@hypequery/cli 1.26.0 → 1.28.0

package/README.md

@@ -37,13 +37,26 @@ npx hypequery init \
 | `hypequery dev` | Local API, docs, and hot reload |
 | `hypequery generate` | Fresh TypeScript types from ClickHouse or chDB |
 | `hypequery generate:datasets` | Dataset definitions scaffolded from tables |
-| `hypequery generate:client` | TypeScript API types and routes from a Python client contract |
+| `hypequery generate:client` | TypeScript API types and routes from a Python client contract or the live Cloud release (`--cloud`) |
 | `hypequery generate:manifest` | A browser-safe route manifest for React hooks |
 | `hypequery pull` / `diff` | Live source inspection and comparison |
 | `hypequery deployment:status` | Live release and Cloud-provided connection URLs |
 
 Non-interactive ClickHouse commands read `CLICKHOUSE_URL`, `CLICKHOUSE_DATABASE`, `CLICKHOUSE_USERNAME`, and `CLICKHOUSE_PASSWORD`.
 
+## Generate a client for Cloud datasets
+
+After `hypequery login`, generate typed React routes and types from the live
+Cloud release, or have every publish regenerate them:
+
+```bash
+npx hypequery generate:client --cloud --output src/hypequery-client.ts
+npx hypequery deploy analytics/cloud.ts --client src/hypequery-client.ts
+```
+
+The file also exports `clientBaseUrl`. See
+[Connect React to hypequery Cloud](https://hypequery.com/docs/react/cloud).
+
 ## Generate a client for Python endpoints
 
 Export a build contract from your Python definition-only factory, then generate

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAE9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAySD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAE9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAgTD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -166,11 +166,15 @@ program
     await generateDatasetsCommand(options);
 }));
 program
-    .command('generate:client <contract>')
-    .description('Generate browser-safe TypeScript API types and routes from a client contract JSON file')
+    .command('generate:client [contract]')
+    .description('Generate browser-safe TypeScript API types and routes from a client contract JSON file or the live Cloud release')
     .option('-o, --output <path>', 'Output TypeScript file (default: analytics/hypequery-client.ts)')
     .option('--check', 'Check for drift without writing')
     .option('--force', 'Replace an existing output file')
+    .option('--cloud', 'Use the live Cloud release of the target from `hypequery login`')
+    .option('--project <project>', 'With --cloud: target project identifier (advanced override)')
+    .option('--environment <environment>', 'With --cloud: target environment identifier (advanced override)')
+    .option('--endpoint <url>', 'With --cloud: HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .action(runCommand(async (contract, options) => {
     await generateClientCommand(contract, options);
 }));
@@ -208,6 +212,7 @@ program
     .command('deployment:submit <bundle>')
     .description('Submit a prebuilt deployment bundle and release')
     .requiredOption('--release <path>', 'Target-bound release JSON path')
+    .option('--draft <name>', 'Save a named Cloud draft without publishing Production')
     .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .option('--replace-restored', 'Intentionally replace a restored live release')
     .action(runCommand(async (bundle, options) => {
@@ -231,9 +236,11 @@ program
     .option('--project <project>', 'Target project identifier (advanced override)')
     .option('--environment <environment>', 'Target environment identifier (advanced override)')
     .option('--no-source', 'Exclude project source files from the deployment bundle')
+    .option('--draft <name>', 'Save a named Cloud draft without publishing Production')
     .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .option('--replace-restored', 'Intentionally replace a restored live release')
     .option('--mcp-config', 'Also print MCP client configuration for the hosted endpoint')
+    .option('--client <path>', 'Regenerate this typed client file from the new live release')
     .action(runCommand(async (source, options) => {
     await deployCommand(source, options);
 }));

package/dist/commands/deploy.d.ts

@@ -3,22 +3,27 @@ import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
 import { fetchLiveDeployment } from '../utils/live-deployment.js';
 import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand } from './deployment.js';
+import { generateClientCommand } from './generate-client.js';
 export interface SubmitDeploymentOptions {
     release?: string;
     endpoint?: string;
     replaceRestored?: boolean;
+    draft?: string;
     /** Also print MCP client configuration for the hosted endpoint. */
     mcpConfig?: boolean;
 }
 export interface DeployOptions {
     endpoint?: string;
     replaceRestored?: boolean;
+    draft?: string;
     project?: string;
     environment?: string;
     bundleOutput?: string;
     releaseOutput?: string;
     source?: boolean;
     mcpConfig?: boolean;
+    /** Regenerate this typed client file from the new live release. */
+    client?: string;
 }
 export interface SubmitDeploymentDependencies {
     readonly env?: Readonly<Record<string, string | undefined>>;
@@ -31,6 +36,7 @@ export interface DeployDependencies extends SubmitDeploymentDependencies {
     readonly buildDeployment?: typeof buildDeploymentCommand;
     readonly prepareDeploymentRelease?: typeof prepareDeploymentReleaseCommand;
     readonly submitDeployment?: typeof submitDeploymentCommand;
+    readonly generateClient?: typeof generateClientCommand;
 }
 export declare function submitDeploymentCommand(bundlePath: string | undefined, options?: SubmitDeploymentOptions, dependencies?: SubmitDeploymentDependencies): Promise<DeploymentSubmissionResponse>;
 export declare function deployCommand(sourcePath: string | undefined, options?: DeployOptions, dependencies?: DeployDependencies): Promise<DeploymentSubmissionResponse>;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CAiFvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAwCvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAM7D,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACxD;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAyEvC"}

package/dist/commands/deploy.js

@@ -3,12 +3,15 @@ import path from 'node:path';
 import { prepareProtocolDeploymentReleaseEnvelope, } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, } from '../utils/deployment-bundle.js';
 import { createHttpDeploymentUploadTransport, DeploymentUploadError, } from '../utils/deployment-upload.js';
+import { validateDraftDeploymentOptions } from '../utils/draft-deployment.js';
+import { shellQuote } from '../utils/shell-quote.js';
 import { logger } from '../utils/logger.js';
 import { resolveDeploymentCredential } from '../utils/cloud-deployment-access.js';
 import { fetchLiveDeployment } from '../utils/live-deployment.js';
 import { fetchHostedEndpoints, } from '../utils/hosted-endpoints.js';
 import { printHostedEndpoints } from '../utils/hosted-endpoints-output.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand, } from './deployment.js';
+import { generateClientCommand } from './generate-client.js';
 const MAX_RELEASE_FILE_BYTES = 16 * 1024;
 const DEFAULT_BUNDLE_PATH = 'analytics/hypequery-deployment';
 const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
@@ -73,6 +76,7 @@ export async function submitDeploymentCommand(bundlePath, options = {}, dependen
             + 'Usage: hypequery deployment:submit analytics/hypequery-deployment '
             + '--release analytics/hypequery-deployment.release.json');
     }
+    validateDraftDeploymentOptions(options);
     const releasePath = requiredConfiguration(options.release, 'Missing required --release <path>.');
     const { endpoint: deploymentEndpoint, token } = await resolveDeploymentCredential(options.endpoint, dependencies);
     let bundle;
@@ -95,7 +99,7 @@ export async function submitDeploymentCommand(bundlePath, options = {}, dependen
     if (release.release.bundleIdentity !== bundle.identity) {
         throw new DeploymentUploadError('HQ_UPLOAD_IDENTITY_MISMATCH', 'Release bundle identity does not match the verified deployment bundle.');
     }
-    const live = await (dependencies.fetchLive ?? fetchLiveDeployment)({
+    const live = options.draft !== undefined ? null : await (dependencies.fetchLive ?? fetchLiveDeployment)({
         endpoint: deploymentEndpoint,
         token,
         target: release.release.target,
@@ -115,8 +119,20 @@ export async function submitDeploymentCommand(bundlePath, options = {}, dependen
             ? { expectedActivationRevision: live.active?.revision ?? null }
             : {}),
         ...(options.replaceRestored ? { replaceRestored: true } : {}),
+        ...(options.draft !== undefined ? { draft: options.draft } : {}),
     };
     const result = await createTransport(transportOptions).submit(bundle, release);
+    if (options.draft !== undefined) {
+        if (!result.draft || result.draft.name !== options.draft) {
+            throw new DeploymentUploadError('HQ_UPLOAD_INVALID_RESPONSE', 'Deployment service did not acknowledge the requested draft.');
+        }
+        logger.success(`Draft saved: ${result.draft.name}`);
+        logger.info(`Draft ID: ${result.draft.draftId}`);
+        logger.info(`Staging endpoint: ${result.draft.stagingUrl}`);
+        logger.info(`Release identity: ${result.releaseIdentity}`);
+        logger.info('Review and publish this draft in Cloud when ready.');
+        return result;
+    }
     logger.success(result.status === 'accepted'
         ? 'Deployment release accepted'
         : 'Deployment release already exists');
@@ -150,6 +166,7 @@ async function rejectBundleDirectorySource(sourcePath) {
         + `${sourcePath} --release <file>\`.`);
 }
 export async function deployCommand(sourcePath, options = {}, dependencies = {}) {
+    validateDraftDeploymentOptions(options);
     if (!sourcePath) {
         throw new Error('Missing Cloud publication module path.\n\n'
             + 'Usage: hypequery deploy analytics/cloud.ts');
@@ -177,10 +194,39 @@ export async function deployCommand(sourcePath, options = {}, dependencies = {})
         loadCredential: dependencies.loadCredential,
         outputFlagLabel: '--release-output',
     });
-    return submit(bundlePath, {
+    const result = await submit(bundlePath, {
         release: releasePath,
         endpoint: options.endpoint,
         replaceRestored: options.replaceRestored,
         mcpConfig: options.mcpConfig,
+        ...(options.draft !== undefined ? { draft: options.draft } : {}),
     }, dependencies);
+    // A draft isn't live, so the client keeps matching Production.
+    if (options.client !== undefined && options.draft !== undefined) {
+        logger.info(`${options.client} was not regenerated: drafts are not live, so the client keeps matching the live release.`);
+    }
+    if (options.client !== undefined && options.draft === undefined) {
+        try {
+            await (dependencies.generateClient ?? generateClientCommand)(undefined, {
+                cloud: true,
+                output: options.client,
+                force: true,
+                endpoint: options.endpoint,
+                project: options.project,
+                environment: options.environment,
+            }, dependencies);
+        }
+        catch (error) {
+            // The release is live either way; say how to catch the client up.
+            logger.warn(`Deployed, but ${options.client} was not regenerated: `
+                + (error instanceof Error ? error.message : String(error)));
+            const flags = [
+                ['--project', options.project],
+                ['--environment', options.environment],
+                ['--endpoint', options.endpoint],
+            ].flatMap(([flag, value]) => value === undefined ? [] : [` ${flag} ${shellQuote(value)}`]).join('');
+            logger.indent(`Run \`hypequery generate:client --cloud --output ${shellQuote(options.client)} --force${flags}\` to retry.`);
+        }
+    }
+    return result;
 }

package/dist/commands/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAkCrC;AAUD,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAG5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgBD,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAmCrC;AAUD,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}

package/dist/commands/deployment.js

@@ -6,7 +6,17 @@ import { captureDeploymentSourceSnapshot } from '../utils/deployment-source-snap
 import { loadCloudPublication } from '../utils/load-cloud-publication.js';
 import { logger } from '../utils/logger.js';
 import { loadCloudCredential, } from '../utils/cloud-credential-store.js';
+import { unscopedTenantCandidates } from '../utils/tenant-key-candidates.js';
 const DEFAULT_BUNDLE_OUTPUT = 'analytics/hypequery-deployment';
+/** Name datasets that would show every customer's rows; Cloud asks the same in Customer access. */
+function warnUnscopedTenantCandidates(contract) {
+    for (const { dataset, columns } of unscopedTenantCandidates(contract)) {
+        logger.warn(`Dataset "${dataset}" has a customer column (${columns.join(', ')}) but no tenantKey, `
+            + 'so every caller can read every customer\'s rows.');
+        logger.indent(`If each customer should see only their own rows, set tenantKey: '${columns[0]}' on the dataset and deploy again.`);
+        logger.indent('If every customer may read all of it, mark it shared when Cloud asks during onboarding, or under Customer access.');
+    }
+}
 export async function buildDeploymentCommand(sourcePath, options = {}) {
     if (!sourcePath) {
         throw new Error('Missing Cloud publication module path.\n\n'
@@ -33,6 +43,7 @@ export async function buildDeploymentCommand(sourcePath, options = {}) {
         + `${prepared.contract.datasets.length === 1 ? 'dataset' : 'datasets'}, 0 runtime artifacts`);
     logger.info(`Bundle identity: ${bundle.identity}`);
     logger.info(`Deployment identity: ${prepared.identity}`);
+    warnUnscopedTenantCandidates(prepared.contract);
     return prepared.contract;
 }
 function describeContract(contract) {

package/dist/commands/generate-client.d.ts

@@ -1,7 +1,19 @@
+import { type CloudDeploymentAccessDependencies } from '../utils/cloud-deployment-access.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
+import type { LiveDeploymentFetch } from '../utils/live-deployment.js';
 export interface GenerateClientOptions {
     output?: string;
     check?: boolean;
     force?: boolean;
+    /** Read the live Cloud release's contract instead of a file (target and credential from `hypequery login`). */
+    cloud?: boolean;
+    project?: string;
+    environment?: string;
+    endpoint?: string;
 }
-export declare function generateClientCommand(artifact: string, options?: GenerateClientOptions): Promise<void>;
+export interface GenerateClientDependencies extends CloudDeploymentAccessDependencies {
+    readonly fetch?: LiveDeploymentFetch;
+    readonly fetchEndpoints?: typeof fetchHostedEndpoints;
+}
+export declare function generateClientCommand(artifact: string | undefined, options?: GenerateClientOptions, dependencies?: GenerateClientDependencies): Promise<void>;
 //# sourceMappingURL=generate-client.d.ts.map

package/dist/commands/generate-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/commands/generate-client.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,qBAAqB;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAE5F,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhH"}
+{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/commands/generate-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAA+B,KAAK,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAG1H,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAKvE,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA2B,SAAQ,iCAAiC;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAcD,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,GAAE,qBAA0B,EACnC,YAAY,GAAE,0BAA+B,GAC5C,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/commands/generate-client.js

@@ -1,25 +1,56 @@
 import path from 'node:path';
 import { decodeProtocolClientContract } from '@hypequery/protocol';
-import { renderClientContract } from '../generators/client-contract/render.js';
-import { checkClientOutputPath, readClientArtifact, readClientOutput } from '../utils/client-contract-file.js';
+import { GENERATED_CLIENT_HEADER, renderClientContract } from '../generators/client-contract/render.js';
+import { checkClientOutputPath, describeClientContractError, readClientArtifact, readClientOutput } from '../utils/client-contract-file.js';
+import { clientOrigin, fetchCloudClientContract } from '../utils/cloud-client-contract.js';
+import { resolveDeploymentCredential } from '../utils/cloud-deployment-access.js';
+import { deploymentTargetFromOptions } from '../utils/deployment-target.js';
 import { writeGeneratedFileAtomically } from '../utils/generated-file.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
 import { logger } from '../utils/logger.js';
 import { updateCommandTelemetry, setCommandTelemetryError } from '../utils/telemetry/command-context.js';
 import { countBucket } from '../utils/telemetry/buckets.js';
-export async function generateClientCommand(artifact, options = {}) {
+/** The live release's contract, and the origin it is served from when Cloud says. */
+async function readCloudClientContract(options, dependencies) {
+    const access = await resolveDeploymentCredential(options.endpoint, dependencies);
+    const target = deploymentTargetFromOptions(options, access.storedCredential);
+    const request = { endpoint: access.endpoint, token: access.token, target, fetch: dependencies.fetch };
+    const [text, endpoints] = await Promise.all([
+        fetchCloudClientContract(request),
+        (dependencies.fetchEndpoints ?? fetchHostedEndpoints)(request),
+    ]);
+    return { text, baseUrl: clientOrigin(endpoints?.rest.baseUrl) };
+}
+export async function generateClientCommand(artifact, options = {}, dependencies = {}) {
     updateCommandTelemetry('generate:client', { mode: options.check ? 'check' : 'write', force: !!options.force, custom_output: options.output !== undefined });
     if (options.force && options.check)
         throw new Error('--force cannot be combined with --check.');
-    const input = path.resolve(artifact);
+    if (options.cloud ? artifact !== undefined : artifact === undefined) {
+        throw new Error(options.cloud
+            ? 'Pass a client contract file or --cloud, not both.'
+            : 'Missing client contract. Pass a contract JSON file, or --cloud for the live Cloud release.');
+    }
+    if (!options.cloud && (options.project ?? options.environment ?? options.endpoint) !== undefined) {
+        throw new Error('--project, --environment and --endpoint apply only with --cloud.');
+    }
     const output = path.resolve(options.output ?? 'analytics/hypequery-client.ts');
-    if (input === output)
+    if (artifact !== undefined && path.resolve(artifact) === output)
         throw new Error('Client input and output must be different files.');
     await checkClientOutputPath(output);
     const current = await readClientOutput(output);
-    const contract = decodeProtocolClientContract(await readClientArtifact(input));
+    const { text, baseUrl } = artifact === undefined
+        ? await readCloudClientContract(options, dependencies)
+        : { text: await readClientArtifact(path.resolve(artifact)), baseUrl: undefined };
+    let contract;
+    try {
+        contract = decodeProtocolClientContract(text);
+    }
+    catch (error) {
+        throw describeClientContractError(error);
+    }
     if (contract.view !== 'build')
         throw new Error('Client generation requires a build view exported by the definition owner.');
-    const contents = renderClientContract(contract);
+    const contents = renderClientContract(contract, { baseUrl });
     if (Buffer.byteLength(contents) > 16 * 1_048_576)
         throw new Error('Generated client exceeds the 16 MiB output limit.');
     updateCommandTelemetry('generate:client', { endpoint_count_bucket: countBucket(contract.endpoints.length) });
@@ -37,6 +68,9 @@ export async function generateClientCommand(artifact, options = {}) {
     }
     if (current !== undefined && !options.force)
         throw new Error('Refusing to overwrite client types; use --check or --force.');
+    if (current !== undefined && !current.startsWith(GENERATED_CLIENT_HEADER)) {
+        throw new Error(`Refusing to overwrite ${output}: it was not generated by hypequery generate:client.`);
+    }
     await checkClientOutputPath(output);
     if (await readClientOutput(output) !== current)
         throw new Error('Client output changed during generation; retry after reviewing it.');

package/dist/generators/client-contract/render.d.ts

@@ -1,3 +1,9 @@
+export interface RenderClientContractOptions {
+    /** Where the endpoints are served; emitted as `clientBaseUrl` (its origin, since paths are absolute). */
+    readonly baseUrl?: string;
+}
+/** First line of every generated client; overwrites are refused for files without it. */
+export declare const GENERATED_CLIENT_HEADER = "// Generated by hypequery generate:client.";
 /** Data-only generator: no API module evaluation, credentials, drivers or server dependencies. */
-export declare function renderClientContract(source: unknown): string;
+export declare function renderClientContract(source: unknown, options?: RenderClientContractOptions): string;
 //# sourceMappingURL=render.d.ts.map

package/dist/generators/client-contract/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../src/generators/client-contract/render.ts"],"names":[],"mappings":"AAmCA,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAqB5D"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../src/generators/client-contract/render.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,2BAA2B;IAC1C,yGAAyG;IACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AAEpF,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CAqBvG"}

package/dist/generators/client-contract/render.js

@@ -29,12 +29,14 @@ function endpointDoc(endpoint) {
     const metric = endpoint.kind === 'metric' ? endpoint.annotations?.fields?.[Object.keys(endpoint.measures)[0]] : undefined;
     return metric ?? endpoint.annotations;
 }
+/** First line of every generated client; overwrites are refused for files without it. */
+export const GENERATED_CLIENT_HEADER = '// Generated by hypequery generate:client.';
 /** Data-only generator: no API module evaluation, credentials, drivers or server dependencies. */
-export function renderClientContract(source) {
+export function renderClientContract(source, options = {}) {
     const contract = validateProtocolClientContract(source);
     const endpoints = [...contract.endpoints].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
     const entries = endpoints.map(endpoint => ({ endpoint, key: endpoint.kind === 'dataset' ? `dataset:${endpoint.id}` : endpoint.id }));
-    return `// Generated by hypequery generate:client. Do not edit.
+    return `${GENERATED_CLIENT_HEADER} Do not edit.
 // Runtime validation still enforces selection dependencies, timezones and query budgets.
 export interface ClientResponseMeta {
   requestId: string;
@@ -50,5 +52,5 @@ export const clientManifest = {
 ${entries.map(({ endpoint, key }) => `  [${literal(key)}]: { method: 'POST', path: ${literal(endpoint.path)}, schemaHash: ${literal(endpoint.schemaHash)} },`).join('\n')}
 } as const;
 export const clientContractHash = ${literal(contract.contentHash)} as const;
-`;
+${options.baseUrl === undefined ? '' : `export const clientBaseUrl = ${literal(new URL(options.baseUrl).origin)} as const;\n`}`;
 }

package/dist/generators/dataset-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;IACxC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAkSN;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;;;GAyEtE"}
+{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAU1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;IACxC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAySN;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;;;GAyEtE"}

package/dist/generators/dataset-generator.js

@@ -7,69 +7,24 @@
 import fs from 'fs/promises';
 import path from 'path';
 import { getClickHouseClient } from '../utils/clickhouse-client.js';
+import { clickHouseDimensionType, namedTupleElements, } from '../utils/clickhouse-dimension-type.js';
+import { createFieldNamer } from '../utils/field-namer.js';
+import { isTenantKeyCandidateName } from '../utils/tenant-key-candidates.js';
+const SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
- * Determine the dataset dimension type from a ClickHouse type
- */
-function clickhouseToDimensionType(chType) {
-    const normalized = chType.toLowerCase();
-    // String types
-    if (normalized.includes('string') || normalized.includes('enum')) {
-        return 'string';
-    }
-    // Numeric types
-    if (normalized.includes('int') ||
-        normalized.includes('float') ||
-        normalized.includes('double') ||
-        normalized.includes('decimal')) {
-        return 'number';
-    }
-    // Date/Time types
-    if (normalized.includes('date') || normalized.includes('datetime')) {
-        return 'timestamp';
-    }
-    // Boolean
-    if (normalized.includes('bool')) {
-        return 'boolean';
-    }
-    // Default to string for unknown types
-    return 'string';
-}
-/**
- * Check if a column is likely a timestamp column
+ * Whether a column can be the dataset's timeKey: its values are dates or times.
  */
 function isTimestampColumn(column) {
-    const name = column.name.toLowerCase();
-    const type = column.type.toLowerCase();
-    return (type.includes('date') ||
-        type.includes('datetime') ||
-        name.includes('timestamp') ||
-        name.includes('_at') ||
-        name === 'created' ||
-        name === 'updated');
+    return clickHouseDimensionType(column.type) === 'timestamp';
 }
-/**
- * Check if a column name is worth presenting as a possible tenant key.
- *
- * A naming match is never enough to activate tenant enforcement. `tenantKey`
- * is a security boundary that must be chosen explicitly by the application.
- */
 function isTenantKeyCandidate(column) {
-    const name = column.name.toLowerCase();
-    return (name === 'tenant_id' ||
-        name === 'organization_id' ||
-        name === 'org_id' ||
-        name === 'account_id' ||
-        name === 'customer_id');
+    return isTenantKeyCandidateName(column.name);
 }
 /**
  * Check if a column is numeric and suitable for measures
  */
 function isNumericColumn(column) {
-    const type = column.type.toLowerCase();
-    return (type.includes('int') ||
-        type.includes('float') ||
-        type.includes('double') ||
-        type.includes('decimal'));
+    return clickHouseDimensionType(column.type) === 'number';
 }
 /**
  * Check if a numeric column is more likely an identifier than an additive value.
@@ -169,39 +124,93 @@ async function generateDatasetForTable(client, tableName, tenantColumn) {
                 'Review them and add tenantKey explicitly only after configuring trusted runtime tenant scope.',
         });
     }
-    // Generate dimensions
+    // Generate dimensions. A named tuple becomes one dimension per scalar
+    // element; columns no dimension type describes are left out with a note.
+    const fields = [];
+    const skippedColumns = [];
+    for (const column of columns) {
+        const dimensionType = clickHouseDimensionType(column.type);
+        if (dimensionType) {
+            fields.push({ column, type: dimensionType, name: columnToCamelCase(column.name) });
+            continue;
+        }
+        const elements = SQL_IDENTIFIER.test(column.name) ? namedTupleElements(column.type) : null;
+        if (elements?.length) {
+            for (const element of elements) {
+                fields.push({
+                    column,
+                    element: element.name,
+                    type: element.type,
+                    name: columnToCamelCase(`${column.name}_${element.name}`),
+                });
+            }
+            continue;
+        }
+        skippedColumns.push(column);
+    }
+    // Field names are SQL aliases, so none may shadow a source column another
+    // field reads. A column spelled like its field keeps that name, then other
+    // columns, then tuple elements; a clash takes a numeric suffix instead.
+    const nameField = createFieldNamer(columns.map((column) => column.name));
+    const naming = [
+        ...fields.filter((field) => !field.element && field.name === field.column.name),
+        ...fields.filter((field) => !field.element && field.name !== field.column.name),
+        ...fields.filter((field) => field.element),
+    ];
+    for (const field of naming) {
+        const name = nameField(field.name, field.element ? undefined : field.column.name);
+        if (name !== field.name)
+            field.renamedFrom = field.name;
+        field.name = name;
+    }
+    const fieldNameByColumn = new Map(fields.filter((field) => !field.element).map((field) => [field.column.name, field.name]));
     const dimensionLines = [];
     for (const column of columns) {
-        const fieldName = columnToCamelCase(column.name);
-        const dimensionType = clickhouseToDimensionType(column.type);
-        const label = generateLabel(column.name);
-        // Skip if column name === fieldName (no transformation needed)
-        if (column.name === fieldName) {
-            dimensionLines.push(`    ${fieldName}: dimension.${dimensionType}({ label: '${label}' }),`);
+        if (skippedColumns.includes(column)) {
+            // ClickHouse can spell a nested type over several lines; keep the note on one comment line.
+            const type = column.type.replace(/\s+/g, ' ');
+            dimensionLines.push(`    // ${column.name} (${type}) is not included: no dimension type describes its values.`);
+            continue;
         }
-        else {
-            dimensionLines.push(`    ${fieldName}: dimension.${dimensionType}({ column: '${column.name}', label: '${label}' }),`);
+        for (const field of fields.filter((candidate) => candidate.column === column)) {
+            const label = generateLabel(column.name);
+            if (field.renamedFrom) {
+                dimensionLines.push(`    // ${field.element ? `${column.name}.${field.element}` : column.name} is ${field.name}: ${field.renamedFrom} is taken by another field or column.`);
+            }
+            if (field.element) {
+                dimensionLines.push(`    ${field.name}: dimension.${field.type}({ sql: "tupleElement(${column.name}, '${field.element}')", ` +
+                    `dependencies: ['${column.name}'], label: '${label} ${generateLabel(field.element)}' }),`);
+            }
+            else if (column.name === field.name) {
+                // No column option needed when the field is spelled like the column
+                dimensionLines.push(`    ${field.name}: dimension.${field.type}({ label: '${label}' }),`);
+            }
+            else {
+                dimensionLines.push(`    ${field.name}: dimension.${field.type}({ column: '${column.name}', label: '${label}' }),`);
+            }
         }
     }
     // Generate measures for numeric value columns only. IDs and coordinates stay
     // dimensions because summing or averaging them is usually noise.
     const numericColumns = columns.filter(isMeasureCandidate);
     const measureLines = [];
+    const countField = fields[0]?.name;
     if (numericColumns.length > 0) {
         measureLines.push(`    // Count measures`);
-        measureLines.push(`    totalCount: measure.count('${columnToCamelCase(columns[0].name)}', { label: 'Total Count' }),`);
+        measureLines.push(`    ${nameField('totalCount')}: measure.count('${countField}', { label: 'Total Count' }),`);
         measureLines.push(``);
         for (const column of numericColumns) {
-            const fieldName = columnToCamelCase(column.name);
+            const fieldName = fieldNameByColumn.get(column.name);
+            const measureSuffix = fieldName.charAt(0).toUpperCase() + fieldName.slice(1);
             const label = generateLabel(column.name);
             measureLines.push(`    // ${label} measures`);
-            measureLines.push(`    total${tableToPascalCase(column.name)}: measure.sum('${fieldName}', { label: 'Total ${label}' }),`);
-            measureLines.push(`    avg${tableToPascalCase(column.name)}: measure.avg('${fieldName}', { label: 'Average ${label}' }),`);
+            measureLines.push(`    ${nameField(`total${measureSuffix}`)}: measure.sum('${fieldName}', { label: 'Total ${label}' }),`);
+            measureLines.push(`    ${nameField(`avg${measureSuffix}`)}: measure.avg('${fieldName}', { label: 'Average ${label}' }),`);
             measureLines.push(``);
         }
     }
-    else {
-        measureLines.push(`    totalCount: measure.count('${columnToCamelCase(columns[0].name)}', { label: 'Total Count' }),`);
+    else if (countField) {
+        measureLines.push(`    ${nameField('totalCount')}: measure.count('${countField}', { label: 'Total Count' }),`);
     }
     // Build the dataset definition
     const datasetName = tableToPascalCase(tableName);

package/dist/templates/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/templates/cloud.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/templates/cloud.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,MAAM,CAY9C"}

package/dist/templates/cloud.js

@@ -5,6 +5,9 @@ import { datasets } from './datasets.js';
 
 export const cloud = publishToCloud({
   datasets,
+  // Empty roles and scopes still require authentication, but let any
+  // authenticated caller read every dataset. A dataset without tenantKey shows
+  // every customer's rows; review both in Cloud under Customer access.
   access: { roles: [], scopes: [] },
 });
 `;