@objectstack/service-datasource 9.11.0 → 10.2.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @objectstack/service-datasource@9.11.0 build /home/runner/work/framework/framework/packages/services/service-datasource
+> @objectstack/service-datasource@10.2.0 build /home/runner/work/framework/framework/packages/services/service-datasource
 > tsup
 
 CLI Building entry: src/index.ts, src/contracts/index.ts
@@ -10,19 +10,23 @@
 CLI Cleaning output folder
 ESM Build start
 CJS Build start
-ESM dist/index.js               35.43 KB
-ESM dist/contracts/index.js     33.00 B
-ESM dist/index.js.map           88.79 KB
+ESM dist/index.js               52.34 KB
+ESM dist/contracts/index.js     133.00 B
+ESM dist/chunk-XLS4RP7B.js      185.00 B
+ESM dist/index.js.map           129.15 KB
 ESM dist/contracts/index.js.map 71.00 B
-ESM ⚡️ Build success in 1016ms
-CJS dist/index.cjs               43.69 KB
-CJS dist/contracts/index.cjs     47.00 B
-CJS dist/contracts/index.cjs.map 265.00 B
-CJS dist/index.cjs.map           75.45 KB
-CJS ⚡️ Build success in 1063ms
+ESM dist/chunk-XLS4RP7B.js.map  3.10 KB
+ESM ⚡️ Build success in 934ms
+CJS dist/index.cjs               63.66 KB
+CJS dist/contracts/index.cjs     242.00 B
+CJS dist/chunk-BI2SYWLC.cjs      280.00 B
+CJS dist/index.cjs.map           110.35 KB
+CJS dist/contracts/index.cjs.map 304.00 B
+CJS dist/chunk-BI2SYWLC.cjs.map  3.38 KB
+CJS ⚡️ Build success in 1084ms
 DTS Build start
-DTS ⚡️ Build success in 16885ms
-DTS dist/index.d.ts            19.19 KB
-DTS dist/contracts/index.d.ts  8.10 KB
-DTS dist/index.d.cts           19.19 KB
-DTS dist/contracts/index.d.cts 8.10 KB
+DTS ⚡️ Build success in 18283ms
+DTS dist/index.d.ts            28.97 KB
+DTS dist/contracts/index.d.ts  11.03 KB
+DTS dist/index.d.cts           28.97 KB
+DTS dist/contracts/index.d.cts 11.03 KB

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # @objectstack/service-external-datasource
 
+## 10.2.0
+
+### Patch Changes
+
+- Updated dependencies [b496498]
+  - @objectstack/spec@10.2.0
+  - @objectstack/core@10.2.0
+
+## 10.1.0
+
+### Minor Changes
+
+- 49da36e: feat(datasource): fail-closed credential resolution at connect (ADR-0062 Phase 2, D3)
+
+  `DatasourceConnectionService` now treats a declared `external.credentialsRef` as
+  **fail-closed**: the credential must resolve to a cleartext secret (via the
+  host's `SecretBinder` over `ICryptoProvider`) _before_ the driver is built. An
+  absent secret store, or a ref that cannot be resolved/decrypted (missing
+  `sys_secret` row, rotated key, or a throwing resolver), leaves the datasource
+  **unconnected with a clear message** — never a silent build-without-secret that
+  would connect with no/wrong auth or fail later with a confusing driver error.
+
+  The same policy as connect failures applies: a code-defined `external` datasource
+  with `validation.onMismatch: 'fail'` auto-connected at boot fails fast (bricks
+  boot); runtime-admin create/update + boot rehydration degrade-with-warning. Code-
+  and runtime-origin secrets converge on the one connection path (the same
+  `SecretBinder` is threaded through the shared service). New `failed-credentials`
+  connect status.
+
+- ac79f16: feat(datasource): auto-connect declared external datasources (ADR-0062 Phase 1, D1/D2/D5)
+
+  A declared external datasource is now connected to a live ObjectQL driver and its
+  federated objects are queryable **with zero app code** — no `onEnable` driver
+  wiring. Implements ADR-0062 Phase 1.
+
+  - **D1 — one connect path.** New `DatasourceConnectionService` in
+    `@objectstack/service-datasource` owns the single "definition → live driver"
+    path: build via the injected driver factory → resolve `external.credentialsRef`
+    via the `SecretBinder` → connect → `engine.registerDriver` under the datasource
+    name → register the datasource def → sync each bound federated object's read
+    metadata (DDL-free). Both origins converge on it: the runtime-admin
+    `registerPool` now delegates here, and `AppPlugin` auto-connects code-defined
+    datasources. Exposed as the `'datasource-connection'` kernel service.
+  - **D2 — opt-in-safe gate.** A declared datasource auto-connects only when it is
+    `external`, an object **explicitly** binds to it via `object.datasource`, or it
+    sets the new `autoConnect: true` flag. A managed datasource that nothing
+    explicitly binds (incl. ones referenced only by a `datasourceMapping` rule, e.g.
+    `examples/app-crm`'s `:memory:` datasources) stays metadata-only — existing apps
+    are byte-for-byte unchanged. See the ADR-0062 D2 implementation note.
+  - **D5 — lifecycle, ordering & policy.** Connect happens in `AppPlugin.start()`
+    (before the `kernel:ready` validation gate, relying on the kernel's
+    init-all-then-start-all ordering). Fail-fast for a declared `external` datasource
+    with `validation.onMismatch: 'fail'`; degrade-with-warning otherwise (and always
+    for runtime-admin/rehydrate, so a UI action or replica blip never bricks the
+    server). Adds a host-injectable `DatasourceConnectPolicy` (open-core default
+    allows; a multi-tenant host binds a stricter fail-closed policy for egress
+    isolation) consulted before every connect — one connect path, no cloud fork.
+
+  Adds `datasource.autoConnect` to the spec. The legacy `onEnable` +
+  `ctx.drivers.register` bridge remains supported as an escape hatch (idempotent vs.
+  auto-connect). No behavior change for managed apps.
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
+## 10.0.0
+
+### Patch Changes
+
+- Updated dependencies [d7ff626]
+- Updated dependencies [2a1b16b]
+- Updated dependencies [e16f2a8]
+- Updated dependencies [e411a82]
+- Updated dependencies [a581385]
+- Updated dependencies [d5f6d29]
+- Updated dependencies [220ce5b]
+- Updated dependencies [3efe334]
+- Updated dependencies [feead7e]
+- Updated dependencies [6ca20b3]
+- Updated dependencies [5f875fe]
+- Updated dependencies [b469950]
+  - @objectstack/spec@10.0.0
+  - @objectstack/core@10.0.0
+
 ## 9.11.0
 
 ### Patch Changes

package/README.md

@@ -33,6 +33,40 @@ layered on by a private host **without forking**.
 
 The runtime admin owns only the `origin: 'runtime'` lifecycle.
 
+## REST routes
+
+Mounted under `/api/v1/datasources` by `registerDatasourceAdminRoutes` (lifecycle
++ introspection) and the federation routes by the external service. Every route
+degrades gracefully (`503` / "unavailable") when its service isn't wired.
+
+**Lifecycle & connection**
+- `GET    /datasources` — list (code + runtime, with provenance/health)
+- `GET    /datasources/drivers` — driver catalog + per-driver JSON-Schema `configSchema` (drives the Studio connection form)
+- `GET    /datasources/:name` — one datasource's detail, **credential-stripped** (`config` + `hasSecret`)
+- `POST   /datasources` — create a runtime datasource
+- `PATCH  /datasources/:name` — update a runtime datasource
+- `DELETE /datasources/:name` — remove a runtime datasource (blocked while objects are bound)
+- `POST   /datasources/test` — probe an unsaved draft (inline body)
+- `POST   /datasources/:name/test` — probe a **saved** datasource by name (backs the `test_connection` action)
+
+**Introspection / sync (read-only)**
+- `GET    /datasources/:name/remote-tables` — list remote tables
+- `POST   /datasources/:name/object-draft` — generate an object definition draft for one table (no persistence)
+- federation import/validate/refresh routes under `/datasources/:name/external/*` (ADR-0015)
+
+Credentials never travel in `config`: a `format:'password'` field is split into
+the top-level `secret` on write (encrypted to `sys_secret`), and reads never
+echo it (`hasSecret` only).
+
+## Studio integration
+
+`datasource` is a metadata type, so it is administered through the generic
+metadata-admin engine (not a bespoke page): the `DatasourceAdminServicePlugin`
+contributes a **Datasources** entry to the Setup app's `group_integrations` nav
+slot (→ the engine route `…/component/metadata/resource?type=datasource`), where
+the list/create/edit/test/**sync objects**/delete UI lives. Runtime records are
+persisted to `sys_metadata` and restored (pools rehydrated) on restart.
+
 ## Exports
 
 - Federation: `ExternalDatasourceService`, `ExternalDatasourceServicePlugin`.

package/dist/chunk-BI2SYWLC.cjs

@@ -0,0 +1,9 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/contracts/connect-policy.ts
+var allowAllConnectPolicy = {
+  canConnect: () => ({ allow: true })
+};
+
+
+
+exports.allowAllConnectPolicy = allowAllConnectPolicy;
+//# sourceMappingURL=chunk-BI2SYWLC.cjs.map

package/dist/chunk-BI2SYWLC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/framework/framework/packages/services/service-datasource/dist/chunk-BI2SYWLC.cjs","../src/contracts/connect-policy.ts"],"names":[],"mappings":"AAAA;ACkEO,IAAM,sBAAA,EAAiD;AAAA,EAC5D,UAAA,EAAY,CAAA,EAAA,GAAA,CAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AACnC,CAAA;ADhEA;AACA;AACE;AACF,sDAAC","file":"/home/runner/work/framework/framework/packages/services/service-datasource/dist/chunk-BI2SYWLC.cjs","sourcesContent":[null,"// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * DatasourceConnectPolicy — host-injectable gate consulted *before*\n * {@link DatasourceConnectionService} builds and registers a live driver\n * (ADR-0062 D1/D5, and the epic #2163 \"connect-policy seam\" note).\n *\n * The framework ships a permissive default ({@link allowAllConnectPolicy}) so a\n * self-hosted single-environment runtime connects external datasources out of\n * the box (subject to the D2 auto-connect gate, which is applied separately by\n * {@link DatasourceConnectionService.connectDeclared}). A multi-tenant host\n * (shared-container cloud) binds a stricter policy that can *fail-close* on the\n * shared runtime — e.g. checking `sys_environment.plan`, an egress allow-list,\n * and per-tenant quota — to enforce SSRF / egress isolation.\n *\n * This keeps a single connect path for code- and runtime-origin datasources\n * (D1): the host injects a policy rather than forking a second connect path.\n * No plan coupling lives in the open framework.\n */\n\n/** Why a connect is being attempted — lets a policy treat origins differently. */\nexport interface DatasourceConnectContext {\n  /** Provenance of the datasource being connected. */\n  origin?: 'code' | 'runtime';\n  /**\n   * What triggered this connect:\n   *  - `declared-auto`  — code-defined datasource auto-connected at boot (D2 gate passed).\n   *  - `runtime-admin`  — UI \"Add/Update Datasource\" hot pool registration.\n   *  - `rehydrate`      — boot rehydration of a persisted runtime datasource.\n   */\n  trigger?: 'declared-auto' | 'runtime-admin' | 'rehydrate';\n}\n\n/** A policy verdict. `allow:false` leaves the datasource unconnected (metadata-only). */\nexport interface DatasourceConnectDecision {\n  allow: boolean;\n  /** Human-readable reason, surfaced in logs when a connect is denied. */\n  reason?: string;\n}\n\n/** The minimal datasource shape a policy inspects (never a secret). */\nexport interface DatasourceConnectSubject {\n  name: string;\n  driver: string;\n  schemaMode?: 'managed' | 'external' | 'validate-only';\n  external?: Record<string, unknown>;\n}\n\n/** Host-provided policy gate consulted before opening a connection. */\nexport interface DatasourceConnectPolicy {\n  /**\n   * Decide whether `ds` may be connected. Sync or async. Throwing is treated\n   * as a denial (fail-closed) by {@link DatasourceConnectionService}.\n   */\n  canConnect(\n    ds: DatasourceConnectSubject,\n    ctx?: DatasourceConnectContext,\n  ): DatasourceConnectDecision | Promise<DatasourceConnectDecision>;\n}\n\n/**\n * Open-core default: allow every connect. The D2 auto-connect gate (external /\n * explicitly-routed / `autoConnect:true`) still applies on top of this for\n * code-defined datasources, so a managed, unrouted datasource is never\n * connected even under the permissive policy.\n */\nexport const allowAllConnectPolicy: DatasourceConnectPolicy = {\n  canConnect: () => ({ allow: true }),\n};\n"]}

package/dist/chunk-XLS4RP7B.js

@@ -0,0 +1,9 @@
+// src/contracts/connect-policy.ts
+var allowAllConnectPolicy = {
+  canConnect: () => ({ allow: true })
+};
+
+export {
+  allowAllConnectPolicy
+};
+//# sourceMappingURL=chunk-XLS4RP7B.js.map

package/dist/chunk-XLS4RP7B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contracts/connect-policy.ts"],"sourcesContent":["// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * DatasourceConnectPolicy — host-injectable gate consulted *before*\n * {@link DatasourceConnectionService} builds and registers a live driver\n * (ADR-0062 D1/D5, and the epic #2163 \"connect-policy seam\" note).\n *\n * The framework ships a permissive default ({@link allowAllConnectPolicy}) so a\n * self-hosted single-environment runtime connects external datasources out of\n * the box (subject to the D2 auto-connect gate, which is applied separately by\n * {@link DatasourceConnectionService.connectDeclared}). A multi-tenant host\n * (shared-container cloud) binds a stricter policy that can *fail-close* on the\n * shared runtime — e.g. checking `sys_environment.plan`, an egress allow-list,\n * and per-tenant quota — to enforce SSRF / egress isolation.\n *\n * This keeps a single connect path for code- and runtime-origin datasources\n * (D1): the host injects a policy rather than forking a second connect path.\n * No plan coupling lives in the open framework.\n */\n\n/** Why a connect is being attempted — lets a policy treat origins differently. */\nexport interface DatasourceConnectContext {\n  /** Provenance of the datasource being connected. */\n  origin?: 'code' | 'runtime';\n  /**\n   * What triggered this connect:\n   *  - `declared-auto`  — code-defined datasource auto-connected at boot (D2 gate passed).\n   *  - `runtime-admin`  — UI \"Add/Update Datasource\" hot pool registration.\n   *  - `rehydrate`      — boot rehydration of a persisted runtime datasource.\n   */\n  trigger?: 'declared-auto' | 'runtime-admin' | 'rehydrate';\n}\n\n/** A policy verdict. `allow:false` leaves the datasource unconnected (metadata-only). */\nexport interface DatasourceConnectDecision {\n  allow: boolean;\n  /** Human-readable reason, surfaced in logs when a connect is denied. */\n  reason?: string;\n}\n\n/** The minimal datasource shape a policy inspects (never a secret). */\nexport interface DatasourceConnectSubject {\n  name: string;\n  driver: string;\n  schemaMode?: 'managed' | 'external' | 'validate-only';\n  external?: Record<string, unknown>;\n}\n\n/** Host-provided policy gate consulted before opening a connection. */\nexport interface DatasourceConnectPolicy {\n  /**\n   * Decide whether `ds` may be connected. Sync or async. Throwing is treated\n   * as a denial (fail-closed) by {@link DatasourceConnectionService}.\n   */\n  canConnect(\n    ds: DatasourceConnectSubject,\n    ctx?: DatasourceConnectContext,\n  ): DatasourceConnectDecision | Promise<DatasourceConnectDecision>;\n}\n\n/**\n * Open-core default: allow every connect. The D2 auto-connect gate (external /\n * explicitly-routed / `autoConnect:true`) still applies on top of this for\n * code-defined datasources, so a managed, unrouted datasource is never\n * connected even under the permissive policy.\n */\nexport const allowAllConnectPolicy: DatasourceConnectPolicy = {\n  canConnect: () => ({ allow: true }),\n};\n"],"mappings":";AAkEO,IAAM,wBAAiD;AAAA,EAC5D,YAAY,OAAO,EAAE,OAAO,KAAK;AACnC;","names":[]}

package/dist/contracts/index.cjs

@@ -1 +1,7 @@
-"use strict";//# sourceMappingURL=index.cjs.map
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkBI2SYWLCcjs = require('../chunk-BI2SYWLC.cjs');
+
+
+exports.allowAllConnectPolicy = _chunkBI2SYWLCcjs.allowAllConnectPolicy;
+//# sourceMappingURL=index.cjs.map

package/dist/contracts/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/framework/framework/packages/services/service-datasource/dist/contracts/index.cjs"],"names":[],"mappings":"AAAA","file":"/home/runner/work/framework/framework/packages/services/service-datasource/dist/contracts/index.cjs"}
+{"version":3,"sources":["/home/runner/work/framework/framework/packages/services/service-datasource/dist/contracts/index.cjs"],"names":[],"mappings":"AAAA;AACE;AACF,yDAA8B;AAC9B;AACE;AACF,wEAAC","file":"/home/runner/work/framework/framework/packages/services/service-datasource/dist/contracts/index.cjs"}

package/dist/contracts/index.d.cts

@@ -175,4 +175,62 @@ interface IDatasourceDriverFactory {
     create(spec: DatasourceConnectionSpec): Promise<DatasourceDriverHandle> | DatasourceDriverHandle;
 }
 
-export type { DatasourceConnectionSpec, DatasourceDraft, DatasourceDriverHandle, DatasourceOrigin, DatasourceSummary, IDatasourceAdminService, IDatasourceDriverFactory, SecretInput, TestConnectionResult };
+/**
+ * DatasourceConnectPolicy — host-injectable gate consulted *before*
+ * {@link DatasourceConnectionService} builds and registers a live driver
+ * (ADR-0062 D1/D5, and the epic #2163 "connect-policy seam" note).
+ *
+ * The framework ships a permissive default ({@link allowAllConnectPolicy}) so a
+ * self-hosted single-environment runtime connects external datasources out of
+ * the box (subject to the D2 auto-connect gate, which is applied separately by
+ * {@link DatasourceConnectionService.connectDeclared}). A multi-tenant host
+ * (shared-container cloud) binds a stricter policy that can *fail-close* on the
+ * shared runtime — e.g. checking `sys_environment.plan`, an egress allow-list,
+ * and per-tenant quota — to enforce SSRF / egress isolation.
+ *
+ * This keeps a single connect path for code- and runtime-origin datasources
+ * (D1): the host injects a policy rather than forking a second connect path.
+ * No plan coupling lives in the open framework.
+ */
+/** Why a connect is being attempted — lets a policy treat origins differently. */
+interface DatasourceConnectContext {
+    /** Provenance of the datasource being connected. */
+    origin?: 'code' | 'runtime';
+    /**
+     * What triggered this connect:
+     *  - `declared-auto`  — code-defined datasource auto-connected at boot (D2 gate passed).
+     *  - `runtime-admin`  — UI "Add/Update Datasource" hot pool registration.
+     *  - `rehydrate`      — boot rehydration of a persisted runtime datasource.
+     */
+    trigger?: 'declared-auto' | 'runtime-admin' | 'rehydrate';
+}
+/** A policy verdict. `allow:false` leaves the datasource unconnected (metadata-only). */
+interface DatasourceConnectDecision {
+    allow: boolean;
+    /** Human-readable reason, surfaced in logs when a connect is denied. */
+    reason?: string;
+}
+/** The minimal datasource shape a policy inspects (never a secret). */
+interface DatasourceConnectSubject {
+    name: string;
+    driver: string;
+    schemaMode?: 'managed' | 'external' | 'validate-only';
+    external?: Record<string, unknown>;
+}
+/** Host-provided policy gate consulted before opening a connection. */
+interface DatasourceConnectPolicy {
+    /**
+     * Decide whether `ds` may be connected. Sync or async. Throwing is treated
+     * as a denial (fail-closed) by {@link DatasourceConnectionService}.
+     */
+    canConnect(ds: DatasourceConnectSubject, ctx?: DatasourceConnectContext): DatasourceConnectDecision | Promise<DatasourceConnectDecision>;
+}
+/**
+ * Open-core default: allow every connect. The D2 auto-connect gate (external /
+ * explicitly-routed / `autoConnect:true`) still applies on top of this for
+ * code-defined datasources, so a managed, unrouted datasource is never
+ * connected even under the permissive policy.
+ */
+declare const allowAllConnectPolicy: DatasourceConnectPolicy;
+
+export { type DatasourceConnectContext, type DatasourceConnectDecision, type DatasourceConnectPolicy, type DatasourceConnectSubject, type DatasourceConnectionSpec, type DatasourceDraft, type DatasourceDriverHandle, type DatasourceOrigin, type DatasourceSummary, type IDatasourceAdminService, type IDatasourceDriverFactory, type SecretInput, type TestConnectionResult, allowAllConnectPolicy };

package/dist/contracts/index.d.ts

@@ -175,4 +175,62 @@ interface IDatasourceDriverFactory {
     create(spec: DatasourceConnectionSpec): Promise<DatasourceDriverHandle> | DatasourceDriverHandle;
 }
 
-export type { DatasourceConnectionSpec, DatasourceDraft, DatasourceDriverHandle, DatasourceOrigin, DatasourceSummary, IDatasourceAdminService, IDatasourceDriverFactory, SecretInput, TestConnectionResult };
+/**
+ * DatasourceConnectPolicy — host-injectable gate consulted *before*
+ * {@link DatasourceConnectionService} builds and registers a live driver
+ * (ADR-0062 D1/D5, and the epic #2163 "connect-policy seam" note).
+ *
+ * The framework ships a permissive default ({@link allowAllConnectPolicy}) so a
+ * self-hosted single-environment runtime connects external datasources out of
+ * the box (subject to the D2 auto-connect gate, which is applied separately by
+ * {@link DatasourceConnectionService.connectDeclared}). A multi-tenant host
+ * (shared-container cloud) binds a stricter policy that can *fail-close* on the
+ * shared runtime — e.g. checking `sys_environment.plan`, an egress allow-list,
+ * and per-tenant quota — to enforce SSRF / egress isolation.
+ *
+ * This keeps a single connect path for code- and runtime-origin datasources
+ * (D1): the host injects a policy rather than forking a second connect path.
+ * No plan coupling lives in the open framework.
+ */
+/** Why a connect is being attempted — lets a policy treat origins differently. */
+interface DatasourceConnectContext {
+    /** Provenance of the datasource being connected. */
+    origin?: 'code' | 'runtime';
+    /**
+     * What triggered this connect:
+     *  - `declared-auto`  — code-defined datasource auto-connected at boot (D2 gate passed).
+     *  - `runtime-admin`  — UI "Add/Update Datasource" hot pool registration.
+     *  - `rehydrate`      — boot rehydration of a persisted runtime datasource.
+     */
+    trigger?: 'declared-auto' | 'runtime-admin' | 'rehydrate';
+}
+/** A policy verdict. `allow:false` leaves the datasource unconnected (metadata-only). */
+interface DatasourceConnectDecision {
+    allow: boolean;
+    /** Human-readable reason, surfaced in logs when a connect is denied. */
+    reason?: string;
+}
+/** The minimal datasource shape a policy inspects (never a secret). */
+interface DatasourceConnectSubject {
+    name: string;
+    driver: string;
+    schemaMode?: 'managed' | 'external' | 'validate-only';
+    external?: Record<string, unknown>;
+}
+/** Host-provided policy gate consulted before opening a connection. */
+interface DatasourceConnectPolicy {
+    /**
+     * Decide whether `ds` may be connected. Sync or async. Throwing is treated
+     * as a denial (fail-closed) by {@link DatasourceConnectionService}.
+     */
+    canConnect(ds: DatasourceConnectSubject, ctx?: DatasourceConnectContext): DatasourceConnectDecision | Promise<DatasourceConnectDecision>;
+}
+/**
+ * Open-core default: allow every connect. The D2 auto-connect gate (external /
+ * explicitly-routed / `autoConnect:true`) still applies on top of this for
+ * code-defined datasources, so a managed, unrouted datasource is never
+ * connected even under the permissive policy.
+ */
+declare const allowAllConnectPolicy: DatasourceConnectPolicy;
+
+export { type DatasourceConnectContext, type DatasourceConnectDecision, type DatasourceConnectPolicy, type DatasourceConnectSubject, type DatasourceConnectionSpec, type DatasourceDraft, type DatasourceDriverHandle, type DatasourceOrigin, type DatasourceSummary, type IDatasourceAdminService, type IDatasourceDriverFactory, type SecretInput, type TestConnectionResult, allowAllConnectPolicy };

package/dist/contracts/index.js

@@ -1 +1,7 @@
+import {
+  allowAllConnectPolicy
+} from "../chunk-XLS4RP7B.js";
+export {
+  allowAllConnectPolicy
+};
 //# sourceMappingURL=index.js.map