@hypequery/cli 1.21.1 → 1.22.0

package/README.md

@@ -2,7 +2,7 @@
 
 The fastest way to start a type-safe ClickHouse analytics backend in TypeScript.
 
-`@hypequery/cli` connects to ClickHouse or embedded chDB, generates schema types, scaffolds queries or semantic datasets, and runs a local API with interactive documentation. The same CLI can generate React route manifests and deploy a verified analytics bundle when you are ready.
+`@hypequery/cli` connects to ClickHouse or embedded chDB, generates schema types, scaffolds queries or semantic datasets, and runs a local API with interactive documentation. It also generates React route manifests.
 
 ## Start here
 
@@ -18,29 +18,9 @@ For a semantic layer:
 
 ```bash
 npx hypequery init --style datasets
-npx hypequery login
-npx hypequery deploy analytics/cloud.ts
-```
-
-The dataset scaffold writes `analytics/cloud.ts` alongside the local
-`analytics/api.ts`. Its Cloud publication is explicit:
-
-```ts
-import { publishToCloud } from '@hypequery/datasets';
-import { datasets } from './datasets.js';
-
-export const cloud = publishToCloud({
-  datasets,
-  access: { roles: [], scopes: [] },
-});
+npx hypequery dev --open
 ```
 
-`api.ts` remains the local Serve entrypoint. Cloud deployment builds from
-`cloud.ts` and does not load Serve configuration. This first Cloud publisher
-accepts datasets only; it rejects named metrics rather than dropping them.
-The required access policy makes the authenticated roles and scopes visible
-before an existing project moves away from Serve-based publishing.
-
 For embedded analytics without a ClickHouse server:
 
 ```bash
@@ -58,9 +38,8 @@ npx hypequery init \
 | `hypequery generate` | Fresh TypeScript types from ClickHouse or chDB |
 | `hypequery generate:datasets` | Dataset definitions scaffolded from tables |
 | `hypequery generate:manifest` | A browser-safe route manifest for React hooks |
-| `hypequery login` | An authenticated Cloud target |
-| `hypequery deploy analytics/cloud.ts` | A verified dataset-only Cloud deployment |
 | `hypequery pull` / `diff` | Live source inspection and comparison |
+| `hypequery deployment:status` | Live release and Cloud-provided connection URLs |
 
 Non-interactive ClickHouse commands read `CLICKHOUSE_URL`, `CLICKHOUSE_DATABASE`, `CLICKHOUSE_USERNAME`, and `CLICKHOUSE_PASSWORD`.
 
@@ -69,7 +48,6 @@ Non-interactive ClickHouse commands read `CLICKHOUSE_URL`, `CLICKHOUSE_DATABASE`
 - Get correct ClickHouse runtime types instead of guessing interfaces.
 - Move from one local query to datasets, APIs, React, and MCP without changing tools.
 - Keep generated types and route manifests reproducible in CI.
-- Build closed, hash-verified deployment artifacts from the same source.
 
 ## Learn more
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAqQD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAkRD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -9,6 +9,7 @@ import { generateDatasetsCommand } from './commands/generate-datasets.js';
 import { generateManifestCommand } from './commands/generate-manifest.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand, validateDeploymentCommand, } from './commands/deployment.js';
 import { deployCommand, submitDeploymentCommand, } from './commands/deploy.js';
+import { deploymentStatusCommand, } from './commands/deployment-status.js';
 import { loginCommand, logoutCommand, } from './commands/login.js';
 import { diffCommand, pullCommand, } from './commands/live-source.js';
 import { isPromptCancelled } from './utils/prompts.js';
@@ -133,6 +134,7 @@ program
     .option('--path <path>', 'Analytics directory (loads <path>/api.ts or <path>/queries.ts)')
     .option('--tenant <id>', 'Trusted tenant applied to every tenant-scoped dataset')
     .option('--self-test', 'Check the entrypoint and exit without speaking MCP')
+    .option('--url <url>', 'With --self-test: check a hosted MCP endpoint (key from HYPEQUERY_API_KEY)')
     .action(runCommand(async (file, options) => {
     await mcpCommand(file, options);
 }));
@@ -198,6 +200,16 @@ program
     .action(runCommand(async (bundle, options) => {
     await submitDeploymentCommand(bundle, options);
 }));
+program
+    .command('deployment:status')
+    .description('Show the live release and hosted connection details for a Cloud target')
+    .option('--project <project>', 'Target project identifier (advanced override)')
+    .option('--environment <environment>', 'Target environment identifier (advanced override)')
+    .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
+    .option('--mcp-config', 'Also print MCP client configuration for the hosted endpoint')
+    .action(runCommand(async (options) => {
+    await deploymentStatusCommand(options);
+}));
 program
     .command('deploy <source>')
     .description('Build, prepare, and deploy a dataset-only Cloud publication')
@@ -208,6 +220,7 @@ program
     .option('--no-source', 'Exclude project source files from the deployment bundle')
     .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .option('--replace-restored', 'Intentionally replace a restored live release')
+    .option('--mcp-config', 'Also print MCP client configuration for the hosted endpoint')
     .action(runCommand(async (source, options) => {
     await deployCommand(source, options);
 }));

package/dist/commands/deploy.d.ts

@@ -1,11 +1,14 @@
 import { createHttpDeploymentUploadTransport, type DeploymentSubmissionResponse } from '../utils/deployment-upload.js';
 import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
 import { fetchLiveDeployment } from '../utils/live-deployment.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand } from './deployment.js';
 export interface SubmitDeploymentOptions {
     release?: string;
     endpoint?: string;
     replaceRestored?: boolean;
+    /** Also print MCP client configuration for the hosted endpoint. */
+    mcpConfig?: boolean;
 }
 export interface DeployOptions {
     endpoint?: string;
@@ -15,12 +18,14 @@ export interface DeployOptions {
     bundleOutput?: string;
     releaseOutput?: string;
     source?: boolean;
+    mcpConfig?: boolean;
 }
 export interface SubmitDeploymentDependencies {
     readonly env?: Readonly<Record<string, string | undefined>>;
     readonly createTransport?: typeof createHttpDeploymentUploadTransport;
     readonly loadCredential?: () => Promise<StoredCloudCredential | null>;
     readonly fetchLive?: typeof fetchLiveDeployment;
+    readonly fetchEndpoints?: typeof fetchHostedEndpoints;
 }
 export interface DeployDependencies extends SubmitDeploymentDependencies {
     readonly buildDeployment?: typeof buildDeploymentCommand;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA0EvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAuCvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CAiFvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAwCvC"}

package/dist/commands/deploy.js

@@ -6,6 +6,8 @@ import { createHttpDeploymentUploadTransport, DeploymentUploadError, } from '../
 import { logger } from '../utils/logger.js';
 import { resolveDeploymentCredential } from '../utils/cloud-deployment-access.js';
 import { fetchLiveDeployment } from '../utils/live-deployment.js';
+import { fetchHostedEndpoints, } from '../utils/hosted-endpoints.js';
+import { printHostedEndpoints } from '../utils/hosted-endpoints-output.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand, } from './deployment.js';
 const MAX_RELEASE_FILE_BYTES = 16 * 1024;
 const DEFAULT_BUNDLE_PATH = 'analytics/hypequery-deployment';
@@ -120,6 +122,13 @@ export async function submitDeploymentCommand(bundlePath, options = {}, dependen
         : 'Deployment release already exists');
     logger.info(`Release identity: ${result.releaseIdentity}`);
     logger.info(`Bundle identity: ${result.bundleIdentity}`);
+    const endpoints = await (dependencies.fetchEndpoints ?? fetchHostedEndpoints)({
+        endpoint: deploymentEndpoint,
+        token,
+        target: release.release.target,
+    });
+    if (endpoints)
+        printHostedEndpoints(endpoints, options.mcpConfig === true);
     return result;
 }
 /**
@@ -172,5 +181,6 @@ export async function deployCommand(sourcePath, options = {}, dependencies = {})
         release: releasePath,
         endpoint: options.endpoint,
         replaceRestored: options.replaceRestored,
+        mcpConfig: options.mcpConfig,
     }, dependencies);
 }

package/dist/commands/deployment-status.d.ts

@@ -0,0 +1,16 @@
+import { type CloudDeploymentAccessDependencies } from '../utils/cloud-deployment-access.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
+import { fetchLiveDeployment } from '../utils/live-deployment.js';
+export interface DeploymentStatusOptions {
+    readonly endpoint?: string;
+    readonly project?: string;
+    readonly environment?: string;
+    readonly mcpConfig?: boolean;
+}
+export interface DeploymentStatusDependencies extends CloudDeploymentAccessDependencies {
+    readonly fetchLive?: typeof fetchLiveDeployment;
+    readonly fetchEndpoints?: typeof fetchHostedEndpoints;
+}
+/** Read the current target and its hosted connection details without deploying. */
+export declare function deploymentStatusCommand(options?: DeploymentStatusOptions, dependencies?: DeploymentStatusDependencies): Promise<void>;
+//# sourceMappingURL=deployment-status.d.ts.map

package/dist/commands/deployment-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-status.d.ts","sourceRoot":"","sources":["../../src/commands/deployment-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA6B,SAAQ,iCAAiC;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAED,mFAAmF;AACnF,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/commands/deployment-status.js

@@ -0,0 +1,36 @@
+import { resolveDeploymentCredential, } from '../utils/cloud-deployment-access.js';
+import { deploymentTargetFromOptions } from '../utils/deployment-target.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
+import { printHostedEndpoints } from '../utils/hosted-endpoints-output.js';
+import { fetchLiveDeployment } from '../utils/live-deployment.js';
+import { logger } from '../utils/logger.js';
+/** Read the current target and its hosted connection details without deploying. */
+export async function deploymentStatusCommand(options = {}, dependencies = {}) {
+    const access = await resolveDeploymentCredential(options.endpoint, dependencies);
+    const target = deploymentTargetFromOptions(options, access.storedCredential);
+    const live = await (dependencies.fetchLive ?? fetchLiveDeployment)({
+        endpoint: access.endpoint,
+        token: access.token,
+        target,
+        resource: 'state',
+    });
+    logger.info(`Target: ${target.project} / ${target.environment}`);
+    if (live?.active) {
+        logger.success(`Live release: ${live.active.releaseIdentity}`);
+        logger.info(`Activated: ${live.active.activatedAt}`);
+        if (live.active.restored)
+            logger.info('This release was restored from history.');
+    }
+    else {
+        logger.info('No live release yet.');
+    }
+    const endpoints = await (dependencies.fetchEndpoints ?? fetchHostedEndpoints)({
+        endpoint: access.endpoint,
+        token: access.token,
+        target,
+    });
+    if (endpoints)
+        printHostedEndpoints(endpoints, options.mcpConfig === true);
+    else
+        logger.warn('Cloud did not return hosted endpoint details.');
+}

package/dist/commands/live-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-source.d.ts","sourceRoot":"","sources":["../../src/commands/live-source.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,EACL,mBAAmB,EAEpB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAuB,SAAQ,iCAAiC;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,+BAA+B,CAAC;CACjE;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAkEF,wBAAsB,WAAW,CAC/B,OAAO,GAAE,WAAgB,EACzB,YAAY,GAAE,sBAA2B,mBAuC1C;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,iBAAsB,EAC/B,YAAY,GAAE,sBAA2B,GACxC,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CA0B1C"}
+{"version":3,"file":"live-source.d.ts","sourceRoot":"","sources":["../../src/commands/live-source.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AAEzF,OAAO,EACL,mBAAmB,EAEpB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAuB,SAAQ,iCAAiC;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,+BAA+B,CAAC;CACjE;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AA2CF,wBAAsB,WAAW,CAC/B,OAAO,GAAE,WAAgB,EACzB,YAAY,GAAE,sBAA2B,mBAuC1C;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,iBAAsB,EAC/B,YAAY,GAAE,sBAA2B,GACxC,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CA0B1C"}

package/dist/commands/live-source.js

@@ -1,37 +1,19 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { validateProtocolDeploymentReleaseTarget, } from '@hypequery/protocol';
-import { CLOUD_SOURCE_SCOPE, } from '../utils/cloud-credential-store.js';
+import { CLOUD_SOURCE_SCOPE } from '../utils/cloud-credential-store.js';
 import { resolveDeploymentCredential, } from '../utils/cloud-deployment-access.js';
 import { captureDeploymentSourceSnapshot } from '../utils/deployment-source-snapshot.js';
+import { deploymentTargetFromOptions } from '../utils/deployment-target.js';
 import { fetchLiveDeployment, } from '../utils/live-deployment.js';
 import { logger } from '../utils/logger.js';
-function targetFromOptions(options, credential) {
-    if ((options.project === undefined) !== (options.environment === undefined)) {
-        throw new Error('Pass both --project and --environment, or omit both.');
-    }
-    const input = options.project === undefined
-        ? credential?.target
-        : { project: options.project, environment: options.environment };
-    if (!input) {
-        throw new Error('Missing deployment target. Run `hypequery login` or pass both '
-            + '--project and --environment.');
-    }
-    try {
-        return validateProtocolDeploymentReleaseTarget(input);
-    }
-    catch {
-        throw new Error('The deployment target is invalid.');
-    }
-}
 async function liveSource(options, dependencies) {
     const access = await resolveDeploymentCredential(options.endpoint, dependencies);
     if (access.storedCredential
         && access.storedCredential.scope !== CLOUD_SOURCE_SCOPE) {
         throw new Error('The stored CLI credential cannot read deployed source. Run `hypequery login` again.');
     }
-    const target = targetFromOptions(options, access.storedCredential);
+    const target = deploymentTargetFromOptions(options, access.storedCredential);
     const live = await (dependencies.fetchLive ?? fetchLiveDeployment)({
         endpoint: access.endpoint,
         token: access.token,

package/dist/commands/mcp.d.ts

@@ -1,4 +1,5 @@
 import { type CloseableMcpServer } from '../utils/mcp-lifecycle.js';
+import { type RemoteMcpCheck } from '../utils/mcp-remote-check.js';
 export interface McpOptions {
     /** Analytics directory, matching `hypequery dev --path`. */
     path?: string;
@@ -6,6 +7,8 @@ export interface McpOptions {
     tenant?: string;
     /** Check the entrypoint and exit instead of speaking MCP over stdio. */
     selfTest?: boolean;
+    /** With `selfTest`: check this hosted MCP endpoint instead of a local entrypoint. */
+    url?: string;
 }
 export interface McpDependencies {
     loadApi?: (file: string) => Promise<unknown>;
@@ -14,6 +17,13 @@ export interface McpDependencies {
         analytics: unknown;
         tenantId?: string;
     }) => Promise<CloseableMcpServer>;
+    /** Loads the optional `@hypequery/mcp` peer; injected in tests. */
+    loadMcp?: () => Promise<unknown>;
+    checkRemote?: (input: {
+        url: string;
+        key: string;
+    }) => Promise<RemoteMcpCheck>;
+    env?: Readonly<Record<string, string | undefined>>;
 }
 export declare function mcpCommand(file?: string, options?: McpOptions, dependencies?: McpDependencies): Promise<void>;
 //# sourceMappingURL=mcp.d.ts.map

package/dist/commands/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQvF,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnC;AAyCD,wBAAsB,UAAU,CAC9B,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,UAAe,EACxB,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,IAAI,CAAC,CAgDf"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQvF,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnF,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAoED,wBAAsB,UAAU,CAC9B,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,UAAe,EACxB,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,IAAI,CAAC,CAkEf"}

package/dist/commands/mcp.js

@@ -5,6 +5,35 @@ import path from 'node:path';
 import { findApiFileForPath, findQueriesFile } from '../utils/find-files.js';
 import { loadApiModule } from '../utils/load-api.js';
 import { logger } from '../utils/logger.js';
+import { MCP_API_KEY_VARIABLE } from '../utils/hosted-endpoints.js';
+import { checkRemoteMcp } from '../utils/mcp-remote-check.js';
+function fail(message, hints = []) {
+    logger.error(message);
+    if (hints.length > 0) {
+        logger.newline();
+        for (const hint of hints)
+            logger.indent(hint);
+    }
+    logger.newline();
+    process.exit(1);
+}
+/** `--self-test --url`: initialize and list tools against a hosted endpoint. */
+async function remoteSelfTest(url, dependencies) {
+    const key = (dependencies.env ?? process.env)[MCP_API_KEY_VARIABLE]?.trim();
+    if (!key) {
+        fail(`Set ${MCP_API_KEY_VARIABLE} to a runtime API key to check a hosted endpoint.`, [
+            'Create one in Cloud under Keys. It is read from the environment so it never',
+            'appears in your shell history.',
+        ]);
+    }
+    const result = await (dependencies.checkRemote ?? checkRemoteMcp)({ url, key });
+    if (!result.ok)
+        fail(`Hosted MCP check failed: ${result.reason}`);
+    logger.success(`Connected to ${result.server ?? 'the hosted MCP endpoint'}`);
+    logger.info(`Tools: ${result.tools}`);
+    logger.newline();
+    logger.info('The hosted endpoint is ready for MCP clients. No tool was called.');
+}
 function entrypointNotFound() {
     logger.error('Could not find a hypequery API file to serve over MCP');
     logger.newline();
@@ -41,8 +70,17 @@ function resolveSource(api, file) {
     return readServeMcpSource(api) ?? noDatasets(file);
 }
 export async function mcpCommand(file, options = {}, dependencies = {}) {
+    if (options.url && !options.selfTest) {
+        fail('--url is only used with --self-test.', [
+            'MCP clients connect to the hosted endpoint directly; this command serves a local project.',
+        ]);
+    }
     const restoreConsole = routeConsoleOutputToStderr();
     try {
+        if (options.url) {
+            await remoteSelfTest(options.url, dependencies);
+            return;
+        }
         const entrypoint = await resolveEntrypoint(file, options);
         const loadApi = dependencies.loadApi ?? loadApiModule;
         const source = resolveSource(await loadApi(entrypoint), entrypoint);
@@ -62,6 +100,16 @@ export async function mcpCommand(file, options = {}, dependencies = {}) {
         }
         const analytics = source.resolveAnalytics();
         if (options.selfTest) {
+            // Serving needs the optional `@hypequery/mcp` peer. Without this check
+            // the self-test passed and the real command then failed on import.
+            try {
+                await (dependencies.loadMcp ?? (() => import('@hypequery/mcp')))();
+            }
+            catch {
+                fail('@hypequery/mcp is not installed, so this project cannot be served over MCP.', [
+                    'npm install @hypequery/mcp',
+                ]);
+            }
             logger.success(`Loaded ${path.relative(process.cwd(), entrypoint)}`);
             logger.info(`Datasets: ${names.join(', ')}`);
             logger.info(options.tenant

package/dist/test-utils.d.ts

@@ -8,7 +8,7 @@ export declare class ProcessExitError extends Error {
     constructor(code: number);
 }
 export declare function mockProcessExit(): {
-    exitMock: Mock<(...args: any[]) => any>;
+    exitMock: Mock;
     restore: () => void;
 };
 //# sourceMappingURL=test-utils.d.ts.map

package/dist/utils/deployment-target.d.ts

@@ -0,0 +1,7 @@
+import { type ProtocolDeploymentReleaseTarget } from '@hypequery/protocol';
+import type { StoredCloudCredential } from './cloud-credential-store.js';
+export declare function deploymentTargetFromOptions(options: {
+    readonly project?: string;
+    readonly environment?: string;
+}, credential: StoredCloudCredential | undefined): ProtocolDeploymentReleaseTarget;
+//# sourceMappingURL=deployment-target.d.ts.map

package/dist/utils/deployment-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-target.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,wBAAgB,2BAA2B,CACzC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACrE,UAAU,EAAE,qBAAqB,GAAG,SAAS,GAC5C,+BAA+B,CAkBjC"}

package/dist/utils/deployment-target.js

@@ -0,0 +1,19 @@
+import { validateProtocolDeploymentReleaseTarget, } from '@hypequery/protocol';
+export function deploymentTargetFromOptions(options, credential) {
+    if ((options.project === undefined) !== (options.environment === undefined)) {
+        throw new Error('Pass both --project and --environment, or omit both.');
+    }
+    const input = options.project === undefined
+        ? credential?.target
+        : { project: options.project, environment: options.environment };
+    if (!input) {
+        throw new Error('Missing deployment target. Run `hypequery login` or pass both '
+            + '--project and --environment.');
+    }
+    try {
+        return validateProtocolDeploymentReleaseTarget(input);
+    }
+    catch {
+        throw new Error('The deployment target is invalid.');
+    }
+}

package/dist/utils/hosted-endpoints-output.d.ts

@@ -0,0 +1,4 @@
+import { type HostedEndpoints } from './hosted-endpoints.js';
+/** Print Cloud's URLs without ever reading or writing runtime API keys. */
+export declare function printHostedEndpoints(endpoints: HostedEndpoints, mcpConfig: boolean): void;
+//# sourceMappingURL=hosted-endpoints-output.d.ts.map

package/dist/utils/hosted-endpoints-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-endpoints-output.d.ts","sourceRoot":"","sources":["../../src/utils/hosted-endpoints-output.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAE/B,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAqBzF"}

package/dist/utils/hosted-endpoints-output.js

@@ -0,0 +1,27 @@
+import { logger } from './logger.js';
+import { MCP_API_KEY_VARIABLE, mcpClientConfiguration, } from './hosted-endpoints.js';
+/** Print Cloud's URLs without ever reading or writing runtime API keys. */
+export function printHostedEndpoints(endpoints, mcpConfig) {
+    logger.newline();
+    logger.info('Hosted endpoints');
+    logger.indent(`REST  ${endpoints.rest.baseUrl}`);
+    const width = Math.max(0, ...endpoints.rest.datasets.map((dataset) => dataset.name.length));
+    for (const dataset of endpoints.rest.datasets) {
+        logger.indent(`  ${dataset.name.padEnd(width)}  POST ${dataset.url}`);
+    }
+    logger.indent(`MCP   ${endpoints.mcp.url}`);
+    logger.newline();
+    if (endpoints.active) {
+        logger.info(`Set ${MCP_API_KEY_VARIABLE} from your secret store. Check MCP without running a query:`);
+        logger.indent(`hypequery mcp --self-test --url ${endpoints.mcp.url}`);
+    }
+    else {
+        logger.info('These URLs will serve the target after a release is live.');
+    }
+    if (mcpConfig) {
+        logger.newline();
+        logger.info(`MCP client configuration (the client reads the key from ${MCP_API_KEY_VARIABLE}):`);
+        for (const line of mcpClientConfiguration(endpoints.mcp.url).split('\n'))
+            logger.indent(line);
+    }
+}

package/dist/utils/hosted-endpoints.d.ts

@@ -0,0 +1,37 @@
+import type { ProtocolDeploymentReleaseTarget } from '@hypequery/protocol';
+import { type LiveDeploymentFetch } from './live-deployment.js';
+/** Where Cloud serves a deployed target. Cloud owns this layout, not the CLI. */
+export type HostedEndpoints = {
+    readonly active: boolean;
+    readonly rest: {
+        readonly baseUrl: string;
+        readonly datasets: readonly {
+            readonly name: string;
+            readonly url: string;
+        }[];
+    };
+    readonly mcp: {
+        readonly url: string;
+    };
+};
+export declare function parseHostedEndpoints(input: unknown): HostedEndpoints | undefined;
+/**
+ * Asks Cloud where the target is served. Never throws: the deployment has
+ * already succeeded, so an older Cloud (404), a network failure, or an
+ * unexpected response just means there is nothing to print.
+ */
+export declare function fetchHostedEndpoints(input: {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly target: ProtocolDeploymentReleaseTarget;
+    readonly fetch?: LiveDeploymentFetch;
+}): Promise<HostedEndpoints | undefined>;
+/** The environment variable generated configuration reads the key from. */
+export declare const MCP_API_KEY_VARIABLE = "HYPEQUERY_API_KEY";
+/**
+ * Client configuration for the hosted MCP endpoint. The key is a placeholder
+ * the client expands from its environment: the CLI never writes a credential
+ * into anything it prints.
+ */
+export declare function mcpClientConfiguration(mcpUrl: string): string;
+//# sourceMappingURL=hosted-endpoints.d.ts.map

package/dist/utils/hosted-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-endpoints.d.ts","sourceRoot":"","sources":["../../src/utils/hosted-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAIzE,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC/E,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC,CAAC;AAYF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAkBhF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAiBvC;AAED,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAc7D"}

package/dist/utils/hosted-endpoints.js

@@ -0,0 +1,81 @@
+import { liveUrl } from './live-deployment.js';
+const MAX_RESPONSE_BYTES = 256 * 1024;
+function httpUrl(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseHostedEndpoints(input) {
+    if (typeof input !== 'object' || input === null)
+        return undefined;
+    const value = input;
+    if (value.kind !== 'hypequery-hosted-endpoints' || value.version !== 1)
+        return undefined;
+    const baseUrl = httpUrl(value.rest?.baseUrl);
+    const mcp = httpUrl(value.mcp?.url);
+    if (!baseUrl || !mcp || !Array.isArray(value.rest?.datasets))
+        return undefined;
+    const datasets = [];
+    for (const dataset of value.rest.datasets) {
+        const url = httpUrl(dataset?.url);
+        if (typeof dataset?.name !== 'string' || !url)
+            return undefined;
+        datasets.push(Object.freeze({ name: dataset.name, url }));
+    }
+    return Object.freeze({
+        active: value.active === true,
+        rest: Object.freeze({ baseUrl, datasets: Object.freeze(datasets) }),
+        mcp: Object.freeze({ url: mcp }),
+    });
+}
+/**
+ * Asks Cloud where the target is served. Never throws: the deployment has
+ * already succeeded, so an older Cloud (404), a network failure, or an
+ * unexpected response just means there is nothing to print.
+ */
+export async function fetchHostedEndpoints(input) {
+    try {
+        const url = liveUrl(input.endpoint, input.target, 'endpoints');
+        if (!url)
+            return undefined;
+        const response = await (input.fetch ?? fetch)(url, {
+            method: 'GET',
+            headers: { Accept: 'application/json', Authorization: `Bearer ${input.token}` },
+            redirect: 'error',
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok)
+            return undefined;
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        if (bytes.byteLength > MAX_RESPONSE_BYTES)
+            return undefined;
+        return parseHostedEndpoints(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The environment variable generated configuration reads the key from. */
+export const MCP_API_KEY_VARIABLE = 'HYPEQUERY_API_KEY';
+/**
+ * Client configuration for the hosted MCP endpoint. The key is a placeholder
+ * the client expands from its environment: the CLI never writes a credential
+ * into anything it prints.
+ */
+export function mcpClientConfiguration(mcpUrl) {
+    return JSON.stringify({
+        mcpServers: {
+            hypequery: {
+                type: 'http',
+                url: mcpUrl,
+                headers: { Authorization: `Bearer \${${MCP_API_KEY_VARIABLE}}` },
+            },
+        },
+    }, null, 2);
+}

package/dist/utils/live-deployment.d.ts

@@ -26,6 +26,12 @@ export type LiveDeployment = {
     };
 };
 export type LiveDeploymentFetch = typeof fetch;
+/**
+ * The Cloud target resource beside a submissions endpoint, or undefined when
+ * the endpoint is not a Cloud submissions URL. Refuses anything but https (or
+ * loopback http) so a credential is never sent in the clear.
+ */
+export declare function liveUrl(endpoint: string, target: ProtocolDeploymentReleaseTarget, resource: 'state' | 'source' | 'endpoints'): string | undefined;
 export declare function fetchLiveDeployment(input: {
     readonly endpoint: string;
     readonly token: string;

package/dist/utils/live-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-deployment.d.ts","sourceRoot":"","sources":["../../src/utils/live-deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAO7B,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,KAAK,CAAC;AA8K/C,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAuCtC"}
+{"version":3,"file":"live-deployment.d.ts","sourceRoot":"","sources":["../../src/utils/live-deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAO7B,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,KAAK,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,+BAA+B,EACvC,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GACzC,MAAM,GAAG,SAAS,CAkBpB;AAsJD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAuCtC"}

package/dist/utils/live-deployment.js

@@ -3,7 +3,12 @@ import path from 'node:path';
 import { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, validateProtocolDeploymentReleaseTarget, } from '@hypequery/protocol';
 const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const MAX_RESPONSE_BYTES = Math.ceil(DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxSourceBytes * 1.4) + 1_000_000;
-function liveUrl(endpoint, target, resource) {
+/**
+ * The Cloud target resource beside a submissions endpoint, or undefined when
+ * the endpoint is not a Cloud submissions URL. Refuses anything but https (or
+ * loopback http) so a credential is never sent in the clear.
+ */
+export function liveUrl(endpoint, target, resource) {
     const url = new URL(endpoint);
     if (!/\/v1\/deployments\/submissions\/?$/.test(url.pathname)) {
         return undefined;

package/dist/utils/mcp-remote-check.d.ts

@@ -0,0 +1,19 @@
+export type RemoteMcpCheck = {
+    readonly ok: true;
+    readonly tools: number;
+    readonly server?: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * A non-destructive check of a hosted MCP endpoint: initialize, then list
+ * tools. It never calls a tool, so it runs no query and changes nothing.
+ * The key is sent only as a bearer header and never included in the result.
+ */
+export declare function checkRemoteMcp(input: {
+    readonly url: string;
+    readonly key: string;
+    readonly fetch?: typeof fetch;
+}): Promise<RemoteMcpCheck>;
+//# sourceMappingURL=mcp-remote-check.d.ts.map

package/dist/utils/mcp-remote-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-check.d.ts","sourceRoot":"","sources":["../../src/utils/mcp-remote-check.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkCpD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B,GAAG,OAAO,CAAC,cAAc,CAAC,CAsD1B"}

package/dist/utils/mcp-remote-check.js

@@ -0,0 +1,96 @@
+import { readMcpResponse } from './mcp-response.js';
+const PROTOCOL_VERSION = '2025-06-18';
+const TIMEOUT_MS = 15_000;
+const SUPPORTED_PROTOCOL_VERSIONS = new Set(['2025-03-26', PROTOCOL_VERSION, '2025-11-25']);
+async function rpc(fetchFn, url, key, message, session, protocolVersion = PROTOCOL_VERSION) {
+    const response = await fetchFn(url, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${key}`,
+            'content-type': 'application/json',
+            accept: 'application/json, text/event-stream',
+            'mcp-protocol-version': protocolVersion,
+            ...(session ? { 'mcp-session-id': session } : {}),
+        },
+        body: JSON.stringify(message),
+        redirect: 'error',
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    const body = await readMcpResponse(response, message.id);
+    return { response, body };
+}
+function refusal(status) {
+    if (status === 401)
+        return 'the API key was refused (401). Check HYPEQUERY_API_KEY.';
+    if (status === 403)
+        return 'the API key may not use MCP here (403). Check its scopes.';
+    if (status === 404)
+        return 'no MCP endpoint is published at this URL (404).';
+    return `the endpoint answered HTTP ${status}.`;
+}
+/**
+ * A non-destructive check of a hosted MCP endpoint: initialize, then list
+ * tools. It never calls a tool, so it runs no query and changes nothing.
+ * The key is sent only as a bearer header and never included in the result.
+ */
+export async function checkRemoteMcp(input) {
+    const fetchFn = input.fetch ?? fetch;
+    let url;
+    try {
+        url = new URL(input.url);
+    }
+    catch {
+        return { ok: false, reason: 'the URL is not valid.' };
+    }
+    const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
+        return { ok: false, reason: 'the URL must use https, so the API key is not sent in the clear.' };
+    }
+    try {
+        const init = await rpc(fetchFn, url.href, input.key, {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: PROTOCOL_VERSION,
+                capabilities: {},
+                clientInfo: { name: 'hypequery-cli-self-test', version: '1.0.0' },
+            },
+        });
+        if (!init.response.ok)
+            return { ok: false, reason: refusal(init.response.status) };
+        if (!init.body?.result)
+            return { ok: false, reason: 'initialize returned no result.' };
+        const protocolVersion = init.body.result.protocolVersion;
+        if (typeof protocolVersion !== 'string' || !SUPPORTED_PROTOCOL_VERSIONS.has(protocolVersion)) {
+            return { ok: false, reason: 'initialize returned an unsupported protocol version.' };
+        }
+        const session = init.response.headers.get('mcp-session-id') ?? undefined;
+        const initialized = await rpc(fetchFn, url.href, input.key, {
+            jsonrpc: '2.0',
+            method: 'notifications/initialized',
+        }, session, protocolVersion);
+        if (!initialized.response.ok)
+            return { ok: false, reason: refusal(initialized.response.status) };
+        const listed = await rpc(fetchFn, url.href, input.key, {
+            jsonrpc: '2.0',
+            id: 2,
+            method: 'tools/list',
+        }, session, protocolVersion);
+        if (!listed.response.ok)
+            return { ok: false, reason: refusal(listed.response.status) };
+        const tools = listed.body?.result?.tools;
+        if (!Array.isArray(tools))
+            return { ok: false, reason: 'tools/list returned no tools.' };
+        const server = init.body.result.serverInfo?.name;
+        return { ok: true, tools: tools.length, ...(typeof server === 'string' ? { server } : {}) };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: error?.name === 'TimeoutError'
+                ? 'the endpoint did not answer in time.'
+                : 'the endpoint could not be reached.',
+        };
+    }
+}

package/dist/utils/mcp-response.d.ts

@@ -0,0 +1,3 @@
+/** Read a JSON-RPC response, including responses delivered over an SSE stream. */
+export declare function readMcpResponse(response: Response, requestId: unknown): Promise<Record<string, any> | null>;
+//# sourceMappingURL=mcp-response.d.ts.map

package/dist/utils/mcp-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-response.d.ts","sourceRoot":"","sources":["../../src/utils/mcp-response.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAiDrC"}

package/dist/utils/mcp-response.js

@@ -0,0 +1,58 @@
+/** Read a JSON-RPC response, including responses delivered over an SSE stream. */
+export async function readMcpResponse(response, requestId) {
+    if (!response.ok || requestId === undefined) {
+        await response.body?.cancel();
+        return null;
+    }
+    const contentType = response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase();
+    if (contentType !== 'text/event-stream') {
+        try {
+            const body = await response.json();
+            return body?.jsonrpc === '2.0' && body.id === requestId ? body : null;
+        }
+        catch (error) {
+            if (error?.name === 'TimeoutError' || error?.name === 'AbortError') {
+                throw error;
+            }
+            return null;
+        }
+    }
+    if (!response.body)
+        return null;
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let pending = '';
+    let data = [];
+    try {
+        for (;;) {
+            const chunk = await reader.read();
+            pending += decoder.decode(chunk.value, { stream: !chunk.done });
+            let newline;
+            while ((newline = /\r\n|\r|\n/.exec(pending))) {
+                // A CR at the chunk boundary may be the first half of CRLF.
+                if (!chunk.done && newline[0] === '\r' && newline.index === pending.length - 1)
+                    break;
+                const line = pending.slice(0, newline.index);
+                pending = pending.slice(newline.index + newline[0].length);
+                if (line === '') {
+                    if (data.length > 0) {
+                        const body = JSON.parse(data.join('\n'));
+                        data = [];
+                        if (body?.jsonrpc === '2.0' && body.id === requestId
+                            && ('result' in body || 'error' in body))
+                            return body;
+                    }
+                }
+                else if (line === 'data' || line.startsWith('data:')) {
+                    data.push(line === 'data' ? '' : line.slice(5).replace(/^ /, ''));
+                }
+            }
+            if (chunk.done)
+                return null;
+        }
+    }
+    finally {
+        await reader.cancel();
+        reader.releaseLock();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.21.1",
+  "version": "1.22.0",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -22,16 +22,16 @@
     "dist"
   ],
   "dependencies": {
-    "@clickhouse/client": "^1.18.3",
+    "@clickhouse/client": "^1.23.1",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "dotenv": "^16.4.7",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.2",
     "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.9.2",
-    "@hypequery/protocol": "0.16.0"
+    "@hypequery/deployment": "0.9.4",
+    "@hypequery/protocol": "0.18.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"
@@ -48,11 +48,11 @@
   "devDependencies": {
     "@types/node": "^20.11.30",
     "@types/prompts": "^2.4.9",
-    "@vitest/coverage-v8": "^3.2.6",
+    "@vitest/coverage-v8": "^5.0.2",
     "typescript": "^5.7.3",
-    "vitest": "^3.2.6",
-    "@hypequery/mcp": "0.8.3",
-    "@hypequery/serve": "0.19.1"
+    "vitest": "^5.0.2",
+    "@hypequery/mcp": "0.8.5",
+    "@hypequery/serve": "0.19.3"
   },
   "repository": {
     "type": "git",
@@ -69,7 +69,7 @@
   "scripts": {
     "build": "tsc --project tsconfig.json",
     "dev": "tsc --project tsconfig.json --watch",
-    "lint": "eslint --ext .ts \"src/**/*.ts\"",
+    "lint": "eslint \"src/**/*.ts\"",
     "test": "vitest run"
   }
 }