release,
-            endpoint: options.endpoint,
-            replaceRestored: options.replaceRestored,
-        }, dependencies);
+        throw new Error('Missing Cloud publication module path.\n\n'
+            + 'Usage: hypequery deploy analytics/cloud.ts');
     }
     await rejectBundleDirectorySource(sourcePath);
     const bundlePath = options.bundleOutput ?? DEFAULT_BUNDLE_PATH;
@@ -188,16 +156,10 @@ export async function deployCommand(sourcePath, options = {}, dependencies = {})
     // Resolve credentials up front. Submission is the last step, so without this
     // a missing or expired login only surfaces after a full bundle build.
     await resolveDeploymentCredential(options.endpoint, dependencies);
-    try {
-        await build(sourcePath, {
-            bundleOutput: bundlePath,
-            source: options.source,
-            allowUnsupportedConfig: options.allowUnsupportedConfig,
-        });
-    }
-    catch (error) {
-        throw withRuntimeFlagHint(error);
-    }
+    await build(sourcePath, {
+        bundleOutput: bundlePath,
+        source: options.source,
+    });
     await prepareRelease(bundlePath, {
         project: options.project,
         environment: options.environment,

package/dist/commands/deployment.d.ts

@@ -2,15 +2,7 @@ import { type ProtocolDeploymentContract, type ProtocolDeploymentReleaseEnvelope
 import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
 export interface BuildDeploymentOptions {
     bundleOutput?: string;
-    output?: string;
-    runtime?: 'node' | 'python';
-    runtimeArtifact?: string;
-    runtimeFile?: string;
-    runtimeOutput?: string;
-    entrypointPrefix?: string;
-    hashOutput?: string;
     source?: boolean;
-    allowUnsupportedConfig?: boolean;
 }
 export interface PrepareDeploymentReleaseOptions {
     project?: string;
@@ -25,7 +17,7 @@ export interface PrepareDeploymentReleaseDependencies {
      */
     outputFlagLabel?: string;
 }
-export declare function buildDeploymentCommand(apiPath: string | undefined, options?: BuildDeploymentOptions): Promise<ProtocolDeploymentContract>;
+export declare function buildDeploymentCommand(sourcePath: string | undefined, options?: BuildDeploymentOptions): Promise<ProtocolDeploymentContract>;
 export declare function validateDeploymentCommand(artifactPath: string | undefined): Promise<ProtocolDeploymentContract>;
 export declare function prepareDeploymentReleaseCommand(bundlePath: string | undefined, options?: PrepareDeploymentReleaseOptions, dependencies?: PrepareDeploymentReleaseDependencies): Promise<ProtocolDeploymentReleaseEnvelope>;
 //# sourceMappingURL=deployment.d.ts.map

package/dist/commands/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAgB7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAI5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAsDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA0JrC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CA2ErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAkCrC;AAUD,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}

package/dist/commands/deployment.js

@@ -1,177 +1,44 @@
-import { createHash } from 'node:crypto';
 import { lstat, mkdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { prepareProtocolDeploymentReleaseEnvelope, prepareProtocolDeploymentContract, } from '@hypequery/protocol';
-import { writeDeploymentBundle, verifyDeploymentBundle, readDeploymentRuntimeFile, } from '../utils/deployment-bundle.js';
-import { buildNodeRuntimeArtifact, getDeploymentRuntimeEntrypoints, } from '../utils/deployment-runtime-artifact.js';
+import { writeDeploymentBundle, verifyDeploymentBundle, } from '../utils/deployment-bundle.js';
 import { captureDeploymentSourceSnapshot } from '../utils/deployment-source-snapshot.js';
-import { loadApiModule } from '../utils/load-api.js';
+import { loadCloudPublication } from '../utils/load-cloud-publication.js';
 import { logger } from '../utils/logger.js';
-import { reportCloudDiagnostic } from '../utils/cloud-diagnostic.js';
 import { loadCloudCredential, } from '../utils/cloud-credential-store.js';
-const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const DEFAULT_BUNDLE_OUTPUT = 'analytics/hypequery-deployment';
-function runtimeName(options) {
-    const runtime = options.runtime ?? 'node';
-    if (runtime !== 'node' && runtime !== 'python') {
-        throw new Error('--runtime must be either node or python.');
+export async function buildDeploymentCommand(sourcePath, options = {}) {
+    if (!sourcePath) {
+        throw new Error('Missing Cloud publication module path.\n\n'
+            + 'Usage: hypequery deployment:build analytics/cloud.ts');
+    }
+    const bundleOutput = options.bundleOutput ?? DEFAULT_BUNDLE_OUTPUT;
+    const contract = await loadCloudPublication(sourcePath);
+    const candidate = contract;
+    if ((Array.isArray(candidate.queries) && candidate.queries.length > 0)
+        || (Array.isArray(candidate.artifacts) && candidate.artifacts.length > 0)) {
+        throw new Error('Cloud publication modules may publish datasets only.');
     }
-    return runtime;
-}
-function configuredRuntimeArtifact(options, runtime) {
-    if (options.runtimeArtifact === undefined)
-        return undefined;
-    if (!SHA256_PATTERN.test(options.runtimeArtifact)) {
-        throw new Error('--runtime-artifact must be a lowercase 64-character SHA-256 digest.');
-    }
-    return {
-        runtime,
-        artifactSha256: options.runtimeArtifact,
-        ...(options.entrypointPrefix !== undefined
-            ? { entrypointPrefix: options.entrypointPrefix }
-            : {}),
-    };
-}
-function assertDistinctOutputPaths(paths) {
-    const seen = new Map();
-    for (const [label, value] of Object.entries(paths)) {
-        if (value === undefined)
-            continue;
-        const resolved = path.resolve(value);
-        const existing = seen.get(resolved);
-        if (existing) {
-            throw new Error(`${label} must use a different path from ${existing}.`);
-        }
-        seen.set(resolved, label);
-    }
-}
-export async function buildDeploymentCommand(apiPath, options = {}) {
-    if (!apiPath) {
-        throw new Error('Missing API module path.\n\n'
-            + 'Usage: hypequery deployment:build analytics/api.ts');
-    }
-    const runtime = runtimeName(options);
-    const configuredArtifact = configuredRuntimeArtifact(options, runtime);
-    const legacyOutputRequested = options.output !== undefined
-        || options.hashOutput !== undefined
-        || options.runtimeOutput !== undefined;
-    if (options.bundleOutput !== undefined && legacyOutputRequested) {
-        throw new Error('--bundle-output cannot be combined with --output, --hash-output, or --runtime-output.');
-    }
-    const bundleOutput = options.bundleOutput
-        ?? (legacyOutputRequested ? undefined : DEFAULT_BUNDLE_OUTPUT);
-    if (options.runtimeFile !== undefined && configuredArtifact === undefined) {
-        throw new Error('--runtime-file requires --runtime-artifact.');
-    }
-    if (options.runtimeFile !== undefined && bundleOutput === undefined) {
-        throw new Error('--runtime-file is only supported when building a deployment bundle.');
-    }
-    if (configuredArtifact && bundleOutput !== undefined && options.runtimeFile === undefined) {
-        throw new Error('A complete deployment bundle requires --runtime-file with a prebuilt --runtime-artifact.');
-    }
-    if (configuredArtifact && options.runtimeOutput !== undefined) {
-        throw new Error('--runtime-output cannot be used with a prebuilt --runtime-artifact.');
-    }
-    const outputPath = options.output ?? 'analytics/hypequery-deployment.json';
-    const hashOutputPath = options.hashOutput ?? `${outputPath}.sha256`;
-    if (options.runtimeOutput !== undefined) {
-        assertDistinctOutputPaths({
-            '--output': outputPath,
-            '--hash-output': hashOutputPath,
-            '--runtime-output': options.runtimeOutput,
-        });
-    }
-    const api = await loadApiModule(apiPath);
-    if (typeof api.deploymentContract !== 'function') {
-        throw new Error(`Invalid API module: ${apiPath}\n\n`
-            + 'The exported API must provide deploymentContract(). '
-            + 'Upgrade @hypequery/serve and export the value returned by createAPI() or serve().');
-    }
-    let builtArtifact;
-    let artifact = configuredArtifact;
-    if (!artifact) {
-        const runtimeEntrypoints = getDeploymentRuntimeEntrypoints(api);
-        if (runtimeEntrypoints.length > 0) {
-            if (runtime !== 'node') {
-                throw new Error('Automatic runtime artifact builds currently support Node only. '
-                    + 'Provide --runtime-artifact for Python deployments.');
-            }
-            builtArtifact = await buildNodeRuntimeArtifact(apiPath, runtimeEntrypoints, options.entrypointPrefix);
-            artifact = {
-                runtime: 'node',
-                artifactSha256: builtArtifact.artifactSha256,
-                entrypointPrefix: builtArtifact.entrypointPrefix,
-            };
-        }
-    }
-    const contract = api.deploymentContract({
-        ...(artifact ? { runtimeArtifact: artifact } : {}),
-        ...(options.allowUnsupportedConfig ? { allowUnsupportedConfig: true } : {}),
-        onCloudDiagnostic: diagnostic => reportCloudDiagnostic(diagnostic, options.allowUnsupportedConfig === true),
-    });
     const prepared = prepareProtocolDeploymentContract(contract);
-    const { canonical, contract: validated, identity: digest } = prepared;
-    if (bundleOutput !== undefined) {
-        const runtimeFiles = [];
-        if (builtArtifact) {
-            runtimeFiles.push({
-                runtime: 'node',
-                sha256: builtArtifact.artifactSha256,
-                bytes: builtArtifact.bytes,
-            });
-        }
-        else if (configuredArtifact && options.runtimeFile) {
-            const bytes = await readDeploymentRuntimeFile(options.runtimeFile);
-            const actualSha256 = createHash('sha256').update(bytes).digest('hex');
-            if (actualSha256 !== configuredArtifact.artifactSha256) {
-                throw new Error(`Prebuilt runtime artifact SHA-256 mismatch: ${options.runtimeFile}\n\n`
-                    + `Expected: ${configuredArtifact.artifactSha256}\nActual: ${actualSha256}`);
-            }
-            runtimeFiles.push({ runtime, sha256: actualSha256, bytes });
-        }
-        const sourceSnapshot = options.source === false
-            ? undefined
-            : await captureDeploymentSourceSnapshot(apiPath);
-        const bundle = await writeDeploymentBundle(bundleOutput, prepared, runtimeFiles, sourceSnapshot);
-        logger.success(`Deployment bundle written to ${bundle.directory}`);
-        if (bundle.manifest.source) {
-            logger.info(`Captured ${bundle.manifest.source.files.length} source `
-                + `${bundle.manifest.source.files.length === 1 ? 'file' : 'files'}`);
-        }
-        logger.info(`Bundle identity: ${bundle.identity}`);
-        logger.info(`Deployment identity: ${digest}`);
-        return validated;
-    }
-    const runtimeOutputPath = builtArtifact
-        ? options.runtimeOutput ?? path.join(path.dirname(outputPath), 'hypequery-runtime.mjs')
-        : undefined;
-    assertDistinctOutputPaths({
-        '--output': outputPath,
-        '--hash-output': hashOutputPath,
-        '--runtime-output': runtimeOutputPath,
-    });
-    const identitySidecar = [
-        '# Hypequery deployment identity v1; not a file checksum or sha256sum input.',
-        '# SHA-256(UTF-8("hypequery:deployment:v1") || 0x00 || RFC 8785 canonical bytes); '
-            + 'the output newline is excluded.',
-        `${digest}  ${path.basename(outputPath)}`,
-        '',
-    ].join('\n');
-    await mkdir(path.dirname(outputPath), { recursive: true });
-    await mkdir(path.dirname(hashOutputPath), { recursive: true });
-    if (runtimeOutputPath && builtArtifact) {
-        await mkdir(path.dirname(runtimeOutputPath), { recursive: true });
-        await writeFile(runtimeOutputPath, builtArtifact.bytes);
-    }
-    await writeFile(outputPath, `${canonical}\n`, 'utf8');
-    await writeFile(hashOutputPath, identitySidecar, 'utf8');
-    if (runtimeOutputPath && builtArtifact) {
-        logger.success(`Runtime artifact written to ${runtimeOutputPath}`);
-        logger.info(`Runtime artifact SHA-256: ${builtArtifact.artifactSha256}`);
-    }
-    logger.success(`Deployment contract written to ${outputPath}`);
-    logger.info(`Identity: ${digest}`);
-    return validated;
+    const sourceSnapshot = options.source === false
+        ? undefined
+        : await captureDeploymentSourceSnapshot(sourcePath);
+    const bundle = await writeDeploymentBundle(bundleOutput, prepared, sourceSnapshot);
+    logger.success(`Deployment bundle written to ${bundle.directory}`);
+    if (bundle.manifest.source) {
+        logger.info(`Captured ${bundle.manifest.source.files.length} source `
+            + `${bundle.manifest.source.files.length === 1 ? 'file' : 'files'}`);
+    }
+    logger.info(`${prepared.contract.datasets.length} `
+        + `${prepared.contract.datasets.length === 1 ? 'dataset' : 'datasets'}, 0 runtime artifacts`);
+    logger.info(`Bundle identity: ${bundle.identity}`);
+    logger.info(`Deployment identity: ${prepared.identity}`);
+    return prepared.contract;
+}
+function describeContract(contract) {
+    const datasets = `${contract.datasets.length} `
+        + `${contract.datasets.length === 1 ? 'dataset' : 'datasets'}`;
+    return datasets;
 }
 export async function validateDeploymentCommand(artifactPath) {
     if (!artifactPath) {
@@ -194,8 +61,7 @@ export async function validateDeploymentCommand(artifactPath) {
             const bundle = await verifyDeploymentBundle(artifactPath);
             const contract = bundle.contract;
             logger.success(`Valid deployment bundle: ${artifactPath}`);
-            logger.info(`${contract.datasets.length} datasets, ${contract.queries.length} queries, `
-                + `${contract.artifacts.length} runtime artifacts`);
+            logger.info(describeContract(contract));
             logger.info(`Bundle identity: ${bundle.identity}`);
             logger.info(`Deployment identity: ${bundle.manifest.deployment.identity}`);
             return contract;
@@ -226,8 +92,7 @@ export async function validateDeploymentCommand(artifactPath) {
     }
     const { contract, identity: digest } = prepared;
     logger.success(`Valid deployment contract: ${artifactPath}`);
-    logger.info(`${contract.datasets.length} datasets, ${contract.queries.length} queries, `
-        + `${contract.artifacts.length} runtime artifacts`);
+    logger.info(describeContract(contract));
     logger.info(`Identity: ${digest}`);
     return contract;
 }

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAWzF,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAqKD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,iBAkb1D"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAYzF,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAqKD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,iBAsb1D"}

package/dist/commands/init.js

@@ -10,6 +10,7 @@ import { generateEnvTemplate, appendToEnv } from '../templates/env.js';
 import { generateClientTemplate } from '../templates/client.js';
 import { generateQueriesTemplate } from '../templates/queries.js';
 import { generateApiTemplate } from '../templates/api.js';
+import { generateCloudTemplate } from '../templates/cloud.js';
 import { CONTEXT_AUTH_TENANT_COLUMN } from '../templates/auth-scaffold.js';
 import { generateDatasetsPlaceholderTemplate } from '../templates/datasets.js';
 import { appendToGitignore } from '../templates/gitignore.js';
@@ -234,6 +235,7 @@ export async function initCommand(options = {}) {
             ? [
                 path.join(resolvedOutputDir, 'datasets.ts'),
                 path.join(resolvedOutputDir, 'api.ts'),
+                path.join(resolvedOutputDir, 'cloud.ts'),
             ]
             : [
                 path.join(resolvedOutputDir, 'queries.ts'),
@@ -421,6 +423,9 @@ export interface IntrospectedSchema {
         apiPath = path.join(resolvedOutputDir, 'api.ts');
         await writeFile(apiPath, generateApiTemplate({ auth }));
         logger.success(`Created API file (${path.relative(process.cwd(), apiPath)})`);
+        const cloudPath = path.join(resolvedOutputDir, 'cloud.ts');
+        await writeFile(cloudPath, generateCloudTemplate());
+        logger.success(`Created Cloud publication (${path.relative(process.cwd(), cloudPath)})`);
     }
     else {
         apiPath = path.join(resolvedOutputDir, 'queries.ts');

package/dist/templates/cloud.d.ts

@@ -0,0 +1,3 @@
+/** Generate the explicit Cloud publication entrypoint for dataset projects. */
+export declare function generateCloudTemplate(): string;
+//# sourceMappingURL=cloud.d.ts.map

package/dist/templates/cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/templates/cloud.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C"}

package/dist/templates/cloud.js

@@ -0,0 +1,11 @@
+/** Generate the explicit Cloud publication entrypoint for dataset projects. */
+export function generateCloudTemplate() {
+    return `import { publishToCloud } from '@hypequery/datasets';
+import { datasets } from './datasets.js';
+
+export const cloud = publishToCloud({
+  datasets,
+  access: { roles: [], scopes: [] },
+});
+`;
+}

package/dist/utils/deployment-bundle.d.ts

@@ -1,13 +1,8 @@
-import { type PreparedProtocolDeploymentContract, type ProtocolDeploymentBundleManifest, type ProtocolDeploymentContract } from '@hypequery/protocol';
+import { type PreparedProtocolDeploymentContract, type ProtocolDeploymentContract, type ProtocolDeploymentBundleManifest } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_CONTRACT, DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle } from '@hypequery/deployment';
 import type { VerifiedDeploymentBundle } from '@hypequery/deployment';
 export { DEPLOYMENT_BUNDLE_CONTRACT, DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, };
 export type { VerifiedDeploymentBundle };
-export interface DeploymentBundleRuntimeFile {
-    readonly runtime: 'node' | 'python';
-    readonly sha256: string;
-    readonly bytes: Uint8Array;
-}
 export interface DeploymentBundleSourceFile {
     readonly path: string;
     readonly bytes: Uint8Array;
@@ -28,6 +23,5 @@ export interface WrittenDeploymentBundle {
     readonly identity: string;
     readonly contract: ProtocolDeploymentContract;
 }
-export declare function writeDeploymentBundle(outputDirectory: string, prepared: PreparedProtocolDeploymentContract, runtimeFiles: readonly DeploymentBundleRuntimeFile[], sourceSnapshot?: DeploymentBundleSourceSnapshot): Promise<WrittenDeploymentBundle>;
-export declare function readDeploymentRuntimeFile(filePath: string): Promise<Uint8Array>;
+export declare function writeDeploymentBundle(outputDirectory: string, prepared: PreparedProtocolDeploymentContract, sourceSnapshot?: DeploymentBundleSourceSnapshot): Promise<WrittenDeploymentBundle>;
 //# sourceMappingURL=deployment-bundle.d.ts.map

package/dist/utils/deployment-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-bundle.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-bundle.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,CAAC;AACF,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AA0ID,wBAAsB,qBAAqB,CACzC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,kCAAkC,EAC5C,YAAY,EAAE,SAAS,2BAA2B,EAAE,EACpD,cAAc,CAAC,EAAE,8BAA8B,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CA+FlC;AAoCD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAMrF"}
+{"version":3,"file":"deployment-bundle.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-bundle.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACtC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,CAAC;AACF,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AA4ED,wBAAsB,qBAAqB,CACzC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,kCAAkC,EAC5C,cAAc,CAAC,EAAE,8BAA8B,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAkFlC"}

package/dist/utils/deployment-bundle.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { constants, lstat, mkdir, mkdtemp, open, rename, rm, writeFile, } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, rename, rm, writeFile, } from 'node:fs/promises';
 import path from 'node:path';
 import { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, prepareProtocolDeploymentBundleManifest, } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_CONTRACT, DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, } from '@hypequery/deployment';
@@ -9,9 +9,6 @@ const utf8Encoder = new TextEncoder();
 function sha256(bytes) {
     return createHash('sha256').update(bytes).digest('hex');
 }
-function runtimeArtifactPath(runtime, digest) {
-    return `artifacts/${digest}.${runtime === 'node' ? 'mjs' : 'pyz'}`;
-}
 const SOURCE_ROOT = 'source';
 function errorCode(error) {
     return typeof error === 'object' && error !== null && 'code' in error
@@ -37,53 +34,6 @@ async function existingVerifiedBundle(outputDirectory) {
     }
     return true;
 }
-function validateRuntimeFiles(prepared, files) {
-    requireClosedContractArtifactSet(prepared.contract);
-    const declared = new Map(prepared.contract.artifacts.map(artifact => [artifact.artifactSha256, artifact.runtime]));
-    const supplied = new Map();
-    for (const file of files) {
-        if (sha256(file.bytes) !== file.sha256) {
-            throw new Error(`Runtime artifact bytes do not match SHA-256 ${file.sha256}.`);
-        }
-        if (declared.get(file.sha256) !== file.runtime) {
-            throw new Error(`Runtime artifact ${file.sha256} is not declared by the deployment contract as ${file.runtime}.`);
-        }
-        if (supplied.has(file.sha256)) {
-            throw new Error(`Duplicate runtime artifact bytes supplied for ${file.sha256}.`);
-        }
-        if (file.bytes.byteLength < 1
-            || file.bytes.byteLength > DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxArtifactBytes) {
-            throw new Error(`Runtime artifact ${file.sha256} exceeds the bundle byte limits.`);
-        }
-        supplied.set(file.sha256, file.runtime);
-    }
-    for (const [digest, runtime] of declared) {
-        if (supplied.get(digest) !== runtime) {
-            throw new Error(`Deployment bundle is missing ${runtime} runtime artifact ${digest}.`);
-        }
-    }
-    return Object.freeze([...files].sort((left, right) => {
-        const leftPath = runtimeArtifactPath(left.runtime, left.sha256);
-        const rightPath = runtimeArtifactPath(right.runtime, right.sha256);
-        return leftPath < rightPath ? -1 : leftPath > rightPath ? 1 : 0;
-    }));
-}
-function requireClosedContractArtifactSet(contract) {
-    const referenced = new Map();
-    for (const query of contract.queries) {
-        if (query.implementation.kind === 'runtime-reference') {
-            referenced.set(query.implementation.artifactSha256, query.implementation.runtime);
-        }
-    }
-    if (referenced.size !== contract.artifacts.length) {
-        throw new Error('Deployment contract contains missing or unreferenced runtime artifacts.');
-    }
-    for (const artifact of contract.artifacts) {
-        if (referenced.get(artifact.artifactSha256) !== artifact.runtime) {
-            throw new Error(`Deployment runtime artifact ${artifact.artifactSha256} is not referenced by a named query.`);
-        }
-    }
-}
 function validateSourceSnapshot(source) {
     if (!source)
         return undefined;
@@ -122,12 +72,11 @@ function validateSourceSnapshot(source) {
         ...(source.revision ? { revision: Object.freeze({ ...source.revision }) } : {}),
     });
 }
-export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFiles, sourceSnapshot) {
+export async function writeDeploymentBundle(outputDirectory, prepared, sourceSnapshot) {
     const destination = path.resolve(outputDirectory);
     if (destination === path.parse(destination).root) {
         throw new Error('The deployment bundle output cannot be a filesystem root.');
     }
-    const files = validateRuntimeFiles(prepared, runtimeFiles);
     const source = validateSourceSnapshot(sourceSnapshot);
     const deploymentBytes = utf8Encoder.encode(`${prepared.canonical}\n`);
     const manifestInput = {
@@ -139,12 +88,8 @@ export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFi
             sha256: sha256(deploymentBytes),
             byteLength: deploymentBytes.byteLength,
         },
-        artifacts: files.map(file => ({
-            runtime: file.runtime,
-            path: runtimeArtifactPath(file.runtime, file.sha256),
-            sha256: file.sha256,
-            byteLength: file.bytes.byteLength,
-        })),
+        // A deployment carries datasets: there is nothing else to put here.
+        artifacts: [],
         ...(source ? {
             source: {
                 root: SOURCE_ROOT,
@@ -164,12 +109,7 @@ export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFi
     await mkdir(parent, { recursive: true });
     const staging = await mkdtemp(path.join(parent, `.${path.basename(destination)}.tmp-`));
     try {
-        if (files.length > 0)
-            await mkdir(path.join(staging, 'artifacts'));
         await writeFile(path.join(staging, DEPLOYMENT_BUNDLE_CONTRACT), deploymentBytes, { flag: 'wx' });
-        for (const file of files) {
-            await writeFile(path.join(staging, runtimeArtifactPath(file.runtime, file.sha256)), file.bytes, { flag: 'wx' });
-        }
         for (const file of source?.files ?? []) {
             const outputPath = path.join(staging, SOURCE_ROOT, ...file.path.split('/'));
             await mkdir(path.dirname(outputPath), { recursive: true });
@@ -209,38 +149,3 @@ export async function writeDeploymentBundle(outputDirectory, prepared, runtimeFi
         contract: prepared.contract,
     });
 }
-async function readBoundedAbsoluteRegularFile(absolutePath, displayPath, maximum) {
-    let handle;
-    try {
-        const initialStat = await lstat(absolutePath);
-        if (initialStat.isSymbolicLink()) {
-            throw new Error(`Bundle entry must not be a symbolic link: ${displayPath}`);
-        }
-        if (!initialStat.isFile()) {
-            throw new Error(`Bundle entry is not a regular file: ${displayPath}`);
-        }
-        if (initialStat.size < 1 || initialStat.size > maximum) {
-            throw new Error(`Bundle entry exceeds its byte limit: ${displayPath}`);
-        }
-        handle = await open(absolutePath, constants.O_RDONLY | constants.O_NOFOLLOW);
-        const stat = await handle.stat();
-        if (!stat.isFile())
-            throw new Error(`Bundle entry is not a regular file: ${displayPath}`);
-        if (stat.size < 1 || stat.size > maximum) {
-            throw new Error(`Bundle entry exceeds its byte limit: ${displayPath}`);
-        }
-        return await handle.readFile();
-    }
-    catch (error) {
-        if (errorCode(error) === 'ELOOP') {
-            throw new Error(`Bundle entry must not be a symbolic link: ${displayPath}`);
-        }
-        throw error;
-    }
-    finally {
-        await handle?.close();
-    }
-}
-export async function readDeploymentRuntimeFile(filePath) {
-    return readBoundedAbsoluteRegularFile(path.resolve(filePath), filePath, DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxArtifactBytes);
-}

package/dist/utils/load-cloud-publication.d.ts

@@ -0,0 +1,4 @@
+import type { ProtocolDeploymentContract } from '@hypequery/protocol';
+/** Load the explicit dataset contract exported by a Cloud publication module. */
+export declare function loadCloudPublication(sourcePath: string): Promise<ProtocolDeploymentContract>;
+//# sourceMappingURL=load-cloud-publication.d.ts.map

package/dist/utils/load-cloud-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-cloud-publication.d.ts","sourceRoot":"","sources":["../../src/utils/load-cloud-publication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGtE,iFAAiF;AACjF,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAYlG"}

package/dist/utils/load-cloud-publication.js

@@ -0,0 +1,13 @@
+import { loadModule } from './load-api.js';
+/** Load the explicit dataset contract exported by a Cloud publication module. */
+export async function loadCloudPublication(sourcePath) {
+    const module = await loadModule(sourcePath);
+    const cloud = module.cloud ?? module.default;
+    if (typeof cloud !== 'object' || cloud === null
+        || !('kind' in cloud) || cloud.kind !== 'hypequery-deployment') {
+        throw new Error(`Invalid Cloud publication: ${sourcePath}\n\n`
+            + 'Export `cloud = publishToCloud({ datasets, access })` from @hypequery/datasets. '
+            + 'A Serve API is not a Cloud publication.');
+    }
+    return cloud;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.19.1",
+  "version": "1.21.0",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -30,8 +30,8 @@
     "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.8.0",
-    "@hypequery/protocol": "0.13.0"
+    "@hypequery/deployment": "0.9.1",
+    "@hypequery/protocol": "0.15.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"
@@ -51,8 +51,8 @@
     "@vitest/coverage-v8": "^3.2.6",
     "typescript": "^5.7.3",
     "vitest": "^3.2.6",
-    "@hypequery/mcp": "0.7.0",
-    "@hypequery/serve": "0.17.1"
+    "@hypequery/mcp": "0.8.2",
+    "@hypequery/serve": "0.19.0"
   },
   "repository": {
     "type": "git",

package/dist/utils/cloud-diagnostic.d.ts

@@ -1,10 +0,0 @@
-export interface CloudCompatibilityDiagnosticLike {
-    readonly severity: 'error' | 'warning';
-    readonly code: string;
-    readonly subject: string;
-    readonly message: string;
-    readonly remedy: string;
-}
-/** Report warnings and explicitly overridden errors before submitting a release. */
-export declare function reportCloudDiagnostic(diagnostic: CloudCompatibilityDiagnosticLike, allowUnsupportedConfig: boolean): void;
-//# sourceMappingURL=cloud-diagnostic.d.ts.map

package/dist/utils/cloud-diagnostic.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-diagnostic.d.ts","sourceRoot":"","sources":["../../src/utils/cloud-diagnostic.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,gCAAgC,EAC5C,sBAAsB,EAAE,OAAO,GAC9B,IAAI,CAMN"}

package/dist/utils/cloud-diagnostic.js

@@ -1,10 +0,0 @@
-import { logger } from './logger.js';
-/** Report warnings and explicitly overridden errors before submitting a release. */
-export function reportCloudDiagnostic(diagnostic, allowUnsupportedConfig) {
-    // Blocking errors are reported by the contract builder's exception.
-    if (diagnostic.severity === 'error' && !allowUnsupportedConfig)
-        return;
-    logger.warn(`${diagnostic.code} (${diagnostic.subject})`);
-    logger.indent(diagnostic.message);
-    logger.indent(`→ ${diagnostic.remedy}`);
-}

package/dist/utils/deployment-runtime-artifact.d.ts

@@ -1,9 +0,0 @@
-export interface NodeRuntimeArtifact {
-    readonly bytes: Uint8Array;
-    readonly artifactSha256: string;
-    readonly entrypointPrefix: string;
-    readonly runtimeEntrypoints: readonly string[];
-}
-export declare function getDeploymentRuntimeEntrypoints(input: unknown): readonly string[];
-export declare function buildNodeRuntimeArtifact(apiPath: string, runtimeEntrypoints: readonly string[], entrypointPrefix?: string): Promise<NodeRuntimeArtifact>;
-//# sourceMappingURL=deployment-runtime-artifact.d.ts.map

package/dist/utils/deployment-runtime-artifact.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deployment-runtime-artifact.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-runtime-artifact.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AASD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CA6BjF;AAiED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,gBAAgB,SAAY,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAmD9B"}

package/dist/utils/deployment-runtime-artifact.js

@@ -1,162 +0,0 @@
-import { createHash } from 'node:crypto';
-import path from 'node:path';
-import { parseProtocolIdentifier, parseProtocolQualifiedIdentifier, } from '@hypequery/protocol';
-import { build } from 'esbuild';
-import { findNearestTsconfig } from './load-api.js';
-const deploymentBuildSourceSymbol = Symbol.for('hypequery.deployment-build-source.v1');
-function executableQuery(query) {
-    return typeof query === 'function'
-        || (typeof query === 'object'
-            && query !== null
-            && typeof query.run === 'function');
-}
-export function getDeploymentRuntimeEntrypoints(input) {
-    if (typeof input !== 'object' || input === null) {
-        throw new Error('Invalid API module: deployment build metadata is unavailable.');
-    }
-    const api = input;
-    const source = api[deploymentBuildSourceSymbol];
-    if (source?.version !== 1 || !Array.isArray(source.runtimeEntrypoints)) {
-        throw new Error('The exported API does not expose deployment build metadata. '
-            + 'Upgrade @hypequery/serve before building runtime artifacts.');
-    }
-    const names = source.runtimeEntrypoints.map((name) => {
-        try {
-            return parseProtocolIdentifier(name);
-        }
-        catch {
-            throw new Error(`Invalid runtime entrypoint name: ${String(name)}`);
-        }
-    });
-    if (new Set(names).size !== names.length) {
-        throw new Error('Deployment build metadata contains duplicate runtime entrypoints.');
-    }
-    for (const name of names) {
-        if (!executableQuery(api.queries?.[name]?.query)) {
-            throw new Error(`Serve query "${name}" does not expose an executable runtime handler.`);
-        }
-    }
-    return Object.freeze([...names].sort());
-}
-function projectRelativeImport(apiPath) {
-    const resolved = path.resolve(process.cwd(), apiPath);
-    const relative = path.relative(process.cwd(), resolved);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-        throw new Error('The API module must be inside the current project for deterministic bundling.');
-    }
-    const portable = relative.split(path.sep).join('/');
-    return {
-        resolved,
-        specifier: portable.startsWith('.') ? portable : `./${portable}`,
-    };
-}
-function runtimeEntrySource(apiSpecifier, runtimeEntrypoints, entrypointPrefix) {
-    const prefix = parseProtocolQualifiedIdentifier(entrypointPrefix).split('.');
-    const names = JSON.stringify(runtimeEntrypoints);
-    let registryExpression = 'runtimeEntries';
-    for (let index = prefix.length - 1; index >= 1; index -= 1) {
-        registryExpression = `Object.freeze({ ${prefix[index]}: ${registryExpression} })`;
-    }
-    return [
-        `import * as apiModule from ${JSON.stringify(apiSpecifier)};`,
-        'const api = apiModule.api ?? Reflect.get(apiModule, "default");',
-        'if (!api || typeof api !== "object") throw new Error("Runtime API export is unavailable.");',
-        'const resolveQuery = (name) => {',
-        '  if (typeof api.execute === "function") {',
-        '    // Serve entrypoint names are validated against api.queries before bundling.',
-        '    return (argument = {}) => api.execute(name, {',
-        '      input: argument.input,',
-        '      ...(argument.context === undefined ? {} : { context: argument.context }),',
-        '      ...(argument.request === undefined ? {} : { request: argument.request }),',
-        '      ...(argument.requestId === undefined ? {} : { requestId: argument.requestId }),',
-        // A null principal means "no trusted principal"; forwarding it would skip the
-        // API's own auth strategies instead of falling through to them.
-        '      ...(argument.trustedAuth == null ? {} : { trustedAuth: argument.trustedAuth }),',
-        '    });',
-        '  }',
-        '  const entry = api.queries?.[name];',
-        '  const query = entry?.query;',
-        '  let run;',
-        '  if (typeof query === "function") run = query;',
-        '  else if (query && typeof query === "object" && typeof query.run === "function") run = query.run.bind(query);',
-        '  if (!run) throw new Error(`Runtime entrypoint ${name} is unavailable.`);',
-        '  // Without a Serve execute() pipeline there is nothing to enforce roles, scopes,',
-        '  // or tenancy, so refuse a trusted principal instead of silently ignoring it.',
-        '  return (argument = {}) => {',
-        '    if (argument?.trustedAuth != null) {',
-        '      throw new Error(`Runtime entrypoint ${name} cannot enforce a trusted principal without a Serve execute() pipeline.`);',
-        '    }',
-        '    return run(argument);',
-        '  };',
-        '};',
-        `const runtimeEntries = Object.freeze(Object.fromEntries(${names}.map(name => [name, resolveQuery(name)])));`,
-        `export const ${prefix[0]} = ${registryExpression};`,
-        '',
-    ].join('\n');
-}
-export async function buildNodeRuntimeArtifact(apiPath, runtimeEntrypoints, entrypointPrefix = 'queries') {
-    if (runtimeEntrypoints.length === 0) {
-        throw new Error('Cannot build a runtime artifact without Serve query entrypoints.');
-    }
-    const names = getValidatedEntrypointNames(runtimeEntrypoints);
-    const { resolved, specifier } = projectRelativeImport(apiPath);
-    let source;
-    try {
-        source = runtimeEntrySource(specifier, names, entrypointPrefix);
-    }
-    catch {
-        throw new Error(`Invalid runtime entrypoint prefix: ${entrypointPrefix}`);
-    }
-    try {
-        const result = await build({
-            stdin: {
-                contents: source,
-                loader: 'ts',
-                resolveDir: process.cwd(),
-                sourcefile: 'hypequery-runtime-entry.ts',
-            },
-            absWorkingDir: process.cwd(),
-            bundle: true,
-            charset: 'utf8',
-            format: 'esm',
-            legalComments: 'none',
-            logLevel: 'warning',
-            minify: true,
-            platform: 'node',
-            sourcemap: false,
-            target: ['node18'],
-            treeShaking: true,
-            tsconfig: await findNearestTsconfig(resolved) ?? undefined,
-            write: false,
-        });
-        const output = result.outputFiles?.find(file => file.path.endsWith('.js'))
-            ?? result.outputFiles?.[0];
-        if (!output)
-            throw new Error('esbuild produced no output');
-        const bytes = output.contents;
-        return Object.freeze({
-            bytes,
-            artifactSha256: createHash('sha256').update(bytes).digest('hex'),
-            entrypointPrefix,
-            runtimeEntrypoints: names,
-        });
-    }
-    catch (error) {
-        throw new Error(`Failed to build the Node runtime artifact from ${apiPath}.\n`
-            + `Original error: ${error instanceof Error ? error.message : String(error)}`);
-    }
-}
-function getValidatedEntrypointNames(input) {
-    const names = input.map((name) => {
-        try {
-            return parseProtocolIdentifier(name);
-        }
-        catch {
-            throw new Error(`Invalid runtime entrypoint name: ${name}`);
-        }
-    });
-    if (new Set(names).size !== names.length) {
-        throw new Error('Runtime entrypoint names must be unique.');
-    }
-    return Object.freeze([...names].sort());
-}