@hypequery/cli 1.22.0 → 1.24.0

package/dist/utils/telemetry/session-config.js

@@ -0,0 +1,17 @@
+import path from 'node:path';
+/** Explicit file arguments are classified without examining or retaining their path. */
+export function entryType(resolved, explicit) {
+    if (explicit)
+        return 'explicit_file';
+    const basename = path.basename(resolved);
+    return basename === 'hypequery.ts' || basename === 'api.ts' || basename === 'queries.ts' ? basename : 'unknown';
+}
+export function devSessionConfig(resolved, explicit, options) {
+    const cache = options.cache;
+    return {
+        entry_type: entryType(resolved, explicit), watch: options.watch !== false,
+        cache_provider: cache === false || cache === 'none' ? 'none' : cache === 'memory' || cache === 'redis' ? cache : 'unknown',
+        cors: options.cors === true, open: options.open === true,
+        custom_port: options.port !== undefined && options.port !== 4000, quiet: options.quiet === true,
+    };
+}

package/dist/utils/telemetry/settings-lock.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Cross-process lock for the telemetry settings file.
+ *
+ * The lock is a directory holding exactly one owner file named
+ * `owner.<pid>.<host>.<token>`. It is published with an atomic rename, so it
+ * never exists without an owner. A writer never removes a lock it does not own:
+ *
+ * - Recovery takes over a lock only when its owner process no longer exists on
+ *   this host, by renaming that exact owner file to the new owner's name. The
+ *   rename fails if the lock was already replaced or taken over, so concurrent
+ *   recoverers cannot both win and a replacement lock is never touched.
+ * - A live owner keeps its lock however long it runs: age is never evidence of
+ *   abandonment, because a slow or suspended writer is still alive.
+ * - Release deletes only this writer's own owner file.
+ *
+ * A lock owned on another host (shared home directory) cannot be checked and
+ * fails closed. PID reuse makes a dead owner look alive, which also fails closed.
+ */
+export interface SettingsLockIdentity {
+    /** Owner process ID; injectable so tests can model separate processes. */
+    readonly pid: number;
+    /** Liveness of a process on this host. */
+    readonly isAlive: (pid: number) => boolean;
+    readonly host: string;
+}
+export interface SettingsLock {
+    /** Removes this writer's ownership only; never another writer's lock. */
+    release(): Promise<void>;
+}
+/** Only an ownerless lock (mid-publish crash on platforms without dir replace) ages out. */
+export declare const ORPHANED_LOCK_MS = 10000;
+export declare function processIsAlive(pid: number): boolean;
+export declare function localIdentity(): SettingsLockIdentity;
+/** Acquires the lock, retrying a held one up to `attempts` times; null when unavailable. */
+export declare function acquireSettingsLock(directory: string, attempts: number, identity?: SettingsLockIdentity): Promise<SettingsLock | null>;
+//# sourceMappingURL=settings-lock.d.ts.map

package/dist/utils/telemetry/settings-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-lock.d.ts","sourceRoot":"","sources":["../../../src/utils/telemetry/settings-lock.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAIvC,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQnD;AAED,wBAAgB,aAAa,IAAI,oBAAoB,CAEpD;AAMD,4FAA4F;AAC5F,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,oBAAsC,GAC/C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB9B"}

package/dist/utils/telemetry/settings-lock.js

@@ -0,0 +1,102 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { mkdir, readdir, rename, rm, rmdir, stat, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+/** Only an ownerless lock (mid-publish crash on platforms without dir replace) ages out. */
+export const ORPHANED_LOCK_MS = 10_000;
+const OWNER = /^owner\.(\d+)\.([0-9a-f]{12})\.([0-9a-f-]{36})$/;
+export function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM: the process exists but belongs to another user.
+        return error.code !== 'ESRCH';
+    }
+}
+export function localIdentity() {
+    return { pid: process.pid, isAlive: processIsAlive, host: hostname() };
+}
+function hostHash(host) {
+    return createHash('sha256').update(host).digest('hex').slice(0, 12);
+}
+/** Acquires the lock, retrying a held one up to `attempts` times; null when unavailable. */
+export async function acquireSettingsLock(directory, attempts, identity = localIdentity()) {
+    const lockPath = path.join(directory, 'telemetry.lock');
+    const owner = `owner.${identity.pid}.${hostHash(identity.host)}.${randomUUID()}`;
+    const staged = path.join(directory, `telemetry.lock.${randomUUID()}.tmp`);
+    await mkdir(staged, { mode: 0o700 });
+    try {
+        await writeFile(path.join(staged, owner), '', { flag: 'wx', mode: 0o600 });
+        for (let attempt = 0; attempt < attempts; attempt++) {
+            if (await publish(staged, lockPath) || await takeOver(lockPath, owner, identity)) {
+                return { release: () => release(lockPath, owner) };
+            }
+            if (attempt + 1 < attempts)
+                await delay(10);
+        }
+        return null;
+    }
+    finally {
+        await rm(staged, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/** Atomically publishes the staged lock; false when a lock already exists. */
+async function publish(staged, lockPath) {
+    try {
+        await rename(staged, lockPath);
+        return true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'EEXIST' || code === 'ENOTEMPTY' || code === 'EPERM' || code === 'EACCES' || code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Takes over a lock whose owner is dead on this host; never touches a live or replaced lock. */
+async function takeOver(lockPath, owner, identity) {
+    let entries;
+    try {
+        entries = await readdir(lockPath);
+    }
+    catch {
+        return false;
+    }
+    const owners = entries.filter(entry => entry.startsWith('owner.'));
+    if (owners.length === 0) {
+        // Ownerless: a publish or release in progress, or one interrupted on a
+        // platform where rename cannot replace an empty directory. rmdir only
+        // removes it while still empty, so a newly published lock survives.
+        try {
+            if (Date.now() - (await stat(lockPath)).mtimeMs >= ORPHANED_LOCK_MS)
+                await rmdir(lockPath);
+        }
+        catch { /* Not empty, already gone, or unavailable. */ }
+        return false;
+    }
+    const match = owners.length === 1 ? OWNER.exec(owners[0]) : null;
+    if (!match || match[2] !== hostHash(identity.host) || identity.isAlive(Number(match[1])))
+        return false;
+    try {
+        // Conditional on that exact owner file: only one recoverer can succeed.
+        await rename(path.join(lockPath, owners[0]), path.join(lockPath, owner));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function release(lockPath, owner) {
+    try {
+        await unlink(path.join(lockPath, owner));
+    }
+    catch {
+        // Not ours any more (or unavailable): never remove someone else's lock.
+        return;
+    }
+    // Removes the directory only while empty; a lock published meanwhile survives.
+    await rmdir(lockPath).catch(() => undefined);
+}

package/dist/utils/telemetry/transport.d.ts

@@ -0,0 +1,25 @@
+import { type DispatchBatch } from './detached-dispatch.js';
+export declare const MAX_BATCH_BYTES: number;
+export declare const MAX_BATCH_EVENTS = 32;
+export interface TransportOptions {
+    readonly enabled: boolean;
+    readonly endpoint?: string;
+    readonly debug?: boolean;
+    /** Injectable for tests; defaults to a detached sender process. */
+    readonly dispatch?: DispatchBatch;
+    readonly write?: (text: string) => void;
+    readonly now?: () => Date;
+}
+/** In-memory, one-batch delivery with no retry queue and no vendor dependency. */
+export declare class TelemetryTransport {
+    private readonly options;
+    private queue;
+    private sent;
+    private flushing?;
+    constructor(options: TransportOptions);
+    private debug;
+    enqueue(input: unknown): void;
+    flush(): Promise<void>;
+    private send;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/utils/telemetry/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../src/utils/telemetry/transport.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAG9E,eAAO,MAAM,eAAe,QAAY,CAAC;AACzC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AASD,kFAAkF;AAClF,qBAAa,kBAAkB;IAKjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,KAAK,CAAmB;IAChC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAC,CAAgB;gBAEJ,OAAO,EAAE,gBAAgB;IAEtD,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IA2B7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAKR,IAAI;CAenB"}

package/dist/utils/telemetry/transport.js

@@ -0,0 +1,76 @@
+import { validateTelemetryEvent } from './validation.js';
+import { dispatchDetached } from './detached-dispatch.js';
+import { telemetryEndpoint } from './endpoint.js';
+export const MAX_BATCH_BYTES = 64 * 1024;
+export const MAX_BATCH_EVENTS = 32;
+/** In-memory, one-batch delivery with no retry queue and no vendor dependency. */
+export class TelemetryTransport {
+    options;
+    queue = [];
+    sent = false;
+    flushing;
+    constructor(options) {
+        this.options = options;
+    }
+    debug(text) {
+        try {
+            (this.options.write ?? (message => { process.stderr.write(message); }))(text);
+        }
+        catch { /* Ignore broken stderr. */ }
+    }
+    enqueue(input) {
+        if (!this.options.enabled || this.sent || this.queue.length >= MAX_BATCH_EVENTS)
+            return;
+        try {
+            if (!validateTelemetryEvent(input)) {
+                if (this.options.debug)
+                    this.debug('[telemetry] Dropped invalid event.\n');
+                return;
+            }
+            const snapshot = JSON.parse(JSON.stringify(input));
+            if (!validateTelemetryEvent(snapshot)) {
+                if (this.options.debug)
+                    this.debug('[telemetry] Dropped invalid event.\n');
+                return;
+            }
+            const event = {
+                event: snapshot.event, distinct_id: snapshot.properties.install_id,
+                properties: { ...snapshot.properties, $process_person_profile: false, $geoip_disable: true },
+                timestamp: (this.options.now?.() ?? new Date()).toISOString(),
+            };
+            if (Buffer.byteLength(JSON.stringify({ api_key: 'hypequery-cli', batch: [...this.queue, event] })) > MAX_BATCH_BYTES) {
+                if (this.options.debug)
+                    this.debug('[telemetry] Dropped event: batch size limit.\n');
+                return;
+            }
+            this.queue.push(event);
+        }
+        catch {
+            if (this.options.debug)
+                this.debug('[telemetry] Dropped invalid event.\n');
+        }
+    }
+    flush() {
+        this.flushing ??= this.send();
+        return this.flushing;
+    }
+    async send() {
+        this.sent = true;
+        const events = this.queue;
+        this.queue = [];
+        if (!this.options.enabled || !events.length)
+            return;
+        if (this.options.debug) {
+            for (const event of events)
+                this.debug(`${JSON.stringify(event)}\n`);
+            return;
+        }
+        const url = telemetryEndpoint(this.options.endpoint);
+        if (!url)
+            return;
+        try {
+            (this.options.dispatch ?? dispatchDetached)(url, JSON.stringify({ api_key: 'hypequery-cli', batch: events }));
+        }
+        catch { /* Temporary-file and spawn failures never affect the command. */ }
+    }
+}

package/dist/utils/telemetry/validation.d.ts

@@ -0,0 +1,10 @@
+import { type TelemetryEvent } from './catalog.js';
+/** Reject the entire payload on unknown content; never guess how to redact it. */
+export declare function validateTelemetryEvent(input: unknown): input is TelemetryEvent;
+type DeepExact<A, E> = E extends unknown ? A extends E ? A extends readonly unknown[] ? A : A extends object ? {
+    [K in keyof A]: K extends keyof E ? DeepExact<A[K], E[K]> : never;
+} : A : never : never;
+/** The typed construction boundary also checks runtime data and returns a detached JSON snapshot. */
+export declare function createTelemetryEvent<const T extends TelemetryEvent>(input: T & DeepExact<T, TelemetryEvent>): TelemetryEvent | null;
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/dist/utils/telemetry/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/utils/telemetry/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,cAAc,EAA2B,MAAM,cAAc,CAAC;AAsC9G,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAwB9E;AAED,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,CAAC,SAAS,CAAC,GAClD,CAAC,SAAS,SAAS,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,MAAM,GACjD;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;CAAE,GACrE,CAAC,GACH,KAAK,GAAG,KAAK,CAAC;AAElB,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,CAAC,SAAS,cAAc,EACjE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,GACtC,cAAc,GAAG,IAAI,CAQvB"}

package/dist/utils/telemetry/validation.js

@@ -0,0 +1,77 @@
+import { COMMON_PROPERTIES, EVENT_CATALOG } from './catalog.js';
+import { COMMAND_FLAGS, GLOBAL_FLAGS } from './domains.js';
+import { matchesTelemetryFormat } from './value-formats.js';
+/** Only plain JSON data; reject accessors, custom prototypes and symbol keys. */
+function plainRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return (prototype === Object.prototype || prototype === null)
+        && Reflect.ownKeys(value).every(key => typeof key === 'string'
+            && Object.getOwnPropertyDescriptor(value, key)?.enumerable === true
+            && Object.hasOwn(Object.getOwnPropertyDescriptor(value, key) ?? {}, 'value'));
+}
+function validField(field, value) {
+    switch (field.kind) {
+        case 'boolean': return typeof value === 'boolean';
+        case 'enum': return field.values.includes(value);
+        case 'enum_list': return Array.isArray(value)
+            && value.length <= field.values.length
+            && Object.getPrototypeOf(value) === Array.prototype
+            && Reflect.ownKeys(value).length === value.length + 1
+            && Array.from({ length: value.length }, (_, index) => Object.getOwnPropertyDescriptor(value, String(index)))
+                .every(descriptor => descriptor?.enumerable === true && Object.hasOwn(descriptor, 'value'))
+            && new Set(value).size === value.length
+            && value.every(item => typeof item === 'string' && field.values.includes(item));
+        case 'format': return matchesTelemetryFormat(field.format, value);
+        case 'record': return validProperties(field.fields, value);
+    }
+}
+function validProperties(fields, value) {
+    return plainRecord(value)
+        && Object.keys(value).every(key => Object.hasOwn(fields, key) && validField(fields[key], value[key]))
+        && Object.entries(fields).every(([key, field]) => field.optional || Object.hasOwn(value, key));
+}
+/** Reject the entire payload on unknown content; never guess how to redact it. */
+export function validateTelemetryEvent(input) {
+    try {
+        if (!plainRecord(input) || Object.keys(input).length !== 2
+            || !Object.hasOwn(input, 'event') || !Object.hasOwn(input, 'properties')
+            || typeof input.event !== 'string' || !Object.hasOwn(EVENT_CATALOG, input.event)
+            || !plainRecord(input.properties))
+            return false;
+        const definition = EVENT_CATALOG[input.event];
+        let variant = {};
+        if ('variants' in definition) {
+            const command = input.properties.command;
+            if (typeof command !== 'string' || !Object.hasOwn(definition.variants, command))
+                return false;
+            variant = definition.variants[command];
+        }
+        if (!validProperties({ ...COMMON_PROPERTIES, ...definition.properties, ...variant }, input.properties))
+            return false;
+        if (input.event === 'cli_command_completed') {
+            const command = input.properties.command;
+            const allowed = [...COMMAND_FLAGS[command], ...GLOBAL_FLAGS];
+            if (!input.properties.flags_used.every(flag => allowed.includes(flag)))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        // Proxies and malformed untrusted objects must not affect the command.
+        return false;
+    }
+}
+/** The typed construction boundary also checks runtime data and returns a detached JSON snapshot. */
+export function createTelemetryEvent(input) {
+    if (!validateTelemetryEvent(input))
+        return null;
+    try {
+        const snapshot = JSON.parse(JSON.stringify(input));
+        return validateTelemetryEvent(snapshot) ? snapshot : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/telemetry/value-formats.d.ts

@@ -0,0 +1,30 @@
+/** Format rules are shared by validation, snapshots and generated documentation. */
+export declare const VALUE_FORMATS: {
+    readonly uuid: {
+        readonly pattern: RegExp;
+        readonly maxLength: 36;
+        readonly description: "Random UUID v4 (36 characters)";
+    };
+    readonly hash: {
+        readonly pattern: RegExp;
+        readonly maxLength: 64;
+        readonly description: "64 lowercase hexadecimal characters (salted SHA-256)";
+    };
+    readonly version: {
+        readonly pattern: RegExp;
+        readonly maxLength: 80;
+        readonly description: "Exact major.minor.patch (1–3 digits per component); optional canary/alpha/beta/rc/dev/snapshot suffix with 1–14 digit numeric components, or `unknown`; at most 80 characters";
+    };
+    readonly node_version: {
+        readonly pattern: RegExp;
+        readonly maxLength: 80;
+        readonly description: "Numeric major.minor (1–3 digits per component), or `unknown`";
+    };
+    readonly major_version: {
+        readonly pattern: RegExp;
+        readonly maxLength: 80;
+        readonly description: "Numeric major (1–3 digits), or `unknown`";
+    };
+};
+export declare function matchesTelemetryFormat(format: keyof typeof VALUE_FORMATS, value: unknown): boolean;
+//# sourceMappingURL=value-formats.d.ts.map

package/dist/utils/telemetry/value-formats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-formats.d.ts","sourceRoot":"","sources":["../../../src/utils/telemetry/value-formats.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,OAAO,aAAa,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAIlG"}

package/dist/utils/telemetry/value-formats.js

@@ -0,0 +1,13 @@
+/** Format rules are shared by validation, snapshots and generated documentation. */
+export const VALUE_FORMATS = {
+    uuid: { pattern: /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, maxLength: 36, description: 'Random UUID v4 (36 characters)' },
+    hash: { pattern: /^[0-9a-f]{64}$/, maxLength: 64, description: '64 lowercase hexadecimal characters (salted SHA-256)' },
+    version: { pattern: /^(?:unknown|\d{1,3}\.\d{1,3}\.\d{1,3}(?:-(?:canary|alpha|beta|rc|dev|snapshot)(?:[.-]\d{1,14})*)?)$/, maxLength: 80, description: 'Exact major.minor.patch (1–3 digits per component); optional canary/alpha/beta/rc/dev/snapshot suffix with 1–14 digit numeric components, or `unknown`; at most 80 characters' },
+    node_version: { pattern: /^(?:unknown|\d{1,3}\.\d{1,3})$/, maxLength: 80, description: 'Numeric major.minor (1–3 digits per component), or `unknown`' },
+    major_version: { pattern: /^(?:unknown|\d{1,3})$/, maxLength: 80, description: 'Numeric major (1–3 digits), or `unknown`' },
+};
+export function matchesTelemetryFormat(format, value) {
+    const rule = VALUE_FORMATS[format];
+    return typeof value === 'string' && value.length <= rule.maxLength
+        && rule.pattern.exec(value)?.[0] === value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.22.0",
+  "version": "1.24.0",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -22,7 +22,7 @@
     "dist"
   ],
   "dependencies": {
-    "@clickhouse/client": "^1.23.1",
+    "@clickhouse/client": "^1.24.0",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "dotenv": "^16.4.7",
@@ -30,8 +30,8 @@
     "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.9.4",
-    "@hypequery/protocol": "0.18.0"
+    "@hypequery/deployment": "0.9.5",
+    "@hypequery/protocol": "0.19.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"
@@ -49,10 +49,10 @@
     "@types/node": "^20.11.30",
     "@types/prompts": "^2.4.9",
     "@vitest/coverage-v8": "^5.0.2",
-    "typescript": "^5.7.3",
+    "typescript": "^6.0.3",
     "vitest": "^5.0.2",
-    "@hypequery/mcp": "0.8.5",
-    "@hypequery/serve": "0.19.3"
+    "@hypequery/mcp": "0.9.0",
+    "@hypequery/serve": "0.21.0"
   },
   "repository": {
     "type": "git",
@@ -70,6 +70,10 @@
     "build": "tsc --project tsconfig.json",
     "dev": "tsc --project tsconfig.json --watch",
     "lint": "eslint \"src/**/*.ts\"",
-    "test": "vitest run"
+    "test": "pnpm build && vitest run && pnpm test:types",
+    "test:types": "tsc --project tsconfig.type-tests.json --noEmit",
+    "telemetry:docs": "pnpm build && node scripts/generate-telemetry-docs.mjs",
+    "telemetry:docs:check": "pnpm build && node scripts/generate-telemetry-docs.mjs --check",
+    "telemetry:benchmark": "pnpm build && node scripts/benchmark-telemetry.mjs"
   }
 }