@hypequery/cli 1.27.0 → 1.28.0

package/README.md

@@ -37,13 +37,26 @@ npx hypequery init \
 | `hypequery dev` | Local API, docs, and hot reload |
 | `hypequery generate` | Fresh TypeScript types from ClickHouse or chDB |
 | `hypequery generate:datasets` | Dataset definitions scaffolded from tables |
-| `hypequery generate:client` | TypeScript API types and routes from a Python client contract |
+| `hypequery generate:client` | TypeScript API types and routes from a Python client contract or the live Cloud release (`--cloud`) |
 | `hypequery generate:manifest` | A browser-safe route manifest for React hooks |
 | `hypequery pull` / `diff` | Live source inspection and comparison |
 | `hypequery deployment:status` | Live release and Cloud-provided connection URLs |
 
 Non-interactive ClickHouse commands read `CLICKHOUSE_URL`, `CLICKHOUSE_DATABASE`, `CLICKHOUSE_USERNAME`, and `CLICKHOUSE_PASSWORD`.
 
+## Generate a client for Cloud datasets
+
+After `hypequery login`, generate typed React routes and types from the live
+Cloud release, or have every publish regenerate them:
+
+```bash
+npx hypequery generate:client --cloud --output src/hypequery-client.ts
+npx hypequery deploy analytics/cloud.ts --client src/hypequery-client.ts
+```
+
+The file also exports `clientBaseUrl`. See
+[Connect React to hypequery Cloud](https://hypequery.com/docs/react/cloud).
+
 ## Generate a client for Python endpoints
 
 Export a build contract from your Python definition-only factory, then generate

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAE9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AA2SD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAE9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAgTD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -166,11 +166,15 @@ program
     await generateDatasetsCommand(options);
 }));
 program
-    .command('generate:client <contract>')
-    .description('Generate browser-safe TypeScript API types and routes from a client contract JSON file')
+    .command('generate:client [contract]')
+    .description('Generate browser-safe TypeScript API types and routes from a client contract JSON file or the live Cloud release')
     .option('-o, --output <path>', 'Output TypeScript file (default: analytics/hypequery-client.ts)')
     .option('--check', 'Check for drift without writing')
     .option('--force', 'Replace an existing output file')
+    .option('--cloud', 'Use the live Cloud release of the target from `hypequery login`')
+    .option('--project <project>', 'With --cloud: target project identifier (advanced override)')
+    .option('--environment <environment>', 'With --cloud: target environment identifier (advanced override)')
+    .option('--endpoint <url>', 'With --cloud: HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .action(runCommand(async (contract, options) => {
     await generateClientCommand(contract, options);
 }));
@@ -236,6 +240,7 @@ program
     .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .option('--replace-restored', 'Intentionally replace a restored live release')
     .option('--mcp-config', 'Also print MCP client configuration for the hosted endpoint')
+    .option('--client <path>', 'Regenerate this typed client file from the new live release')
     .action(runCommand(async (source, options) => {
     await deployCommand(source, options);
 }));

package/dist/commands/deploy.d.ts

@@ -3,6 +3,7 @@ import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
 import { fetchLiveDeployment } from '../utils/live-deployment.js';
 import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand } from './deployment.js';
+import { generateClientCommand } from './generate-client.js';
 export interface SubmitDeploymentOptions {
     release?: string;
     endpoint?: string;
@@ -21,6 +22,8 @@ export interface DeployOptions {
     releaseOutput?: string;
     source?: boolean;
     mcpConfig?: boolean;
+    /** Regenerate this typed client file from the new live release. */
+    client?: string;
 }
 export interface SubmitDeploymentDependencies {
     readonly env?: Readonly<Record<string, string | undefined>>;
@@ -33,6 +36,7 @@ export interface DeployDependencies extends SubmitDeploymentDependencies {
     readonly buildDeployment?: typeof buildDeploymentCommand;
     readonly prepareDeploymentRelease?: typeof prepareDeploymentReleaseCommand;
     readonly submitDeployment?: typeof submitDeploymentCommand;
+    readonly generateClient?: typeof generateClientCommand;
 }
 export declare function submitDeploymentCommand(bundlePath: string | undefined, options?: SubmitDeploymentOptions, dependencies?: SubmitDeploymentDependencies): Promise<DeploymentSubmissionResponse>;
 export declare function deployCommand(sourcePath: string | undefined, options?: DeployOptions, dependencies?: DeployDependencies): Promise<DeploymentSubmissionResponse>;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CA0CvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAM7D,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;IAC3D,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACxD;AA4DD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAsBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAyEvC"}

package/dist/commands/deploy.js

@@ -4,12 +4,14 @@ import { prepareProtocolDeploymentReleaseEnvelope, } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, } from '../utils/deployment-bundle.js';
 import { createHttpDeploymentUploadTransport, DeploymentUploadError, } from '../utils/deployment-upload.js';
 import { validateDraftDeploymentOptions } from '../utils/draft-deployment.js';
+import { shellQuote } from '../utils/shell-quote.js';
 import { logger } from '../utils/logger.js';
 import { resolveDeploymentCredential } from '../utils/cloud-deployment-access.js';
 import { fetchLiveDeployment } from '../utils/live-deployment.js';
 import { fetchHostedEndpoints, } from '../utils/hosted-endpoints.js';
 import { printHostedEndpoints } from '../utils/hosted-endpoints-output.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand, } from './deployment.js';
+import { generateClientCommand } from './generate-client.js';
 const MAX_RELEASE_FILE_BYTES = 16 * 1024;
 const DEFAULT_BUNDLE_PATH = 'analytics/hypequery-deployment';
 const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
@@ -192,11 +194,39 @@ export async function deployCommand(sourcePath, options = {}, dependencies = {})
         loadCredential: dependencies.loadCredential,
         outputFlagLabel: '--release-output',
     });
-    return submit(bundlePath, {
+    const result = await submit(bundlePath, {
         release: releasePath,
         endpoint: options.endpoint,
         replaceRestored: options.replaceRestored,
         mcpConfig: options.mcpConfig,
         ...(options.draft !== undefined ? { draft: options.draft } : {}),
     }, dependencies);
+    // A draft isn't live, so the client keeps matching Production.
+    if (options.client !== undefined && options.draft !== undefined) {
+        logger.info(`${options.client} was not regenerated: drafts are not live, so the client keeps matching the live release.`);
+    }
+    if (options.client !== undefined && options.draft === undefined) {
+        try {
+            await (dependencies.generateClient ?? generateClientCommand)(undefined, {
+                cloud: true,
+                output: options.client,
+                force: true,
+                endpoint: options.endpoint,
+                project: options.project,
+                environment: options.environment,
+            }, dependencies);
+        }
+        catch (error) {
+            // The release is live either way; say how to catch the client up.
+            logger.warn(`Deployed, but ${options.client} was not regenerated: `
+                + (error instanceof Error ? error.message : String(error)));
+            const flags = [
+                ['--project', options.project],
+                ['--environment', options.environment],
+                ['--endpoint', options.endpoint],
+            ].flatMap(([flag, value]) => value === undefined ? [] : [` ${flag} ${shellQuote(value)}`]).join('');
+            logger.indent(`Run \`hypequery generate:client --cloud --output ${shellQuote(options.client)} --force${flags}\` to retry.`);
+        }
+    }
+    return result;
 }

package/dist/commands/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAkCrC;AAUD,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAG5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgBD,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAmCrC;AAUD,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}

package/dist/commands/deployment.js

@@ -6,7 +6,17 @@ import { captureDeploymentSourceSnapshot } from '../utils/deployment-source-snap
 import { loadCloudPublication } from '../utils/load-cloud-publication.js';
 import { logger } from '../utils/logger.js';
 import { loadCloudCredential, } from '../utils/cloud-credential-store.js';
+import { unscopedTenantCandidates } from '../utils/tenant-key-candidates.js';
 const DEFAULT_BUNDLE_OUTPUT = 'analytics/hypequery-deployment';
+/** Name datasets that would show every customer's rows; Cloud asks the same in Customer access. */
+function warnUnscopedTenantCandidates(contract) {
+    for (const { dataset, columns } of unscopedTenantCandidates(contract)) {
+        logger.warn(`Dataset "${dataset}" has a customer column (${columns.join(', ')}) but no tenantKey, `
+            + 'so every caller can read every customer\'s rows.');
+        logger.indent(`If each customer should see only their own rows, set tenantKey: '${columns[0]}' on the dataset and deploy again.`);
+        logger.indent('If every customer may read all of it, mark it shared when Cloud asks during onboarding, or under Customer access.');
+    }
+}
 export async function buildDeploymentCommand(sourcePath, options = {}) {
     if (!sourcePath) {
         throw new Error('Missing Cloud publication module path.\n\n'
@@ -33,6 +43,7 @@ export async function buildDeploymentCommand(sourcePath, options = {}) {
         + `${prepared.contract.datasets.length === 1 ? 'dataset' : 'datasets'}, 0 runtime artifacts`);
     logger.info(`Bundle identity: ${bundle.identity}`);
     logger.info(`Deployment identity: ${prepared.identity}`);
+    warnUnscopedTenantCandidates(prepared.contract);
     return prepared.contract;
 }
 function describeContract(contract) {

package/dist/commands/generate-client.d.ts

@@ -1,7 +1,19 @@
+import { type CloudDeploymentAccessDependencies } from '../utils/cloud-deployment-access.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
+import type { LiveDeploymentFetch } from '../utils/live-deployment.js';
 export interface GenerateClientOptions {
     output?: string;
     check?: boolean;
     force?: boolean;
+    /** Read the live Cloud release's contract instead of a file (target and credential from `hypequery login`). */
+    cloud?: boolean;
+    project?: string;
+    environment?: string;
+    endpoint?: string;
 }
-export declare function generateClientCommand(artifact: string, options?: GenerateClientOptions): Promise<void>;
+export interface GenerateClientDependencies extends CloudDeploymentAccessDependencies {
+    readonly fetch?: LiveDeploymentFetch;
+    readonly fetchEndpoints?: typeof fetchHostedEndpoints;
+}
+export declare function generateClientCommand(artifact: string | undefined, options?: GenerateClientOptions, dependencies?: GenerateClientDependencies): Promise<void>;
 //# sourceMappingURL=generate-client.d.ts.map

package/dist/commands/generate-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/commands/generate-client.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,qBAAqB;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAE5F,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoChH"}
+{"version":3,"file":"generate-client.d.ts","sourceRoot":"","sources":["../../src/commands/generate-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAA+B,KAAK,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAG1H,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAKvE,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA2B,SAAQ,iCAAiC;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACvD;AAcD,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,GAAE,qBAA0B,EACnC,YAAY,GAAE,0BAA+B,GAC5C,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/commands/generate-client.js

@@ -1,22 +1,46 @@
 import path from 'node:path';
 import { decodeProtocolClientContract } from '@hypequery/protocol';
-import { renderClientContract } from '../generators/client-contract/render.js';
+import { GENERATED_CLIENT_HEADER, renderClientContract } from '../generators/client-contract/render.js';
 import { checkClientOutputPath, describeClientContractError, readClientArtifact, readClientOutput } from '../utils/client-contract-file.js';
+import { clientOrigin, fetchCloudClientContract } from '../utils/cloud-client-contract.js';
+import { resolveDeploymentCredential } from '../utils/cloud-deployment-access.js';
+import { deploymentTargetFromOptions } from '../utils/deployment-target.js';
 import { writeGeneratedFileAtomically } from '../utils/generated-file.js';
+import { fetchHostedEndpoints } from '../utils/hosted-endpoints.js';
 import { logger } from '../utils/logger.js';
 import { updateCommandTelemetry, setCommandTelemetryError } from '../utils/telemetry/command-context.js';
 import { countBucket } from '../utils/telemetry/buckets.js';
-export async function generateClientCommand(artifact, options = {}) {
+/** The live release's contract, and the origin it is served from when Cloud says. */
+async function readCloudClientContract(options, dependencies) {
+    const access = await resolveDeploymentCredential(options.endpoint, dependencies);
+    const target = deploymentTargetFromOptions(options, access.storedCredential);
+    const request = { endpoint: access.endpoint, token: access.token, target, fetch: dependencies.fetch };
+    const [text, endpoints] = await Promise.all([
+        fetchCloudClientContract(request),
+        (dependencies.fetchEndpoints ?? fetchHostedEndpoints)(request),
+    ]);
+    return { text, baseUrl: clientOrigin(endpoints?.rest.baseUrl) };
+}
+export async function generateClientCommand(artifact, options = {}, dependencies = {}) {
     updateCommandTelemetry('generate:client', { mode: options.check ? 'check' : 'write', force: !!options.force, custom_output: options.output !== undefined });
     if (options.force && options.check)
         throw new Error('--force cannot be combined with --check.');
-    const input = path.resolve(artifact);
+    if (options.cloud ? artifact !== undefined : artifact === undefined) {
+        throw new Error(options.cloud
+            ? 'Pass a client contract file or --cloud, not both.'
+            : 'Missing client contract. Pass a contract JSON file, or --cloud for the live Cloud release.');
+    }
+    if (!options.cloud && (options.project ?? options.environment ?? options.endpoint) !== undefined) {
+        throw new Error('--project, --environment and --endpoint apply only with --cloud.');
+    }
     const output = path.resolve(options.output ?? 'analytics/hypequery-client.ts');
-    if (input === output)
+    if (artifact !== undefined && path.resolve(artifact) === output)
         throw new Error('Client input and output must be different files.');
     await checkClientOutputPath(output);
     const current = await readClientOutput(output);
-    const text = await readClientArtifact(input);
+    const { text, baseUrl } = artifact === undefined
+        ? await readCloudClientContract(options, dependencies)
+        : { text: await readClientArtifact(path.resolve(artifact)), baseUrl: undefined };
     let contract;
     try {
         contract = decodeProtocolClientContract(text);
@@ -26,7 +50,7 @@ export async function generateClientCommand(artifact, options = {}) {
     }
     if (contract.view !== 'build')
         throw new Error('Client generation requires a build view exported by the definition owner.');
-    const contents = renderClientContract(contract);
+    const contents = renderClientContract(contract, { baseUrl });
     if (Buffer.byteLength(contents) > 16 * 1_048_576)
         throw new Error('Generated client exceeds the 16 MiB output limit.');
     updateCommandTelemetry('generate:client', { endpoint_count_bucket: countBucket(contract.endpoints.length) });
@@ -44,6 +68,9 @@ export async function generateClientCommand(artifact, options = {}) {
     }
     if (current !== undefined && !options.force)
         throw new Error('Refusing to overwrite client types; use --check or --force.');
+    if (current !== undefined && !current.startsWith(GENERATED_CLIENT_HEADER)) {
+        throw new Error(`Refusing to overwrite ${output}: it was not generated by hypequery generate:client.`);
+    }
     await checkClientOutputPath(output);
     if (await readClientOutput(output) !== current)
         throw new Error('Client output changed during generation; retry after reviewing it.');

package/dist/generators/client-contract/render.d.ts

@@ -1,3 +1,9 @@
+export interface RenderClientContractOptions {
+    /** Where the endpoints are served; emitted as `clientBaseUrl` (its origin, since paths are absolute). */
+    readonly baseUrl?: string;
+}
+/** First line of every generated client; overwrites are refused for files without it. */
+export declare const GENERATED_CLIENT_HEADER = "// Generated by hypequery generate:client.";
 /** Data-only generator: no API module evaluation, credentials, drivers or server dependencies. */
-export declare function renderClientContract(source: unknown): string;
+export declare function renderClientContract(source: unknown, options?: RenderClientContractOptions): string;
 //# sourceMappingURL=render.d.ts.map

package/dist/generators/client-contract/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../src/generators/client-contract/render.ts"],"names":[],"mappings":"AAmCA,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAqB5D"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../src/generators/client-contract/render.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,2BAA2B;IAC1C,yGAAyG;IACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AAEpF,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CAqBvG"}

package/dist/generators/client-contract/render.js

@@ -29,12 +29,14 @@ function endpointDoc(endpoint) {
     const metric = endpoint.kind === 'metric' ? endpoint.annotations?.fields?.[Object.keys(endpoint.measures)[0]] : undefined;
     return metric ?? endpoint.annotations;
 }
+/** First line of every generated client; overwrites are refused for files without it. */
+export const GENERATED_CLIENT_HEADER = '// Generated by hypequery generate:client.';
 /** Data-only generator: no API module evaluation, credentials, drivers or server dependencies. */
-export function renderClientContract(source) {
+export function renderClientContract(source, options = {}) {
     const contract = validateProtocolClientContract(source);
     const endpoints = [...contract.endpoints].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
     const entries = endpoints.map(endpoint => ({ endpoint, key: endpoint.kind === 'dataset' ? `dataset:${endpoint.id}` : endpoint.id }));
-    return `// Generated by hypequery generate:client. Do not edit.
+    return `${GENERATED_CLIENT_HEADER} Do not edit.
 // Runtime validation still enforces selection dependencies, timezones and query budgets.
 export interface ClientResponseMeta {
   requestId: string;
@@ -50,5 +52,5 @@ export const clientManifest = {
 ${entries.map(({ endpoint, key }) => `  [${literal(key)}]: { method: 'POST', path: ${literal(endpoint.path)}, schemaHash: ${literal(endpoint.schemaHash)} },`).join('\n')}
 } as const;
 export const clientContractHash = ${literal(contract.contentHash)} as const;
-`;
+${options.baseUrl === undefined ? '' : `export const clientBaseUrl = ${literal(new URL(options.baseUrl).origin)} as const;\n`}`;
 }

package/dist/generators/dataset-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAS1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;IACxC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAuTN;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;;;GAyEtE"}
+{"version":3,"file":"dataset-generator.d.ts","sourceRoot":"","sources":["../../src/generators/dataset-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAU1E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,8BAA8B,CAAC;IACxC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAySN;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;;;;;GAyEtE"}

package/dist/generators/dataset-generator.js

@@ -9,6 +9,7 @@ import path from 'path';
 import { getClickHouseClient } from '../utils/clickhouse-client.js';
 import { clickHouseDimensionType, namedTupleElements, } from '../utils/clickhouse-dimension-type.js';
 import { createFieldNamer } from '../utils/field-namer.js';
+import { isTenantKeyCandidateName } from '../utils/tenant-key-candidates.js';
 const SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
  * Whether a column can be the dataset's timeKey: its values are dates or times.
@@ -16,19 +17,8 @@ const SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function isTimestampColumn(column) {
     return clickHouseDimensionType(column.type) === 'timestamp';
 }
-/**
- * Check if a column name is worth presenting as a possible tenant key.
- *
- * A naming match is never enough to activate tenant enforcement. `tenantKey`
- * is a security boundary that must be chosen explicitly by the application.
- */
 function isTenantKeyCandidate(column) {
-    const name = column.name.toLowerCase();
-    return (name === 'tenant_id' ||
-        name === 'organization_id' ||
-        name === 'org_id' ||
-        name === 'account_id' ||
-        name === 'customer_id');
+    return isTenantKeyCandidateName(column.name);
 }
 /**
  * Check if a column is numeric and suitable for measures

package/dist/templates/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/templates/cloud.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/templates/cloud.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,MAAM,CAY9C"}

package/dist/templates/cloud.js

@@ -5,6 +5,9 @@ import { datasets } from './datasets.js';
 
 export const cloud = publishToCloud({
   datasets,
+  // Empty roles and scopes still require authentication, but let any
+  // authenticated caller read every dataset. A dataset without tenantKey shows
+  // every customer's rows; review both in Cloud under Customer access.
   access: { roles: [], scopes: [] },
 });
 `;

package/dist/utils/cloud-client-contract.d.ts

@@ -0,0 +1,20 @@
+import type { ProtocolDeploymentReleaseTarget } from '@hypequery/protocol';
+import { type LiveDeploymentFetch } from './live-deployment.js';
+/**
+ * The origin a generated client calls. Refused when Cloud did not say, when it
+ * is not https (loopback aside), or when it carries a path: the client resolves
+ * its absolute endpoint paths against the origin, so a prefix would be dropped.
+ */
+export declare function clientOrigin(baseUrl: string | undefined): string;
+/**
+ * The client contract of the target's live release, as Cloud serves it beside
+ * the deployment endpoint. Returned as text: the caller decodes and verifies it
+ * exactly as it would a contract file.
+ */
+export declare function fetchCloudClientContract(input: {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly target: ProtocolDeploymentReleaseTarget;
+    readonly fetch?: LiveDeploymentFetch;
+}): Promise<string>;
+//# sourceMappingURL=cloud-client-contract.d.ts.map

package/dist/utils/cloud-client-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-client-contract.d.ts","sourceRoot":"","sources":["../../src/utils/cloud-client-contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOzE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAehE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB"}

package/dist/utils/cloud-client-contract.js

@@ -0,0 +1,52 @@
+import { liveUrl } from './live-deployment.js';
+import { readCapped } from './read-capped.js';
+const MAX_CONTRACT_BYTES = 1_048_576;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/**
+ * The origin a generated client calls. Refused when Cloud did not say, when it
+ * is not https (loopback aside), or when it carries a path: the client resolves
+ * its absolute endpoint paths against the origin, so a prefix would be dropped.
+ */
+export function clientOrigin(baseUrl) {
+    if (baseUrl === undefined) {
+        throw new Error('Cloud did not say where this release is served, so the client would have no base URL. Retry, or update Cloud.');
+    }
+    const url = new URL(baseUrl);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname))) {
+        throw new Error(`Cloud serves this release from ${url.origin}, which is not https.`);
+    }
+    if (url.pathname !== '/' || url.search || url.hash) {
+        throw new Error(`Cloud serves this release under ${baseUrl} because an endpoint path collides with a reserved Cloud path (such as /mcp). `
+            + 'Rename that endpoint path and deploy again; generated clients call the customer origin directly.');
+    }
+    return url.origin;
+}
+/**
+ * The client contract of the target's live release, as Cloud serves it beside
+ * the deployment endpoint. Returned as text: the caller decodes and verifies it
+ * exactly as it would a contract file.
+ */
+export async function fetchCloudClientContract(input) {
+    const url = liveUrl(input.endpoint, input.target, 'client-contract');
+    if (!url) {
+        throw new Error('The deployment endpoint is not a Cloud submissions URL, so it serves no client contract.');
+    }
+    const response = await (input.fetch ?? fetch)(url, {
+        method: 'GET',
+        headers: { Accept: 'application/json', Authorization: `Bearer ${input.token}` },
+        redirect: 'error',
+        signal: AbortSignal.timeout(30_000),
+    });
+    const target = `${input.target.project} / ${input.target.environment}`;
+    if (response.status === 401 || response.status === 403) {
+        throw new Error(`Cloud refused the client contract for ${target}. Run \`hypequery login\` again.`);
+    }
+    if (response.status === 404) {
+        throw new Error(`Cloud has no client contract for ${target}: publish a release first, `
+            + 'or this Cloud version does not serve client contracts yet.');
+    }
+    if (!response.ok) {
+        throw new Error(`Cloud could not return the client contract for ${target} (HTTP ${response.status}).`);
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(await readCapped(response, MAX_CONTRACT_BYTES));
+}

package/dist/utils/live-deployment.d.ts

@@ -31,7 +31,7 @@ export type LiveDeploymentFetch = typeof fetch;
  * the endpoint is not a Cloud submissions URL. Refuses anything but https (or
  * loopback http) so a credential is never sent in the clear.
  */
-export declare function liveUrl(endpoint: string, target: ProtocolDeploymentReleaseTarget, resource: 'state' | 'source' | 'endpoints'): string | undefined;
+export declare function liveUrl(endpoint: string, target: ProtocolDeploymentReleaseTarget, resource: 'state' | 'source' | 'endpoints' | 'client-contract'): string | undefined;
 export declare function fetchLiveDeployment(input: {
     readonly endpoint: string;
     readonly token: string;

package/dist/utils/live-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-deployment.d.ts","sourceRoot":"","sources":["../../src/utils/live-deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAO7B,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,KAAK,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,+BAA+B,EACvC,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GACzC,MAAM,GAAG,SAAS,CAkBpB;AAsJD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAuCtC"}
+{"version":3,"file":"live-deployment.d.ts","sourceRoot":"","sources":["../../src/utils/live-deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAO7B,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,KAAK,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,+BAA+B,EACvC,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAC7D,MAAM,GAAG,SAAS,CAkBpB;AAsJD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAuCtC"}

package/dist/utils/read-capped.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A response body, refused once it passes `maxBytes`: by the declared length
+ * before reading, and while streaming when no length is declared.
+ */
+export declare function readCapped(response: Response, maxBytes: number): Promise<Uint8Array>;
+//# sourceMappingURL=read-capped.d.ts.map

package/dist/utils/read-capped.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-capped.d.ts","sourceRoot":"","sources":["../../src/utils/read-capped.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA6B1F"}

package/dist/utils/read-capped.js

@@ -0,0 +1,36 @@
+/**
+ * A response body, refused once it passes `maxBytes`: by the declared length
+ * before reading, and while streaming when no length is declared.
+ */
+export async function readCapped(response, maxBytes) {
+    const tooLarge = () => new Error(`The response exceeds ${maxBytes} bytes.`);
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        // Release the connection rather than leave the body unread.
+        await response.body?.cancel();
+        throw tooLarge();
+    }
+    if (!response.body)
+        return new Uint8Array(await response.arrayBuffer());
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw tooLarge();
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}

package/dist/utils/shell-quote.d.ts

@@ -0,0 +1,6 @@
+/**
+ * One argument as a POSIX shell word, for commands printed for the user to
+ * copy. Plain words stay as they are; anything else is single-quoted.
+ */
+export declare function shellQuote(value: string): string;
+//# sourceMappingURL=shell-quote.d.ts.map

package/dist/utils/shell-quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-quote.d.ts","sourceRoot":"","sources":["../../src/utils/shell-quote.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/utils/shell-quote.js

@@ -0,0 +1,7 @@
+/**
+ * One argument as a POSIX shell word, for commands printed for the user to
+ * copy. Plain words stay as they are; anything else is single-quoted.
+ */
+export function shellQuote(value) {
+    return /^[A-Za-z0-9_./:=@%+-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
+}

package/dist/utils/telemetry/catalog.d.ts

@@ -625,7 +625,7 @@ export declare const EVENT_CATALOG: {
             readonly flags_used: {
                 readonly kind: "enum_list";
                 readonly description: string;
-                readonly values: readonly ("--path" | "--style" | "--database" | "--chdb-path" | "--auth" | "--all-tables" | "--tables" | "--exclude-tables" | "--no-example" | "--no-interactive" | "--force" | "--skip-connection" | "--port" | "--hostname" | "--no-watch" | "--no-cache" | "--cache" | "--redis-url" | "--open" | "--cors" | "--quiet" | "--tenant" | "--self-test" | "--url" | "--client-contract-url" | "--output" | "--tenant-column" | "--check" | "--diff" | "--cloud-url" | "--environment" | "--bundle-output" | "--release-output" | "--project" | "--no-source" | "--endpoint" | "--replace-restored" | "--mcp-config" | "--draft" | "--release" | "--no-telemetry" | "--help" | "--version")[];
+                readonly values: readonly ("--path" | "--style" | "--database" | "--chdb-path" | "--auth" | "--all-tables" | "--tables" | "--exclude-tables" | "--no-example" | "--no-interactive" | "--force" | "--skip-connection" | "--port" | "--hostname" | "--no-watch" | "--no-cache" | "--cache" | "--redis-url" | "--open" | "--cors" | "--quiet" | "--tenant" | "--self-test" | "--url" | "--client-contract-url" | "--output" | "--tenant-column" | "--check" | "--diff" | "--cloud" | "--project" | "--environment" | "--endpoint" | "--cloud-url" | "--bundle-output" | "--release-output" | "--no-source" | "--replace-restored" | "--mcp-config" | "--draft" | "--client" | "--release" | "--no-telemetry" | "--help" | "--version")[];
             };
             readonly outcome: {
                 readonly kind: "enum";

package/dist/utils/telemetry/domains.d.ts

@@ -15,10 +15,10 @@ export declare const COMMAND_FLAGS: {
     readonly 'generate:types': readonly ["--output", "--path", "--tables", "--database", "--chdb-path"];
     readonly 'generate:datasets': readonly ["--output", "--path", "--tables", "--exclude-tables", "--tenant-column", "--force", "--check", "--diff"];
     readonly 'generate:manifest': readonly ["--output"];
-    readonly 'generate:client': readonly ["--output", "--check", "--force"];
+    readonly 'generate:client': readonly ["--output", "--check", "--force", "--cloud", "--project", "--environment", "--endpoint"];
     readonly login: readonly ["--cloud-url", "--environment"];
     readonly logout: readonly [];
-    readonly deploy: readonly ["--bundle-output", "--release-output", "--project", "--environment", "--no-source", "--endpoint", "--replace-restored", "--mcp-config", "--draft"];
+    readonly deploy: readonly ["--bundle-output", "--release-output", "--project", "--environment", "--no-source", "--endpoint", "--replace-restored", "--mcp-config", "--draft", "--client"];
     readonly 'deployment:build': readonly ["--bundle-output", "--no-source"];
     readonly 'deployment:validate': readonly [];
     readonly 'deployment:release': readonly ["--project", "--environment", "--output"];
@@ -41,10 +41,10 @@ export declare const VALUE_FLAGS: {
     readonly 'generate:types': readonly ["--output", "--path", "--tables", "--database", "--chdb-path"];
     readonly 'generate:datasets': readonly ["--output", "--path", "--tables", "--exclude-tables", "--tenant-column"];
     readonly 'generate:manifest': readonly ["--output"];
-    readonly 'generate:client': readonly ["--output"];
+    readonly 'generate:client': readonly ["--output", "--project", "--environment", "--endpoint"];
     readonly login: readonly ["--cloud-url", "--environment"];
     readonly logout: readonly [];
-    readonly deploy: readonly ["--bundle-output", "--release-output", "--project", "--environment", "--endpoint", "--draft"];
+    readonly deploy: readonly ["--bundle-output", "--release-output", "--project", "--environment", "--endpoint", "--draft", "--client"];
     readonly 'deployment:build': readonly ["--bundle-output"];
     readonly 'deployment:validate': readonly [];
     readonly 'deployment:release': readonly ["--project", "--environment", "--output"];

package/dist/utils/telemetry/domains.js

@@ -24,10 +24,10 @@ export const COMMAND_FLAGS = {
     'generate:types': ['--output', '--path', '--tables', '--database', '--chdb-path'],
     'generate:datasets': ['--output', '--path', '--tables', '--exclude-tables', '--tenant-column', '--force', '--check', '--diff'],
     'generate:manifest': ['--output'],
-    'generate:client': ['--output', '--check', '--force'],
+    'generate:client': ['--output', '--check', '--force', '--cloud', '--project', '--environment', '--endpoint'],
     login: ['--cloud-url', '--environment'],
     logout: [],
-    deploy: ['--bundle-output', '--release-output', '--project', '--environment', '--no-source', '--endpoint', '--replace-restored', '--mcp-config', '--draft'],
+    deploy: ['--bundle-output', '--release-output', '--project', '--environment', '--no-source', '--endpoint', '--replace-restored', '--mcp-config', '--draft', '--client'],
     'deployment:build': ['--bundle-output', '--no-source'],
     'deployment:validate': [],
     'deployment:release': ['--project', '--environment', '--output'],
@@ -47,10 +47,10 @@ export const VALUE_FLAGS = {
     'generate:types': ['--output', '--path', '--tables', '--database', '--chdb-path'],
     'generate:datasets': ['--output', '--path', '--tables', '--exclude-tables', '--tenant-column'],
     'generate:manifest': ['--output'],
-    'generate:client': ['--output'],
+    'generate:client': ['--output', '--project', '--environment', '--endpoint'],
     login: ['--cloud-url', '--environment'],
     logout: [],
-    deploy: ['--bundle-output', '--release-output', '--project', '--environment', '--endpoint', '--draft'],
+    deploy: ['--bundle-output', '--release-output', '--project', '--environment', '--endpoint', '--draft', '--client'],
     'deployment:build': ['--bundle-output'],
     'deployment:validate': [],
     'deployment:release': ['--project', '--environment', '--output'],

package/dist/utils/tenant-key-candidates.d.ts

@@ -0,0 +1,19 @@
+import type { ProtocolDeploymentContract } from '@hypequery/protocol';
+/**
+ * Whether a column name is worth presenting as a possible tenant key.
+ *
+ * A naming match is never enough to activate tenant enforcement. `tenantKey`
+ * is a security boundary that must be chosen explicitly by the application.
+ */
+export declare function isTenantKeyCandidateName(name: string): boolean;
+export interface UnscopedTenantCandidate {
+    readonly dataset: string;
+    readonly columns: readonly string[];
+}
+/**
+ * Served datasets about to be published with a customer-like column that
+ * neither the dataset nor its endpoint scopes by tenant. Datasets without an
+ * endpoint are not callable, so they are skipped.
+ */
+export declare function unscopedTenantCandidates(contract: ProtocolDeploymentContract): UnscopedTenantCandidate[];
+//# sourceMappingURL=tenant-key-candidates.d.ts.map

package/dist/utils/tenant-key-candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-key-candidates.d.ts","sourceRoot":"","sources":["../../src/utils/tenant-key-candidates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AActE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAoCD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,uBAAuB,EAAE,CAMxG"}

package/dist/utils/tenant-key-candidates.js

@@ -0,0 +1,63 @@
+// Kept in step with Cloud's customer-scope review, so the CLI and onboarding flag the same columns.
+const CANDIDATE_NAMES = new Set([
+    'tenant_id',
+    'org_id',
+    'organization_id',
+    'organisation_id',
+    'account_id',
+    'customer_id',
+    'workspace_id',
+    'company_id',
+]);
+/**
+ * Whether a column name is worth presenting as a possible tenant key.
+ *
+ * A naming match is never enough to activate tenant enforcement. `tenantKey`
+ * is a security boundary that must be chosen explicitly by the application.
+ */
+export function isTenantKeyCandidateName(name) {
+    return CANDIDATE_NAMES.has(name.toLowerCase());
+}
+const lastSegment = (name) => name.slice(name.lastIndexOf('.') + 1);
+/**
+ * The physical columns a dataset reads from its own table, which are the only
+ * values `tenantKey` accepts. Dimension sources may be table-qualified or SQL
+ * with declared dependencies; measure and filter fields may name a dimension,
+ * which resolves to its source. Fields reached through a relationship belong
+ * to another table and are skipped.
+ */
+function ownColumns(dataset) {
+    const related = new Set((dataset.relationships ?? []).map((relationship) => String(relationship.name)));
+    const own = (reference) => {
+        const dot = reference.lastIndexOf('.');
+        return dot < 0 || !related.has(reference.slice(0, dot));
+    };
+    const sourceColumns = (dimension) => (dimension.source.kind === 'column' ? [dimension.source.column] : dimension.source.dependencies.map(String))
+        .filter(own)
+        .map(lastSegment);
+    const dimensions = new Map(dataset.dimensions.map((dimension) => [String(dimension.name), dimension]));
+    const resolve = (field) => {
+        if (!own(field))
+            return [];
+        const dimension = dimensions.get(lastSegment(field));
+        return dimension ? sourceColumns(dimension) : [lastSegment(field)];
+    };
+    return [
+        ...dataset.dimensions.flatMap(sourceColumns),
+        ...dataset.measures.flatMap((measure) => 'field' in measure ? resolve(String(measure.field)) : []),
+        ...dataset.filters.flatMap((filter) => resolve(String(filter.field))),
+    ];
+}
+/**
+ * Served datasets about to be published with a customer-like column that
+ * neither the dataset nor its endpoint scopes by tenant. Datasets without an
+ * endpoint are not callable, so they are skipped.
+ */
+export function unscopedTenantCandidates(contract) {
+    return contract.datasets.flatMap((dataset) => {
+        if (!dataset.endpoint || dataset.tenant.kind === 'required' || dataset.endpoint.tenant.kind === 'required')
+            return [];
+        const columns = [...new Set(ownColumns(dataset).filter(isTenantKeyCandidateName))];
+        return columns.length ? [{ dataset: dataset.name, columns }] : [];
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments",
   "keywords": [
     "clickhouse",
@@ -23,15 +23,15 @@
   ],
   "dependencies": {
     "@clickhouse/client": "^1.24.1",
-    "chalk": "^5.3.0",
+    "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "dotenv": "^18.0.8",
     "esbuild": "^0.28.2",
     "open": "^11.0.4",
-    "ora": "^8.0.1",
+    "ora": "^9.4.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.11.1",
-    "@hypequery/protocol": "0.24.1"
+    "@hypequery/deployment": "0.11.2",
+    "@hypequery/protocol": "0.24.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "2.1.2"
@@ -54,8 +54,8 @@
     "@vitest/coverage-v8": "^5.0.5",
     "typescript": "^6.0.3",
     "vitest": "^5.0.5",
-    "@hypequery/mcp": "0.11.1",
-    "@hypequery/serve": "0.24.1"
+    "@hypequery/mcp": "0.11.2",
+    "@hypequery/serve": "0.24.2"
   },
   "repository": {
     "type": "git",