@niuhuoshan/dsh-connect 0.1.0

package/lib/index.js

@@ -0,0 +1,2303 @@
+// src/index.ts
+import { settingsNamespace } from "@deepseek-ai/dsh-settings";
+import z5 from "@deepseek-ai/schemastery";
+
+// src/domain.ts
+import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
+
+// src/types.ts
+import { z } from "zod";
+var databaseTypeSchema = z.enum(["mysql", "postgresql", "clickhouse"]);
+var apiMethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+var apiParameterSchema = z.object({
+  name: z.string().min(1).max(64).regex(/^[A-Za-z_][A-Za-z0-9_-]*$/),
+  location: z.enum(["path", "query", "header", "body"]),
+  type: z.enum(["string", "number", "integer", "boolean", "json"]),
+  description: z.string().max(500).default(""),
+  required: z.boolean().default(false)
+});
+var apiAuthSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("none") }),
+  z.object({ type: z.literal("bearer"), credentialRef: z.string().min(1) }),
+  z.object({
+    type: z.literal("api-key"),
+    credentialRef: z.string().min(1),
+    location: z.enum(["header", "query"]),
+    name: z.string().min(1).max(100)
+  }),
+  z.object({ type: z.literal("basic"), credentialRef: z.string().min(1), username: z.string().min(1).max(200) })
+]);
+var timestampSchema = z.number().int().nonnegative();
+var dataSourceSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string().min(1).max(100),
+  type: databaseTypeSchema,
+  host: z.string().min(1).max(255),
+  port: z.number().int().min(1).max(65535),
+  database: z.string().min(1).max(255),
+  username: z.string().min(1).max(255),
+  credentialRef: z.string().min(1),
+  schemaInclude: z.array(z.string().min(1).max(255)).max(100).default([]),
+  tls: z.boolean().default(false),
+  sampleRows: z.number().int().min(0).max(3).default(0),
+  aiEnrichment: z.boolean().default(false),
+  enabled: z.boolean().default(true),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
+});
+var apiDefinitionSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string().min(1).max(100),
+  slug: z.string().min(2).max(48).regex(/^[a-z][a-z0-9_]*$/),
+  description: z.string().min(1).max(1e3),
+  method: apiMethodSchema,
+  baseUrl: z.string().url().max(2048),
+  pathTemplate: z.string().min(1).max(2048).default("/"),
+  parameters: z.array(apiParameterSchema).max(50).default([]),
+  auth: apiAuthSchema,
+  timeoutMs: z.number().int().min(1e3).max(12e4).default(3e4),
+  maxResponseBytes: z.number().int().min(1024).max(2 * 1024 * 1024).default(131072),
+  responsePointer: z.string().max(500).default(""),
+  allowPrivateNetwork: z.boolean().default(false),
+  enabled: z.boolean().default(true),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
+});
+var physicalColumnSchema = z.object({
+  name: z.string(),
+  type: z.string(),
+  nullable: z.boolean(),
+  defaultValue: z.string().nullable().optional(),
+  comment: z.string().optional(),
+  primaryKey: z.boolean().default(false),
+  references: z.object({
+    schemaName: z.string(),
+    objectName: z.string(),
+    columnName: z.string()
+  }).optional()
+});
+var semanticColumnSchema = z.object({
+  name: z.string(),
+  term: z.string(),
+  description: z.string(),
+  synonyms: z.array(z.string().max(100)).max(20).default([]),
+  enums: z.array(z.string().max(100)).max(50).default([]),
+  role: z.enum(["identifier", "dimension", "measure", "time", "unknown"]).default("unknown")
+});
+var metadataProfileSchema = z.object({
+  id: z.string(),
+  sourceId: z.string().uuid(),
+  schemaName: z.string(),
+  objectName: z.string(),
+  objectType: z.enum(["table", "view"]),
+  engine: z.string().optional(),
+  comment: z.string().optional(),
+  ddl: z.string().max(1e5),
+  columns: z.array(physicalColumnSchema),
+  sample: z.array(z.record(z.string(), z.unknown())).max(3).default([]),
+  term: z.string().default(""),
+  description: z.string().default(""),
+  tags: z.array(z.string()).max(20).default([]),
+  synonyms: z.array(z.string().max(100)).max(30).default([]),
+  semanticColumns: z.array(semanticColumnSchema).default([]),
+  confidence: z.number().int().min(0).max(100).default(0),
+  confidenceReason: z.string().default(""),
+  temporary: z.boolean().default(false),
+  ignored: z.boolean().default(false),
+  ignoredOverride: z.boolean().optional(),
+  editedAt: timestampSchema.optional(),
+  fingerprint: z.string(),
+  semanticFingerprint: z.string().default(""),
+  modelProvider: z.string().optional(),
+  modelName: z.string().optional(),
+  modelReasoningEffort: z.string().optional(),
+  modelAnalyzedAt: timestampSchema.optional(),
+  modelStatus: z.enum(["heuristic", "ai", "failed"]).default("heuristic"),
+  modelPromptVersion: z.string().default("v1"),
+  profiledAt: timestampSchema
+});
+var metricAggregationSchema = z.enum(["count", "sum", "avg", "min", "max", "formula"]);
+var metricDefinitionSchema = z.object({
+  id: z.string().uuid(),
+  sourceId: z.string().uuid(),
+  profileId: z.string().min(1),
+  name: z.string().min(1).max(120),
+  term: z.string().min(1).max(120),
+  description: z.string().max(500).default(""),
+  aggregation: metricAggregationSchema,
+  columnName: z.string().max(255).default(""),
+  expression: z.string().max(2e3),
+  unit: z.string().max(50).default(""),
+  tags: z.array(z.string().max(50)).max(20).default([]),
+  enabled: z.boolean().default(true),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
+});
+var metadataChangeSchema = z.object({
+  id: z.string().uuid(),
+  sourceId: z.string().uuid(),
+  profileId: z.string().min(1),
+  action: z.enum(["create", "update", "scan", "model"]),
+  summary: z.string().max(500),
+  before: z.record(z.string(), z.unknown()).optional(),
+  after: z.record(z.string(), z.unknown()).optional(),
+  changedAt: timestampSchema
+});
+var profileJobSchema = z.object({
+  id: z.string().uuid(),
+  sourceId: z.string().uuid(),
+  status: z.enum(["queued", "running", "completed", "cancelled", "failed"]),
+  mode: z.enum(["incremental", "rebuild-ai", "full"]).default("incremental"),
+  total: z.number().int().nonnegative(),
+  processed: z.number().int().nonnegative(),
+  currentObject: z.string().optional(),
+  error: z.string().optional(),
+  startedAt: timestampSchema,
+  updatedAt: timestampSchema,
+  finishedAt: timestampSchema.optional(),
+  modelProvider: z.string().optional(),
+  modelName: z.string().optional()
+});
+
+// src/domain.ts
+var connectDomainSpec = defineDomain({
+  name: "dsh_connect",
+  version: 0,
+  tables: {
+    data_sources: domainTable(dataSourceSchema),
+    api_definitions: domainTable(apiDefinitionSchema),
+    metadata_profiles: domainTable(metadataProfileSchema),
+    profile_jobs: domainTable(profileJobSchema),
+    metrics: domainTable(metricDefinitionSchema),
+    metadata_changes: domainTable(metadataChangeSchema)
+  }
+});
+
+// src/host/store.ts
+var ConnectStore = class {
+  constructor(ctx, domain) {
+    this.ctx = ctx;
+    this.domain = domain;
+  }
+  dataSources() {
+    return [...this.domain.table("data_sources").entries()].map(([, value]) => value).sort((a, b) => a.name.localeCompare(b.name));
+  }
+  dataSource(id) {
+    return this.domain.table("data_sources").get(id);
+  }
+  async dataSourceViews() {
+    const jobs = this.jobs();
+    const profiles = this.profiles();
+    return Promise.all(this.dataSources().map(async (source) => {
+      const { credentialRef: credentialRef5, ...safe } = source;
+      const latestJob = jobs.filter((job) => job.sourceId === source.id && job.status !== "cancelled").sort((a, b) => b.startedAt - a.startedAt)[0];
+      return {
+        ...safe,
+        credentialConfigured: (await this.ctx.credentials.describe(credentialRef5)).configured,
+        ...latestJob === void 0 ? {} : { latestJob },
+        profileCount: profiles.filter((profile) => profile.sourceId === source.id).length,
+        aiProfileCount: profiles.filter((profile) => profile.sourceId === source.id && profile.modelStatus === "ai").length
+      };
+    }));
+  }
+  putDataSource(value) {
+    return this.domain.table("data_sources").put(value.id, value);
+  }
+  async deleteDataSource(id) {
+    await this.domain.table("data_sources").delete(id);
+    const profileTable = this.domain.table("metadata_profiles");
+    for (const [key, profile] of profileTable.entries()) {
+      if (profile.sourceId === id) await profileTable.delete(key);
+    }
+    const jobTable = this.domain.table("profile_jobs");
+    for (const [key, job] of jobTable.entries()) {
+      if (job.sourceId === id) await jobTable.delete(key);
+    }
+    for (const tableName of ["metrics", "metadata_changes"]) {
+      const table = this.domain.table(tableName);
+      for (const [key, value] of table.entries()) if (value.sourceId === id) await table.delete(key);
+    }
+  }
+  apiDefinitions() {
+    return [...this.domain.table("api_definitions").entries()].map(([, value]) => value).sort((a, b) => a.name.localeCompare(b.name));
+  }
+  apiDefinition(id) {
+    return this.domain.table("api_definitions").get(id);
+  }
+  async apiDefinitionViews() {
+    return Promise.all(this.apiDefinitions().map(async (definition) => {
+      const { auth, ...safe } = definition;
+      if (auth.type === "none") {
+        return { ...safe, auth: { type: "none", credentialConfigured: true }, toolName: toolName(definition) };
+      }
+      const { credentialRef: credentialRef5, ...safeAuth } = auth;
+      return {
+        ...safe,
+        auth: {
+          ...safeAuth,
+          credentialConfigured: (await this.ctx.credentials.describe(credentialRef5)).configured
+        },
+        toolName: toolName(definition)
+      };
+    }));
+  }
+  putApiDefinition(value) {
+    return this.domain.table("api_definitions").put(value.id, value);
+  }
+  deleteApiDefinition(id) {
+    return this.domain.table("api_definitions").delete(id);
+  }
+  profiles(sourceId) {
+    return [...this.domain.table("metadata_profiles").entries()].map(([, value]) => value).filter((profile) => sourceId === void 0 || profile.sourceId === sourceId).sort((a, b) => `${a.schemaName}.${a.objectName}`.localeCompare(`${b.schemaName}.${b.objectName}`));
+  }
+  profile(id) {
+    return this.domain.table("metadata_profiles").get(id);
+  }
+  putProfile(value) {
+    return this.domain.table("metadata_profiles").put(value.id, value);
+  }
+  metrics(sourceId) {
+    return [...this.domain.table("metrics").entries()].map(([, value]) => value).filter((metric) => sourceId === void 0 || metric.sourceId === sourceId).sort((a, b) => a.term.localeCompare(b.term));
+  }
+  metric(id) {
+    return this.domain.table("metrics").get(id);
+  }
+  putMetric(value) {
+    return this.domain.table("metrics").put(value.id, value);
+  }
+  deleteMetric(id) {
+    return this.domain.table("metrics").delete(id);
+  }
+  changes(sourceId, profileId2) {
+    return [...this.domain.table("metadata_changes").entries()].map(([, value]) => value).filter((change) => (sourceId === void 0 || change.sourceId === sourceId) && (profileId2 === void 0 || change.profileId === profileId2)).sort((a, b) => b.changedAt - a.changedAt);
+  }
+  changePage(sourceId, profileId2, offset, limit) {
+    const changes = this.changes(sourceId, profileId2);
+    return {
+      items: changes.slice(offset, offset + limit).map(({ id, sourceId: itemSourceId, profileId: itemProfileId, action, summary, changedAt }) => ({
+        id,
+        sourceId: itemSourceId,
+        profileId: itemProfileId,
+        action,
+        summary,
+        changedAt
+      })),
+      offset,
+      limit,
+      total: changes.length,
+      hasMore: offset + limit < changes.length
+    };
+  }
+  putChange(value) {
+    return this.domain.table("metadata_changes").put(value.id, value);
+  }
+  async deleteStaleProfiles(sourceId, keep) {
+    const table = this.domain.table("metadata_profiles");
+    for (const [key, value] of table.entries()) {
+      if (value.sourceId === sourceId && !keep.has(key)) await table.delete(key);
+    }
+  }
+  jobs(sourceId) {
+    return [...this.domain.table("profile_jobs").entries()].map(([, value]) => value).filter((job) => job.status !== "cancelled" && (sourceId === void 0 || job.sourceId === sourceId)).sort((a, b) => b.startedAt - a.startedAt);
+  }
+  putJob(value) {
+    return this.domain.table("profile_jobs").put(value.id, value);
+  }
+  deleteJob(id) {
+    return this.domain.table("profile_jobs").delete(id);
+  }
+};
+function toolName(definition) {
+  return `dsh_connect_api_${definition.slug}`;
+}
+
+// src/host/http/executor.ts
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+
+// src/host/http/security.ts
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+var FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "host",
+  "content-length",
+  "connection",
+  "transfer-encoding",
+  "cookie"
+]);
+function assertSafeHeaderName(name2) {
+  const normalized = name2.trim().toLowerCase();
+  if (!/^[a-z0-9!#$%&'*+.^_`|~-]+$/.test(normalized)) {
+    throw new Error(`Invalid HTTP header name: ${name2}`);
+  }
+  if (FORBIDDEN_HEADERS.has(normalized)) {
+    throw new Error(`HTTP header ${name2} is controlled by dsh-connect`);
+  }
+}
+function parseConfiguredBaseUrl(raw) {
+  const url = new URL(raw);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("Only HTTP and HTTPS API targets are supported");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new Error("Credentials must not be embedded in the API URL");
+  }
+  if (url.hash !== "") throw new Error("API base URL must not contain a fragment");
+  return url;
+}
+async function assertOutboundTarget(url, allowPrivateNetwork) {
+  if (allowPrivateNetwork) return;
+  const addresses = isIP(url.hostname) === 0 ? await lookup(url.hostname, { all: true, verbatim: true }) : [{ address: url.hostname, family: isIP(url.hostname) }];
+  if (addresses.length === 0) throw new Error("API target did not resolve to an address");
+  for (const { address } of addresses) {
+    if (isPrivateAddress(address)) {
+      throw new Error("API target resolves to a private, loopback, link-local, or reserved address");
+    }
+  }
+}
+function isPrivateAddress(raw) {
+  const lower = raw.toLowerCase();
+  const unbracketed = lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
+  const address = unbracketed.split("%", 1)[0] ?? unbracketed;
+  if (address.includes(":")) {
+    if (isIP(address) !== 6) return true;
+    if (address === "::" || address === "::1") return true;
+    if (address.startsWith("fc") || address.startsWith("fd") || address.startsWith("fe8") || address.startsWith("fe9") || address.startsWith("fea") || address.startsWith("feb")) return true;
+    if (address.startsWith("::ffff:")) return isPrivateAddress(address.slice("::ffff:".length));
+    return address.startsWith("ff") || address.startsWith("2001:db8:") || address.startsWith("2001:0db8:") || address.startsWith("2001:10:") || address.startsWith("2001:20:") || address.startsWith("2002:");
+  }
+  const parts = address.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) return true;
+  const [a, b, c] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 && (c === 0 || c === 2) || a === 192 && b === 88 && c === 99 || a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113 || a === 100 && b >= 64 && b <= 127 || a >= 224;
+}
+
+// src/host/http/executor.ts
+var BLOCKED_PARAMETER_HEADERS = /* @__PURE__ */ new Set(["authorization", "proxy-authorization"]);
+var SecureHttpExecutor = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async execute(definition, rawArgs, signal) {
+    const args = validateArguments(definition.parameters, rawArgs);
+    const base = parseConfiguredBaseUrl(definition.baseUrl);
+    const path = replacePathParameters(definition.pathTemplate, definition.parameters, args);
+    const target = new URL(path, base);
+    if (target.origin !== base.origin) throw new Error("API path must stay on the configured origin");
+    await assertOutboundTarget(target, definition.allowPrivateNetwork);
+    const headers = new Headers({ Accept: "application/json, text/plain;q=0.9, */*;q=0.5" });
+    const bodyValues = {};
+    for (const parameter of definition.parameters) {
+      const value = args[parameter.name];
+      if (value === void 0 || parameter.location === "path") continue;
+      if (parameter.location === "query") target.searchParams.append(parameter.name, serializeScalar(value));
+      if (parameter.location === "header") {
+        assertSafeHeaderName(parameter.name);
+        if (BLOCKED_PARAMETER_HEADERS.has(parameter.name.toLowerCase())) {
+          throw new Error(`Header ${parameter.name} cannot be supplied by the model`);
+        }
+        headers.set(parameter.name, serializeScalar(value));
+      }
+      if (parameter.location === "body") bodyValues[parameter.name] = value;
+    }
+    await this.applyAuth(definition, target, headers);
+    let body;
+    if (!["GET", "DELETE"].includes(definition.method) && Object.keys(bodyValues).length > 0) {
+      body = JSON.stringify(bodyValues);
+      headers.set("Content-Type", "application/json");
+    }
+    const timeout = AbortSignal.timeout(definition.timeoutMs);
+    const combined = signal === void 0 ? timeout : AbortSignal.any([signal, timeout]);
+    const started = Date.now();
+    const response = await fetch(target, {
+      method: definition.method,
+      headers,
+      ...body === void 0 ? {} : { body },
+      redirect: "error",
+      signal: combined
+    });
+    const payload = await readBounded(response, definition.maxResponseBytes);
+    const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    const parsed = parseBody(payload.text, contentType);
+    const selected = definition.responsePointer === "" ? parsed : resolveJsonPointer(parsed, definition.responsePointer);
+    if (!response.ok) {
+      const detail = typeof selected === "string" ? selected : JSON.stringify(selected);
+      throw new Error(`HTTP ${response.status}: ${detail.slice(0, 500)}`);
+    }
+    return {
+      status: response.status,
+      contentType,
+      body: selected,
+      truncated: payload.truncated,
+      durationMs: Date.now() - started
+    };
+  }
+  async applyAuth(definition, target, headers) {
+    const auth = definition.auth;
+    if (auth.type === "none") return;
+    const resolved = await this.ctx.credentials.resolve(credentialRef(auth.credentialRef));
+    if (resolved === void 0) throw new Error(`Credential ${auth.credentialRef} is not configured`);
+    if (auth.type === "bearer") headers.set("Authorization", `Bearer ${resolved.value}`);
+    if (auth.type === "basic") {
+      headers.set("Authorization", `Basic ${Buffer.from(`${auth.username}:${resolved.value}`).toString("base64")}`);
+    }
+    if (auth.type === "api-key") {
+      if (auth.location === "header") {
+        assertSafeHeaderName(auth.name);
+        headers.set(auth.name, resolved.value);
+      } else {
+        target.searchParams.set(auth.name, resolved.value);
+      }
+    }
+  }
+};
+function validateArguments(parameters, raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Tool arguments must be an object");
+  const source = raw;
+  const known = new Set(parameters.map((parameter) => parameter.name));
+  for (const key of Object.keys(source)) {
+    if (!known.has(key)) throw new Error(`Unknown API parameter: ${key}`);
+  }
+  const result = {};
+  for (const parameter of parameters) {
+    const value = source[parameter.name];
+    if (value === void 0) {
+      if (parameter.required) throw new Error(`Missing required API parameter: ${parameter.name}`);
+      continue;
+    }
+    if (!matchesType(parameter.type, value)) throw new Error(`API parameter ${parameter.name} must be ${parameter.type}`);
+    result[parameter.name] = value;
+  }
+  return result;
+}
+function matchesType(type, value) {
+  if (type === "string") return typeof value === "string";
+  if (type === "boolean") return typeof value === "boolean";
+  if (type === "number") return typeof value === "number" && Number.isFinite(value);
+  if (type === "integer") return typeof value === "number" && Number.isSafeInteger(value);
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean" || Array.isArray(value) || typeof value === "object";
+}
+function replacePathParameters(template, parameters, args) {
+  let path = template.startsWith("/") ? template : `/${template}`;
+  for (const parameter of parameters.filter((item) => item.location === "path")) {
+    const value = args[parameter.name];
+    if (value === void 0) throw new Error(`Path parameter ${parameter.name} is required`);
+    path = path.replaceAll(`{${parameter.name}}`, encodeURIComponent(serializeScalar(value)));
+  }
+  if (/\{[^}]+\}/.test(path)) throw new Error("API path contains an unresolved placeholder");
+  return path;
+}
+function serializeScalar(value) {
+  return typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+async function readBounded(response, maxBytes) {
+  if (response.body === null) return { text: "", truncated: false };
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  let truncated = false;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) break;
+      const remaining = maxBytes - size;
+      if (next.value.byteLength > remaining) {
+        if (remaining > 0) chunks.push(next.value.slice(0, remaining));
+        truncated = true;
+        await reader.cancel("dsh-connect response limit reached");
+        break;
+      }
+      chunks.push(next.value);
+      size += next.value.byteLength;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.byteLength, 0));
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { text: new TextDecoder().decode(bytes), truncated };
+}
+function parseBody(text, contentType) {
+  if (text === "") return null;
+  if (contentType === "application/json" || contentType.endsWith("+json")) {
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new Error("API returned invalid JSON");
+    }
+  }
+  return text;
+}
+function resolveJsonPointer(value, pointer) {
+  if (pointer === "") return value;
+  if (!pointer.startsWith("/")) throw new Error("Response pointer must be empty or start with /");
+  let current = value;
+  for (const encoded of pointer.slice(1).split("/")) {
+    const key = encoded.replaceAll("~1", "/").replaceAll("~0", "~");
+    if (Array.isArray(current)) {
+      const index = Number(key);
+      if (!Number.isSafeInteger(index) || index < 0 || index >= current.length) throw new Error(`Response pointer not found: ${pointer}`);
+      current = current[index];
+    } else if (current !== null && typeof current === "object" && Object.hasOwn(current, key)) {
+      current = current[key];
+    } else {
+      throw new Error(`Response pointer not found: ${pointer}`);
+    }
+  }
+  return current;
+}
+
+// src/host/http/tools.ts
+var ApiToolRegistry = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.executor = new SecureHttpExecutor(ctx);
+  }
+  disposers = [];
+  names = /* @__PURE__ */ new Set();
+  executor;
+  replace(definitions) {
+    const enabled = definitions.filter((definition) => definition.enabled);
+    const names = /* @__PURE__ */ new Set();
+    for (const definition of enabled) {
+      const name2 = toolName(definition);
+      if (names.has(name2)) throw new Error(`Duplicate API tool name: ${name2}`);
+      names.add(name2);
+      const existing = this.ctx.tools.get(name2);
+      if (existing !== void 0 && !this.names.has(name2)) throw new Error(`Tool name is already registered: ${name2}`);
+    }
+    this.dispose();
+    const next = [];
+    try {
+      for (const definition of enabled) next.push(this.ctx.tools.register(this.definition(definition)));
+    } catch (error) {
+      for (const dispose of next.reverse()) dispose();
+      throw error;
+    }
+    this.disposers = next;
+    this.names = names;
+  }
+  dispose() {
+    for (const dispose of this.disposers.splice(0).reverse()) dispose();
+    this.names.clear();
+  }
+  definition(definition) {
+    return {
+      name: toolName(definition),
+      description: definition.description,
+      parameters: parametersSchema(definition.parameters),
+      output: {
+        schema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            status: { type: "integer" },
+            contentType: { type: "string" },
+            body: {},
+            truncated: { type: "boolean" },
+            durationMs: { type: "integer" }
+          },
+          required: ["status", "contentType", "body", "truncated", "durationMs"]
+        },
+        render: (_args, value) => [{ type: "text", text: JSON.stringify(value, null, 2) }]
+      },
+      timeoutMs: definition.timeoutMs,
+      isConcurrencySafe: () => definition.method === "GET",
+      execute: (args, exec) => this.executor.execute(definition, args, exec.signal),
+      presentCall: (args) => ({
+        card: "generic",
+        title: definition.name,
+        kind: "fetch",
+        rawInput: args
+      })
+    };
+  }
+};
+function parametersSchema(parameters) {
+  const properties = {};
+  const required = [];
+  for (const parameter of parameters) {
+    properties[parameter.name] = {
+      ...parameter.type === "json" ? {} : { type: parameter.type },
+      description: parameter.description || `${parameter.location} parameter ${parameter.name}`
+    };
+    if (parameter.required || parameter.location === "path") required.push(parameter.name);
+  }
+  return {
+    type: "object",
+    properties,
+    required,
+    additionalProperties: false
+  };
+}
+
+// src/host/http/conversation-api.ts
+import { defineTool } from "@deepseek-ai/dsh-tools";
+import { z as z2 } from "zod";
+var CONVERSATION_API_TOOL = "dsh_connect_create_http_api";
+var conversationApiInput = z2.object({
+  name: z2.string().min(1).max(100),
+  slug: z2.string().min(2).max(48).regex(/^[a-z][a-z0-9_]*$/),
+  description: z2.string().min(1).max(1e3),
+  method: apiMethodSchema,
+  baseUrl: z2.string().url().max(2048),
+  pathTemplate: z2.string().min(1).max(2048).default("/"),
+  parameters: z2.array(apiParameterSchema).max(50).default([]),
+  authType: z2.enum(["none", "bearer", "api-key", "basic"]).default("none"),
+  authLocation: z2.enum(["header", "query"]).optional(),
+  authName: z2.string().min(1).max(100).optional(),
+  basicUsername: z2.string().min(1).max(200).optional(),
+  timeoutMs: z2.number().int().min(1e3).max(12e4).default(3e4),
+  maxResponseBytes: z2.number().int().min(1024).max(2 * 1024 * 1024).default(131072),
+  responsePointer: z2.string().max(500).default("")
+}).strict().superRefine((input, refinement) => {
+  if (input.authType === "api-key") {
+    if (input.authLocation === void 0) refinement.addIssue({ code: "custom", path: ["authLocation"], message: "Required for api-key authentication" });
+    if (input.authName === void 0) refinement.addIssue({ code: "custom", path: ["authName"], message: "Required for api-key authentication" });
+  } else if (input.authLocation !== void 0 || input.authName !== void 0) {
+    refinement.addIssue({ code: "custom", path: ["authType"], message: "API key fields are only allowed with api-key authentication" });
+  }
+  if (input.authType === "basic") {
+    if (input.basicUsername === void 0) refinement.addIssue({ code: "custom", path: ["basicUsername"], message: "Required for basic authentication" });
+  } else if (input.basicUsername !== void 0) {
+    refinement.addIssue({ code: "custom", path: ["basicUsername"], message: "Only allowed with basic authentication" });
+  }
+});
+var parameterItem = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    name: { type: "string", required: true, description: "Parameter name." },
+    location: { type: "string", enum: ["path", "query", "header", "body"], required: true },
+    type: { type: "string", enum: ["string", "number", "integer", "boolean", "json"], required: true },
+    description: { type: "string", description: "What the parameter means." },
+    required: { type: "boolean", description: "Whether the caller must provide this parameter." }
+  }
+};
+function registerConversationApiTool(ctx, validate, create) {
+  const disposeTool = ctx.tools.register(defineTool({
+    name: CONVERSATION_API_TOOL,
+    description: [
+      "Create and register a reusable HTTP API in DSH\u8FDE\u63A5\u5668 when the user asks to add, configure, or register an API.",
+      "Derive this non-secret configuration from the conversation, then call this tool so DSH can show an approval preview.",
+      "Never ask for or pass tokens, passwords, API-key values, Authorization values, or other credentials.",
+      "For authenticated APIs, provide only the authentication type and public metadata; the user completes credentials in Settings."
+    ].join(" "),
+    parameters: {
+      name: { type: "string", required: true, description: "User-facing API name." },
+      slug: { type: "string", required: true, description: "Lowercase tool suffix matching ^[a-z][a-z0-9_]{1,47}$." },
+      description: { type: "string", required: true, description: "Describe when the Agent should call this API and what it returns." },
+      method: { type: "string", enum: ["GET", "POST", "PUT", "PATCH", "DELETE"], required: true },
+      baseUrl: { type: "string", required: true, description: "Public HTTP(S) base URL without credentials or a query string." },
+      pathTemplate: { type: "string", description: "Request path such as /v1/weather/{city}. Default /." },
+      parameters: { type: "array", items: parameterItem, description: "Path, query, header, and body arguments exposed to the Agent." },
+      authType: { type: "string", enum: ["none", "bearer", "api-key", "basic"], description: "Authentication type. Default none." },
+      authLocation: { type: "string", enum: ["header", "query"], description: "Required only for api-key authentication." },
+      authName: { type: "string", description: "Header or query parameter name for an API key, never its value." },
+      basicUsername: { type: "string", description: "Public username for basic authentication, never the password." },
+      timeoutMs: { type: "integer", description: "Timeout from 1000 to 120000 milliseconds. Default 30000." },
+      maxResponseBytes: { type: "integer", description: "Response limit from 1024 to 2097152 bytes. Default 131072." },
+      responsePointer: { type: "string", description: "Optional RFC 6901 JSON pointer selecting the useful response value." }
+    },
+    output: {
+      schema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          created: { type: "boolean", required: true },
+          id: { type: "string", required: true },
+          name: { type: "string", required: true },
+          toolName: { type: "string", required: true },
+          enabled: { type: "boolean", required: true },
+          credentialRequired: { type: "boolean", required: true },
+          nextStep: { type: "string", required: true }
+        }
+      },
+      render: (_args, value) => [{ type: "text", text: JSON.stringify(value, null, 2) }]
+    },
+    isConcurrencySafe: () => false,
+    async execute(rawInput) {
+      const input = conversationApiInput.parse(rawInput);
+      validate(input);
+      const saved = await create(input);
+      if (saved === void 0) throw new Error("HTTP API was saved but could not be loaded");
+      const credentialRequired = saved.auth.type !== "none" && !saved.auth.credentialConfigured;
+      return {
+        created: true,
+        id: saved.id,
+        name: saved.name,
+        toolName: saved.toolName,
+        enabled: saved.enabled,
+        credentialRequired,
+        nextStep: credentialRequired ? "\u8BF7\u524D\u5F80\u201CDSH\u8FDE\u63A5\u5668 \u2192 HTTP API\u201D\u8865\u5145\u51ED\u636E\u5E76\u542F\u7528\u8BE5 API\u3002" : `API \u5DF2\u542F\u7528\uFF0CAgent \u73B0\u5728\u53EF\u4EE5\u8C03\u7528 ${saved.toolName}\u3002`
+      };
+    },
+    presentCall: (input) => ({
+      card: "generic",
+      title: `\u521B\u5EFA HTTP API\uFF1A${input.name}`,
+      kind: "edit",
+      rawInput: input
+    })
+  }));
+  const disposeApproval = ctx.on("tools/pre-execute", async (exec, next) => {
+    if (exec.name !== CONVERSATION_API_TOOL) return next();
+    const downstream = await next();
+    if (downstream.kind !== "allow") return downstream;
+    const parsed = conversationApiInput.safeParse(exec.arguments);
+    if (!parsed.success) {
+      return { kind: "deny", reason: "HTTP API \u914D\u7F6E\u65E0\u6548\uFF1B\u5BF9\u8BDD\u521B\u5EFA\u4E0D\u63A5\u53D7\u672A\u58F0\u660E\u5B57\u6BB5\u6216\u4EFB\u4F55\u51ED\u636E\u3002\u8BF7\u4FEE\u6B63\u975E\u654F\u611F\u914D\u7F6E\u540E\u91CD\u8BD5\u3002" };
+    }
+    try {
+      validate(parsed.data);
+    } catch (error) {
+      return { kind: "deny", reason: safeValidationMessage(error) };
+    }
+    return { kind: "ask", reason: approvalPreview(parsed.data) };
+  });
+  return [disposeTool, disposeApproval];
+}
+function approvalPreview(input) {
+  const auth = input.authType === "none" ? "\u65E0\u8BA4\u8BC1" : `${input.authType}\uFF08\u51ED\u636E\u7A0D\u540E\u5728\u8BBE\u7F6E\u4E2D\u586B\u5199\uFF0C\u6B64 API \u5C06\u5148\u4FDD\u6301\u7981\u7528\uFF09`;
+  return [
+    "\u786E\u8BA4\u521B\u5EFA\u4EE5\u4E0B HTTP API\uFF1A",
+    `\u540D\u79F0\uFF1A${input.name}`,
+    `\u8BF7\u6C42\uFF1A${input.method} ${previewTarget(input)}`,
+    `\u5DE5\u5177\uFF1Adsh_connect_api_${input.slug}`,
+    `\u53C2\u6570\uFF1A${input.parameters.length} \u4E2A`,
+    `\u8BA4\u8BC1\uFF1A${auth}`
+  ].join("\n");
+}
+function previewTarget(input) {
+  try {
+    const path = input.pathTemplate.startsWith("/") ? input.pathTemplate : `/${input.pathTemplate}`;
+    return new URL(path, input.baseUrl).toString();
+  } catch {
+    return `${input.baseUrl.replace(/\/$/, "")}/${input.pathTemplate.replace(/^\//, "")}`;
+  }
+}
+function safeValidationMessage(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return `HTTP API \u914D\u7F6E\u65E0\u6548\uFF1A${message.replaceAll(/[\r\n]+/g, " ").slice(0, 500)}`;
+}
+
+// src/host/metadata/profiler.ts
+import { createHash, randomUUID } from "node:crypto";
+import { credentialRef as credentialRef2 } from "@deepseek-ai/dsh-credentials";
+
+// src/host/datasource/clickhouse.ts
+import { createClient } from "@clickhouse/client";
+
+// src/host/datasource/provider.ts
+var SENSITIVE_COLUMN = /(?:pass(?:word)?|secret|token|api[_-]?key|authorization|cookie|email|e[-_]?mail|phone|mobile|id[_-]?card|身份证|手机号|邮箱)/i;
+function sanitizeRows(rows, maxRows) {
+  return rows.slice(0, maxRows).map((row) => {
+    if (row === null || typeof row !== "object" || Array.isArray(row)) return { value: sanitizeValue(row) };
+    return Object.fromEntries(Object.entries(row).map(([key, value]) => [
+      key,
+      SENSITIVE_COLUMN.test(key) ? "[REDACTED]" : sanitizeValue(value)
+    ]));
+  });
+}
+function sanitizeValue(value) {
+  if (value === null || typeof value === "number" || typeof value === "boolean") return value;
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "bigint") return value.toString();
+  if (value instanceof Uint8Array) return `[binary:${value.byteLength} bytes]`;
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return text.length <= 200 ? text : `${text.slice(0, 200)}...`;
+}
+function throwIfAborted(signal) {
+  signal?.throwIfAborted();
+}
+function validateReadOnlySql(rawSql) {
+  const sql = rawSql.trim();
+  if (sql === "") throw new Error("SQL cannot be empty");
+  if (sql.length > 2e4) throw new Error("SQL is limited to 20000 characters");
+  if (sql.includes(";") || sql.includes("--") || sql.includes("/*") || sql.includes("*/")) {
+    throw new Error("Only one read-only SQL statement is allowed; comments and semicolons are not allowed");
+  }
+  if (!/^(?:select|with)\b/i.test(sql)) throw new Error("Only SELECT or WITH queries are allowed");
+  if (/\b(?:insert|update|delete|drop|alter|create|truncate|grant|revoke|replace|merge|call|set|use|into|outfile|dumpfile)\b/i.test(sql)) {
+    throw new Error("The SQL contains a write or session-changing operation");
+  }
+  return sql;
+}
+function queryLimit(value) {
+  if (value === void 0 || !Number.isFinite(value)) return 100;
+  return Math.min(1e3, Math.max(1, Math.trunc(value)));
+}
+function queryResult(columns, rows, limit, startedAt) {
+  const truncated = rows.length > limit;
+  return {
+    columns,
+    rows: sanitizeRows(rows, limit),
+    rowCount: Math.min(rows.length, limit),
+    truncated,
+    durationMs: Date.now() - startedAt
+  };
+}
+
+// src/host/datasource/clickhouse.ts
+var ClickhouseProvider = class {
+  async test(source, password, signal) {
+    const client = connect(source, password);
+    try {
+      await client.query({ query: "SELECT 1", format: "JSONEachRow", ...signal === void 0 ? {} : { abort_signal: signal } });
+    } finally {
+      await client.close();
+    }
+  }
+  async discover(source, password, signal) {
+    const client = connect(source, password);
+    try {
+      const databases = source.schemaInclude.length > 0 ? source.schemaInclude : [source.database];
+      const dbList = databases.map(quoteLiteral).join(", ");
+      const tableResult = await client.query({
+        query: `SELECT database, name, engine, comment, create_table_query, is_temporary
+                FROM system.tables WHERE database IN (${dbList}) ORDER BY database, name`,
+        format: "JSONEachRow",
+        ...signal === void 0 ? {} : { abort_signal: signal }
+      });
+      const columnResult = await client.query({
+        query: `SELECT database, table, name, type, default_expression, comment, is_in_primary_key
+                FROM system.columns WHERE database IN (${dbList}) ORDER BY database, table, position`,
+        format: "JSONEachRow",
+        ...signal === void 0 ? {} : { abort_signal: signal }
+      });
+      const tables = await tableResult.json();
+      const columns = await columnResult.json();
+      const columnsByObject = groupColumns(columns);
+      const result = [];
+      for (const table of tables) {
+        throwIfAborted(signal);
+        let sample = [];
+        if (source.sampleRows > 0) {
+          const rows = await client.query({
+            query: `SELECT * FROM ${quote(table.database)}.${quote(table.name)} LIMIT ${source.sampleRows}`,
+            format: "JSONEachRow",
+            ...signal === void 0 ? {} : { abort_signal: signal }
+          });
+          sample = sanitizeRows(await rows.json(), source.sampleRows);
+        }
+        result.push({
+          schemaName: table.database,
+          objectName: table.name,
+          objectType: table.engine === "View" || table.engine.endsWith("View") ? "view" : "table",
+          engine: table.engine,
+          ...table.comment ? { comment: table.comment } : {},
+          ddl: table.create_table_query,
+          columns: columnsByObject.get(`${table.database}\0${table.name}`) ?? [],
+          sample
+        });
+      }
+      return result;
+    } finally {
+      await client.close();
+    }
+  }
+  async query(source, password, rawSql, limit, signal) {
+    const sql = validateReadOnlySql(rawSql);
+    const bounded = queryLimit(limit);
+    const startedAt = Date.now();
+    const client = connect(source, password);
+    try {
+      const result = await client.query({ query: `SELECT * FROM (${sql}) AS dsh_connect_query LIMIT ${bounded + 1}`, format: "JSONEachRow", clickhouse_settings: { readonly: "2", max_execution_time: 30 }, ...signal === void 0 ? {} : { abort_signal: signal } });
+      const rows = await result.json();
+      throwIfAborted(signal);
+      return queryResult(Object.keys(rows[0] ?? {}), rows, bounded, startedAt);
+    } finally {
+      await client.close();
+    }
+  }
+};
+function connect(source, password) {
+  return createClient({
+    url: `${source.tls ? "https" : "http"}://${source.host}:${source.port}`,
+    username: source.username,
+    password,
+    database: source.database,
+    request_timeout: 3e4
+  });
+}
+function groupColumns(rows) {
+  const result = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const key = `${row.database}\0${row.table}`;
+    const list = result.get(key) ?? [];
+    list.push({
+      name: row.name,
+      type: row.type,
+      nullable: row.type.startsWith("Nullable("),
+      defaultValue: row.default_expression === "" ? null : row.default_expression,
+      ...row.comment ? { comment: row.comment } : {},
+      primaryKey: Boolean(row.is_in_primary_key)
+    });
+    result.set(key, list);
+  }
+  return result;
+}
+function quote(value) {
+  return `\`${value.replaceAll("`", "``")}\``;
+}
+function quoteLiteral(value) {
+  return `'${value.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+// src/host/datasource/mysql.ts
+import mysql from "mysql2/promise";
+var MysqlProvider = class {
+  async test(source, password, signal) {
+    throwIfAborted(signal);
+    const connection = await connect2(source, password);
+    try {
+      await connection.query("SELECT 1");
+      throwIfAborted(signal);
+    } finally {
+      await connection.end();
+    }
+  }
+  async discover(source, password, signal) {
+    const connection = await connect2(source, password);
+    try {
+      const schemas = source.schemaInclude.length > 0 ? source.schemaInclude : [source.database];
+      const placeholders = schemas.map(() => "?").join(", ");
+      const [tables] = await connection.query(
+        `SELECT TABLE_SCHEMA, TABLE_NAME, TABLE_TYPE, ENGINE, TABLE_COMMENT
+         FROM information_schema.TABLES
+         WHERE TABLE_SCHEMA IN (${placeholders})
+         ORDER BY TABLE_SCHEMA, TABLE_NAME`,
+        schemas
+      );
+      const [columns] = await connection.query(
+        `SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME, COLUMN_TYPE, IS_NULLABLE,
+                COLUMN_DEFAULT, COLUMN_COMMENT, COLUMN_KEY
+         FROM information_schema.COLUMNS
+         WHERE TABLE_SCHEMA IN (${placeholders})
+         ORDER BY TABLE_SCHEMA, TABLE_NAME, ORDINAL_POSITION`,
+        schemas
+      );
+      const [foreignKeys] = await connection.query(
+        `SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME, REFERENCED_TABLE_SCHEMA,
+                REFERENCED_TABLE_NAME, REFERENCED_COLUMN_NAME
+         FROM information_schema.KEY_COLUMN_USAGE
+         WHERE TABLE_SCHEMA IN (${placeholders})
+           AND REFERENCED_TABLE_NAME IS NOT NULL
+         ORDER BY TABLE_SCHEMA, TABLE_NAME, ORDINAL_POSITION`,
+        schemas
+      );
+      const columnsByObject = groupColumns2(columns, foreignKeys);
+      const result = [];
+      for (const table of tables) {
+        throwIfAborted(signal);
+        const qualified = `${quote2(table.TABLE_SCHEMA)}.${quote2(table.TABLE_NAME)}`;
+        const [ddlRows] = await connection.query(`SHOW CREATE ${table.TABLE_TYPE === "VIEW" ? "VIEW" : "TABLE"} ${qualified}`);
+        const ddlRecord = ddlRows[0];
+        const ddl = ddlRecord === void 0 ? "" : String(ddlRecord["Create Table"] ?? ddlRecord["Create View"] ?? "");
+        let sample = [];
+        if (source.sampleRows > 0) {
+          const [rows] = await connection.query(`SELECT * FROM ${qualified} LIMIT ${source.sampleRows}`);
+          sample = sanitizeRows(rows, source.sampleRows);
+        }
+        result.push({
+          schemaName: table.TABLE_SCHEMA,
+          objectName: table.TABLE_NAME,
+          objectType: table.TABLE_TYPE === "VIEW" ? "view" : "table",
+          ...table.ENGINE === null ? {} : { engine: table.ENGINE },
+          ...table.TABLE_COMMENT ? { comment: table.TABLE_COMMENT } : {},
+          ddl,
+          columns: columnsByObject.get(`${table.TABLE_SCHEMA}\0${table.TABLE_NAME}`) ?? [],
+          sample
+        });
+      }
+      return result;
+    } finally {
+      await connection.end();
+    }
+  }
+  async query(source, password, rawSql, limit, signal) {
+    const sql = validateReadOnlySql(rawSql);
+    const bounded = queryLimit(limit);
+    const startedAt = Date.now();
+    throwIfAborted(signal);
+    const connection = await connect2(source, password);
+    try {
+      await connection.query("START TRANSACTION READ ONLY");
+      const [rows, fields] = await connection.query({ sql: `SELECT * FROM (${sql}) AS dsh_connect_query LIMIT ${bounded + 1}`, timeout: 3e4 });
+      throwIfAborted(signal);
+      const columns = fields?.map((field) => field.name) ?? Object.keys(rows[0] ?? {});
+      return queryResult(columns, rows, bounded, startedAt);
+    } finally {
+      await connection.rollback().catch(() => {
+      });
+      await connection.end();
+    }
+  }
+};
+function connect2(source, password) {
+  return mysql.createConnection({
+    host: source.host,
+    port: source.port,
+    user: source.username,
+    password,
+    database: source.database,
+    connectTimeout: 1e4,
+    ...source.tls ? { ssl: {} } : {}
+  });
+}
+function groupColumns2(rows, foreignKeys) {
+  const result = /* @__PURE__ */ new Map();
+  const references = new Map(foreignKeys.map((row) => [
+    `${row.TABLE_SCHEMA}\0${row.TABLE_NAME}\0${row.COLUMN_NAME}`,
+    { schemaName: row.REFERENCED_TABLE_SCHEMA, objectName: row.REFERENCED_TABLE_NAME, columnName: row.REFERENCED_COLUMN_NAME }
+  ]));
+  for (const row of rows) {
+    const key = `${row.TABLE_SCHEMA}\0${row.TABLE_NAME}`;
+    const list = result.get(key) ?? [];
+    list.push({
+      name: row.COLUMN_NAME,
+      type: row.COLUMN_TYPE,
+      nullable: row.IS_NULLABLE === "YES",
+      defaultValue: row.COLUMN_DEFAULT === null ? null : String(row.COLUMN_DEFAULT),
+      ...row.COLUMN_COMMENT ? { comment: row.COLUMN_COMMENT } : {},
+      primaryKey: row.COLUMN_KEY === "PRI",
+      ...references.get(`${row.TABLE_SCHEMA}\0${row.TABLE_NAME}\0${row.COLUMN_NAME}`) === void 0 ? {} : { references: references.get(`${row.TABLE_SCHEMA}\0${row.TABLE_NAME}\0${row.COLUMN_NAME}`) }
+    });
+    result.set(key, list);
+  }
+  return result;
+}
+function quote2(value) {
+  return `\`${value.replaceAll("`", "``")}\``;
+}
+
+// src/host/datasource/postgresql.ts
+import { Client } from "pg";
+var PostgresqlProvider = class {
+  async test(source, password, signal) {
+    const client = await connect3(source, password);
+    try {
+      await queryRows(client, "SELECT 1", [], signal);
+    } finally {
+      await client.end();
+    }
+  }
+  async discover(source, password, signal) {
+    const client = await connect3(source, password);
+    try {
+      const schemas = source.schemaInclude.length > 0 ? source.schemaInclude : ["public"];
+      const tables = await queryRows(client, `SELECT t.table_schema, t.table_name, t.table_type,
+                      obj_description((quote_ident(t.table_schema) || '.' || quote_ident(t.table_name))::regclass) AS table_comment
+               FROM information_schema.tables t
+               WHERE t.table_schema = ANY($1::text[])
+               ORDER BY t.table_schema, t.table_name`, [schemas], signal);
+      const columns = await queryRows(client, `SELECT c.table_schema, c.table_name, c.column_name, c.data_type, c.udt_name,
+                      c.is_nullable, c.column_default,
+                      col_description((quote_ident(c.table_schema) || '.' || quote_ident(c.table_name))::regclass, c.ordinal_position) AS column_comment,
+                      EXISTS (
+                        SELECT 1 FROM information_schema.table_constraints tc
+                        JOIN information_schema.key_column_usage kcu
+                          ON tc.constraint_name = kcu.constraint_name AND tc.constraint_schema = kcu.constraint_schema
+                        WHERE tc.constraint_type = 'PRIMARY KEY'
+                          AND tc.table_schema = c.table_schema AND tc.table_name = c.table_name
+                          AND kcu.column_name = c.column_name
+                      ) AS primary_key
+               FROM information_schema.columns c
+               WHERE c.table_schema = ANY($1::text[])
+               ORDER BY c.table_schema, c.table_name, c.ordinal_position`, [schemas], signal);
+      const foreignKeys = await queryRows(client, `SELECT fk.table_schema, fk.table_name, fk.column_name,
+                      pk.table_schema AS referenced_table_schema,
+                      pk.table_name AS referenced_table_name,
+                      pk.column_name AS referenced_column_name
+               FROM information_schema.referential_constraints rc
+               JOIN information_schema.key_column_usage fk
+                 ON fk.constraint_catalog = rc.constraint_catalog
+                AND fk.constraint_schema = rc.constraint_schema
+                AND fk.constraint_name = rc.constraint_name
+               JOIN information_schema.key_column_usage pk
+                 ON pk.constraint_catalog = rc.unique_constraint_catalog
+                AND pk.constraint_schema = rc.unique_constraint_schema
+                AND pk.constraint_name = rc.unique_constraint_name
+                AND pk.ordinal_position = fk.position_in_unique_constraint
+               WHERE fk.table_schema = ANY($1::text[])
+               ORDER BY fk.table_schema, fk.table_name, fk.ordinal_position`, [schemas], signal);
+      const columnsByObject = groupColumns3(columns, foreignKeys);
+      const result = [];
+      for (const table of tables) {
+        throwIfAborted(signal);
+        const objectColumns = columnsByObject.get(`${table.table_schema}\0${table.table_name}`) ?? [];
+        const qualified = `${quote3(table.table_schema)}.${quote3(table.table_name)}`;
+        let sample = [];
+        if (source.sampleRows > 0) {
+          const rows = await queryRows(client, `SELECT * FROM ${qualified} LIMIT ${source.sampleRows}`, [], signal);
+          sample = sanitizeRows(rows, source.sampleRows);
+        }
+        result.push({
+          schemaName: table.table_schema,
+          objectName: table.table_name,
+          objectType: table.table_type === "VIEW" ? "view" : "table",
+          ...table.table_comment ? { comment: table.table_comment } : {},
+          ddl: buildDdl(table.table_schema, table.table_name, objectColumns, table.table_type === "VIEW"),
+          columns: objectColumns,
+          sample
+        });
+      }
+      return result;
+    } finally {
+      await client.end();
+    }
+  }
+  async query(source, password, rawSql, limit, signal) {
+    const sql = validateReadOnlySql(rawSql);
+    const bounded = queryLimit(limit);
+    const startedAt = Date.now();
+    const client = await connect3(source, password);
+    try {
+      const result = await client.query({ text: `SELECT * FROM (${sql}) AS dsh_connect_query LIMIT $1`, values: [bounded + 1], ...signal === void 0 ? {} : { signal } });
+      throwIfAborted(signal);
+      return queryResult(result.fields.map((field) => field.name), result.rows, bounded, startedAt);
+    } finally {
+      await client.end();
+    }
+  }
+};
+async function queryRows(client, text, values, signal) {
+  throwIfAborted(signal);
+  const config = {
+    text,
+    ...values.length === 0 ? {} : { values },
+    ...signal === void 0 ? {} : { signal }
+  };
+  const result = await client.query(config);
+  throwIfAborted(signal);
+  return result.rows;
+}
+async function connect3(source, password) {
+  const client = new Client({
+    host: source.host,
+    port: source.port,
+    user: source.username,
+    password,
+    database: source.database,
+    connectionTimeoutMillis: 1e4,
+    statement_timeout: 3e4,
+    ssl: source.tls ? { rejectUnauthorized: true } : false
+  });
+  await client.connect();
+  await client.query("SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY");
+  return client;
+}
+function groupColumns3(rows, foreignKeys) {
+  const result = /* @__PURE__ */ new Map();
+  const references = new Map(foreignKeys.map((row) => [
+    `${row.table_schema}\0${row.table_name}\0${row.column_name}`,
+    { schemaName: row.referenced_table_schema, objectName: row.referenced_table_name, columnName: row.referenced_column_name }
+  ]));
+  for (const row of rows) {
+    const key = `${row.table_schema}\0${row.table_name}`;
+    const list = result.get(key) ?? [];
+    list.push({
+      name: row.column_name,
+      type: row.data_type === "USER-DEFINED" ? row.udt_name : row.data_type,
+      nullable: row.is_nullable === "YES",
+      defaultValue: row.column_default,
+      ...row.column_comment ? { comment: row.column_comment } : {},
+      primaryKey: row.primary_key,
+      ...references.get(`${row.table_schema}\0${row.table_name}\0${row.column_name}`) === void 0 ? {} : { references: references.get(`${row.table_schema}\0${row.table_name}\0${row.column_name}`) }
+    });
+    result.set(key, list);
+  }
+  return result;
+}
+function buildDdl(schema, table, columns, view) {
+  if (view) return `CREATE VIEW ${quote3(schema)}.${quote3(table)} AS /* definition not exposed by information_schema */;`;
+  const definitions = columns.map((column) => {
+    const suffix = [column.nullable ? "" : "NOT NULL", column.defaultValue == null ? "" : `DEFAULT ${column.defaultValue}`].filter(Boolean).join(" ");
+    return `  ${quote3(column.name)} ${column.type}${suffix === "" ? "" : ` ${suffix}`}`;
+  });
+  const primary = columns.filter((column) => column.primaryKey).map((column) => quote3(column.name));
+  if (primary.length > 0) definitions.push(`  PRIMARY KEY (${primary.join(", ")})`);
+  for (const column of columns) {
+    if (column.references !== void 0) {
+      definitions.push(`  FOREIGN KEY (${quote3(column.name)}) REFERENCES ${quote3(column.references.schemaName)}.${quote3(column.references.objectName)} (${quote3(column.references.columnName)})`);
+    }
+  }
+  return `CREATE TABLE ${quote3(schema)}.${quote3(table)} (
+${definitions.join(",\n")}
+);`;
+}
+function quote3(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+
+// src/host/datasource/index.ts
+var providers = {
+  mysql: new MysqlProvider(),
+  postgresql: new PostgresqlProvider(),
+  clickhouse: new ClickhouseProvider()
+};
+function providerFor(type) {
+  return providers[type];
+}
+
+// src/host/metadata/enricher.ts
+import { BlockAssembler, createUserMessage, deepFreeze } from "@deepseek-ai/dsh-llm";
+import { z as z3 } from "zod";
+var METADATA_MODEL_PROMPT_VERSION = "v3";
+var MetadataModelOutputError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "MetadataModelOutputError";
+  }
+};
+var stringList = (maxItems, maxLength) => z3.preprocess(
+  (value) => normalizeStringList(value, maxItems, maxLength),
+  z3.array(z3.string().max(maxLength)).max(maxItems)
+);
+var semanticProfileSchema = z3.object({
+  term: z3.string().max(100),
+  description: z3.string().max(500),
+  tags: stringList(20, 50),
+  synonyms: stringList(30, 100),
+  columns: z3.array(z3.object({
+    name: z3.string(),
+    term: z3.string().max(100),
+    description: z3.string().max(300),
+    synonyms: stringList(20, 100),
+    enums: stringList(50, 100),
+    role: z3.enum(["identifier", "dimension", "measure", "time", "unknown"]).default("unknown")
+  })).max(500),
+  confidence: z3.number().refine(Number.isFinite, "confidence must be a finite number"),
+  confidenceReason: z3.string().max(500),
+  temporary: z3.boolean()
+});
+var MetadataEnricher = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async enrich(object, useAi, signal, selectedRoute) {
+    const fallback = heuristicProfile(object);
+    if (!useAi) return fallback;
+    const llm = this.ctx.get("llm");
+    const defaults = this.ctx.get("agentDefaultModel");
+    if (llm === void 0 || defaults === void 0) {
+      return { ...fallback, modelStatus: "failed", confidenceReason: `${fallback.confidenceReason}; DSH model service unavailable` };
+    }
+    try {
+      signal?.throwIfAborted();
+      const route = selectedRoute ?? defaults.currentSelection();
+      const input = JSON.stringify({
+        schema: object.schemaName,
+        name: object.objectName,
+        type: object.objectType,
+        comment: object.comment ?? "",
+        ddl: object.ddl.slice(0, 16e3),
+        columns: object.columns
+      });
+      const messages = [createUserMessage({
+        content: [{ type: "text", text: input }],
+        source: { kind: "plugin", plugin: "dsh-connect" }
+      })];
+      const assembler = new BlockAssembler();
+      const options = deepFreeze({
+        provider: route.provider,
+        model: route.model,
+        messages,
+        system: SYSTEM_PROMPT,
+        temperature: 0.1,
+        maxTokens: 12e3,
+        ...signal === void 0 ? {} : { signal }
+      });
+      for await (const chunk of llm.stream(options)) assembler.push(chunk);
+      if (assembler.finish.kind !== "stop") throw new Error(`model stopped with ${assembler.finish.kind}`);
+      const text = assembler.blocks().filter((block) => block.type === "text").map((block) => block.text).join("\n");
+      let parsed;
+      try {
+        parsed = semanticProfileSchema.parse(parseJson(text));
+      } catch (error) {
+        if (error instanceof z3.ZodError) {
+          throw new MetadataModelOutputError(`AI \u5143\u6570\u636E\u7ED3\u679C\u683C\u5F0F\u65E0\u6548\uFF1A${formatIssues(error)}`, { cause: error });
+        }
+        throw new MetadataModelOutputError("AI \u5143\u6570\u636E\u7ED3\u679C\u4E0D\u662F\u6709\u6548 JSON", { cause: error });
+      }
+      const knownColumns = new Set(object.columns.map((column) => column.name));
+      const parsedColumns = new Map(parsed.columns.filter((column) => knownColumns.has(column.name)).map((column) => [column.name, column]));
+      return {
+        term: parsed.term,
+        description: parsed.description,
+        tags: [...new Set(parsed.tags)],
+        synonyms: [...new Set(parsed.synonyms)],
+        semanticColumns: object.columns.map((column) => {
+          const semantic = parsedColumns.get(column.name);
+          const fallbackColumn = fallback.semanticColumns.find((item) => item.name === column.name);
+          return {
+            name: column.name,
+            term: semantic?.term ?? fallbackColumn?.term ?? column.name,
+            description: semantic?.description ?? fallbackColumn?.description ?? "",
+            synonyms: semantic?.synonyms ?? fallbackColumn?.synonyms ?? [],
+            enums: semantic?.enums ?? fallbackColumn?.enums ?? [],
+            role: normalizeRole(semantic?.role ?? fallbackColumn?.role ?? "unknown", column)
+          };
+        }),
+        confidence: normalizeConfidence(parsed.confidence),
+        confidenceReason: parsed.confidenceReason,
+        temporary: parsed.temporary,
+        modelProvider: route.provider,
+        modelName: route.model,
+        ...route.reasoningEffort === void 0 ? {} : { modelReasoningEffort: route.reasoningEffort },
+        modelAnalyzedAt: Date.now(),
+        modelStatus: "ai"
+      };
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      return {
+        ...fallback,
+        modelStatus: "failed",
+        ...selectedRoute === void 0 ? {} : { modelProvider: selectedRoute.provider, modelName: selectedRoute.model, modelAnalyzedAt: Date.now() },
+        confidenceReason: `${fallback.confidenceReason}; AI enrichment failed: ${safeError(error)}`.slice(0, 500)
+      };
+    }
+  }
+};
+var SYSTEM_PROMPT = `You are a database metadata governance specialist. Infer semantic metadata only from the supplied JSON physical metadata. Never invent rows, metrics, or business rules. Return one JSON object with exactly these fields: term, description, tags, columns, confidence, confidenceReason, temporary, synonyms. columns is an array of {name, term, description, synonyms, enums, role} using only physical column names. role must be one of identifier, dimension, measure, time, unknown. Role rules are strict: primary keys, explicit foreign keys, columns with a references object, and obvious identifiers such as *_id, *_key, *_code, *_uuid, *_no, or comments containing ID/\u7F16\u53F7/\u7F16\u7801/\u6807\u8BC6 must be identifier, even when they can also be used for filtering. A foreign-key identifier must never be dimension. Use dimension only for descriptive or categorical attributes such as name, status, type, region, or category. Use measure only for numeric amounts, counts, quantities, rates, or scores; use time only for dates and timestamps. Preserve every physical column in the response. confidence may be either a probability from 0 to 1 or a score from 0 to 100; it will be normalized by the host. Return JSON only, without Markdown.`;
+function heuristicProfile(object) {
+  const temporary = /(?:^|_)(?:tmp|temp|test|bak|backup|stg|stage|cache)(?:_|$)/i.test(object.objectName);
+  let confidence = temporary ? 35 : 85;
+  const reasons = [];
+  if (temporary) reasons.push("object name indicates temporary, test, staging, backup, or cache data");
+  if (!object.columns.some((column) => column.primaryKey)) {
+    confidence -= 10;
+    reasons.push("no primary key was discovered");
+  }
+  if (!object.comment && object.columns.every((column) => !column.comment)) {
+    confidence -= 10;
+    reasons.push("database comments are absent");
+  }
+  if (object.sample.length === 0) {
+    confidence -= 5;
+    reasons.push("sample data was disabled or unavailable");
+  }
+  return {
+    term: object.comment?.trim() || humanize(object.objectName),
+    description: object.comment?.trim() || `${object.objectType} ${object.schemaName}.${object.objectName}`,
+    tags: [object.objectType, ...object.engine ? [object.engine] : [], ...temporary ? ["temporary"] : []],
+    synonyms: [],
+    semanticColumns: object.columns.map((column) => ({
+      name: column.name,
+      term: column.comment?.trim() || humanize(column.name),
+      description: column.comment?.trim() || `${column.type}${column.nullable ? ", nullable" : ", required"}`,
+      synonyms: [],
+      enums: [],
+      role: fallbackRole(column)
+    })),
+    confidence: Math.max(0, confidence),
+    confidenceReason: reasons.join("; ") || "physical metadata is complete",
+    temporary,
+    modelStatus: "heuristic"
+  };
+}
+function humanize(value) {
+  return value.replaceAll(/[_-]+/g, " ").replaceAll(/\s+/g, " ").trim();
+}
+function normalizeConfidence(value) {
+  const score = value >= 0 && value <= 1 ? value * 100 : value;
+  return Math.max(0, Math.min(100, Math.round(score)));
+}
+function normalizeStringList(value, maxItems, maxLength) {
+  const items = Array.isArray(value) ? value : value !== null && typeof value === "object" ? Object.entries(value).map(([key, item]) => `${key}: ${String(item)}`) : value === void 0 || value === null || value === "" ? [] : [value];
+  return [...new Set(items.map((item) => String(item).trim().slice(0, maxLength)).filter(Boolean))].slice(0, maxItems);
+}
+function normalizeRole(role, column) {
+  if (column.primaryKey || column.references !== void 0 || isIdentifierName(column.name) || isIdentifierComment(column.comment)) return "identifier";
+  return role;
+}
+function fallbackRole(column) {
+  if (column.primaryKey || column.references !== void 0 || isIdentifierName(column.name) || isIdentifierComment(column.comment)) return "identifier";
+  if (/(?:date|time|timestamp|year|month|day)(?:$|_)/i.test(column.name) || /(?:date|time|timestamp)/i.test(column.type)) return "time";
+  if (/(?:amount|price|cost|total|balance|quantity|count|num|score|points|rate|ratio)(?:$|_)/i.test(column.name) && /(?:int|decimal|numeric|float|double|real)/i.test(column.type)) return "measure";
+  if (/(?:name|status|state|type|category|region|country|city|flag)(?:$|_)/i.test(column.name)) return "dimension";
+  return "unknown";
+}
+function isIdentifierName(name2) {
+  return /(?:^|_)(?:id|key|code|uuid|no)(?:$|_)/i.test(name2);
+}
+function isIdentifierComment(comment) {
+  return comment !== void 0 && /(?:\bid\b|\bidentifier\b|编号|编码|标识)/i.test(comment);
+}
+function formatIssues(error) {
+  return error.issues.slice(0, 3).map((issue) => `${issue.path.join(".")} ${issue.message}`).join("; ");
+}
+function parseJson(text) {
+  const trimmed = text.trim().replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, "");
+  const start = trimmed.indexOf("{");
+  const end = trimmed.lastIndexOf("}");
+  if (start < 0 || end <= start) throw new Error("model returned no JSON object");
+  return JSON.parse(trimmed.slice(start, end + 1));
+}
+function safeError(error) {
+  return (error instanceof Error ? error.message : String(error)).replaceAll(/[\r\n]+/g, " ").slice(0, 160);
+}
+
+// src/host/metadata/profiler.ts
+var MetadataProfiler = class {
+  constructor(ctx, store) {
+    this.ctx = ctx;
+    this.store = store;
+    this.enricher = new MetadataEnricher(ctx);
+  }
+  running = /* @__PURE__ */ new Map();
+  enricher;
+  async test(source, signal) {
+    const password = await this.resolvePassword(source);
+    await providerFor(source.type).test(source, password, signal);
+  }
+  async start(sourceId, mode = "incremental") {
+    const source = this.store.dataSource(sourceId);
+    if (source === void 0) throw new Error("Data source not found");
+    if (!source.enabled) throw new Error("Data source is disabled");
+    if (mode === "rebuild-ai" && !source.aiEnrichment) throw new Error("\u8BF7\u5148\u5728\u6570\u636E\u5E93\u8BBE\u7F6E\u4E2D\u5F00\u542F AI \u8BED\u4E49\u589E\u5F3A");
+    if (this.running.has(sourceId)) throw new Error("A metadata scan is already running for this data source");
+    await this.resolvePassword(source);
+    const now = Date.now();
+    const job = {
+      id: randomUUID(),
+      sourceId,
+      status: "queued",
+      mode,
+      total: 0,
+      processed: 0,
+      startedAt: now,
+      updatedAt: now
+    };
+    await this.store.putJob(job);
+    const controller = new AbortController();
+    const done = this.run(source, job, controller.signal).finally(() => {
+      this.running.delete(sourceId);
+    });
+    this.running.set(sourceId, { controller, done });
+    void done.catch(() => {
+    });
+    return job;
+  }
+  async cancel(sourceId) {
+    const active = this.running.get(sourceId);
+    active?.controller.abort("metadata scan cancelled");
+    const current = this.store.jobs(sourceId).find((job) => job.status === "queued" || job.status === "running");
+    if (current !== void 0) await this.store.deleteJob(current.id);
+    return { stopped: true, processed: current?.processed ?? 0, total: current?.total ?? 0 };
+  }
+  async dispose() {
+    const active = [...this.running.values()];
+    for (const job of active) job.controller.abort("dsh-connect is unloading");
+    await Promise.allSettled(active.map((job) => job.done));
+  }
+  async run(source, initial, signal) {
+    const route = source.aiEnrichment ? this.modelRoute() : void 0;
+    let job = { ...initial, status: "running", updatedAt: Date.now() };
+    if (route !== void 0) job = { ...job, modelProvider: route.provider, modelName: route.model };
+    await this.store.putJob(job);
+    try {
+      const password = await this.resolvePassword(source);
+      const objects = await providerFor(source.type).discover(source, password, signal);
+      signal.throwIfAborted();
+      job = { ...job, total: objects.length, updatedAt: Date.now() };
+      await this.store.putJob(job);
+      const keep = /* @__PURE__ */ new Set();
+      for (const object of objects) {
+        signal.throwIfAborted();
+        const id = profileId(source.id, object);
+        keep.add(id);
+        job = { ...job, currentObject: `${object.schemaName}.${object.objectName}`, updatedAt: Date.now() };
+        await this.store.putJob(job);
+        const fingerprint = fingerprintOf(object);
+        const semanticFingerprint = semanticFingerprintOf(fingerprint, source.aiEnrichment, route);
+        const existing = this.store.profile(id);
+        const rebuild = initial.mode === "full" || initial.mode === "rebuild-ai" && source.aiEnrichment;
+        if (rebuild || existing === void 0 || existing.semanticFingerprint !== semanticFingerprint) {
+          const semantic = await this.enricher.enrich(object, source.aiEnrichment, signal, route);
+          signal.throwIfAborted();
+          const profile = {
+            id,
+            sourceId: source.id,
+            schemaName: object.schemaName,
+            objectName: object.objectName,
+            objectType: object.objectType,
+            ...object.engine === void 0 ? {} : { engine: object.engine },
+            ...object.comment === void 0 ? {} : { comment: object.comment },
+            ddl: object.ddl.slice(0, 1e5),
+            columns: object.columns,
+            sample: object.sample,
+            term: semantic.term,
+            description: semantic.description,
+            tags: semantic.tags,
+            synonyms: semantic.synonyms,
+            semanticColumns: semantic.semanticColumns,
+            confidence: semantic.confidence,
+            confidenceReason: semantic.confidenceReason,
+            temporary: semantic.temporary,
+            ignored: existing?.ignoredOverride ?? (semantic.temporary || semantic.confidence < 60),
+            ...existing?.ignoredOverride === void 0 ? {} : { ignoredOverride: existing.ignoredOverride },
+            fingerprint,
+            semanticFingerprint,
+            ...semantic.modelProvider === void 0 ? {} : { modelProvider: semantic.modelProvider },
+            ...semantic.modelName === void 0 ? {} : { modelName: semantic.modelName },
+            ...semantic.modelReasoningEffort === void 0 ? {} : { modelReasoningEffort: semantic.modelReasoningEffort },
+            ...semantic.modelAnalyzedAt === void 0 ? {} : { modelAnalyzedAt: semantic.modelAnalyzedAt },
+            modelStatus: semantic.modelStatus,
+            modelPromptVersion: METADATA_MODEL_PROMPT_VERSION,
+            profiledAt: Date.now()
+          };
+          await this.store.putProfile(profile);
+          await this.store.putChange({
+            id: randomUUID(),
+            sourceId: source.id,
+            profileId: profile.id,
+            action: initial.mode === "rebuild-ai" ? "model" : "scan",
+            summary: initial.mode === "rebuild-ai" ? "AI \u8BED\u4E49\u5EFA\u6A21\u5B8C\u6210" : "\u7269\u7406\u5143\u6570\u636E\u626B\u63CF\u5B8C\u6210",
+            after: { term: profile.term, description: profile.description, modelStatus: profile.modelStatus, confidence: profile.confidence },
+            changedAt: Date.now()
+          });
+        }
+        signal.throwIfAborted();
+        job = { ...job, processed: job.processed + 1, updatedAt: Date.now() };
+        await this.store.putJob(job);
+      }
+      signal.throwIfAborted();
+      await this.store.deleteStaleProfiles(source.id, keep);
+      const { currentObject: _currentObject, ...completedJob } = job;
+      await this.store.putJob({
+        ...completedJob,
+        status: "completed",
+        processed: objects.length,
+        updatedAt: Date.now(),
+        finishedAt: Date.now()
+      });
+    } catch (error) {
+      const cancelled = signal.aborted;
+      if (cancelled) {
+        await this.store.deleteJob(job.id);
+      } else {
+        const { currentObject: _currentObject, ...failedJob } = job;
+        await this.store.putJob({
+          ...failedJob,
+          status: "failed",
+          error: safeError2(error),
+          updatedAt: Date.now(),
+          finishedAt: Date.now()
+        });
+      }
+    }
+  }
+  async resolvePassword(source) {
+    const resolved = await this.ctx.credentials.resolve(credentialRef2(source.credentialRef));
+    if (resolved === void 0) throw new Error("Database credential is not configured");
+    return resolved.value;
+  }
+  modelRoute() {
+    const defaults = this.ctx.get("agentDefaultModel");
+    if (defaults === void 0) return void 0;
+    try {
+      return defaults.currentSelection();
+    } catch {
+      return void 0;
+    }
+  }
+};
+function profileId(sourceId, object) {
+  return `${sourceId}:${object.schemaName}:${object.objectName}`;
+}
+function fingerprintOf(object) {
+  return createHash("sha256").update(JSON.stringify({
+    schemaName: object.schemaName,
+    objectName: object.objectName,
+    objectType: object.objectType,
+    engine: object.engine,
+    comment: object.comment,
+    ddl: object.ddl,
+    columns: object.columns,
+    sample: object.sample
+  })).digest("hex");
+}
+function semanticFingerprintOf(physicalFingerprint, aiEnabled, route) {
+  return createHash("sha256").update(JSON.stringify({
+    physicalFingerprint,
+    aiEnabled,
+    promptVersion: METADATA_MODEL_PROMPT_VERSION,
+    provider: aiEnabled ? route?.provider : void 0,
+    model: aiEnabled ? route?.model : void 0,
+    reasoningEffort: aiEnabled ? route?.reasoningEffort : void 0
+  })).digest("hex");
+}
+function safeError2(error) {
+  return (error instanceof Error ? error.message : String(error)).replaceAll(/[\r\n]+/g, " ").slice(0, 1e3);
+}
+
+// src/host/metadata/tools.ts
+import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
+import { credentialRef as credentialRef3 } from "@deepseek-ai/dsh-credentials";
+
+// src/host/metadata/governance.ts
+function recommendMetrics(profiles, sourceId, existing) {
+  const result = [];
+  const known = new Set(existing.filter((metric) => metric.sourceId === sourceId).map((metric) => `${metric.profileId}:${metric.columnName}:${metric.aggregation}`));
+  for (const profile of profiles) {
+    if (profile.sourceId !== sourceId || profile.ignored) continue;
+    const identifier = profile.columns.find((column) => column.primaryKey);
+    if (!known.has(`${profile.id}::count`)) {
+      result.push({
+        profileId: profile.id,
+        name: `${profile.objectName}_count`,
+        term: `${profile.term || profile.objectName}\u6570\u91CF`,
+        description: `\u7EDF\u8BA1${profile.term || profile.objectName}\u8BB0\u5F55\u6570`,
+        aggregation: "count",
+        columnName: "",
+        expression: "COUNT(*)",
+        unit: "\u6761",
+        reason: "\u6BCF\u4E2A\u4E1A\u52A1\u8868\u90FD\u53EF\u63D0\u4F9B\u8BB0\u5F55\u6570\u6307\u6807"
+      });
+    }
+    for (const column of profile.columns) {
+      if (column.primaryKey || !isNumeric(column.type) || known.has(`${profile.id}:${column.name}:sum`)) continue;
+      const label = profile.semanticColumns.find((item) => item.name === column.name)?.term || column.comment || column.name;
+      const lower = column.name.toLowerCase();
+      const aggregation = /(?:amount|price|cost|total|balance|quantity|count|num|score|points|金额|数量|余额|积分)/i.test(lower) ? "sum" : "avg";
+      result.push({
+        profileId: profile.id,
+        name: `${profile.objectName}_${column.name}_${aggregation}`,
+        term: `${profile.term || profile.objectName}${label}${aggregation === "sum" ? "\u5408\u8BA1" : "\u5E73\u5747\u503C"}`,
+        description: `${aggregation === "sum" ? "\u6C47\u603B" : "\u8BA1\u7B97\u5E73\u5747"}\u5B57\u6BB5 ${label}`,
+        aggregation,
+        columnName: column.name,
+        expression: `${aggregation.toUpperCase()}(${quoteIdentifier(column.name)})`,
+        unit: "",
+        reason: `\u5B57\u6BB5\u7C7B\u578B ${column.type} \u9002\u5408${aggregation === "sum" ? "\u6C42\u548C" : "\u6C42\u5E73\u5747"}`
+      });
+      if (result.length >= 50) return result;
+    }
+    if (identifier === void 0 && result.length >= 50) break;
+  }
+  return result.slice(0, 50);
+}
+function metadataYaml(profiles, metrics, sourceId) {
+  const lines = ["version: 1", `sourceId: ${yamlScalar(sourceId)}`, "tables:"];
+  for (const profile of profiles.filter((item) => item.sourceId === sourceId)) {
+    lines.push(`  - id: ${yamlScalar(profile.id)}`, `    name: ${yamlScalar(`${profile.schemaName}.${profile.objectName}`)}`, `    type: ${yamlScalar(profile.objectType)}`, `    term: ${yamlScalar(profile.term)}`, `    description: ${yamlScalar(profile.description)}`, `    synonyms: ${yamlList(profile.synonyms)}`, `    tags: ${yamlList(profile.tags)}`, `    ignored: ${String(profile.ignored)}`, "    columns:");
+    for (const column of profile.columns) {
+      const semantic = profile.semanticColumns.find((item) => item.name === column.name);
+      lines.push(`      - name: ${yamlScalar(column.name)}`, `        type: ${yamlScalar(column.type)}`, `        nullable: ${String(column.nullable)}`, `        primaryKey: ${String(column.primaryKey)}`, `        term: ${yamlScalar(semantic?.term ?? column.comment ?? "")}`, `        description: ${yamlScalar(semantic?.description ?? "")}`, `        synonyms: ${yamlList(semantic?.synonyms ?? [])}`, `        enums: ${yamlList(semantic?.enums ?? [])}`);
+    }
+  }
+  lines.push("metrics:");
+  for (const metric of metrics.filter((item) => item.sourceId === sourceId)) {
+    lines.push(`  - id: ${yamlScalar(metric.id)}`, `    name: ${yamlScalar(metric.name)}`, `    term: ${yamlScalar(metric.term)}`, `    profileId: ${yamlScalar(metric.profileId)}`, `    aggregation: ${yamlScalar(metric.aggregation)}`, `    columnName: ${yamlScalar(metric.columnName)}`, `    expression: ${yamlScalar(metric.expression)}`, `    description: ${yamlScalar(metric.description)}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function isNumeric(type) {
+  return /(?:int|decimal|numeric|number|float|double|real|money|serial)/i.test(type);
+}
+function quoteIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function yamlScalar(value) {
+  return JSON.stringify(value ?? "");
+}
+function yamlList(values) {
+  return `[${values.map(yamlScalar).join(", ")}]`;
+}
+
+// src/host/metadata/tools.ts
+var jsonOutput = {
+  schema: { type: "json" },
+  render: (_args, value) => [{ type: "text", text: JSON.stringify(value, null, 2) }]
+};
+function registerMetadataTools(ctx, store) {
+  return [
+    ctx.tools.register(defineTool2({
+      name: "dsh_connect_list_data_sources",
+      description: "List configured data sources that have metadata available. This exposes connection names and metadata counts, never credentials or host addresses.",
+      parameters: {},
+      output: jsonOutput,
+      isConcurrencySafe: () => true,
+      async execute() {
+        const views = await store.dataSourceViews();
+        return views.filter((source) => source.enabled).map((source) => ({
+          id: source.id,
+          name: source.name,
+          type: source.type,
+          database: source.database,
+          profileCount: source.profileCount,
+          lastScanStatus: source.latestJob?.status ?? "never-scanned"
+        }));
+      },
+      presentCall: () => ({ card: "generic", title: "List data sources", kind: "read" })
+    })),
+    ctx.tools.register(defineTool2({
+      name: "dsh_connect_search_metadata",
+      description: "Search recognized table, view, and column metadata. Use this to understand available data structures; it does not query business rows or execute SQL.",
+      parameters: {
+        query: { type: "string", required: true, description: "Name, semantic term, description, tag, or column text to search." },
+        sourceId: { type: "string", description: "Optional exact data source id from dsh_connect_list_data_sources." },
+        limit: { type: "integer", description: "Optional result limit from 1 to 20. Default 10." }
+      },
+      output: jsonOutput,
+      isConcurrencySafe: () => true,
+      execute(args) {
+        const query = args.query.trim().toLocaleLowerCase();
+        if (query === "") throw new Error("query must not be blank");
+        const limit = Math.min(20, Math.max(1, args.limit ?? 10));
+        const results = store.profiles(args.sourceId).filter((profile) => {
+          const haystack = [
+            profile.schemaName,
+            profile.objectName,
+            profile.term,
+            profile.description,
+            profile.tags.join(" "),
+            profile.columns.map((column) => `${column.name} ${column.comment ?? ""}`).join(" "),
+            profile.semanticColumns.map((column) => `${column.name} ${column.term} ${column.description}`).join(" ")
+          ].join(" ").toLocaleLowerCase();
+          return haystack.includes(query);
+        }).slice(0, limit);
+        return Promise.resolve(results.map((profile) => ({
+          id: profile.id,
+          sourceId: profile.sourceId,
+          schema: profile.schemaName,
+          name: profile.objectName,
+          type: profile.objectType,
+          term: profile.term,
+          description: profile.description,
+          tags: profile.tags,
+          confidence: profile.confidence,
+          temporary: profile.temporary,
+          ignored: profile.ignored,
+          columns: profile.semanticColumns.map((column) => ({ name: column.name, term: column.term }))
+        })));
+      },
+      presentCall: (args) => ({ card: "generic", title: `Search metadata: ${args.query}`, kind: "search" })
+    })),
+    ctx.tools.register(defineTool2({
+      name: "dsh_connect_get_table_metadata",
+      description: "Read one recognized table or view metadata profile by the exact profile id returned by dsh_connect_search_metadata. It returns schema and semantic metadata, never sample rows.",
+      parameters: {
+        profileId: { type: "string", required: true, description: "Exact metadata profile id." }
+      },
+      output: jsonOutput,
+      isConcurrencySafe: () => true,
+      execute(args) {
+        const profile = store.profile(args.profileId);
+        if (profile === void 0) throw new Error("Metadata profile not found");
+        return Promise.resolve({
+          id: profile.id,
+          sourceId: profile.sourceId,
+          schema: profile.schemaName,
+          name: profile.objectName,
+          type: profile.objectType,
+          ...profile.engine === void 0 ? {} : { engine: profile.engine },
+          ...profile.comment === void 0 ? {} : { databaseComment: profile.comment },
+          ddl: profile.ddl,
+          columns: profile.columns.map((column) => {
+            const semantic = profile.semanticColumns.find((item) => item.name === column.name);
+            return {
+              name: column.name,
+              type: column.type,
+              nullable: column.nullable,
+              primaryKey: column.primaryKey,
+              ...column.defaultValue === void 0 ? {} : { defaultValue: column.defaultValue },
+              ...column.comment === void 0 ? {} : { comment: column.comment },
+              ...column.references === void 0 ? {} : { references: column.references },
+              ...semantic === void 0 ? {} : { semantic }
+            };
+          }),
+          term: profile.term,
+          description: profile.description,
+          tags: profile.tags,
+          confidence: profile.confidence,
+          confidenceReason: profile.confidenceReason,
+          temporary: profile.temporary,
+          ignored: profile.ignored,
+          profiledAt: profile.profiledAt
+        });
+      },
+      presentCall: () => ({ card: "generic", title: "Read table metadata", kind: "read" })
+    })),
+    ctx.tools.register(defineTool2({
+      name: "dsh_connect_query_data_source",
+      description: "Execute a bounded read-only SELECT or WITH query against a configured data source. Never use this for writes or schema changes.",
+      parameters: {
+        sourceId: { type: "string", required: true, description: "Exact data source id." },
+        sql: { type: "string", required: true, description: "One SELECT or WITH query. No semicolon or comments." },
+        limit: { type: "integer", description: "Maximum rows, 1 to 1000. Default 100." }
+      },
+      output: jsonOutput,
+      isConcurrencySafe: () => false,
+      async execute(args, exec) {
+        const source = store.dataSource(args.sourceId);
+        if (source === void 0) throw new Error("Data source not found");
+        if (!source.enabled) throw new Error("Data source is disabled");
+        const password = await ctx.credentials.resolve(credentialRef3(source.credentialRef));
+        if (password === void 0) throw new Error("Database credential is not configured");
+        return JSON.parse(JSON.stringify(await providerFor(source.type).query(source, password.value, args.sql, queryLimit(args.limit), exec.signal)));
+      },
+      presentCall: (args) => ({ card: "generic", title: `Query ${args.sourceId}`, kind: "read" })
+    })),
+    ctx.tools.register(defineTool2({
+      name: "dsh_connect_export_metadata_yaml",
+      description: "Export recognized metadata and metrics as YAML text for review or version control.",
+      parameters: { sourceId: { type: "string", required: true } },
+      output: { schema: { type: "string" }, render: (_args, value) => [{ type: "text", text: String(value) }] },
+      isConcurrencySafe: () => true,
+      async execute(args) {
+        return metadataYaml(store.profiles(args.sourceId), store.metrics(args.sourceId), args.sourceId);
+      },
+      presentCall: () => ({ card: "generic", title: "Export metadata YAML", kind: "read" })
+    }))
+  ];
+}
+
+// src/host/rpc.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { credentialRef as credentialRef4 } from "@deepseek-ai/dsh-credentials";
+import { z as z4 } from "zod";
+var idInput = z4.object({ id: z4.string().uuid() });
+var sourceInput = z4.object({ sourceId: z4.string().uuid() });
+var scanInput = z4.object({ sourceId: z4.string().uuid(), mode: z4.enum(["incremental", "rebuild-ai", "full"]).default("incremental") });
+var metadataListInput = z4.object({ sourceId: z4.string().uuid().optional() });
+var profileInput = z4.object({ id: z4.string().min(1) });
+var apiTestInput = z4.object({ id: z4.string().uuid(), args: z4.record(z4.string(), z4.unknown()).default({}) });
+var queryInput = z4.object({ sourceId: z4.string().uuid(), sql: z4.string().min(1).max(2e4), limit: z4.number().int().min(1).max(1e3).default(100) });
+var metricsListInput = z4.object({ sourceId: z4.string().uuid() });
+var metricSaveInput = z4.object({
+  id: z4.string().uuid().optional(),
+  sourceId: z4.string().uuid(),
+  profileId: z4.string().min(1),
+  name: z4.string().min(1).max(120),
+  term: z4.string().min(1).max(120),
+  description: z4.string().max(500).default(""),
+  aggregation: z4.enum(["count", "sum", "avg", "min", "max", "formula"]),
+  columnName: z4.string().max(255).default(""),
+  expression: z4.string().max(2e3),
+  unit: z4.string().max(50).default(""),
+  tags: z4.array(z4.string().max(50)).max(20).default([]),
+  enabled: z4.boolean().default(true)
+});
+var metricBatchSaveInput = z4.object({ metrics: z4.array(metricSaveInput).min(1).max(5e3) });
+var profileUpdateInput = z4.object({
+  id: z4.string().min(1),
+  term: z4.string().max(100).optional(),
+  description: z4.string().max(500).optional(),
+  tags: z4.array(z4.string().max(50)).max(20).optional(),
+  synonyms: z4.array(z4.string().max(100)).max(30).optional(),
+  ignored: z4.boolean().optional(),
+  semanticColumns: z4.array(z4.object({ name: z4.string(), term: z4.string().max(100), description: z4.string().max(300), synonyms: z4.array(z4.string().max(100)).max(20).default([]), enums: z4.array(z4.string().max(100)).max(50).default([]), role: z4.enum(["identifier", "dimension", "measure", "time", "unknown"]).default("unknown") })).optional()
+});
+var saveDataSourceInput = z4.object({
+  id: z4.string().uuid().optional(),
+  name: z4.string().min(1).max(100),
+  type: databaseTypeSchema,
+  host: z4.string().min(1).max(255),
+  port: z4.number().int().min(1).max(65535),
+  database: z4.string().min(1).max(255),
+  username: z4.string().min(1).max(255),
+  secret: z4.string().min(1).optional(),
+  schemaInclude: z4.array(z4.string().min(1).max(255)).max(100).default([]),
+  tls: z4.boolean().default(false),
+  sampleRows: z4.number().int().min(0).max(3).default(0),
+  aiEnrichment: z4.boolean().default(false),
+  enabled: z4.boolean().default(true)
+});
+var saveAuthInput = z4.discriminatedUnion("type", [
+  z4.object({ type: z4.literal("none") }),
+  z4.object({ type: z4.literal("bearer") }),
+  z4.object({ type: z4.literal("api-key"), location: z4.enum(["header", "query"]), name: z4.string().min(1).max(100) }),
+  z4.object({ type: z4.literal("basic"), username: z4.string().min(1).max(200) })
+]);
+var saveApiInput = z4.object({
+  id: z4.string().uuid().optional(),
+  name: z4.string().min(1).max(100),
+  slug: z4.string().min(2).max(48).regex(/^[a-z][a-z0-9_]*$/),
+  description: z4.string().min(1).max(1e3),
+  method: apiMethodSchema,
+  baseUrl: z4.string().url().max(2048),
+  pathTemplate: z4.string().min(1).max(2048).default("/"),
+  parameters: z4.array(apiParameterSchema).max(50).default([]),
+  auth: saveAuthInput,
+  secret: z4.string().min(1).optional(),
+  timeoutMs: z4.number().int().min(1e3).max(12e4).default(3e4),
+  maxResponseBytes: z4.number().int().min(1024).max(2 * 1024 * 1024).default(131072),
+  responsePointer: z4.string().max(500).default(""),
+  allowPrivateNetwork: z4.boolean().default(false),
+  enabled: z4.boolean().default(true)
+});
+var ConnectRpc = class {
+  constructor(ctx, store, profiler, tools) {
+    this.ctx = ctx;
+    this.store = store;
+    this.profiler = profiler;
+    this.tools = tools;
+    this.executor = new SecureHttpExecutor(ctx);
+  }
+  executor;
+  async handle(endpoint, payload, signal) {
+    try {
+      switch (endpoint) {
+        case "sources/list":
+          return ok(await this.store.dataSourceViews());
+        case "sources/save":
+          return ok(await this.saveDataSource(saveDataSourceInput.parse(payload)));
+        case "sources/delete":
+          return ok(await this.deleteDataSource(idInput.parse(payload).id));
+        case "sources/test": {
+          const source = this.requireSource(idInput.parse(payload).id);
+          await this.profiler.test(source, signal);
+          return ok({ connected: true });
+        }
+        case "sources/scan": {
+          const input = scanInput.parse(payload);
+          return ok(await this.profiler.start(input.sourceId, input.mode));
+        }
+        case "sources/cancel": {
+          return ok(await this.profiler.cancel(sourceInput.parse(payload).sourceId));
+        }
+        case "sources/query": {
+          const input = queryInput.parse(payload);
+          const source = this.requireSource(input.sourceId);
+          if (!source.enabled) throw new Error("Data source is disabled");
+          const password = await this.ctx.credentials.resolve(credentialRef4(source.credentialRef));
+          if (password === void 0) throw new Error("Database credential is not configured");
+          return ok(await providerFor(source.type).query(source, password.value, input.sql, input.limit, signal));
+        }
+        case "jobs/list":
+          return ok(this.store.jobs(sourceInput.parse(payload).sourceId));
+        case "metadata/list":
+          return ok(this.store.profiles(metadataListInput.parse(payload).sourceId));
+        case "metadata/get": {
+          const profile = this.store.profile(profileInput.parse(payload).id);
+          if (profile === void 0) throw new Error("Metadata profile not found");
+          return ok(profile);
+        }
+        case "metadata/update":
+          return ok(await this.updateMetadata(profileUpdateInput.parse(payload)));
+        case "metadata/yaml": {
+          const input = sourceInput.parse(payload);
+          return ok(metadataYaml(this.store.profiles(input.sourceId), this.store.metrics(input.sourceId), input.sourceId));
+        }
+        case "metadata/changes": {
+          const input = z4.object({
+            sourceId: z4.string().uuid(),
+            profileId: z4.string().min(1).optional(),
+            offset: z4.number().int().min(0).default(0),
+            limit: z4.number().int().min(1).max(100).default(20)
+          }).parse(payload);
+          return ok(this.store.changePage(input.sourceId, input.profileId, input.offset, input.limit));
+        }
+        case "metrics/list":
+          return ok(this.store.metrics(metricsListInput.parse(payload).sourceId));
+        case "metrics/recommend": {
+          const input = metricsListInput.parse(payload);
+          return ok(recommendMetrics(this.store.profiles(input.sourceId), input.sourceId, this.store.metrics(input.sourceId)));
+        }
+        case "metrics/save":
+          return ok(await this.saveMetric(metricSaveInput.parse(payload)));
+        case "metrics/save-batch": {
+          const input = metricBatchSaveInput.parse(payload);
+          const saved = [];
+          for (const metric of input.metrics) saved.push(await this.saveMetric(metric));
+          return ok({ saved: saved.length });
+        }
+        case "metrics/delete": {
+          const metric = this.store.metric(idInput.parse(payload).id);
+          if (metric === void 0) throw new Error("Metric not found");
+          await this.store.deleteMetric(metric.id);
+          await this.store.putChange({ id: randomUUID2(), sourceId: metric.sourceId, profileId: metric.profileId, action: "update", summary: `\u5220\u9664\u6307\u6807\uFF1A${metric.term}`, before: { metric }, changedAt: Date.now() });
+          return ok({ deleted: true });
+        }
+        case "apis/list":
+          return ok(await this.store.apiDefinitionViews());
+        case "apis/save":
+          return ok(await this.saveApi(saveApiInput.parse(payload)));
+        case "apis/delete":
+          return ok(await this.deleteApi(idInput.parse(payload).id));
+        case "apis/test": {
+          const input = apiTestInput.parse(payload);
+          const definition = this.requireApi(input.id);
+          return ok(await this.executor.execute(definition, input.args, signal));
+        }
+        default:
+          return badRequest(`Unknown dsh-connect endpoint: ${endpoint}`);
+      }
+    } catch (error) {
+      if (signal.aborted) return { ok: false, error: { code: "cancelled", message: "Request cancelled", details: {} } };
+      if (error instanceof z4.ZodError) return badRequest("Invalid dsh-connect request", error.issues);
+      return { ok: false, error: { code: "internal", message: safeError3(error), details: {} } };
+    }
+  }
+  validateConversationApi(input) {
+    const prepared = this.prepareConversationApi(input);
+    if (this.store.apiDefinitions().some((api) => api.slug === prepared.slug)) {
+      throw new Error(`API slug already exists: ${prepared.slug}`);
+    }
+    const baseUrl = parseConfiguredBaseUrl(prepared.baseUrl);
+    if (baseUrl.search !== "") throw new Error("Base URL query strings are not allowed; declare query parameters instead");
+    if (prepared.pathTemplate.includes("?")) throw new Error("Path template query strings are not allowed; declare query parameters instead");
+    validateApiInput(prepared);
+  }
+  async createConversationApi(input) {
+    const prepared = this.prepareConversationApi(input);
+    this.validateConversationApi(input);
+    return this.saveApi(prepared, { allowMissingCredential: true });
+  }
+  async saveDataSource(input) {
+    const existing = input.id === void 0 ? void 0 : this.store.dataSource(input.id);
+    if (input.id !== void 0 && existing === void 0) throw new Error("Data source not found");
+    const duplicate = this.store.dataSources().find((source) => source.name === input.name && source.id !== input.id);
+    if (duplicate !== void 0) throw new Error(`Data source name already exists: ${input.name}`);
+    const id = existing?.id ?? randomUUID2();
+    const credentialName = existing?.credentialRef ?? databaseCredentialRef(id);
+    if (existing === void 0 && input.secret === void 0) throw new Error("Password is required for a new data source");
+    if (input.secret !== void 0) await this.ctx.credentials.set(credentialRef4(credentialName), input.secret);
+    const now = Date.now();
+    const definition = dataSourceSchema.parse({
+      id,
+      name: input.name.trim(),
+      type: input.type,
+      host: input.host.trim(),
+      port: input.port,
+      database: input.database.trim(),
+      username: input.username.trim(),
+      credentialRef: credentialName,
+      schemaInclude: input.schemaInclude.map((value) => value.trim()).filter(Boolean),
+      tls: input.tls,
+      sampleRows: input.sampleRows,
+      aiEnrichment: input.aiEnrichment,
+      enabled: input.enabled,
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now
+    });
+    await this.store.putDataSource(definition);
+    return (await this.store.dataSourceViews()).find((source) => source.id === id);
+  }
+  async deleteDataSource(id) {
+    const existing = this.requireSource(id);
+    await this.profiler.cancel(id);
+    await this.store.deleteDataSource(id);
+    await this.unsetIfWritable(existing.credentialRef);
+    return { deleted: true };
+  }
+  async saveApi(input, options = {}) {
+    const existing = input.id === void 0 ? void 0 : this.store.apiDefinition(input.id);
+    if (input.id !== void 0 && existing === void 0) throw new Error("API definition not found");
+    const duplicate = this.store.apiDefinitions().find((api) => api.slug === input.slug && api.id !== input.id);
+    if (duplicate !== void 0) throw new Error(`API slug already exists: ${input.slug}`);
+    validateApiInput(input);
+    const id = existing?.id ?? randomUUID2();
+    const nextAuth = await this.resolveApiAuth(id, input.auth, input.secret, existing?.auth, options.allowMissingCredential ?? false);
+    const now = Date.now();
+    const definition = apiDefinitionSchema.parse({
+      id,
+      name: input.name.trim(),
+      slug: input.slug,
+      description: input.description.trim(),
+      method: input.method,
+      baseUrl: input.baseUrl,
+      pathTemplate: input.pathTemplate,
+      parameters: input.parameters,
+      auth: nextAuth,
+      timeoutMs: input.timeoutMs,
+      maxResponseBytes: input.maxResponseBytes,
+      responsePointer: input.responsePointer,
+      allowPrivateNetwork: input.allowPrivateNetwork,
+      enabled: input.enabled,
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now
+    });
+    await this.store.putApiDefinition(definition);
+    try {
+      this.tools.replace(this.store.apiDefinitions());
+    } catch (error) {
+      if (existing === void 0) await this.store.deleteApiDefinition(id);
+      else await this.store.putApiDefinition(existing);
+      this.tools.replace(this.store.apiDefinitions());
+      throw error;
+    }
+    if (existing !== void 0 && existing.auth.type !== "none" && nextAuth.type === "none") {
+      await this.unsetIfWritable(existing.auth.credentialRef);
+    }
+    return (await this.store.apiDefinitionViews()).find((api) => api.id === id);
+  }
+  async deleteApi(id) {
+    const existing = this.requireApi(id);
+    await this.store.deleteApiDefinition(id);
+    this.tools.replace(this.store.apiDefinitions());
+    if (existing.auth.type !== "none") await this.unsetIfWritable(existing.auth.credentialRef);
+    return { deleted: true };
+  }
+  async resolveApiAuth(id, input, secret, existing, allowMissingCredential) {
+    if (input.type === "none") return { type: "none" };
+    const ref = existing?.type === "none" || existing === void 0 ? apiCredentialRef(id) : existing.credentialRef;
+    const configured = (await this.ctx.credentials.describe(credentialRef4(ref))).configured;
+    if (!configured && secret === void 0 && !allowMissingCredential) throw new Error("Credential is required for this authentication method");
+    if (secret !== void 0) await this.ctx.credentials.set(credentialRef4(ref), secret);
+    if (input.type === "bearer") return { type: "bearer", credentialRef: ref };
+    if (input.type === "basic") return { type: "basic", credentialRef: ref, username: input.username };
+    return { type: "api-key", credentialRef: ref, location: input.location, name: input.name };
+  }
+  prepareConversationApi(input) {
+    const auth = input.authType === "none" ? { type: "none" } : input.authType === "bearer" ? { type: "bearer" } : input.authType === "basic" ? { type: "basic", username: input.basicUsername ?? "" } : { type: "api-key", location: input.authLocation ?? "header", name: input.authName ?? "" };
+    return saveApiInput.parse({
+      name: input.name,
+      slug: input.slug,
+      description: input.description,
+      method: input.method,
+      baseUrl: input.baseUrl,
+      pathTemplate: input.pathTemplate,
+      parameters: input.parameters,
+      auth,
+      timeoutMs: input.timeoutMs,
+      maxResponseBytes: input.maxResponseBytes,
+      responsePointer: input.responsePointer,
+      allowPrivateNetwork: false,
+      enabled: input.authType === "none"
+    });
+  }
+  requireSource(id) {
+    const source = this.store.dataSource(id);
+    if (source === void 0) throw new Error("Data source not found");
+    return source;
+  }
+  requireApi(id) {
+    const definition = this.store.apiDefinition(id);
+    if (definition === void 0) throw new Error("API definition not found");
+    return definition;
+  }
+  async updateMetadata(input) {
+    const existing = this.store.profile(input.id);
+    if (existing === void 0) throw new Error("Metadata profile not found");
+    const next = {
+      ...existing,
+      ...input.term === void 0 ? {} : { term: input.term.trim() },
+      ...input.description === void 0 ? {} : { description: input.description.trim() },
+      ...input.tags === void 0 ? {} : { tags: [...new Set(input.tags.map((tag) => tag.trim()).filter(Boolean))] },
+      ...input.synonyms === void 0 ? {} : { synonyms: [...new Set(input.synonyms.map((value) => value.trim()).filter(Boolean))] },
+      ...input.ignored === void 0 ? {} : { ignored: input.ignored, ignoredOverride: input.ignored },
+      ...input.semanticColumns === void 0 ? {} : { semanticColumns: input.semanticColumns },
+      editedAt: Date.now()
+    };
+    await this.store.putProfile(next);
+    await this.store.putChange({ id: randomUUID2(), sourceId: next.sourceId, profileId: next.id, action: "update", summary: "\u624B\u52A8\u66F4\u65B0\u5143\u6570\u636E", before: { term: existing.term, description: existing.description, tags: existing.tags, synonyms: existing.synonyms, ignored: existing.ignored }, after: { term: next.term, description: next.description, tags: next.tags, synonyms: next.synonyms, ignored: next.ignored }, changedAt: Date.now() });
+    return next;
+  }
+  async saveMetric(input) {
+    const existing = input.id === void 0 ? void 0 : this.store.metric(input.id);
+    if (input.id !== void 0 && existing === void 0) throw new Error("Metric not found");
+    if (this.store.profile(input.profileId)?.sourceId !== input.sourceId) throw new Error("Metric profile does not belong to this data source");
+    if (this.store.metrics(input.sourceId).some((metric2) => metric2.name === input.name && metric2.id !== input.id)) throw new Error(`Metric name already exists: ${input.name}`);
+    const now = Date.now();
+    const metric = {
+      ...input,
+      id: existing?.id ?? randomUUID2(),
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now
+    };
+    await this.store.putMetric(metric);
+    await this.store.putChange({ id: randomUUID2(), sourceId: metric.sourceId, profileId: metric.profileId, action: "update", summary: `${existing === void 0 ? "\u521B\u5EFA" : "\u66F4\u65B0"}\u6307\u6807\uFF1A${metric.term}`, ...existing === void 0 ? {} : { before: { metric: existing } }, after: { metric }, changedAt: Date.now() });
+    return metric;
+  }
+  async unsetIfWritable(ref) {
+    const info = await this.ctx.credentials.describe(credentialRef4(ref));
+    if (info.configured && info.writable) await this.ctx.credentials.unset(credentialRef4(ref));
+  }
+};
+function validateApiInput(input) {
+  parseConfiguredBaseUrl(input.baseUrl);
+  if (input.responsePointer !== "" && !input.responsePointer.startsWith("/")) {
+    throw new Error("Response pointer must be empty or start with /");
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const parameter of input.parameters) {
+    if (names.has(parameter.name)) throw new Error(`Duplicate API parameter: ${parameter.name}`);
+    names.add(parameter.name);
+    if (parameter.location === "header") assertSafeHeaderName(parameter.name);
+    if (parameter.location === "path" && !input.pathTemplate.includes(`{${parameter.name}}`)) {
+      throw new Error(`Path parameter ${parameter.name} has no matching placeholder`);
+    }
+  }
+  for (const match of input.pathTemplate.matchAll(/\{([^}]+)\}/g)) {
+    const name2 = match[1];
+    if (name2 === void 0 || !input.parameters.some((parameter) => parameter.name === name2 && parameter.location === "path")) {
+      throw new Error(`Path placeholder ${name2 ?? ""} has no path parameter definition`);
+    }
+  }
+  if (input.auth.type === "api-key" && input.auth.location === "header") assertSafeHeaderName(input.auth.name);
+}
+function databaseCredentialRef(id) {
+  return `DSH_CONNECT_DB_${id.replaceAll("-", "_").toUpperCase()}_PASSWORD`;
+}
+function apiCredentialRef(id) {
+  return `DSH_CONNECT_API_${id.replaceAll("-", "_").toUpperCase()}_SECRET`;
+}
+function ok(value) {
+  return { ok: true, value };
+}
+function badRequest(message, issues = []) {
+  return { ok: false, error: { code: "bad-request", message, details: { issues } } };
+}
+function safeError3(error) {
+  return (error instanceof Error ? error.message : String(error)).replaceAll(/[\r\n]+/g, " ").slice(0, 1e3);
+}
+
+// src/index.ts
+var name = "dsh-connect";
+var inject = ["storageDomain", "credentials", "tools", "connection"];
+var CONNECT_SETTINGS_NAMESPACE = settingsNamespace("dsh-connect");
+var ConnectSettingsSchema = z5.object({
+  version: z5.number().step(1).min(1).default(1)
+});
+async function apply(ctx) {
+  ctx.inject(["settings"], (settingsCtx) => {
+    settingsCtx.settings.register(CONNECT_SETTINGS_NAMESPACE, ConnectSettingsSchema);
+  });
+  const domain = await ctx.storageDomain.open(connectDomainSpec);
+  const store = new ConnectStore(ctx, domain);
+  const apiTools = new ApiToolRegistry(ctx);
+  const profiler = new MetadataProfiler(ctx, store);
+  const fixedTools = [];
+  let disposeRpc;
+  try {
+    apiTools.replace(store.apiDefinitions());
+    fixedTools.push(...registerMetadataTools(ctx, store));
+    const rpc = new ConnectRpc(ctx, store, profiler, apiTools);
+    fixedTools.push(...registerConversationApiTool(
+      ctx,
+      (input) => rpc.validateConversationApi(input),
+      (input) => rpc.createConversationApi(input)
+    ));
+    disposeRpc = ctx.connection.rpc.handle(
+      "/dsh-connect",
+      (endpoint, payload, signal) => rpc.handle(endpoint, payload, signal),
+      { authority: "loopback" }
+    );
+  } catch (error) {
+    apiTools.dispose();
+    for (const dispose of fixedTools.reverse()) dispose();
+    await domain.close();
+    throw error;
+  }
+  ctx.effect(() => async () => {
+    await profiler.dispose();
+    apiTools.dispose();
+    for (const dispose of fixedTools.reverse()) dispose();
+    await disposeRpc?.();
+    await domain.close();
+  }, "dsh-connect runtime");
+}
+export {
+  apply,
+  inject,
+  name
+};
+//# sourceMappingURL=index.js.map