@objectstack/service-datasource 9.11.0 → 10.0.0

package/dist/index.cjs

@@ -47,6 +47,28 @@ var ExternalDatasourceService = class {
     }
     return tables;
   }
+  /**
+   * Probe a *saved* datasource by name with a live round-trip. Reuses the
+   * introspection path (driver connect + schema read) as a cheap connectivity
+   * check, so the secret is resolved through the same wired pool as the rest of
+   * the introspection surface — the caller never handles cleartext. Returns a
+   * structured result rather than throwing so the route can render ok/error
+   * uniformly. This backs the `datasource` `test_connection` action
+   * (`POST /datasources/:name/test`).
+   */
+  async testConnection(datasource) {
+    const started = Date.now();
+    try {
+      const schema = await this.config.introspect(datasource);
+      return {
+        ok: true,
+        latencyMs: Date.now() - started,
+        tableCount: Object.keys(schema.tables).length
+      };
+    } catch (err) {
+      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+  }
   async generateObjectDraft(datasource, remoteName, opts = {}) {
     const schema = await this.config.introspect(datasource);
     const table = this.findTable(schema, remoteName);
@@ -382,16 +404,39 @@ var DatasourceAdminService = class {
     }
     return summaries;
   }
+  /**
+   * Read one datasource's full detail for editing, with the credential stripped.
+   * Returns `config` (non-sensitive — credentials live in `sys_secret`, never in
+   * config), `origin`, and a `hasSecret` flag so the UI can show "leave blank to
+   * keep" without ever receiving the `credentialsRef` or any cleartext. Returns
+   * `undefined` when the name is unknown.
+   */
+  async getDatasource(name) {
+    const rec = await this.config.getDatasourceRecord(name);
+    if (!rec) return void 0;
+    const hasSecret = Boolean(_optionalChain([rec, 'access', _40 => _40.external, 'optionalAccess', _41 => _41.credentialsRef]));
+    return {
+      name: rec.name,
+      label: rec.label,
+      driver: rec.driver,
+      schemaMode: _nullishCoalesce(rec.schemaMode, () => ( "managed")),
+      config: _nullishCoalesce(rec.config, () => ( {})),
+      active: _nullishCoalesce(rec.active, () => ( true)),
+      origin: rec.origin === "runtime" ? "runtime" : "code",
+      hasSecret,
+      ...rec.definedIn ? { definedIn: rec.definedIn } : {}
+    };
+  }
   async testConnection(input, secret) {
-    if (!_optionalChain([input, 'optionalAccess', _40 => _40.driver])) {
+    if (!_optionalChain([input, 'optionalAccess', _42 => _42.driver])) {
       return { ok: false, error: "A driver is required to test a connection." };
     }
-    const queryTimeoutMs = _optionalChain([input, 'access', _41 => _41.external, 'optionalAccess', _42 => _42.queryTimeoutMs]);
+    const queryTimeoutMs = _optionalChain([input, 'access', _43 => _43.external, 'optionalAccess', _44 => _44.queryTimeoutMs]);
     try {
       return await this.config.probe({
         driver: input.driver,
         config: _nullishCoalesce(input.config, () => ( {})),
-        secret: _optionalChain([secret, 'optionalAccess', _43 => _43.value]),
+        secret: _optionalChain([secret, 'optionalAccess', _45 => _45.value]),
         external: input.external,
         ...typeof queryTimeoutMs === "number" ? { timeoutMs: queryTimeoutMs } : {}
       });
@@ -400,7 +445,7 @@ var DatasourceAdminService = class {
     }
   }
   async createDatasource(input, secret) {
-    this.assertValidName(_optionalChain([input, 'optionalAccess', _44 => _44.name]));
+    this.assertValidName(_optionalChain([input, 'optionalAccess', _46 => _46.name]));
     if (!input.driver) throw new Error("A driver is required to create a datasource.");
     const existing = await this.config.getDatasourceRecord(input.name);
     if (existing) {
@@ -441,10 +486,10 @@ var DatasourceAdminService = class {
       origin: "runtime"
     };
     if (patch.external !== void 0) {
-      merged.external = { ...patch.external, credentialsRef: _optionalChain([existing, 'access', _45 => _45.external, 'optionalAccess', _46 => _46.credentialsRef]) };
+      merged.external = { ...patch.external, credentialsRef: _optionalChain([existing, 'access', _47 => _47.external, 'optionalAccess', _48 => _48.credentialsRef]) };
     }
     if (secret) {
-      const prevRef = _optionalChain([existing, 'access', _47 => _47.external, 'optionalAccess', _48 => _48.credentialsRef]);
+      const prevRef = _optionalChain([existing, 'access', _49 => _49.external, 'optionalAccess', _50 => _50.credentialsRef]);
       const credentialsRef = await this.config.writeSecret(secret, { name });
       merged.external = { ..._nullishCoalesce(merged.external, () => ( {})), credentialsRef };
       if (prevRef && prevRef !== credentialsRef) await this.tryRemoveSecret(prevRef);
@@ -466,7 +511,7 @@ var DatasourceAdminService = class {
       );
     }
     await this.config.deleteDatasourceRecord(name);
-    if (_optionalChain([existing, 'access', _49 => _49.external, 'optionalAccess', _50 => _50.credentialsRef])) await this.tryRemoveSecret(existing.external.credentialsRef);
+    if (_optionalChain([existing, 'access', _51 => _51.external, 'optionalAccess', _52 => _52.credentialsRef])) await this.tryRemoveSecret(existing.external.credentialsRef);
     await this.tryUnregisterPool(name);
   }
   // --- internals -----------------------------------------------------------
@@ -502,29 +547,80 @@ var DatasourceAdminService = class {
   }
   async tryRegisterPool(record) {
     try {
-      await _optionalChain([this, 'access', _51 => _51.config, 'access', _52 => _52.registerPool, 'optionalCall', _53 => _53(record)]);
+      await _optionalChain([this, 'access', _53 => _53.config, 'access', _54 => _54.registerPool, 'optionalCall', _55 => _55(record)]);
     } catch (err) {
-      _optionalChain([this, 'access', _54 => _54.logger, 'optionalAccess', _55 => _55.warn, 'call', _56 => _56(`registerPool('${record.name}') failed`, err)]);
+      _optionalChain([this, 'access', _56 => _56.logger, 'optionalAccess', _57 => _57.warn, 'call', _58 => _58(`registerPool('${record.name}') failed`, err)]);
     }
   }
   async tryUnregisterPool(name) {
     try {
-      await _optionalChain([this, 'access', _57 => _57.config, 'access', _58 => _58.unregisterPool, 'optionalCall', _59 => _59(name)]);
+      await _optionalChain([this, 'access', _59 => _59.config, 'access', _60 => _60.unregisterPool, 'optionalCall', _61 => _61(name)]);
     } catch (err) {
-      _optionalChain([this, 'access', _60 => _60.logger, 'optionalAccess', _61 => _61.warn, 'call', _62 => _62(`unregisterPool('${name}') failed`, err)]);
+      _optionalChain([this, 'access', _62 => _62.logger, 'optionalAccess', _63 => _63.warn, 'call', _64 => _64(`unregisterPool('${name}') failed`, err)]);
     }
   }
   async tryRemoveSecret(credentialsRef) {
     try {
-      await _optionalChain([this, 'access', _63 => _63.config, 'access', _64 => _64.removeSecret, 'optionalCall', _65 => _65(credentialsRef)]);
+      await _optionalChain([this, 'access', _65 => _65.config, 'access', _66 => _66.removeSecret, 'optionalCall', _67 => _67(credentialsRef)]);
     } catch (err) {
-      _optionalChain([this, 'access', _66 => _66.logger, 'optionalAccess', _67 => _67.warn, 'call', _68 => _68(`removeSecret('${credentialsRef}') failed`, err)]);
+      _optionalChain([this, 'access', _68 => _68.logger, 'optionalAccess', _69 => _69.warn, 'call', _70 => _70(`removeSecret('${credentialsRef}') failed`, err)]);
     }
   }
 };
 
 // src/datasource-admin-plugin.ts
 var _kernel = require('@objectstack/spec/kernel');
+var DS_META_TYPE = "datasource";
+var SYS_METADATA = "sys_metadata";
+function newMetaId() {
+  return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `meta_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+async function persistDatasourceRow(engine, record) {
+  if (!_optionalChain([engine, 'optionalAccess', _71 => _71.insert]) || !engine.findOne) return;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = await engine.findOne(SYS_METADATA, {
+    where: { type: DS_META_TYPE, name: record.name, state: "active" }
+  });
+  if (existing) {
+    await _optionalChain([engine, 'access', _72 => _72.update, 'optionalCall', _73 => _73(
+      SYS_METADATA,
+      { metadata: JSON.stringify(record), updated_at: now, version: (existing.version || 0) + 1, state: "active" },
+      { where: { id: existing.id } }
+    )]);
+  } else {
+    await engine.insert(SYS_METADATA, {
+      id: newMetaId(),
+      name: record.name,
+      type: DS_META_TYPE,
+      scope: "platform",
+      metadata: JSON.stringify(record),
+      state: "active",
+      version: 1,
+      created_at: now,
+      updated_at: now
+    });
+  }
+}
+async function deleteDatasourceRow(engine, name) {
+  if (!_optionalChain([engine, 'optionalAccess', _74 => _74.findOne])) return;
+  const existing = await engine.findOne(SYS_METADATA, { where: { type: DS_META_TYPE, name, state: "active" } });
+  if (!existing) return;
+  if (engine.delete) await engine.delete(SYS_METADATA, { where: { id: existing.id } });
+  else await _optionalChain([engine, 'access', _75 => _75.update, 'optionalCall', _76 => _76(SYS_METADATA, { state: "inactive" }, { where: { id: existing.id } })]);
+}
+async function loadDatasourceRows(engine) {
+  if (!_optionalChain([engine, 'optionalAccess', _77 => _77.find])) return [];
+  const rows = await engine.find(SYS_METADATA, { where: { type: DS_META_TYPE, state: "active" } });
+  const out = [];
+  for (const r of _nullishCoalesce(rows, () => ( []))) {
+    const raw = r.metadata;
+    try {
+      out.push(typeof raw === "string" ? JSON.parse(raw) : raw);
+    } catch (e2) {
+    }
+  }
+  return out;
+}
 var DatasourceAdminServicePlugin = class {
   constructor(options = {}) {
     this.name = "com.objectstack.service-datasource-admin";
@@ -554,30 +650,32 @@ var DatasourceAdminServicePlugin = class {
     const config = {
       probe: (input) => this.probe(factory(), input),
       listDatasourceRecords: async () => {
-        const rows = await _asyncNullishCoalesce(await _optionalChain([metadataOf, 'call', _69 => _69(), 'optionalAccess', _70 => _70.list, 'call', _71 => _71("datasource")]), async () => ( []));
+        const rows = await _asyncNullishCoalesce(await _optionalChain([metadataOf, 'call', _78 => _78(), 'optionalAccess', _79 => _79.list, 'call', _80 => _80("datasource")]), async () => ( []));
         return rows.map((r) => ({ ...r, origin: _nullishCoalesce(r.origin, () => ( "code")) }));
       },
       getDatasourceRecord: async (name) => {
-        const row = await _optionalChain([metadataOf, 'call', _72 => _72(), 'optionalAccess', _73 => _73.get, 'call', _74 => _74("datasource", name)]);
+        const row = await _optionalChain([metadataOf, 'call', _81 => _81(), 'optionalAccess', _82 => _82.get, 'call', _83 => _83("datasource", name)]);
         return row ? { ...row, origin: _nullishCoalesce(row.origin, () => ( "code")) } : void 0;
       },
       putDatasourceRecord: async (record) => {
         const metadata = metadataOf();
-        if (!_optionalChain([metadata, 'optionalAccess', _75 => _75.register])) {
+        if (!_optionalChain([metadata, 'optionalAccess', _84 => _84.register])) {
           throw new Error("Metadata service is unavailable; cannot persist datasource.");
         }
         await metadata.register("datasource", record.name, record);
+        await persistDatasourceRow(engineOf(), record);
       },
       deleteDatasourceRecord: async (name) => {
         const metadata = metadataOf();
-        if (!_optionalChain([metadata, 'optionalAccess', _76 => _76.unregister])) {
+        if (!_optionalChain([metadata, 'optionalAccess', _85 => _85.unregister])) {
           throw new Error("Metadata service is unavailable; cannot remove datasource.");
         }
         await metadata.unregister("datasource", name);
+        await deleteDatasourceRow(engineOf(), name);
       },
       writeSecret: async (input, hint) => {
         const binder = this.options.secrets;
-        if (!_optionalChain([binder, 'optionalAccess', _77 => _77.bind])) {
+        if (!_optionalChain([binder, 'optionalAccess', _86 => _86.bind])) {
           throw new Error(
             "No secret store configured: refusing to persist a datasource credential in cleartext. Wire a SecretBinder (CryptoProvider + sys_secret) into DatasourceAdminServicePlugin."
           );
@@ -585,47 +683,106 @@ var DatasourceAdminServicePlugin = class {
         return binder.bind(input, hint);
       },
       removeSecret: async (ref) => {
-        await _optionalChain([this, 'access', _78 => _78.options, 'access', _79 => _79.secrets, 'optionalAccess', _80 => _80.unbind, 'optionalCall', _81 => _81(ref)]);
+        await _optionalChain([this, 'access', _87 => _87.options, 'access', _88 => _88.secrets, 'optionalAccess', _89 => _89.unbind, 'optionalCall', _90 => _90(ref)]);
       },
       countBoundObjects: async (datasource) => {
         const metadata = metadataOf();
-        const objects = await _asyncNullishCoalesce(await _asyncNullishCoalesce(await _optionalChain([metadata, 'optionalAccess', _82 => _82.listObjects, 'optionalCall', _83 => _83()]), async () => ( await _optionalChain([metadata, 'optionalAccess', _84 => _84.list, 'call', _85 => _85("object")]))), async () => ( []));
-        return objects.filter((o) => _optionalChain([o, 'optionalAccess', _86 => _86.datasource]) === datasource).length;
+        const objects = await _asyncNullishCoalesce(await _asyncNullishCoalesce(await _optionalChain([metadata, 'optionalAccess', _91 => _91.listObjects, 'optionalCall', _92 => _92()]), async () => ( await _optionalChain([metadata, 'optionalAccess', _93 => _93.list, 'call', _94 => _94("object")]))), async () => ( []));
+        return objects.filter((o) => _optionalChain([o, 'optionalAccess', _95 => _95.datasource]) === datasource).length;
       },
       registerPool: async (record) => {
         const f = factory();
         const engine = engineOf();
-        if (!f || !_optionalChain([engine, 'optionalAccess', _87 => _87.registerDriver]) || !f.supports(record.driver)) return;
-        const credentialsRef = _optionalChain([record, 'access', _88 => _88.external, 'optionalAccess', _89 => _89.credentialsRef]);
-        const secret = credentialsRef ? await _optionalChain([this, 'access', _90 => _90.options, 'access', _91 => _91.secrets, 'optionalAccess', _92 => _92.resolve, 'optionalCall', _93 => _93(credentialsRef)]) : void 0;
+        if (!f || !_optionalChain([engine, 'optionalAccess', _96 => _96.registerDriver]) || !f.supports(record.driver)) return;
+        const credentialsRef = _optionalChain([record, 'access', _97 => _97.external, 'optionalAccess', _98 => _98.credentialsRef]);
+        const secret = credentialsRef ? await _optionalChain([this, 'access', _99 => _99.options, 'access', _100 => _100.secrets, 'optionalAccess', _101 => _101.resolve, 'optionalCall', _102 => _102(credentialsRef)]) : void 0;
         const handle = await f.create({ ...this.toSpec(record), ...secret ? { secret } : {} });
-        if (typeof _optionalChain([handle, 'optionalAccess', _94 => _94.connect]) === "function") await handle.connect();
+        if (typeof _optionalChain([handle, 'optionalAccess', _103 => _103.connect]) === "function") await handle.connect();
         const engineDriver = _nullishCoalesce(handle.driver, () => ( handle));
         try {
           engineDriver.name = record.name;
-        } catch (e2) {
+        } catch (e3) {
         }
         engine.registerDriver(engineDriver);
-        _optionalChain([engine, 'access', _95 => _95.registerDatasourceDef, 'optionalCall', _96 => _96({
+        _optionalChain([engine, 'access', _104 => _104.registerDatasourceDef, 'optionalCall', _105 => _105({
           name: record.name,
           schemaMode: record.schemaMode,
           external: record.external
         })]);
       },
       unregisterPool: async (name) => {
-        const driver = _optionalChain([engineOf, 'call', _97 => _97(), 'optionalAccess', _98 => _98.getDriverByName, 'optionalCall', _99 => _99(name)]);
-        if (typeof _optionalChain([driver, 'optionalAccess', _100 => _100.disconnect]) === "function") await driver.disconnect();
+        const driver = _optionalChain([engineOf, 'call', _106 => _106(), 'optionalAccess', _107 => _107.getDriverByName, 'optionalCall', _108 => _108(name)]);
+        if (typeof _optionalChain([driver, 'optionalAccess', _109 => _109.disconnect]) === "function") await driver.disconnect();
       },
       logger
     };
     this.config = config;
     this.service = new DatasourceAdminService(config);
     ctx.registerService("datasource-admin", this.service);
+    try {
+      const manifest = ctx.getService("manifest");
+      if (manifest && typeof manifest.register === "function") {
+        manifest.register({
+          id: "com.objectstack.service-datasource.nav",
+          namespace: "sys",
+          version: this.version,
+          type: "plugin",
+          scope: "system",
+          name: "Datasource Navigation",
+          description: "Contributes the Datasources entry to the Setup app Integrations group.",
+          navigationContributions: [
+            {
+              app: "setup",
+              group: "group_integrations",
+              priority: 100,
+              items: [
+                {
+                  id: "nav_datasources",
+                  type: "url",
+                  label: "Datasources",
+                  url: "/apps/setup/component/metadata/resource?type=datasource",
+                  icon: "database",
+                  requiredPermissions: ["manage_platform_settings"]
+                }
+              ]
+            }
+          ]
+        });
+      }
+    } catch (err) {
+      _optionalChain([this, 'access', _110 => _110.options, 'access', _111 => _111.logger, 'optionalAccess', _112 => _112.warn, 'optionalCall', _113 => _113("datasource nav contribution skipped", err)]);
+    }
   }
   async start(ctx) {
+    await this.restoreRuntimeDatasources(ctx);
     await this.rehydratePools();
     if (this.service) await ctx.trigger("datasource-admin:ready", this.service);
   }
+  /** Reload persisted runtime datasource rows (sys_metadata) into the registry. */
+  async restoreRuntimeDatasources(ctx) {
+    const engine = safeGetService2(ctx, "data");
+    const metadata = safeGetService2(ctx, "metadata");
+    if (!_optionalChain([engine, 'optionalAccess', _114 => _114.find]) || !_optionalChain([metadata, 'optionalAccess', _115 => _115.register])) return;
+    let rows;
+    try {
+      rows = await loadDatasourceRows(engine);
+    } catch (err) {
+      _optionalChain([this, 'access', _116 => _116.options, 'access', _117 => _117.logger, 'optionalAccess', _118 => _118.warn, 'optionalCall', _119 => _119("datasource restore: reading sys_metadata failed", err)]);
+      return;
+    }
+    let restored = 0;
+    for (const rec of rows) {
+      const name = rec.name;
+      if (!name) continue;
+      try {
+        await metadata.register("datasource", name, rec);
+        restored += 1;
+      } catch (err) {
+        _optionalChain([this, 'access', _120 => _120.options, 'access', _121 => _121.logger, 'optionalAccess', _122 => _122.warn, 'optionalCall', _123 => _123(`datasource restore: register '${name}' failed`, err)]);
+      }
+    }
+    if (restored > 0) _optionalChain([this, 'access', _124 => _124.options, 'access', _125 => _125.logger, 'optionalAccess', _126 => _126.info, 'optionalCall', _127 => _127(`datasource: restored ${restored} runtime record(s) from sys_metadata`)]);
+  }
   /**
    * Boot-time rehydration: list persisted runtime datasources and re-register
    * each one's connection pool (driver build → connect → registerDriver),
@@ -637,12 +794,12 @@ var DatasourceAdminServicePlugin = class {
    */
   async rehydratePools() {
     const cfg = this.config;
-    if (!_optionalChain([cfg, 'optionalAccess', _101 => _101.registerPool]) || !cfg.listDatasourceRecords) return;
+    if (!_optionalChain([cfg, 'optionalAccess', _128 => _128.registerPool]) || !cfg.listDatasourceRecords) return;
     let records;
     try {
       records = await cfg.listDatasourceRecords();
     } catch (err) {
-      _optionalChain([this, 'access', _102 => _102.options, 'access', _103 => _103.logger, 'optionalAccess', _104 => _104.warn, 'optionalCall', _105 => _105("datasource rehydrate: listing records failed", err)]);
+      _optionalChain([this, 'access', _129 => _129.options, 'access', _130 => _130.logger, 'optionalAccess', _131 => _131.warn, 'optionalCall', _132 => _132("datasource rehydrate: listing records failed", err)]);
       return;
     }
     const runtime = records.filter((r) => r.origin === "runtime" && (_nullishCoalesce(r.active, () => ( true))));
@@ -653,10 +810,10 @@ var DatasourceAdminServicePlugin = class {
         await cfg.registerPool(record);
         registered++;
       } catch (err) {
-        _optionalChain([this, 'access', _106 => _106.options, 'access', _107 => _107.logger, 'optionalAccess', _108 => _108.warn, 'optionalCall', _109 => _109(`datasource rehydrate: pool '${record.name}' failed`, err)]);
+        _optionalChain([this, 'access', _133 => _133.options, 'access', _134 => _134.logger, 'optionalAccess', _135 => _135.warn, 'optionalCall', _136 => _136(`datasource rehydrate: pool '${record.name}' failed`, err)]);
       }
     }
-    _optionalChain([this, 'access', _110 => _110.options, 'access', _111 => _111.logger, 'optionalAccess', _112 => _112.info, 'optionalCall', _113 => _113(
+    _optionalChain([this, 'access', _137 => _137.options, 'access', _138 => _138.logger, 'optionalAccess', _139 => _139.info, 'optionalCall', _140 => _140(
       `Rehydrated ${registered}/${runtime.length} runtime datasource pool(s) on boot`
     )]);
   }
@@ -694,23 +851,23 @@ var DatasourceAdminServicePlugin = class {
     }
     const startedAt = monotonicNow();
     try {
-      if (typeof _optionalChain([driver, 'optionalAccess', _114 => _114.connect]) === "function") await driver.connect();
-      if (typeof _optionalChain([driver, 'optionalAccess', _115 => _115.ping]) === "function") await driver.ping();
-      else if (typeof _optionalChain([driver, 'optionalAccess', _116 => _116.checkHealth]) === "function") await driver.checkHealth();
-      else if (typeof _optionalChain([driver, 'optionalAccess', _117 => _117.introspectSchema]) === "function") await driver.introspectSchema();
+      if (typeof _optionalChain([driver, 'optionalAccess', _141 => _141.connect]) === "function") await driver.connect();
+      if (typeof _optionalChain([driver, 'optionalAccess', _142 => _142.ping]) === "function") await driver.ping();
+      else if (typeof _optionalChain([driver, 'optionalAccess', _143 => _143.checkHealth]) === "function") await driver.checkHealth();
+      else if (typeof _optionalChain([driver, 'optionalAccess', _144 => _144.introspectSchema]) === "function") await driver.introspectSchema();
       const latencyMs = elapsedSince(startedAt);
       let serverVersion;
       try {
-        serverVersion = typeof _optionalChain([driver, 'optionalAccess', _118 => _118.serverVersion]) === "function" ? await driver.serverVersion() : void 0;
-      } catch (e3) {
+        serverVersion = typeof _optionalChain([driver, 'optionalAccess', _145 => _145.serverVersion]) === "function" ? await driver.serverVersion() : void 0;
+      } catch (e4) {
       }
       return { ok: true, latencyMs, ...serverVersion ? { serverVersion } : {} };
     } catch (err) {
       return { ok: false, error: errMsg(err) };
     } finally {
       try {
-        if (typeof _optionalChain([driver, 'optionalAccess', _119 => _119.disconnect]) === "function") await driver.disconnect();
-      } catch (e4) {
+        if (typeof _optionalChain([driver, 'optionalAccess', _146 => _146.disconnect]) === "function") await driver.disconnect();
+      } catch (e5) {
       }
     }
   }
@@ -718,7 +875,7 @@ var DatasourceAdminServicePlugin = class {
 function safeGetService2(ctx, name) {
   try {
     return ctx.getService(name);
-  } catch (e5) {
+  } catch (e6) {
     return void 0;
   }
 }
@@ -727,7 +884,7 @@ function errMsg(err) {
 }
 function monotonicNow() {
   const perf = globalThis.performance;
-  return typeof _optionalChain([perf, 'optionalAccess', _120 => _120.now]) === "function" ? perf.now() : 0;
+  return typeof _optionalChain([perf, 'optionalAccess', _147 => _147.now]) === "function" ? perf.now() : 0;
 }
 function elapsedSince(startedAt) {
   return Math.max(0, Math.round(monotonicNow() - startedAt));
@@ -752,10 +909,10 @@ function resolveKind(driverId) {
 }
 function toHandle(driver, serverVersion) {
   return {
-    connect: typeof _optionalChain([driver, 'optionalAccess', _121 => _121.connect]) === "function" ? () => driver.connect() : void 0,
-    disconnect: typeof _optionalChain([driver, 'optionalAccess', _122 => _122.disconnect]) === "function" ? () => driver.disconnect() : void 0,
-    checkHealth: typeof _optionalChain([driver, 'optionalAccess', _123 => _123.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
-    ping: typeof _optionalChain([driver, 'optionalAccess', _124 => _124.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
+    connect: typeof _optionalChain([driver, 'optionalAccess', _148 => _148.connect]) === "function" ? () => driver.connect() : void 0,
+    disconnect: typeof _optionalChain([driver, 'optionalAccess', _149 => _149.disconnect]) === "function" ? () => driver.disconnect() : void 0,
+    checkHealth: typeof _optionalChain([driver, 'optionalAccess', _150 => _150.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
+    ping: typeof _optionalChain([driver, 'optionalAccess', _151 => _151.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
     ...serverVersion ? { serverVersion } : {},
     driver
   };
@@ -800,7 +957,7 @@ function createDefaultDatasourceDriverFactory() {
       if (!kind) {
         throw new Error(`Unsupported driver id '${spec.driver}'.`);
       }
-      const schemaMode = _nullishCoalesce(_optionalChain([spec, 'access', _125 => _125.external, 'optionalAccess', _126 => _126.schemaMode]), () => ( _optionalChain([spec, 'access', _127 => _127.config, 'optionalAccess', _128 => _128.schemaMode])));
+      const schemaMode = _nullishCoalesce(_optionalChain([spec, 'access', _152 => _152.external, 'optionalAccess', _153 => _153.schemaMode]), () => ( _optionalChain([spec, 'access', _154 => _154.config, 'optionalAccess', _155 => _155.schemaMode])));
       if (kind === "postgres") {
         const { SqlDriver } = await Promise.resolve().then(() => _interopRequireWildcard(require("@objectstack/driver-sql")));
         const driver = new SqlDriver({
@@ -827,7 +984,7 @@ function createDefaultDatasourceDriverFactory() {
           ({ MongoDBDriver } = await Promise.resolve().then(() => _interopRequireWildcard(require("@objectstack/driver-mongodb"))));
         } catch (err) {
           throw new Error(
-            `mongodb driver requested but @objectstack/driver-mongodb is not installed (${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _129 => _129.message]), () => ( err))}).`
+            `mongodb driver requested but @objectstack/driver-mongodb is not installed (${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _156 => _156.message]), () => ( err))}).`
           );
         }
         const driver = new MongoDBDriver({ url: buildMongoUrl(spec) });
@@ -839,14 +996,14 @@ function createDefaultDatasourceDriverFactory() {
   };
 }
 async function sqlServerVersion(driver, client) {
-  if (typeof _optionalChain([driver, 'optionalAccess', _130 => _130.execute]) !== "function") return void 0;
+  if (typeof _optionalChain([driver, 'optionalAccess', _157 => _157.execute]) !== "function") return void 0;
   try {
     const sql = client === "pg" ? "SELECT version() AS v" : "SELECT sqlite_version() AS v";
     const rows = await driver.execute(sql);
-    const first = Array.isArray(rows) ? rows[0] : Array.isArray(_optionalChain([rows, 'optionalAccess', _131 => _131.rows])) ? rows.rows[0] : rows;
-    const v = _nullishCoalesce(_nullishCoalesce(_optionalChain([first, 'optionalAccess', _132 => _132.v]), () => ( _optionalChain([first, 'optionalAccess', _133 => _133.version]))), () => ( _optionalChain([first, 'optionalAccess', _134 => _134["sqlite_version()"]])));
+    const first = Array.isArray(rows) ? rows[0] : Array.isArray(_optionalChain([rows, 'optionalAccess', _158 => _158.rows])) ? rows.rows[0] : rows;
+    const v = _nullishCoalesce(_nullishCoalesce(_optionalChain([first, 'optionalAccess', _159 => _159.v]), () => ( _optionalChain([first, 'optionalAccess', _160 => _160.version]))), () => ( _optionalChain([first, 'optionalAccess', _161 => _161["sqlite_version()"]])));
     return typeof v === "string" ? v : void 0;
-  } catch (e6) {
+  } catch (e7) {
     return void 0;
   }
 }
@@ -857,7 +1014,7 @@ function toCredentialsRef(handleId) {
   return `${REF_PREFIX}${handleId}`;
 }
 function parseCredentialsRef(ref) {
-  return _optionalChain([ref, 'optionalAccess', _135 => _135.startsWith, 'call', _136 => _136(REF_PREFIX)]) ? ref.slice(REF_PREFIX.length) : void 0;
+  return _optionalChain([ref, 'optionalAccess', _162 => _162.startsWith, 'call', _163 => _163(REF_PREFIX)]) ? ref.slice(REF_PREFIX.length) : void 0;
 }
 function createDatasourceSecretBinder(deps) {
   const { engine, cryptoProvider } = deps;
@@ -894,9 +1051,9 @@ function createDatasourceSecretBinder(deps) {
           // skip the tenant-audit warning (mirrors SettingsService's store).
           bypassTenantAudit: true
         });
-        const rows = _nullishCoalesce((Array.isArray(result) ? result : _optionalChain([result, 'optionalAccess', _137 => _137.data])), () => ( []));
+        const rows = _nullishCoalesce((Array.isArray(result) ? result : _optionalChain([result, 'optionalAccess', _164 => _164.data])), () => ( []));
         const row = rows[0];
-        if (!_optionalChain([row, 'optionalAccess', _138 => _138.ciphertext])) return void 0;
+        if (!_optionalChain([row, 'optionalAccess', _165 => _165.ciphertext])) return void 0;
         return await cryptoProvider.decrypt(
           {
             id: row.id,
@@ -907,20 +1064,113 @@ function createDatasourceSecretBinder(deps) {
           },
           { namespace: row.namespace, key: row.key }
         );
-      } catch (e7) {
+      } catch (e8) {
         return void 0;
       }
     }
   };
 }
 
+// src/driver-catalog.ts
+var SSL_PROP = {
+  ssl: { type: "boolean", title: "Use SSL/TLS", default: false }
+};
+var DRIVER_CATALOG = [
+  {
+    id: "memory",
+    label: "In-Memory",
+    description: "Ephemeral in-memory driver for dev, tests, and prototyping. No connection settings.",
+    icon: "memory-stick",
+    configSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    id: "sqlite",
+    label: "SQLite",
+    description: "File-backed (or in-memory) SQL database. Great for local dev and small deployments.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        filename: {
+          type: "string",
+          title: "Filename",
+          description: 'Database file path, or ":memory:" for an ephemeral in-memory database.',
+          default: ":memory:"
+        }
+      },
+      required: ["filename"],
+      additionalProperties: false
+    }
+  },
+  {
+    id: "postgres",
+    label: "PostgreSQL",
+    description: "PostgreSQL connection. Supply host/port/database or a connection URL.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", title: "Connection URL", description: "postgres://user:pass@host:5432/db (overrides the fields below when set)." },
+        host: { type: "string", title: "Host", default: "localhost" },
+        port: { type: "number", title: "Port", default: 5432 },
+        database: { type: "string", title: "Database" },
+        username: { type: "string", title: "User" },
+        password: { type: "string", title: "Password", format: "password" },
+        schema: { type: "string", title: "Schema", default: "public" },
+        ...SSL_PROP
+      },
+      additionalProperties: true
+    }
+  },
+  {
+    id: "mysql",
+    label: "MySQL / MariaDB",
+    description: "MySQL or MariaDB connection.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        host: { type: "string", title: "Host", default: "localhost" },
+        port: { type: "number", title: "Port", default: 3306 },
+        database: { type: "string", title: "Database" },
+        username: { type: "string", title: "User" },
+        password: { type: "string", title: "Password", format: "password" },
+        ...SSL_PROP
+      },
+      additionalProperties: true
+    }
+  },
+  {
+    id: "mongo",
+    label: "MongoDB",
+    description: "MongoDB connection via a connection URI.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", title: "Connection URI", description: "mongodb://host:27017" },
+        database: { type: "string", title: "Database" }
+      },
+      required: ["url"],
+      additionalProperties: true
+    }
+  }
+];
+
 // src/admin-routes.ts
 function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   const root = `${basePath}/datasources`;
   const adminService = () => {
     try {
       return ctx.getService("datasource-admin");
-    } catch (e8) {
+    } catch (e9) {
+      return void 0;
+    }
+  };
+  const externalService = () => {
+    try {
+      return ctx.getService("external-datasource");
+    } catch (e10) {
       return void 0;
     }
   };
@@ -933,13 +1183,59 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   };
   server.get(root, async (_req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _139 => _139.listDatasources])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _166 => _166.listDatasources])) return unavailable(res);
     const datasources = await svc.listDatasources();
     res.json({ datasources });
   });
+  server.get(`${root}/drivers`, async (_req, res) => {
+    res.json({ drivers: DRIVER_CATALOG });
+  });
+  server.get(`${root}/:name/remote-tables`, async (req, res) => {
+    const svc = externalService();
+    if (!_optionalChain([svc, 'optionalAccess', _167 => _167.listRemoteTables])) return unavailable(res);
+    try {
+      const tables = await svc.listRemoteTables(req.params.name);
+      res.json({ tables });
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
+  server.get(`${root}/:name`, async (req, res) => {
+    const svc = adminService();
+    if (!_optionalChain([svc, 'optionalAccess', _168 => _168.getDatasource])) return unavailable(res);
+    try {
+      const datasource = await svc.getDatasource(req.params.name);
+      if (!datasource) return res.status(404).json({ error: "not_found" });
+      res.json({ datasource });
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
+  server.post(`${root}/:name/test`, async (req, res) => {
+    const svc = externalService();
+    if (!_optionalChain([svc, 'optionalAccess', _169 => _169.testConnection])) return unavailable(res);
+    try {
+      const result = await svc.testConnection(req.params.name);
+      res.json(result);
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
+  server.post(`${root}/:name/object-draft`, async (req, res) => {
+    const svc = externalService();
+    if (!_optionalChain([svc, 'optionalAccess', _170 => _170.generateObjectDraft])) return unavailable(res);
+    const { table, ...opts } = _nullishCoalesce(req.body, () => ( {}));
+    if (!table) return badRequest(res, new Error('Body field "table" is required.'));
+    try {
+      const draft = await svc.generateObjectDraft(req.params.name, String(table), opts);
+      res.json({ draft });
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
   server.post(`${root}/test`, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _140 => _140.testConnection])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _171 => _171.testConnection])) return unavailable(res);
     const { draft, secret } = splitSecret(req.body);
     try {
       const result = await svc.testConnection(draft, secret);
@@ -950,7 +1246,7 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   });
   server.post(root, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _141 => _141.createDatasource])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _172 => _172.createDatasource])) return unavailable(res);
     const { draft, secret } = splitSecret(req.body);
     try {
       const datasource = await svc.createDatasource(draft, secret);
@@ -961,7 +1257,7 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   });
   server.patch(`${root}/:name`, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _142 => _142.updateDatasource])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _173 => _173.updateDatasource])) return unavailable(res);
     const { draft, secret } = splitSecret(req.body);
     try {
       const datasource = await svc.updateDatasource(req.params.name, draft, secret);
@@ -972,7 +1268,7 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   });
   server.delete(`${root}/:name`, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _143 => _143.removeDatasource])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _174 => _174.removeDatasource])) return unavailable(res);
     try {
       await svc.removeDatasource(req.params.name);
       res.status(204).end();