@objectstack/service-datasource 9.11.0 → 10.2.0

package/dist/index.cjs

@@ -1,4 +1,8 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/external-datasource-service.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkBI2SYWLCcjs = require('./chunk-BI2SYWLC.cjs');
+
+// src/external-datasource-service.ts
 
 
 
@@ -47,6 +51,28 @@ var ExternalDatasourceService = class {
     }
     return tables;
   }
+  /**
+   * Probe a *saved* datasource by name with a live round-trip. Reuses the
+   * introspection path (driver connect + schema read) as a cheap connectivity
+   * check, so the secret is resolved through the same wired pool as the rest of
+   * the introspection surface — the caller never handles cleartext. Returns a
+   * structured result rather than throwing so the route can render ok/error
+   * uniformly. This backs the `datasource` `test_connection` action
+   * (`POST /datasources/:name/test`).
+   */
+  async testConnection(datasource) {
+    const started = Date.now();
+    try {
+      const schema = await this.config.introspect(datasource);
+      return {
+        ok: true,
+        latencyMs: Date.now() - started,
+        tableCount: Object.keys(schema.tables).length
+      };
+    } catch (err) {
+      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+  }
   async generateObjectDraft(datasource, remoteName, opts = {}) {
     const schema = await this.config.introspect(datasource);
     const table = this.findTable(schema, remoteName);
@@ -346,6 +372,179 @@ function safeGetService(ctx, name) {
   }
 }
 
+// src/datasource-connection-service.ts
+function isDatasourceAddressed(ds, ctx) {
+  if (ds.schemaMode && ds.schemaMode !== "managed") return true;
+  if (ds.autoConnect === true) return true;
+  if (_optionalChain([ctx, 'access', _38 => _38.objects, 'optionalAccess', _39 => _39.some, 'call', _40 => _40((o) => _optionalChain([o, 'optionalAccess', _41 => _41.datasource]) === ds.name)])) return true;
+  return false;
+}
+var DatasourceConnectionService = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+    this.policy = _nullishCoalesce(cfg.policy, () => ( _chunkBI2SYWLCcjs.allowAllConnectPolicy));
+    this.logger = cfg.logger;
+  }
+  /**
+   * Auto-connect the declared (code-defined) datasources that pass the D2 gate.
+   * Called from `AppPlugin.start()` with the app bundle's datasources + objects.
+   * Each connected external datasource also has its bound objects' read metadata
+   * synced so they are immediately queryable with zero app code.
+   */
+  async connectDeclared(input) {
+    const objects = _nullishCoalesce(input.objects, () => ( []));
+    const results = [];
+    for (const ds of input.datasources) {
+      if (!_optionalChain([ds, 'optionalAccess', _42 => _42.name])) continue;
+      if (ds.active === false) continue;
+      if (!isDatasourceAddressed(ds, { objects })) continue;
+      const bound = objects.filter((o) => _optionalChain([o, 'optionalAccess', _43 => _43.datasource]) === ds.name && typeof _optionalChain([o, 'optionalAccess', _44 => _44.name]) === "string").map((o) => o.name);
+      results.push(
+        await this.connect(ds, { objects: bound, context: { origin: _nullishCoalesce(ds.origin, () => ( "code")), trigger: "declared-auto" } })
+      );
+    }
+    return results;
+  }
+  /**
+   * Build + connect + register a single datasource's live driver. The shared
+   * core used by both auto-connect and the runtime-admin pool registration.
+   *
+   * Failure policy (ADR-0062 D5): an `external` datasource with
+   * `validation.onMismatch: 'fail'` fails fast (re-throws, bricking boot as
+   * intended); everything else degrades with a warning so an optional replica's
+   * connectivity blip never bricks boot.
+   */
+  async connect(record, opts = {}) {
+    const name = record.name;
+    const engine = this.cfg.engine();
+    const factory = this.cfg.factory();
+    if (_optionalChain([engine, 'optionalAccess', _45 => _45.getDriverByName, 'optionalCall', _46 => _46(name)])) {
+      return { name, status: "already-registered" };
+    }
+    let decision;
+    try {
+      decision = await this.policy.canConnect(
+        { name, driver: record.driver, schemaMode: record.schemaMode, external: record.external },
+        opts.context
+      );
+    } catch (err) {
+      decision = { allow: false, reason: `connect policy threw: ${errMsg(err)}` };
+    }
+    if (!decision.allow) {
+      _optionalChain([this, 'access', _47 => _47.logger, 'optionalAccess', _48 => _48.info, 'optionalCall', _49 => _49(`datasource '${name}': connect denied by policy${decision.reason ? ` (${decision.reason})` : ""}`)]);
+      return { name, status: "skipped-policy", reason: decision.reason };
+    }
+    if (!factory || !_optionalChain([engine, 'optionalAccess', _50 => _50.registerDriver])) {
+      _optionalChain([this, 'access', _51 => _51.logger, 'optionalAccess', _52 => _52.debug, 'optionalCall', _53 => _53(`datasource '${name}': no driver factory / engine \u2014 left metadata-only`)]);
+      return { name, status: "skipped-no-infra" };
+    }
+    if (!factory.supports(record.driver)) {
+      return this.handleFailure(
+        record,
+        "skipped-unsupported",
+        `no driver factory supports driver '${record.driver}'`,
+        opts.context
+      );
+    }
+    let secret;
+    const credentialsRef = _optionalChain([record, 'access', _54 => _54.external, 'optionalAccess', _55 => _55.credentialsRef]);
+    if (credentialsRef) {
+      const resolver = _optionalChain([this, 'access', _56 => _56.cfg, 'access', _57 => _57.secrets, 'optionalAccess', _58 => _58.resolve]);
+      if (!resolver) {
+        return this.handleFailure(
+          record,
+          "failed-credentials",
+          `requires credential '${credentialsRef}' but no secret store (SecretBinder/ICryptoProvider) is configured`,
+          opts.context
+        );
+      }
+      try {
+        secret = await resolver(credentialsRef);
+      } catch (err) {
+        return this.handleFailure(record, "failed-credentials", `resolving credential '${credentialsRef}' threw: ${errMsg(err)}`, opts.context);
+      }
+      if (secret == null || secret === "") {
+        return this.handleFailure(
+          record,
+          "failed-credentials",
+          `credential '${credentialsRef}' could not be resolved or decrypted (missing sys_secret row, or the encryption key changed)`,
+          opts.context
+        );
+      }
+    }
+    try {
+      const handle = await factory.create({ ...toSpec(record), ...secret ? { secret } : {} });
+      if (typeof _optionalChain([handle, 'optionalAccess', _59 => _59.connect]) === "function") await handle.connect();
+      const engineDriver = _nullishCoalesce(handle.driver, () => ( handle));
+      try {
+        engineDriver.name = name;
+      } catch (e2) {
+      }
+      engine.registerDriver(engineDriver);
+      _optionalChain([engine, 'access', _60 => _60.registerDatasourceDef, 'optionalCall', _61 => _61({
+        name,
+        schemaMode: record.schemaMode,
+        external: record.external
+      })]);
+      for (const objectName of _nullishCoalesce(opts.objects, () => ( []))) {
+        try {
+          await _optionalChain([engine, 'access', _62 => _62.syncObjectSchema, 'optionalCall', _63 => _63(objectName)]);
+        } catch (err) {
+          _optionalChain([this, 'access', _64 => _64.logger, 'optionalAccess', _65 => _65.warn, 'optionalCall', _66 => _66(`datasource '${name}': syncObjectSchema('${objectName}') failed: ${errMsg(err)}`)]);
+        }
+      }
+      _optionalChain([this, 'access', _67 => _67.logger, 'optionalAccess', _68 => _68.info, 'optionalCall', _69 => _69(`datasource '${name}': connected (driver=${record.driver}, schemaMode=${_nullishCoalesce(record.schemaMode, () => ( "managed"))})`)]);
+      return { name, status: "connected" };
+    } catch (err) {
+      return this.handleFailure(record, "failed-degraded", errMsg(err), opts.context);
+    }
+  }
+  /** Gracefully disconnect a previously-registered datasource pool. */
+  async disconnect(name) {
+    const driver = _optionalChain([this, 'access', _70 => _70.cfg, 'access', _71 => _71.engine, 'call', _72 => _72(), 'optionalAccess', _73 => _73.getDriverByName, 'optionalCall', _74 => _74(name)]);
+    if (typeof _optionalChain([driver, 'optionalAccess', _75 => _75.disconnect]) === "function") {
+      try {
+        await driver.disconnect();
+      } catch (err) {
+        _optionalChain([this, 'access', _76 => _76.logger, 'optionalAccess', _77 => _77.warn, 'optionalCall', _78 => _78(`datasource '${name}': disconnect failed: ${errMsg(err)}`)]);
+      }
+    }
+  }
+  /**
+   * Apply the D5 connect-failure policy (also covers D3 credential failures). A
+   * code-defined `external` datasource with `onMismatch:'fail'` auto-connected at
+   * boot re-throws (fail-fast, bricking boot as intended). Runtime-admin
+   * create/update + boot rehydration always degrade-with-warning — a UI action
+   * or a replica blip must never brick the running server (preserves the
+   * pre-ADR-0062 admin behavior). Either way the datasource is left unconnected
+   * with a clear message — never a silent skip.
+   */
+  handleFailure(record, status, reason, context) {
+    const isExternal = record.schemaMode && record.schemaMode !== "managed";
+    const failFast = _optionalChain([context, 'optionalAccess', _79 => _79.trigger]) === "declared-auto" && isExternal && _optionalChain([record, 'access', _80 => _80.external, 'optionalAccess', _81 => _81.validation, 'optionalAccess', _82 => _82.onMismatch]) === "fail";
+    const msg = `datasource '${record.name}': connect failed \u2014 ${reason}`;
+    if (failFast) {
+      throw new Error(
+        `${msg}. (schemaMode=${record.schemaMode}, validation.onMismatch='fail' \u21D2 fail-fast per ADR-0062 D5)`
+      );
+    }
+    _optionalChain([this, 'access', _83 => _83.logger, 'optionalAccess', _84 => _84.warn, 'optionalCall', _85 => _85(`${msg} \u2014 degrading (datasource left unconnected)`)]);
+    return { name: record.name, status, reason };
+  }
+};
+function toSpec(record) {
+  return {
+    name: record.name,
+    driver: record.driver,
+    config: _nullishCoalesce(record.config, () => ( {})),
+    external: record.external,
+    pool: record.pool
+  };
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/datasource-admin-service.ts
 var NAME_RE = /^[a-z_][a-z0-9_]*$/;
 var DatasourceAdminService = class {
@@ -376,22 +575,45 @@ var DatasourceAdminService = class {
         origin: slot.code ? "code" : "runtime",
         active: _nullishCoalesce(effective.active, () => ( true)),
         status: "unvalidated",
-        ..._optionalChain([slot, 'access', _38 => _38.code, 'optionalAccess', _39 => _39.definedIn]) ? { definedIn: slot.code.definedIn } : {},
+        ..._optionalChain([slot, 'access', _86 => _86.code, 'optionalAccess', _87 => _87.definedIn]) ? { definedIn: slot.code.definedIn } : {},
         ...slot.code && slot.runtime ? { conflictsWithCode: true } : {}
       });
     }
     return summaries;
   }
+  /**
+   * Read one datasource's full detail for editing, with the credential stripped.
+   * Returns `config` (non-sensitive — credentials live in `sys_secret`, never in
+   * config), `origin`, and a `hasSecret` flag so the UI can show "leave blank to
+   * keep" without ever receiving the `credentialsRef` or any cleartext. Returns
+   * `undefined` when the name is unknown.
+   */
+  async getDatasource(name) {
+    const rec = await this.config.getDatasourceRecord(name);
+    if (!rec) return void 0;
+    const hasSecret = Boolean(_optionalChain([rec, 'access', _88 => _88.external, 'optionalAccess', _89 => _89.credentialsRef]));
+    return {
+      name: rec.name,
+      label: rec.label,
+      driver: rec.driver,
+      schemaMode: _nullishCoalesce(rec.schemaMode, () => ( "managed")),
+      config: _nullishCoalesce(rec.config, () => ( {})),
+      active: _nullishCoalesce(rec.active, () => ( true)),
+      origin: rec.origin === "runtime" ? "runtime" : "code",
+      hasSecret,
+      ...rec.definedIn ? { definedIn: rec.definedIn } : {}
+    };
+  }
   async testConnection(input, secret) {
-    if (!_optionalChain([input, 'optionalAccess', _40 => _40.driver])) {
+    if (!_optionalChain([input, 'optionalAccess', _90 => _90.driver])) {
       return { ok: false, error: "A driver is required to test a connection." };
     }
-    const queryTimeoutMs = _optionalChain([input, 'access', _41 => _41.external, 'optionalAccess', _42 => _42.queryTimeoutMs]);
+    const queryTimeoutMs = _optionalChain([input, 'access', _91 => _91.external, 'optionalAccess', _92 => _92.queryTimeoutMs]);
     try {
       return await this.config.probe({
         driver: input.driver,
         config: _nullishCoalesce(input.config, () => ( {})),
-        secret: _optionalChain([secret, 'optionalAccess', _43 => _43.value]),
+        secret: _optionalChain([secret, 'optionalAccess', _93 => _93.value]),
         external: input.external,
         ...typeof queryTimeoutMs === "number" ? { timeoutMs: queryTimeoutMs } : {}
       });
@@ -400,7 +622,7 @@ var DatasourceAdminService = class {
     }
   }
   async createDatasource(input, secret) {
-    this.assertValidName(_optionalChain([input, 'optionalAccess', _44 => _44.name]));
+    this.assertValidName(_optionalChain([input, 'optionalAccess', _94 => _94.name]));
     if (!input.driver) throw new Error("A driver is required to create a datasource.");
     const existing = await this.config.getDatasourceRecord(input.name);
     if (existing) {
@@ -441,10 +663,10 @@ var DatasourceAdminService = class {
       origin: "runtime"
     };
     if (patch.external !== void 0) {
-      merged.external = { ...patch.external, credentialsRef: _optionalChain([existing, 'access', _45 => _45.external, 'optionalAccess', _46 => _46.credentialsRef]) };
+      merged.external = { ...patch.external, credentialsRef: _optionalChain([existing, 'access', _95 => _95.external, 'optionalAccess', _96 => _96.credentialsRef]) };
     }
     if (secret) {
-      const prevRef = _optionalChain([existing, 'access', _47 => _47.external, 'optionalAccess', _48 => _48.credentialsRef]);
+      const prevRef = _optionalChain([existing, 'access', _97 => _97.external, 'optionalAccess', _98 => _98.credentialsRef]);
       const credentialsRef = await this.config.writeSecret(secret, { name });
       merged.external = { ..._nullishCoalesce(merged.external, () => ( {})), credentialsRef };
       if (prevRef && prevRef !== credentialsRef) await this.tryRemoveSecret(prevRef);
@@ -466,7 +688,7 @@ var DatasourceAdminService = class {
       );
     }
     await this.config.deleteDatasourceRecord(name);
-    if (_optionalChain([existing, 'access', _49 => _49.external, 'optionalAccess', _50 => _50.credentialsRef])) await this.tryRemoveSecret(existing.external.credentialsRef);
+    if (_optionalChain([existing, 'access', _99 => _99.external, 'optionalAccess', _100 => _100.credentialsRef])) await this.tryRemoveSecret(existing.external.credentialsRef);
     await this.tryUnregisterPool(name);
   }
   // --- internals -----------------------------------------------------------
@@ -502,29 +724,80 @@ var DatasourceAdminService = class {
   }
   async tryRegisterPool(record) {
     try {
-      await _optionalChain([this, 'access', _51 => _51.config, 'access', _52 => _52.registerPool, 'optionalCall', _53 => _53(record)]);
+      await _optionalChain([this, 'access', _101 => _101.config, 'access', _102 => _102.registerPool, 'optionalCall', _103 => _103(record)]);
     } catch (err) {
-      _optionalChain([this, 'access', _54 => _54.logger, 'optionalAccess', _55 => _55.warn, 'call', _56 => _56(`registerPool('${record.name}') failed`, err)]);
+      _optionalChain([this, 'access', _104 => _104.logger, 'optionalAccess', _105 => _105.warn, 'call', _106 => _106(`registerPool('${record.name}') failed`, err)]);
     }
   }
   async tryUnregisterPool(name) {
     try {
-      await _optionalChain([this, 'access', _57 => _57.config, 'access', _58 => _58.unregisterPool, 'optionalCall', _59 => _59(name)]);
+      await _optionalChain([this, 'access', _107 => _107.config, 'access', _108 => _108.unregisterPool, 'optionalCall', _109 => _109(name)]);
     } catch (err) {
-      _optionalChain([this, 'access', _60 => _60.logger, 'optionalAccess', _61 => _61.warn, 'call', _62 => _62(`unregisterPool('${name}') failed`, err)]);
+      _optionalChain([this, 'access', _110 => _110.logger, 'optionalAccess', _111 => _111.warn, 'call', _112 => _112(`unregisterPool('${name}') failed`, err)]);
     }
   }
   async tryRemoveSecret(credentialsRef) {
     try {
-      await _optionalChain([this, 'access', _63 => _63.config, 'access', _64 => _64.removeSecret, 'optionalCall', _65 => _65(credentialsRef)]);
+      await _optionalChain([this, 'access', _113 => _113.config, 'access', _114 => _114.removeSecret, 'optionalCall', _115 => _115(credentialsRef)]);
     } catch (err) {
-      _optionalChain([this, 'access', _66 => _66.logger, 'optionalAccess', _67 => _67.warn, 'call', _68 => _68(`removeSecret('${credentialsRef}') failed`, err)]);
+      _optionalChain([this, 'access', _116 => _116.logger, 'optionalAccess', _117 => _117.warn, 'call', _118 => _118(`removeSecret('${credentialsRef}') failed`, err)]);
     }
   }
 };
 
 // src/datasource-admin-plugin.ts
 var _kernel = require('@objectstack/spec/kernel');
+var DS_META_TYPE = "datasource";
+var SYS_METADATA = "sys_metadata";
+function newMetaId() {
+  return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `meta_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+async function persistDatasourceRow(engine, record) {
+  if (!_optionalChain([engine, 'optionalAccess', _119 => _119.insert]) || !engine.findOne) return;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = await engine.findOne(SYS_METADATA, {
+    where: { type: DS_META_TYPE, name: record.name, state: "active" }
+  });
+  if (existing) {
+    await _optionalChain([engine, 'access', _120 => _120.update, 'optionalCall', _121 => _121(
+      SYS_METADATA,
+      { metadata: JSON.stringify(record), updated_at: now, version: (existing.version || 0) + 1, state: "active" },
+      { where: { id: existing.id } }
+    )]);
+  } else {
+    await engine.insert(SYS_METADATA, {
+      id: newMetaId(),
+      name: record.name,
+      type: DS_META_TYPE,
+      scope: "platform",
+      metadata: JSON.stringify(record),
+      state: "active",
+      version: 1,
+      created_at: now,
+      updated_at: now
+    });
+  }
+}
+async function deleteDatasourceRow(engine, name) {
+  if (!_optionalChain([engine, 'optionalAccess', _122 => _122.findOne])) return;
+  const existing = await engine.findOne(SYS_METADATA, { where: { type: DS_META_TYPE, name, state: "active" } });
+  if (!existing) return;
+  if (engine.delete) await engine.delete(SYS_METADATA, { where: { id: existing.id } });
+  else await _optionalChain([engine, 'access', _123 => _123.update, 'optionalCall', _124 => _124(SYS_METADATA, { state: "inactive" }, { where: { id: existing.id } })]);
+}
+async function loadDatasourceRows(engine) {
+  if (!_optionalChain([engine, 'optionalAccess', _125 => _125.find])) return [];
+  const rows = await engine.find(SYS_METADATA, { where: { type: DS_META_TYPE, state: "active" } });
+  const out = [];
+  for (const r of _nullishCoalesce(rows, () => ( []))) {
+    const raw = r.metadata;
+    try {
+      out.push(typeof raw === "string" ? JSON.parse(raw) : raw);
+    } catch (e3) {
+    }
+  }
+  return out;
+}
 var DatasourceAdminServicePlugin = class {
   constructor(options = {}) {
     this.name = "com.objectstack.service-datasource-admin";
@@ -551,33 +824,43 @@ var DatasourceAdminServicePlugin = class {
     const metadataOf = () => safeGetService2(ctx, "metadata");
     const engineOf = () => safeGetService2(ctx, "data");
     const factory = () => _nullishCoalesce(this.options.driverFactory, () => ( safeGetService2(ctx, "datasource-driver-factory")));
+    this.connection = new DatasourceConnectionService({
+      factory,
+      engine: () => engineOf(),
+      secrets: { resolve: (ref) => _nullishCoalesce(_optionalChain([this, 'access', _126 => _126.options, 'access', _127 => _127.secrets, 'optionalAccess', _128 => _128.resolve, 'optionalCall', _129 => _129(ref)]), () => ( Promise.resolve(void 0))) },
+      policy: this.options.connectPolicy,
+      logger: this.options.logger
+    });
+    ctx.registerService("datasource-connection", this.connection);
     const config = {
       probe: (input) => this.probe(factory(), input),
       listDatasourceRecords: async () => {
-        const rows = await _asyncNullishCoalesce(await _optionalChain([metadataOf, 'call', _69 => _69(), 'optionalAccess', _70 => _70.list, 'call', _71 => _71("datasource")]), async () => ( []));
+        const rows = await _asyncNullishCoalesce(await _optionalChain([metadataOf, 'call', _130 => _130(), 'optionalAccess', _131 => _131.list, 'call', _132 => _132("datasource")]), async () => ( []));
         return rows.map((r) => ({ ...r, origin: _nullishCoalesce(r.origin, () => ( "code")) }));
       },
       getDatasourceRecord: async (name) => {
-        const row = await _optionalChain([metadataOf, 'call', _72 => _72(), 'optionalAccess', _73 => _73.get, 'call', _74 => _74("datasource", name)]);
+        const row = await _optionalChain([metadataOf, 'call', _133 => _133(), 'optionalAccess', _134 => _134.get, 'call', _135 => _135("datasource", name)]);
         return row ? { ...row, origin: _nullishCoalesce(row.origin, () => ( "code")) } : void 0;
       },
       putDatasourceRecord: async (record) => {
         const metadata = metadataOf();
-        if (!_optionalChain([metadata, 'optionalAccess', _75 => _75.register])) {
+        if (!_optionalChain([metadata, 'optionalAccess', _136 => _136.register])) {
           throw new Error("Metadata service is unavailable; cannot persist datasource.");
         }
         await metadata.register("datasource", record.name, record);
+        await persistDatasourceRow(engineOf(), record);
       },
       deleteDatasourceRecord: async (name) => {
         const metadata = metadataOf();
-        if (!_optionalChain([metadata, 'optionalAccess', _76 => _76.unregister])) {
+        if (!_optionalChain([metadata, 'optionalAccess', _137 => _137.unregister])) {
           throw new Error("Metadata service is unavailable; cannot remove datasource.");
         }
         await metadata.unregister("datasource", name);
+        await deleteDatasourceRow(engineOf(), name);
       },
       writeSecret: async (input, hint) => {
         const binder = this.options.secrets;
-        if (!_optionalChain([binder, 'optionalAccess', _77 => _77.bind])) {
+        if (!_optionalChain([binder, 'optionalAccess', _138 => _138.bind])) {
           throw new Error(
             "No secret store configured: refusing to persist a datasource credential in cleartext. Wire a SecretBinder (CryptoProvider + sys_secret) into DatasourceAdminServicePlugin."
           );
@@ -585,47 +868,97 @@ var DatasourceAdminServicePlugin = class {
         return binder.bind(input, hint);
       },
       removeSecret: async (ref) => {
-        await _optionalChain([this, 'access', _78 => _78.options, 'access', _79 => _79.secrets, 'optionalAccess', _80 => _80.unbind, 'optionalCall', _81 => _81(ref)]);
+        await _optionalChain([this, 'access', _139 => _139.options, 'access', _140 => _140.secrets, 'optionalAccess', _141 => _141.unbind, 'optionalCall', _142 => _142(ref)]);
       },
       countBoundObjects: async (datasource) => {
         const metadata = metadataOf();
-        const objects = await _asyncNullishCoalesce(await _asyncNullishCoalesce(await _optionalChain([metadata, 'optionalAccess', _82 => _82.listObjects, 'optionalCall', _83 => _83()]), async () => ( await _optionalChain([metadata, 'optionalAccess', _84 => _84.list, 'call', _85 => _85("object")]))), async () => ( []));
-        return objects.filter((o) => _optionalChain([o, 'optionalAccess', _86 => _86.datasource]) === datasource).length;
+        const objects = await _asyncNullishCoalesce(await _asyncNullishCoalesce(await _optionalChain([metadata, 'optionalAccess', _143 => _143.listObjects, 'optionalCall', _144 => _144()]), async () => ( await _optionalChain([metadata, 'optionalAccess', _145 => _145.list, 'call', _146 => _146("object")]))), async () => ( []));
+        return objects.filter((o) => _optionalChain([o, 'optionalAccess', _147 => _147.datasource]) === datasource).length;
       },
+      // Hot pool (de)registration converges on the shared
+      // DatasourceConnectionService (ADR-0062 D1) — one connect path for code-
+      // and runtime-origin datasources. `connect()` builds the driver via the
+      // factory, dereferences `external.credentialsRef` through the SecretBinder,
+      // opens the connection, and registers the live driver + datasource def.
+      // Runtime-admin connects always degrade-with-warning on failure (never
+      // fail-fast), preserving the pre-ADR-0062 admin behavior.
       registerPool: async (record) => {
-        const f = factory();
-        const engine = engineOf();
-        if (!f || !_optionalChain([engine, 'optionalAccess', _87 => _87.registerDriver]) || !f.supports(record.driver)) return;
-        const credentialsRef = _optionalChain([record, 'access', _88 => _88.external, 'optionalAccess', _89 => _89.credentialsRef]);
-        const secret = credentialsRef ? await _optionalChain([this, 'access', _90 => _90.options, 'access', _91 => _91.secrets, 'optionalAccess', _92 => _92.resolve, 'optionalCall', _93 => _93(credentialsRef)]) : void 0;
-        const handle = await f.create({ ...this.toSpec(record), ...secret ? { secret } : {} });
-        if (typeof _optionalChain([handle, 'optionalAccess', _94 => _94.connect]) === "function") await handle.connect();
-        const engineDriver = _nullishCoalesce(handle.driver, () => ( handle));
-        try {
-          engineDriver.name = record.name;
-        } catch (e2) {
-        }
-        engine.registerDriver(engineDriver);
-        _optionalChain([engine, 'access', _95 => _95.registerDatasourceDef, 'optionalCall', _96 => _96({
-          name: record.name,
-          schemaMode: record.schemaMode,
-          external: record.external
+        await _optionalChain([this, 'access', _148 => _148.connection, 'optionalAccess', _149 => _149.connect, 'call', _150 => _150(record, {
+          context: { origin: _nullishCoalesce(record.origin, () => ( "runtime")), trigger: "runtime-admin" }
         })]);
       },
       unregisterPool: async (name) => {
-        const driver = _optionalChain([engineOf, 'call', _97 => _97(), 'optionalAccess', _98 => _98.getDriverByName, 'optionalCall', _99 => _99(name)]);
-        if (typeof _optionalChain([driver, 'optionalAccess', _100 => _100.disconnect]) === "function") await driver.disconnect();
+        await _optionalChain([this, 'access', _151 => _151.connection, 'optionalAccess', _152 => _152.disconnect, 'call', _153 => _153(name)]);
       },
       logger
     };
     this.config = config;
     this.service = new DatasourceAdminService(config);
     ctx.registerService("datasource-admin", this.service);
+    try {
+      const manifest = ctx.getService("manifest");
+      if (manifest && typeof manifest.register === "function") {
+        manifest.register({
+          id: "com.objectstack.service-datasource.nav",
+          namespace: "sys",
+          version: this.version,
+          type: "plugin",
+          scope: "system",
+          name: "Datasource Navigation",
+          description: "Contributes the Datasources entry to the Setup app Integrations group.",
+          navigationContributions: [
+            {
+              app: "setup",
+              group: "group_integrations",
+              priority: 100,
+              items: [
+                {
+                  id: "nav_datasources",
+                  type: "url",
+                  label: "Datasources",
+                  url: "/apps/setup/component/metadata/resource?type=datasource",
+                  icon: "database",
+                  requiredPermissions: ["manage_platform_settings"]
+                }
+              ]
+            }
+          ]
+        });
+      }
+    } catch (err) {
+      _optionalChain([this, 'access', _154 => _154.options, 'access', _155 => _155.logger, 'optionalAccess', _156 => _156.warn, 'optionalCall', _157 => _157("datasource nav contribution skipped", err)]);
+    }
   }
   async start(ctx) {
+    await this.restoreRuntimeDatasources(ctx);
     await this.rehydratePools();
     if (this.service) await ctx.trigger("datasource-admin:ready", this.service);
   }
+  /** Reload persisted runtime datasource rows (sys_metadata) into the registry. */
+  async restoreRuntimeDatasources(ctx) {
+    const engine = safeGetService2(ctx, "data");
+    const metadata = safeGetService2(ctx, "metadata");
+    if (!_optionalChain([engine, 'optionalAccess', _158 => _158.find]) || !_optionalChain([metadata, 'optionalAccess', _159 => _159.register])) return;
+    let rows;
+    try {
+      rows = await loadDatasourceRows(engine);
+    } catch (err) {
+      _optionalChain([this, 'access', _160 => _160.options, 'access', _161 => _161.logger, 'optionalAccess', _162 => _162.warn, 'optionalCall', _163 => _163("datasource restore: reading sys_metadata failed", err)]);
+      return;
+    }
+    let restored = 0;
+    for (const rec of rows) {
+      const name = rec.name;
+      if (!name) continue;
+      try {
+        await metadata.register("datasource", name, rec);
+        restored += 1;
+      } catch (err) {
+        _optionalChain([this, 'access', _164 => _164.options, 'access', _165 => _165.logger, 'optionalAccess', _166 => _166.warn, 'optionalCall', _167 => _167(`datasource restore: register '${name}' failed`, err)]);
+      }
+    }
+    if (restored > 0) _optionalChain([this, 'access', _168 => _168.options, 'access', _169 => _169.logger, 'optionalAccess', _170 => _170.info, 'optionalCall', _171 => _171(`datasource: restored ${restored} runtime record(s) from sys_metadata`)]);
+  }
   /**
    * Boot-time rehydration: list persisted runtime datasources and re-register
    * each one's connection pool (driver build → connect → registerDriver),
@@ -637,12 +970,12 @@ var DatasourceAdminServicePlugin = class {
    */
   async rehydratePools() {
     const cfg = this.config;
-    if (!_optionalChain([cfg, 'optionalAccess', _101 => _101.registerPool]) || !cfg.listDatasourceRecords) return;
+    if (!_optionalChain([cfg, 'optionalAccess', _172 => _172.registerPool]) || !cfg.listDatasourceRecords) return;
     let records;
     try {
       records = await cfg.listDatasourceRecords();
     } catch (err) {
-      _optionalChain([this, 'access', _102 => _102.options, 'access', _103 => _103.logger, 'optionalAccess', _104 => _104.warn, 'optionalCall', _105 => _105("datasource rehydrate: listing records failed", err)]);
+      _optionalChain([this, 'access', _173 => _173.options, 'access', _174 => _174.logger, 'optionalAccess', _175 => _175.warn, 'optionalCall', _176 => _176("datasource rehydrate: listing records failed", err)]);
       return;
     }
     const runtime = records.filter((r) => r.origin === "runtime" && (_nullishCoalesce(r.active, () => ( true))));
@@ -653,10 +986,10 @@ var DatasourceAdminServicePlugin = class {
         await cfg.registerPool(record);
         registered++;
       } catch (err) {
-        _optionalChain([this, 'access', _106 => _106.options, 'access', _107 => _107.logger, 'optionalAccess', _108 => _108.warn, 'optionalCall', _109 => _109(`datasource rehydrate: pool '${record.name}' failed`, err)]);
+        _optionalChain([this, 'access', _177 => _177.options, 'access', _178 => _178.logger, 'optionalAccess', _179 => _179.warn, 'optionalCall', _180 => _180(`datasource rehydrate: pool '${record.name}' failed`, err)]);
       }
     }
-    _optionalChain([this, 'access', _110 => _110.options, 'access', _111 => _111.logger, 'optionalAccess', _112 => _112.info, 'optionalCall', _113 => _113(
+    _optionalChain([this, 'access', _181 => _181.options, 'access', _182 => _182.logger, 'optionalAccess', _183 => _183.info, 'optionalCall', _184 => _184(
       `Rehydrated ${registered}/${runtime.length} runtime datasource pool(s) on boot`
     )]);
   }
@@ -664,15 +997,6 @@ var DatasourceAdminServicePlugin = class {
     this.service = void 0;
   }
   // --- internals -----------------------------------------------------------
-  toSpec(record) {
-    return {
-      name: record.name,
-      driver: record.driver,
-      config: _nullishCoalesce(record.config, () => ( {})),
-      external: record.external,
-      pool: record.pool
-    };
-  }
   /** Probe a connection via the driver factory: build → connect → ping → close. */
   async probe(factory, input) {
     if (!factory) {
@@ -690,27 +1014,27 @@ var DatasourceAdminServicePlugin = class {
         external: input.external
       });
     } catch (err) {
-      return { ok: false, error: `Failed to build driver: ${errMsg(err)}` };
+      return { ok: false, error: `Failed to build driver: ${errMsg2(err)}` };
     }
     const startedAt = monotonicNow();
     try {
-      if (typeof _optionalChain([driver, 'optionalAccess', _114 => _114.connect]) === "function") await driver.connect();
-      if (typeof _optionalChain([driver, 'optionalAccess', _115 => _115.ping]) === "function") await driver.ping();
-      else if (typeof _optionalChain([driver, 'optionalAccess', _116 => _116.checkHealth]) === "function") await driver.checkHealth();
-      else if (typeof _optionalChain([driver, 'optionalAccess', _117 => _117.introspectSchema]) === "function") await driver.introspectSchema();
+      if (typeof _optionalChain([driver, 'optionalAccess', _185 => _185.connect]) === "function") await driver.connect();
+      if (typeof _optionalChain([driver, 'optionalAccess', _186 => _186.ping]) === "function") await driver.ping();
+      else if (typeof _optionalChain([driver, 'optionalAccess', _187 => _187.checkHealth]) === "function") await driver.checkHealth();
+      else if (typeof _optionalChain([driver, 'optionalAccess', _188 => _188.introspectSchema]) === "function") await driver.introspectSchema();
       const latencyMs = elapsedSince(startedAt);
       let serverVersion;
       try {
-        serverVersion = typeof _optionalChain([driver, 'optionalAccess', _118 => _118.serverVersion]) === "function" ? await driver.serverVersion() : void 0;
-      } catch (e3) {
+        serverVersion = typeof _optionalChain([driver, 'optionalAccess', _189 => _189.serverVersion]) === "function" ? await driver.serverVersion() : void 0;
+      } catch (e4) {
       }
       return { ok: true, latencyMs, ...serverVersion ? { serverVersion } : {} };
     } catch (err) {
-      return { ok: false, error: errMsg(err) };
+      return { ok: false, error: errMsg2(err) };
     } finally {
       try {
-        if (typeof _optionalChain([driver, 'optionalAccess', _119 => _119.disconnect]) === "function") await driver.disconnect();
-      } catch (e4) {
+        if (typeof _optionalChain([driver, 'optionalAccess', _190 => _190.disconnect]) === "function") await driver.disconnect();
+      } catch (e5) {
       }
     }
   }
@@ -718,16 +1042,16 @@ var DatasourceAdminServicePlugin = class {
 function safeGetService2(ctx, name) {
   try {
     return ctx.getService(name);
-  } catch (e5) {
+  } catch (e6) {
     return void 0;
   }
 }
-function errMsg(err) {
+function errMsg2(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function monotonicNow() {
   const perf = globalThis.performance;
-  return typeof _optionalChain([perf, 'optionalAccess', _120 => _120.now]) === "function" ? perf.now() : 0;
+  return typeof _optionalChain([perf, 'optionalAccess', _191 => _191.now]) === "function" ? perf.now() : 0;
 }
 function elapsedSince(startedAt) {
   return Math.max(0, Math.round(monotonicNow() - startedAt));
@@ -752,10 +1076,10 @@ function resolveKind(driverId) {
 }
 function toHandle(driver, serverVersion) {
   return {
-    connect: typeof _optionalChain([driver, 'optionalAccess', _121 => _121.connect]) === "function" ? () => driver.connect() : void 0,
-    disconnect: typeof _optionalChain([driver, 'optionalAccess', _122 => _122.disconnect]) === "function" ? () => driver.disconnect() : void 0,
-    checkHealth: typeof _optionalChain([driver, 'optionalAccess', _123 => _123.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
-    ping: typeof _optionalChain([driver, 'optionalAccess', _124 => _124.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
+    connect: typeof _optionalChain([driver, 'optionalAccess', _192 => _192.connect]) === "function" ? () => driver.connect() : void 0,
+    disconnect: typeof _optionalChain([driver, 'optionalAccess', _193 => _193.disconnect]) === "function" ? () => driver.disconnect() : void 0,
+    checkHealth: typeof _optionalChain([driver, 'optionalAccess', _194 => _194.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
+    ping: typeof _optionalChain([driver, 'optionalAccess', _195 => _195.checkHealth]) === "function" ? () => driver.checkHealth() : void 0,
     ...serverVersion ? { serverVersion } : {},
     driver
   };
@@ -800,7 +1124,7 @@ function createDefaultDatasourceDriverFactory() {
       if (!kind) {
         throw new Error(`Unsupported driver id '${spec.driver}'.`);
       }
-      const schemaMode = _nullishCoalesce(_optionalChain([spec, 'access', _125 => _125.external, 'optionalAccess', _126 => _126.schemaMode]), () => ( _optionalChain([spec, 'access', _127 => _127.config, 'optionalAccess', _128 => _128.schemaMode])));
+      const schemaMode = _nullishCoalesce(_optionalChain([spec, 'access', _196 => _196.external, 'optionalAccess', _197 => _197.schemaMode]), () => ( _optionalChain([spec, 'access', _198 => _198.config, 'optionalAccess', _199 => _199.schemaMode])));
       if (kind === "postgres") {
         const { SqlDriver } = await Promise.resolve().then(() => _interopRequireWildcard(require("@objectstack/driver-sql")));
         const driver = new SqlDriver({
@@ -827,7 +1151,7 @@ function createDefaultDatasourceDriverFactory() {
           ({ MongoDBDriver } = await Promise.resolve().then(() => _interopRequireWildcard(require("@objectstack/driver-mongodb"))));
         } catch (err) {
           throw new Error(
-            `mongodb driver requested but @objectstack/driver-mongodb is not installed (${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _129 => _129.message]), () => ( err))}).`
+            `mongodb driver requested but @objectstack/driver-mongodb is not installed (${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _200 => _200.message]), () => ( err))}).`
           );
         }
         const driver = new MongoDBDriver({ url: buildMongoUrl(spec) });
@@ -839,14 +1163,14 @@ function createDefaultDatasourceDriverFactory() {
   };
 }
 async function sqlServerVersion(driver, client) {
-  if (typeof _optionalChain([driver, 'optionalAccess', _130 => _130.execute]) !== "function") return void 0;
+  if (typeof _optionalChain([driver, 'optionalAccess', _201 => _201.execute]) !== "function") return void 0;
   try {
     const sql = client === "pg" ? "SELECT version() AS v" : "SELECT sqlite_version() AS v";
     const rows = await driver.execute(sql);
-    const first = Array.isArray(rows) ? rows[0] : Array.isArray(_optionalChain([rows, 'optionalAccess', _131 => _131.rows])) ? rows.rows[0] : rows;
-    const v = _nullishCoalesce(_nullishCoalesce(_optionalChain([first, 'optionalAccess', _132 => _132.v]), () => ( _optionalChain([first, 'optionalAccess', _133 => _133.version]))), () => ( _optionalChain([first, 'optionalAccess', _134 => _134["sqlite_version()"]])));
+    const first = Array.isArray(rows) ? rows[0] : Array.isArray(_optionalChain([rows, 'optionalAccess', _202 => _202.rows])) ? rows.rows[0] : rows;
+    const v = _nullishCoalesce(_nullishCoalesce(_optionalChain([first, 'optionalAccess', _203 => _203.v]), () => ( _optionalChain([first, 'optionalAccess', _204 => _204.version]))), () => ( _optionalChain([first, 'optionalAccess', _205 => _205["sqlite_version()"]])));
     return typeof v === "string" ? v : void 0;
-  } catch (e6) {
+  } catch (e7) {
     return void 0;
   }
 }
@@ -857,7 +1181,7 @@ function toCredentialsRef(handleId) {
   return `${REF_PREFIX}${handleId}`;
 }
 function parseCredentialsRef(ref) {
-  return _optionalChain([ref, 'optionalAccess', _135 => _135.startsWith, 'call', _136 => _136(REF_PREFIX)]) ? ref.slice(REF_PREFIX.length) : void 0;
+  return _optionalChain([ref, 'optionalAccess', _206 => _206.startsWith, 'call', _207 => _207(REF_PREFIX)]) ? ref.slice(REF_PREFIX.length) : void 0;
 }
 function createDatasourceSecretBinder(deps) {
   const { engine, cryptoProvider } = deps;
@@ -894,9 +1218,9 @@ function createDatasourceSecretBinder(deps) {
           // skip the tenant-audit warning (mirrors SettingsService's store).
           bypassTenantAudit: true
         });
-        const rows = _nullishCoalesce((Array.isArray(result) ? result : _optionalChain([result, 'optionalAccess', _137 => _137.data])), () => ( []));
+        const rows = _nullishCoalesce((Array.isArray(result) ? result : _optionalChain([result, 'optionalAccess', _208 => _208.data])), () => ( []));
         const row = rows[0];
-        if (!_optionalChain([row, 'optionalAccess', _138 => _138.ciphertext])) return void 0;
+        if (!_optionalChain([row, 'optionalAccess', _209 => _209.ciphertext])) return void 0;
         return await cryptoProvider.decrypt(
           {
             id: row.id,
@@ -907,20 +1231,113 @@ function createDatasourceSecretBinder(deps) {
           },
           { namespace: row.namespace, key: row.key }
         );
-      } catch (e7) {
+      } catch (e8) {
         return void 0;
       }
     }
   };
 }
 
+// src/driver-catalog.ts
+var SSL_PROP = {
+  ssl: { type: "boolean", title: "Use SSL/TLS", default: false }
+};
+var DRIVER_CATALOG = [
+  {
+    id: "memory",
+    label: "In-Memory",
+    description: "Ephemeral in-memory driver for dev, tests, and prototyping. No connection settings.",
+    icon: "memory-stick",
+    configSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    id: "sqlite",
+    label: "SQLite",
+    description: "File-backed (or in-memory) SQL database. Great for local dev and small deployments.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        filename: {
+          type: "string",
+          title: "Filename",
+          description: 'Database file path, or ":memory:" for an ephemeral in-memory database.',
+          default: ":memory:"
+        }
+      },
+      required: ["filename"],
+      additionalProperties: false
+    }
+  },
+  {
+    id: "postgres",
+    label: "PostgreSQL",
+    description: "PostgreSQL connection. Supply host/port/database or a connection URL.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", title: "Connection URL", description: "postgres://user:pass@host:5432/db (overrides the fields below when set)." },
+        host: { type: "string", title: "Host", default: "localhost" },
+        port: { type: "number", title: "Port", default: 5432 },
+        database: { type: "string", title: "Database" },
+        username: { type: "string", title: "User" },
+        password: { type: "string", title: "Password", format: "password" },
+        schema: { type: "string", title: "Schema", default: "public" },
+        ...SSL_PROP
+      },
+      additionalProperties: true
+    }
+  },
+  {
+    id: "mysql",
+    label: "MySQL / MariaDB",
+    description: "MySQL or MariaDB connection.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        host: { type: "string", title: "Host", default: "localhost" },
+        port: { type: "number", title: "Port", default: 3306 },
+        database: { type: "string", title: "Database" },
+        username: { type: "string", title: "User" },
+        password: { type: "string", title: "Password", format: "password" },
+        ...SSL_PROP
+      },
+      additionalProperties: true
+    }
+  },
+  {
+    id: "mongo",
+    label: "MongoDB",
+    description: "MongoDB connection via a connection URI.",
+    icon: "database",
+    configSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", title: "Connection URI", description: "mongodb://host:27017" },
+        database: { type: "string", title: "Database" }
+      },
+      required: ["url"],
+      additionalProperties: true
+    }
+  }
+];
+
 // src/admin-routes.ts
 function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   const root = `${basePath}/datasources`;
   const adminService = () => {
     try {
       return ctx.getService("datasource-admin");
-    } catch (e8) {
+    } catch (e9) {
+      return void 0;
+    }
+  };
+  const externalService = () => {
+    try {
+      return ctx.getService("external-datasource");
+    } catch (e10) {
       return void 0;
     }
   };
@@ -933,13 +1350,59 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   };
   server.get(root, async (_req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _139 => _139.listDatasources])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _210 => _210.listDatasources])) return unavailable(res);
     const datasources = await svc.listDatasources();
     res.json({ datasources });
   });
+  server.get(`${root}/drivers`, async (_req, res) => {
+    res.json({ drivers: DRIVER_CATALOG });
+  });
+  server.get(`${root}/:name/remote-tables`, async (req, res) => {
+    const svc = externalService();
+    if (!_optionalChain([svc, 'optionalAccess', _211 => _211.listRemoteTables])) return unavailable(res);
+    try {
+      const tables = await svc.listRemoteTables(req.params.name);
+      res.json({ tables });
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
+  server.get(`${root}/:name`, async (req, res) => {
+    const svc = adminService();
+    if (!_optionalChain([svc, 'optionalAccess', _212 => _212.getDatasource])) return unavailable(res);
+    try {
+      const datasource = await svc.getDatasource(req.params.name);
+      if (!datasource) return res.status(404).json({ error: "not_found" });
+      res.json({ datasource });
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
+  server.post(`${root}/:name/test`, async (req, res) => {
+    const svc = externalService();
+    if (!_optionalChain([svc, 'optionalAccess', _213 => _213.testConnection])) return unavailable(res);
+    try {
+      const result = await svc.testConnection(req.params.name);
+      res.json(result);
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
+  server.post(`${root}/:name/object-draft`, async (req, res) => {
+    const svc = externalService();
+    if (!_optionalChain([svc, 'optionalAccess', _214 => _214.generateObjectDraft])) return unavailable(res);
+    const { table, ...opts } = _nullishCoalesce(req.body, () => ( {}));
+    if (!table) return badRequest(res, new Error('Body field "table" is required.'));
+    try {
+      const draft = await svc.generateObjectDraft(req.params.name, String(table), opts);
+      res.json({ draft });
+    } catch (err) {
+      badRequest(res, err);
+    }
+  });
   server.post(`${root}/test`, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _140 => _140.testConnection])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _215 => _215.testConnection])) return unavailable(res);
     const { draft, secret } = splitSecret(req.body);
     try {
       const result = await svc.testConnection(draft, secret);
@@ -950,7 +1413,7 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   });
   server.post(root, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _141 => _141.createDatasource])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _216 => _216.createDatasource])) return unavailable(res);
     const { draft, secret } = splitSecret(req.body);
     try {
       const datasource = await svc.createDatasource(draft, secret);
@@ -961,7 +1424,7 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   });
   server.patch(`${root}/:name`, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _142 => _142.updateDatasource])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _217 => _217.updateDatasource])) return unavailable(res);
     const { draft, secret } = splitSecret(req.body);
     try {
       const datasource = await svc.updateDatasource(req.params.name, draft, secret);
@@ -972,7 +1435,7 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
   });
   server.delete(`${root}/:name`, async (req, res) => {
     const svc = adminService();
-    if (!_optionalChain([svc, 'optionalAccess', _143 => _143.removeDatasource])) return unavailable(res);
+    if (!_optionalChain([svc, 'optionalAccess', _218 => _218.removeDatasource])) return unavailable(res);
     try {
       await svc.removeDatasource(req.params.name);
       res.status(204).end();
@@ -991,5 +1454,8 @@ function registerDatasourceAdminRoutes(server, ctx, basePath = "/api/v1") {
 
 
 
-exports.DatasourceAdminService = DatasourceAdminService; exports.DatasourceAdminServicePlugin = DatasourceAdminServicePlugin; exports.ExternalDatasourceService = ExternalDatasourceService; exports.ExternalDatasourceServicePlugin = ExternalDatasourceServicePlugin; exports.createDatasourceSecretBinder = createDatasourceSecretBinder; exports.createDefaultDatasourceDriverFactory = createDefaultDatasourceDriverFactory; exports.parseCredentialsRef = parseCredentialsRef; exports.registerDatasourceAdminRoutes = registerDatasourceAdminRoutes; exports.toCredentialsRef = toCredentialsRef;
+
+
+
+exports.DatasourceAdminService = DatasourceAdminService; exports.DatasourceAdminServicePlugin = DatasourceAdminServicePlugin; exports.DatasourceConnectionService = DatasourceConnectionService; exports.ExternalDatasourceService = ExternalDatasourceService; exports.ExternalDatasourceServicePlugin = ExternalDatasourceServicePlugin; exports.allowAllConnectPolicy = _chunkBI2SYWLCcjs.allowAllConnectPolicy; exports.createDatasourceSecretBinder = createDatasourceSecretBinder; exports.createDefaultDatasourceDriverFactory = createDefaultDatasourceDriverFactory; exports.isDatasourceAddressed = isDatasourceAddressed; exports.parseCredentialsRef = parseCredentialsRef; exports.registerDatasourceAdminRoutes = registerDatasourceAdminRoutes; exports.toCredentialsRef = toCredentialsRef;
 //# sourceMappingURL=index.cjs.map