yamchart 0.10.1 → 0.10.2

package/dist/{dev-H6SJZ5UA.js → dev-KOWFGDOP.js}

@@ -2,7 +2,7 @@ import { createRequire as __yamchartCreateRequire } from 'module'; if (!globalTh
 import {
   loadEnvFile,
   validateProject
-} from "./chunk-S2CH4HUZ.js";
+} from "./chunk-25ES7MGF.js";
 import {
   box,
   detail,
@@ -18,9 +18,10 @@ import {
   filterCatalogEntries
 } from "./chunk-ZMJPRNOA.js";
 import {
+  buildProvider,
   createEmbedder,
   createProviderForTask
-} from "./chunk-64CI3HSY.js";
+} from "./chunk-UOSOZT47.js";
 import {
   BigQueryConnector,
   DuckDBConnector,
@@ -39,7 +40,7 @@ import {
   resolveMySQLAuth,
   resolvePostgresAuth,
   resolveSnowflakeAuth
-} from "./chunk-QUIDZO5G.js";
+} from "./chunk-5CRXV5PQ.js";
 import {
   SemanticModelBuilder,
   SemanticQueryCompiler,
@@ -56,8 +57,9 @@ import {
   isRelativeDateRange,
   loadSemanticDefinitions,
   validateSemanticQuery
-} from "./chunk-UFDQ3C7Q.js";
+} from "./chunk-X3UG6T3Q.js";
 import {
+  AiConfigSchema,
   ChartSchema,
   ConnectionSchema,
   DashboardSchema,
@@ -65,11 +67,14 @@ import {
   EventsFileSchema,
   NewBlindspotSchema,
   ProjectSchema,
+  ProviderConfigSchema,
+  RuntimeConfigSchema,
+  RuntimeConnectionSchema,
   ScheduleSchema,
   SemanticQuerySchema,
   deepMerge,
   resolveProjectConfig
-} from "./chunk-ZIY22VO7.js";
+} from "./chunk-7HWFVUGP.js";
 import {
   AuthDatabase,
   generateOpaqueToken,
@@ -7113,6 +7118,9 @@ var ConfigLoader = class {
   projectDir;
   project = null;
   connections = /* @__PURE__ */ new Map();
+  connectionSecrets = /* @__PURE__ */ new Map();
+  runtimeKnowledgeUrl;
+  runtimeAi;
   charts = /* @__PURE__ */ new Map();
   chartFolders = /* @__PURE__ */ new Map();
   chartFilePaths = /* @__PURE__ */ new Map();
@@ -7133,6 +7141,9 @@ var ConfigLoader = class {
   }
   async load() {
     this.connections.clear();
+    this.connectionSecrets.clear();
+    this.runtimeKnowledgeUrl = void 0;
+    this.runtimeAi = void 0;
     this.charts.clear();
     this.chartFolders.clear();
     this.chartFilePaths.clear();
@@ -7447,6 +7458,31 @@ Fix: run "ulimit -n 10240" before starting yamchart dev, or add it to your shell
   getConnectionByName(name) {
     return this.connections.get(name);
   }
+  /** Merge a runtime config layer over the Git-loaded config. Call after load(). */
+  applyRuntimeOverrides(rc) {
+    for (const rconn of rc.connections ?? []) {
+      const { secrets, ...rest } = rconn;
+      this.connections.set(rconn.name, rest);
+      if (secrets)
+        this.connectionSecrets.set(rconn.name, secrets);
+    }
+    this.runtimeKnowledgeUrl = rc.knowledge?.database_url;
+    this.runtimeAi = rc.ai;
+  }
+  getConnectionSecrets(name) {
+    return this.connectionSecrets.get(name);
+  }
+  /** Knowledge DB URL: runtime override wins, else the named env var. */
+  getKnowledgeDbUrl(envVarName, env) {
+    return this.runtimeKnowledgeUrl ?? env[envVarName];
+  }
+  /** Effective AI config: Git project.ai with the runtime ai deep-merged over it. */
+  getAiConfig() {
+    const base2 = this.project?.ai;
+    if (!this.runtimeAi)
+      return base2;
+    return deepMerge(base2 ?? {}, this.runtimeAi);
+  }
   getCharts() {
     return Array.from(this.charts.values());
   }
@@ -7508,6 +7544,152 @@ Fix: run "ulimit -n 10240" before starting yamchart dev, or add it to your shell
   }
 };
 
+// ../server/dist/services/runtime-config-store.js
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname3, join as join3, isAbsolute } from "path";
+
+// ../server/dist/services/secret-crypto.js
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var ALGO = "aes-256-gcm";
+function deriveKeyFromEnv(env) {
+  const b64 = env.YAMCHART_CONFIG_SECRET;
+  if (!b64)
+    return null;
+  const key = Buffer.from(b64, "base64");
+  if (key.length !== 32) {
+    throw new Error("YAMCHART_CONFIG_SECRET must be a base64-encoded 32-byte key");
+  }
+  return key;
+}
+function getConfigKey(dataDir, env, log) {
+  const fromEnv = deriveKeyFromEnv(env);
+  if (fromEnv)
+    return fromEnv;
+  const keyPath = join2(dataDir, ".config-secret");
+  if (existsSync(keyPath)) {
+    const key2 = Buffer.from(readFileSync(keyPath, "utf8").trim(), "base64");
+    if (key2.length !== 32) {
+      throw new Error(`Key file at ${keyPath} does not contain a 32-byte key (got ${key2.length} bytes). Delete it to regenerate.`);
+    }
+    return key2;
+  }
+  mkdirSync(dirname2(keyPath), { recursive: true });
+  const key = randomBytes(32);
+  writeFileSync(keyPath, key.toString("base64"), { mode: 384 });
+  log?.(`No YAMCHART_CONFIG_SECRET set \u2014 generated a machine-local key at ${keyPath}. Set YAMCHART_CONFIG_SECRET to keep secrets readable across deploys/volumes.`);
+  return key;
+}
+function encryptSecret(plain, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv(ALGO, key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+}
+function decryptSecret(enc, key) {
+  const [ivB64, tagB64, ctB64] = enc.split(":");
+  if (!ivB64 || !tagB64 || !ctB64)
+    throw new Error("Malformed encrypted secret");
+  const decipher = createDecipheriv(ALGO, key, Buffer.from(ivB64, "base64"));
+  decipher.setAuthTag(Buffer.from(tagB64, "base64"));
+  return Buffer.concat([decipher.update(Buffer.from(ctB64, "base64")), decipher.final()]).toString("utf8");
+}
+function maskSecret(plain) {
+  if (plain.length <= 4)
+    return "\u2022\u2022\u2022\u2022";
+  return "\u2022\u2022\u2022\u2022" + plain.slice(-4);
+}
+
+// ../server/dist/services/runtime-config-store.js
+var RuntimeConfigError = class extends Error {
+};
+var SECRET_LEAF_KEYS = /* @__PURE__ */ new Set(["password", "private_key", "credentials_json", "database_url", "api_key"]);
+function transformSecretLeaves(obj, fn) {
+  if (Array.isArray(obj))
+    return obj.map((v) => transformSecretLeaves(v, fn));
+  if (obj && typeof obj === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      out[k] = SECRET_LEAF_KEYS.has(k) && typeof v === "string" ? fn(v) : transformSecretLeaves(v, fn);
+    }
+    return out;
+  }
+  return obj;
+}
+var RuntimeConfigStore = class {
+  filePath;
+  key;
+  constructor(filePath, key) {
+    this.filePath = filePath;
+    this.key = key;
+  }
+  /** Directory the store (and key file) live in — useful for getConfigKey(). */
+  get dataDir() {
+    return dirname3(this.filePath);
+  }
+  static resolvePath(opts) {
+    if (opts.env.YAMCHART_RUNTIME_CONFIG)
+      return opts.env.YAMCHART_RUNTIME_CONFIG;
+    if (opts.authDbPath && isAbsolute(opts.authDbPath))
+      return join3(dirname3(opts.authDbPath), "runtime-config.json");
+    return join3(opts.projectDir, ".yamchart", "runtime-config.json");
+  }
+  read() {
+    if (!existsSync2(this.filePath))
+      return { version: 1 };
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync2(this.filePath, "utf8"));
+    } catch (err) {
+      throw new RuntimeConfigError(`runtime-config.json is not valid JSON: ${err.message}`);
+    }
+    let decrypted;
+    try {
+      decrypted = transformSecretLeaves(parsed, (s) => decryptSecret(s, this.key));
+    } catch (err) {
+      throw new RuntimeConfigError(`Could not decrypt runtime-config.json (wrong YAMCHART_CONFIG_SECRET?): ${err.message}`);
+    }
+    const result = RuntimeConfigSchema.safeParse(decrypted);
+    if (!result.success)
+      throw new RuntimeConfigError(`Invalid runtime-config.json: ${result.error.message}`);
+    return result.data;
+  }
+  write(config) {
+    const validated = RuntimeConfigSchema.parse(config);
+    const encrypted = transformSecretLeaves(validated, (s) => encryptSecret(s, this.key));
+    mkdirSync2(dirname3(this.filePath), { recursive: true, mode: 448 });
+    writeFileSync2(this.filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  }
+};
+
+// ../server/dist/services/restart.js
+function requestRestart(env, exit = (c) => process.exit(c), schedule = (fn, ms) => {
+  setTimeout(fn, ms).unref?.();
+}) {
+  if (env.YAMCHART_DEV_CHILD === "1") {
+    schedule(() => exit(75), 150);
+    return { applying: true, restartRequired: false };
+  }
+  return { applying: false, restartRequired: true };
+}
+
+// ../server/dist/services/connection-refs.js
+function findConnectionRefs(connectionName, input) {
+  const refs = [];
+  const resolves = (explicit) => (explicit ?? input.defaultConnection) === connectionName;
+  for (const c of input.charts) {
+    if (resolves(c.source?.connection))
+      refs.push({ kind: "chart", name: c.name });
+  }
+  for (const m of input.models) {
+    if (resolves(m.metadata.connection))
+      refs.push({ kind: "model", name: m.metadata.name });
+  }
+  return refs;
+}
+
 // ../server/dist/services/cache.js
 import { LRUCache } from "lru-cache";
 var MemoryCache = class {
@@ -7804,18 +7986,18 @@ var QueryService = class {
 };
 
 // ../server/dist/services/connector-factory.js
-import { join as join2 } from "path";
+import { join as join4 } from "path";
 function createConnectorFromConfig(connection, options) {
   const { projectDir } = options;
   switch (connection.type) {
     case "duckdb": {
       const duckdbConfig = connection;
-      const dbPath = duckdbConfig.config.path.startsWith("/") ? duckdbConfig.config.path : join2(projectDir, duckdbConfig.config.path);
+      const dbPath = duckdbConfig.config.path.startsWith("/") ? duckdbConfig.config.path : join4(projectDir, duckdbConfig.config.path);
       return new DuckDBConnector({ path: dbPath });
     }
     case "postgres": {
       const pgConnection = connection;
-      const credentials = resolvePostgresAuth(pgConnection);
+      const credentials = resolvePostgresAuth(pgConnection, options.secrets);
       return new PostgresConnector({
         host: pgConnection.config.host,
         port: pgConnection.config.port,
@@ -7832,7 +8014,7 @@ function createConnectorFromConfig(connection, options) {
     }
     case "mysql": {
       const mysqlConnection = connection;
-      const credentials = resolveMySQLAuth(mysqlConnection);
+      const credentials = resolveMySQLAuth(mysqlConnection, options.secrets);
       return new MySQLConnector({
         host: mysqlConnection.config.host,
         port: mysqlConnection.config.port,
@@ -7848,12 +8030,12 @@ function createConnectorFromConfig(connection, options) {
     }
     case "sqlite": {
       const sqliteConnection = connection;
-      const dbPath = sqliteConnection.config.path.startsWith("/") ? sqliteConnection.config.path : sqliteConnection.config.path === ":memory:" ? ":memory:" : join2(projectDir, sqliteConnection.config.path);
+      const dbPath = sqliteConnection.config.path.startsWith("/") ? sqliteConnection.config.path : sqliteConnection.config.path === ":memory:" ? ":memory:" : join4(projectDir, sqliteConnection.config.path);
       return new SQLiteConnector({ path: dbPath });
     }
     case "snowflake": {
       const sfConnection = connection;
-      const credentials = resolveSnowflakeAuth(sfConnection);
+      const credentials = resolveSnowflakeAuth(sfConnection, options.secrets);
       return new SnowflakeConnector({
         account: sfConnection.config.account,
         username: credentials.username,
@@ -7870,8 +8052,8 @@ function createConnectorFromConfig(connection, options) {
     }
     case "bigquery": {
       const bqConnection = connection;
-      const creds = resolveBigQueryAuth(bqConnection);
-      const keyFilename = creds.keyFilename ? creds.keyFilename.startsWith("/") ? creds.keyFilename : join2(projectDir, creds.keyFilename) : void 0;
+      const creds = resolveBigQueryAuth(bqConnection, options.secrets);
+      const keyFilename = creds.keyFilename ? creds.keyFilename.startsWith("/") ? creds.keyFilename : join4(projectDir, creds.keyFilename) : void 0;
       return new BigQueryConnector({
         projectId: bqConnection.config.project_id,
         dataset: bqConnection.config.dataset,
@@ -8004,7 +8186,10 @@ async function configRoutes(fastify, options) {
   });
   fastify.get("/api/connections/status", async () => {
     const connections = configLoader.getConnections();
-    const results = await Promise.all(connections.map((conn) => testConnection(conn, { projectDir: options.projectDir })));
+    const results = await Promise.all(connections.map((conn) => testConnection(conn, {
+      projectDir: options.projectDir,
+      secrets: options.getConnectionSecrets?.(conn.name)
+    })));
     return { connections: results };
   });
   fastify.get("/api/connections/:name/status", async (request, reply) => {
@@ -8013,7 +8198,10 @@ async function configRoutes(fastify, options) {
     if (!connection) {
       return reply.status(404).send({ error: `Connection not found: ${name}` });
     }
-    const result = await testConnection(connection, { projectDir: options.projectDir });
+    const result = await testConnection(connection, {
+      projectDir: options.projectDir,
+      secrets: options.getConnectionSecrets?.(connection.name)
+    });
     return result;
   });
   fastify.get("/api/cache/stats", async () => {
@@ -8492,10 +8680,10 @@ async function chartRoutes(fastify, options) {
 
 // ../server/dist/routes/chart-events.js
 import { readFile as readFile2, writeFile } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join5 } from "path";
 import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
 async function readEventsFile(projectDir) {
-  const eventsPath = join3(projectDir, "events.yaml");
+  const eventsPath = join5(projectDir, "events.yaml");
   try {
     const content = await readFile2(eventsPath, "utf-8");
     const parsed = parseYaml2(content);
@@ -8506,7 +8694,7 @@ async function readEventsFile(projectDir) {
   }
 }
 async function writeEventsFile(projectDir, events) {
-  const eventsPath = join3(projectDir, "events.yaml");
+  const eventsPath = join5(projectDir, "events.yaml");
   await writeFile(eventsPath, stringifyYaml({ events }));
 }
 async function chartEventsRoutes(fastify, options) {
@@ -8555,7 +8743,7 @@ async function chartEventsRoutes(fastify, options) {
 
 // ../server/dist/routes/dashboards.js
 import { writeFile as writeFile2 } from "fs/promises";
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 import { stringify as stringifyYaml2 } from "yaml";
 function classifyError2(error2) {
   const msg = error2 instanceof Error ? error2.message : String(error2);
@@ -8634,7 +8822,7 @@ async function dashboardRoutes(fastify, options) {
       }
       updated = { ...dashboard, layout };
     }
-    const filePath = configLoader.getDashboardFilePath(id) ?? join4(projectDir, "dashboards", `${id}.yaml`);
+    const filePath = configLoader.getDashboardFilePath(id) ?? join6(projectDir, "dashboards", `${id}.yaml`);
     await writeFile2(filePath, stringifyYaml2(updated));
     await configLoader.load();
     const commitMessage = message || `Update ${dashboard.title} layout`;
@@ -8830,11 +9018,11 @@ async function semanticRoutes(fastify, options) {
         errorType: "validation_error"
       });
     }
-    const { writeFileSync, mkdirSync } = await import("fs");
-    const { join: join12, dirname: dirname3 } = await import("path");
-    const fullPath = join12(projectDir, filePath);
-    mkdirSync(dirname3(fullPath), { recursive: true });
-    writeFileSync(fullPath, sql, "utf-8");
+    const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync3 } = await import("fs");
+    const { join: join14, dirname: dirname5 } = await import("path");
+    const fullPath = join14(projectDir, filePath);
+    mkdirSync3(dirname5(fullPath), { recursive: true });
+    writeFileSync3(fullPath, sql, "utf-8");
     return { saved: true, path: filePath };
   });
   fastify.post("/api/semantic/rebuild", async () => {
@@ -8849,8 +9037,8 @@ async function semanticRoutes(fastify, options) {
 }
 
 // ../server/dist/services/semantic-service.js
-import { readFileSync, existsSync } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
+import { join as join7 } from "path";
 var SemanticService = class {
   model = null;
   builder;
@@ -8867,10 +9055,10 @@ var SemanticService = class {
     this.model = this.builder.build(input);
   }
   buildFromDisk(models, chartHints) {
-    const catalogPath = join5(this.projectDir, ".yamchart", "catalog.json");
+    const catalogPath = join7(this.projectDir, ".yamchart", "catalog.json");
     let catalog;
-    if (existsSync(catalogPath)) {
-      const raw = readFileSync(catalogPath, "utf-8");
+    if (existsSync3(catalogPath)) {
+      const raw = readFileSync3(catalogPath, "utf-8");
       catalog = JSON.parse(raw);
     }
     this.build({ catalog, models, chartHints });
@@ -9190,6 +9378,14 @@ var GitService = class {
   }
 };
 
+// ../server/dist/services/ai-error-redact.js
+function redactProviderError(msg, apiKey) {
+  let out = msg.replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url redacted]");
+  if (apiKey)
+    out = out.split(apiKey).join("[redacted]");
+  return out;
+}
+
 // ../../packages/knowledge/dist/memory-store.js
 import { randomUUID } from "crypto";
 
@@ -9474,6 +9670,63 @@ var PostgresKnowledgeStore = class {
     const r = rows[0];
     return { id: r.id, connection: r.connection, source_kind: r.source_kind, source_id: r.source_id, text: r.text, vector: r.vector };
   }
+  async exportAll() {
+    const profilesRes = await this.pool.query(`SELECT connection, profile FROM source_profiles`);
+    return {
+      profiles: profilesRes.rows.map((r) => ({ connection: r.connection, profile: r.profile })),
+      hunches: await this.listHunches({}),
+      blindspots: await this.listBlindspots({}),
+      knowledgeDocs: await this.listKnowledgeDocs({}),
+      embeddings: await this.listEmbeddings({})
+    };
+  }
+  async importAll(snapshot) {
+    for (const p of snapshot.profiles)
+      await this.saveProfile(p.connection, p.profile);
+    for (const h of snapshot.hunches) {
+      await this.pool.query(`INSERT INTO hunches (id, connection, question, sql, generated_sql, status, tables_used, rationale, confidence, last_run_sample, created_at, updated_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) ON CONFLICT (id) DO NOTHING`, [
+        h.id,
+        h.connection,
+        h.question,
+        h.sql,
+        h.generatedSql,
+        h.status,
+        JSON.stringify(h.tablesUsed ?? []),
+        h.rationale ?? null,
+        h.confidence ?? null,
+        h.lastRunSample ? JSON.stringify(h.lastRunSample) : null,
+        h.createdAt,
+        h.updatedAt
+      ]);
+    }
+    for (const b of snapshot.blindspots) {
+      await this.pool.query(`INSERT INTO blindspots (id, connection, kind, title, detail, subject, suggested_model, confidence, status, answer, created_at, updated_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) ON CONFLICT (id) DO NOTHING`, [
+        b.id,
+        b.connection,
+        b.kind,
+        b.title,
+        b.detail,
+        b.subject ?? null,
+        JSON.stringify(b.suggestedModel ?? null),
+        b.confidence ?? null,
+        b.status,
+        b.answer ?? null,
+        b.createdAt,
+        b.updatedAt
+      ]);
+    }
+    for (const d of snapshot.knowledgeDocs) {
+      await this.pool.query(`INSERT INTO knowledge_docs (id, connection, title, content, source, created_at, updated_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7) ON CONFLICT (id) DO NOTHING`, [d.id, d.connection, d.title, d.content, d.source, d.createdAt, d.updatedAt]);
+    }
+    for (const e of snapshot.embeddings)
+      await this.upsertEmbedding(e);
+  }
+  async close() {
+    await this.pool.end();
+  }
 };
 
 // ../../node_modules/.pnpm/tslib@2.8.1/node_modules/tslib/tslib.es6.mjs
@@ -12165,8 +12418,8 @@ var RealtimeChannel = class _RealtimeChannel {
   _trigger(type, payload, ref) {
     var _a, _b;
     const typeLower = type.toLocaleLowerCase();
-    const { close, error: error2, leave, join: join12 } = CHANNEL_EVENTS;
-    const events = [close, error2, leave, join12];
+    const { close, error: error2, leave, join: join14 } = CHANNEL_EVENTS;
+    const events = [close, error2, leave, join14];
     if (ref && events.indexOf(typeLower) >= 0 && ref !== this._joinRef()) {
       return;
     }
@@ -21598,14 +21851,14 @@ async function publicRoutes(fastify, options) {
 }
 
 // ../server/dist/routes/chat.js
-import { resolve, join as join6 } from "path";
+import { resolve, join as join8 } from "path";
 import { readFile as readFile3 } from "fs/promises";
 function isChatEnabled(configLoader) {
   const project = configLoader.getProject();
   return !!(project?.features?.chat && process.env.ANTHROPIC_API_KEY);
 }
 async function chatRoutes(fastify, options) {
-  const { configLoader, queryService } = options;
+  const { configLoader, queryService, aiConfig } = options;
   fastify.post("/api/chat/generate-text", async (request, reply) => {
     const { prompt, mode, dashboard: dashboardName, existingContent, filters } = request.body ?? {};
     if (!prompt || !mode || !dashboardName) {
@@ -21616,10 +21869,9 @@ async function chatRoutes(fastify, options) {
     if (mode !== "insert" && mode !== "replace") {
       return reply.status(400).send({ error: 'mode must be "insert" or "replace"' });
     }
-    const apiKey = process.env.ANTHROPIC_API_KEY;
-    if (!apiKey) {
+    if (!aiConfig && !process.env.ANTHROPIC_API_KEY) {
       return reply.status(400).send({
-        error: "AI text generation requires an API key. Set ANTHROPIC_API_KEY in your environment."
+        error: "AI text generation requires an API key. Set ANTHROPIC_API_KEY in your environment, or configure an ai: block in yamchart.yaml."
       });
     }
     const dashboard = configLoader.getDashboardByName(dashboardName);
@@ -21726,8 +21978,7 @@ async function chatRoutes(fastify, options) {
         systemParts.push("Output ONLY the new text to insert. Do NOT repeat the existing content.");
       }
       const systemPrompt = systemParts.join("\n");
-      const { AnthropicProvider } = await import("./dist-5DQO6L2S.js");
-      const provider = new AnthropicProvider(apiKey);
+      const provider = createProviderForTask(aiConfig, "text_generation", process.env);
       const response = await provider.chat({
         system: systemPrompt,
         messages: [{ role: "user", content: prompt }],
@@ -21850,7 +22101,7 @@ IMPORTANT: When using query_model, pass the chart name (e.g. "${chartRefs[0] ??
 The user is viewing the "${chart.title ?? chart.name}" chart (id: "${chart.name}", type: ${chart.chart?.type}).${model}${params}`;
       }
     } else if (chatContext.type === "explore") {
-      const catalogPath = join6(options.projectDir, ".yamchart", "catalog.json");
+      const catalogPath = join8(options.projectDir, ".yamchart", "catalog.json");
       const tableLines = [];
       try {
         const catalogData = JSON.parse(await readFile3(catalogPath, "utf-8"));
@@ -28839,10 +29090,10 @@ async function runModel(deps, args) {
 }
 
 // ../../packages/mcp-core/dist/catalog.js
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 import { readFile as readFile4 } from "fs/promises";
 async function readCatalogTables(projectDir, include) {
-  const catalogPath = join7(projectDir, ".yamchart", "catalog.json");
+  const catalogPath = join9(projectDir, ".yamchart", "catalog.json");
   let parsed;
   try {
     parsed = JSON.parse(await readFile4(catalogPath, "utf-8"));
@@ -29040,7 +29291,7 @@ async function visualize(_deps, args) {
 
 // ../../packages/mcp-core/dist/tools/save.js
 import { mkdir, writeFile as writeFile3 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join10 } from "path";
 import { stringify as stringifyYaml3 } from "yaml";
 var SAFE_NAME = /^[a-zA-Z_][a-zA-Z0-9_-]*$/;
 async function saveChart(deps, args) {
@@ -29058,9 +29309,9 @@ async function saveChart(deps, args) {
   if (name.length > 200) {
     return `Error: Chart name is too long (${name.length} chars). Maximum is 200.`;
   }
-  const chartsDir = join8(deps.projectDir, "charts");
+  const chartsDir = join10(deps.projectDir, "charts");
   await mkdir(chartsDir, { recursive: true });
-  await writeFile3(join8(chartsDir, `${name}.yaml`), stringifyYaml3(parsed.data), "utf-8");
+  await writeFile3(join10(chartsDir, `${name}.yaml`), stringifyYaml3(parsed.data), "utf-8");
   await deps.configLoader.load();
   return `Chart "${name}" saved to charts/${name}.yaml`;
 }
@@ -29367,15 +29618,15 @@ async function scanBlindspots(input) {
 }
 
 // ../../packages/learning/dist/context.js
-import { readFileSync as readFileSync2, existsSync as existsSync2, readdirSync } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync4, existsSync as existsSync4, readdirSync } from "fs";
+import { join as join11 } from "path";
 var MAX_DOC = 6e3;
 var MAX_TOTAL = 16e3;
 function loadKnowledgeDocs(projectDir) {
-  const dir = join9(projectDir, "knowledge");
-  if (!existsSync2(dir))
+  const dir = join11(projectDir, "knowledge");
+  if (!existsSync4(dir))
     return [];
-  return readdirSync(dir).filter((f) => /\.md$/i.test(f)).map((f) => readFileSync2(join9(dir, f), "utf8"));
+  return readdirSync(dir).filter((f) => /\.md$/i.test(f)).map((f) => readFileSync4(join11(dir, f), "utf8"));
 }
 function buildContextBlock(input) {
   const parts = [];
@@ -29494,6 +29745,34 @@ function limit(sql) {
   return /\blimit\b/i.test(sql) ? sql : `${sql.replace(/;\s*$/, "")} LIMIT 1000`;
 }
 
+// ../../packages/learning/dist/reindex.js
+async function reindexEmbeddings(input) {
+  const { store, embedder, connection } = input;
+  const corpus = [];
+  for (const h of await store.listHunches({ connection, status: "confirmed" })) {
+    corpus.push({ kind: "hunch", id: h.id, connection: h.connection, text: h.question });
+  }
+  for (const b of await store.listBlindspots({ connection, status: "answered" })) {
+    if (b.answer)
+      corpus.push({ kind: "blindspot", id: b.id, connection: b.connection, text: `${b.title}: ${b.answer}` });
+  }
+  for (const d of await store.listKnowledgeDocs({ connection })) {
+    corpus.push({ kind: "knowledge", id: d.id, connection: d.connection, text: `${d.title}
+${d.content}` });
+  }
+  if (corpus.length === 0)
+    return 0;
+  const vectors = await embedder.embed(corpus.map((c) => c.text));
+  if (vectors.length !== corpus.length) {
+    throw new Error(`Embedder returned ${vectors.length} vectors for ${corpus.length} texts`);
+  }
+  for (let i = 0; i < corpus.length; i++) {
+    const item = corpus[i];
+    await store.upsertEmbedding({ connection: item.connection, source_kind: item.kind, source_id: item.id, text: item.text, vector: vectors[i] });
+  }
+  return corpus.length;
+}
+
 // ../../packages/mcp-core/dist/tools/answer.js
 async function answerQuestionTool(deps, args) {
   const connection = args.connection ?? deps.defaultConnectionName ?? "default";
@@ -29599,31 +29878,129 @@ var text = (s) => ({
   content: [{ type: "text", text: s }],
   ...s.startsWith("Error:") ? { isError: true } : {}
 });
+var READ_ONLY = { readOnlyHint: true, destructiveHint: false, openWorldHint: false };
+var WRITE_SAFE = { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
+function buildResourceMeta(baseUrl) {
+  return {
+    ui: {
+      domain: baseUrl,
+      csp: {
+        connectDomains: [baseUrl],
+        resourceDomains: ["https://persistent.oaistatic.com"]
+      }
+    }
+  };
+}
 function createMcpServer(deps) {
   const server = new McpServer({ name: "yamchart", version: "0.1.0" });
-  server.registerResource("chart-renderer", TEMPLATE_URI, { mimeType: "text/html;profile=mcp-app", description: "Interactive yamchart chart renderer" }, async () => {
+  const baseUrl = deps.baseUrl ?? process.env["BASE_URL"] ?? "https://yamchart.example.com";
+  server.registerResource("chart-renderer", TEMPLATE_URI, {
+    mimeType: "text/html;profile=mcp-app",
+    description: "Interactive yamchart chart renderer",
+    _meta: buildResourceMeta(baseUrl)
+  }, async () => {
     const tpl = await buildTemplateResource();
     return { contents: [{ uri: TEMPLATE_URI, mimeType: tpl.resource.mimeType, text: tpl.resource.text ?? "" }] };
   });
-  server.registerTool("list_charts", { description: "List governed yamchart charts (name, title, type, model, parameters).", inputSchema: {} }, async () => text(await listCharts(deps)));
-  server.registerTool("list_models", { description: "List governed SQL models (name, description).", inputSchema: {} }, async () => text(await listModels(deps)));
+  server.registerTool("list_charts", {
+    description: "List governed yamchart charts (name, title, type, model, parameters).",
+    inputSchema: {},
+    annotations: READ_ONLY
+  }, async () => {
+    const raw = await listCharts(deps);
+    const charts = JSON.parse(raw);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: { charts }
+    };
+  });
+  server.registerTool("list_models", {
+    description: "List governed SQL models (name, description).",
+    inputSchema: {},
+    annotations: READ_ONLY
+  }, async () => {
+    const raw = await listModels(deps);
+    const models = JSON.parse(raw);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: { models }
+    };
+  });
   server.registerTool("run_model", {
     description: "Run a governed chart/model by name with parameters and return its data.",
-    inputSchema: { name: z2.string(), params: z2.record(z2.unknown()).optional() }
-  }, async (args) => text(await runModel(deps, args)));
+    inputSchema: { name: z2.string(), params: z2.record(z2.unknown()).optional() },
+    annotations: READ_ONLY
+  }, async (args) => {
+    const raw = await runModel(deps, args);
+    if (raw.startsWith("Error:"))
+      return { content: [{ type: "text", text: raw }], isError: true };
+    const parsed = JSON.parse(raw);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: {
+        rowCount: parsed.rows.length,
+        columns: parsed.columns.map((c) => c.name),
+        preview: parsed.rows.slice(0, 5)
+      }
+    };
+  });
   server.registerTool("run_sql", {
     description: "Run a read-only ad-hoc SQL query (destructive statements blocked, row-capped).",
-    inputSchema: { sql: z2.string(), limit: z2.number().optional() }
-  }, async (args) => text(await runSql(deps, args)));
-  server.registerTool("list_tables", { description: "List warehouse tables from the cached catalog (name, schema, connection, column count).", inputSchema: {} }, async () => text(await listTables(deps)));
+    inputSchema: { sql: z2.string(), limit: z2.number().optional() },
+    annotations: READ_ONLY
+  }, async (args) => {
+    const raw = await runSql(deps, args);
+    if (raw.startsWith("Error:"))
+      return { content: [{ type: "text", text: raw }], isError: true };
+    const parsed = JSON.parse(raw);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: {
+        rowCount: parsed.rows.length,
+        columns: parsed.columns.map((c) => c.name),
+        preview: parsed.rows.slice(0, 5)
+      }
+    };
+  });
+  server.registerTool("list_tables", {
+    description: "List warehouse tables from the cached catalog (name, schema, connection, column count).",
+    inputSchema: {},
+    annotations: READ_ONLY
+  }, async () => {
+    const raw = await listTables(deps);
+    const tables = JSON.parse(raw);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: { tables }
+    };
+  });
   server.registerTool("describe_table", {
     description: 'Show columns and types for a catalog table. Accepts { table } (with optional dot-notation schema: "schema.table") or { table, schema } separately.',
-    inputSchema: { table: z2.string(), schema: z2.string().optional() }
+    inputSchema: { table: z2.string(), schema: z2.string().optional() },
+    annotations: READ_ONLY
   }, async (args) => text(await describeTable(deps, args)));
-  server.registerTool("sample_table", { description: "Return a few sample rows from a table.", inputSchema: { table: z2.string(), limit: z2.number().optional() } }, async (args) => text(await sampleTable(deps, args)));
+  server.registerTool("sample_table", {
+    description: "Return a few sample rows from a table.",
+    inputSchema: { table: z2.string(), limit: z2.number().optional() },
+    annotations: READ_ONLY
+  }, async (args) => {
+    const raw = await sampleTable(deps, args);
+    if (raw.startsWith("Error:"))
+      return { content: [{ type: "text", text: raw }], isError: true };
+    const parsed = JSON.parse(raw);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: {
+        rowCount: parsed.rows.length,
+        columns: parsed.columns.map((c) => c.name),
+        preview: parsed.rows.slice(0, 5)
+      }
+    };
+  });
   server.registerTool("visualize", {
     description: "Render a yamchart chart spec + data rows to an interactive chart (with a static image fallback). Provide a full chart spec (name, title, source.model, chart) and the data array.",
     inputSchema: { spec: z2.record(z2.unknown()), data: z2.array(z2.record(z2.unknown())) },
+    annotations: READ_ONLY,
     _meta: {
       ui: { resourceUri: TEMPLATE_URI },
       "openai/outputTemplate": TEMPLATE_URI
@@ -29645,17 +30022,27 @@ function createMcpServer(deps) {
   });
   server.registerTool("save_chart", {
     description: "Save a yamchart chart spec to charts/<name>.yaml (requires editor/admin).",
-    inputSchema: { spec: z2.record(z2.unknown()) }
+    inputSchema: { spec: z2.record(z2.unknown()) },
+    annotations: WRITE_SAFE
   }, async (args) => text(await saveChart(deps, args)));
   if (deps.semanticLayer) {
     const semanticLayer = deps.semanticLayer;
     server.registerTool("list_metrics", {
       description: "List governed business metrics (the semantic glossary): name, synonyms, the entity they belong to, and which dimensions you can slice them by. Prefer querying these by name over writing raw SQL.",
-      inputSchema: {}
-    }, async () => text(listMetrics({ semanticLayer })));
+      inputSchema: {},
+      annotations: READ_ONLY
+    }, async () => {
+      const raw = listMetrics({ semanticLayer });
+      const metrics = JSON.parse(raw);
+      return {
+        content: [{ type: "text", text: raw }],
+        structuredContent: { metrics }
+      };
+    });
     server.registerTool("get_metric", {
       description: "Get the full governed definition of a metric (by name or synonym): how it is computed (aggregation, field/sql, governed filter), its source table, format, and the dimensions/time dimension you can group it by.",
-      inputSchema: { name: z2.string() }
+      inputSchema: { name: z2.string() },
+      annotations: READ_ONLY
     }, async (args) => text(getMetric({ semanticLayer }, args)));
     server.registerTool("query_metric", {
       description: "Query governed metrics by name (or synonym), optionally sliced by dimensions and a time grain, and filtered by a time range. Returns the data rows, the generated SQL (for transparency), and a ready-to-use suggested_chart spec. Prefer this over run_sql for business questions about governed metrics \u2014 it guarantees correct, governed definitions.",
@@ -29670,10 +30057,25 @@ function createMcpServer(deps) {
         filters: z2.array(z2.object({ dimension: z2.string(), operator: z2.string(), value: z2.any() })).optional(),
         order_by: z2.object({ field: z2.string(), direction: z2.enum(["asc", "desc"]).optional() }).optional(),
         limit: z2.number().int().positive().max(1e4).optional()
-      }
+      },
+      annotations: READ_ONLY
     }, async (args) => {
       try {
-        return text(await queryMetric({ semanticLayer, queryService: deps.queryService, connectionType: deps.connectionType }, args));
+        const raw = await queryMetric({ semanticLayer, queryService: deps.queryService, connectionType: deps.connectionType }, args);
+        if (raw.startsWith("Error:") || raw.startsWith("{") && JSON.parse(raw).error) {
+          return text(raw);
+        }
+        const parsed = JSON.parse(raw);
+        return {
+          content: [{ type: "text", text: raw }],
+          structuredContent: {
+            rowCount: parsed.rows.length,
+            columns: parsed.columns.map((c) => c.name),
+            preview: parsed.rows.slice(0, 5),
+            sql: parsed.sql,
+            suggested_chart: parsed.suggested_chart
+          }
+        };
       } catch (err) {
         return text(`Error: ${err instanceof Error ? err.message : String(err)}`);
       }
@@ -29685,27 +30087,48 @@ function createMcpServer(deps) {
     const answerProvider = deps.answerProvider;
     server.registerTool("answer_question", {
       description: 'Answer a business question using governed knowledge: retrieves confirmed Hunches + business context for the source and either reuses a matching SQL or generates SQL grounded in trusted examples. Prefer this for "how many / how much / which" questions.',
-      inputSchema: { question: z2.string(), connection: z2.string().optional() }
-    }, async (args) => text(await answerQuestionTool({
-      knowledgeStore,
-      embedder,
-      provider: answerProvider,
-      queryService: deps.queryService,
-      connectionType: deps.connectionType,
-      defaultConnectionName: deps.aiConnectionName
-    }, args)));
+      inputSchema: { question: z2.string(), connection: z2.string().optional() },
+      annotations: READ_ONLY
+    }, async (args) => {
+      const raw = await answerQuestionTool({
+        knowledgeStore,
+        embedder,
+        provider: answerProvider,
+        queryService: deps.queryService,
+        connectionType: deps.connectionType,
+        defaultConnectionName: deps.aiConnectionName
+      }, args);
+      if (raw.startsWith("Error:"))
+        return { content: [{ type: "text", text: raw }], isError: true };
+      const parsed = JSON.parse(raw);
+      const rows = parsed.rows ?? [];
+      const columns = parsed.columns ?? [];
+      return {
+        content: [{ type: "text", text: raw }],
+        structuredContent: {
+          rowCount: rows.length,
+          columns: columns.map((c) => c.name),
+          preview: rows.slice(0, 5),
+          sql: parsed.sql,
+          answer: parsed.answer
+        }
+      };
+    });
   }
   server.registerTool("get_chart_schema", {
     description: "Get the exact yamchart chart spec shape and a working example for a chart type (bar, line, area, kpi, pie, scatter, table). Call this before building a chart. Axes are objects: { field, type: temporal|quantitative|ordinal|nominal }.",
-    inputSchema: { type: z2.string().optional() }
+    inputSchema: { type: z2.string().optional() },
+    annotations: READ_ONLY
   }, async (args) => text(getChartSchema(args)));
   server.registerTool("validate_chart", {
     description: "Validate a yamchart chart spec without saving it. Returns { valid: true } or field-level errors with hints so you can self-correct before calling save_chart or visualize.",
-    inputSchema: { spec: z2.record(z2.unknown()) }
+    inputSchema: { spec: z2.record(z2.unknown()) },
+    annotations: READ_ONLY
   }, async (args) => text(validateChart(args)));
   server.registerTool("get_chart_spec", {
     description: "Get the full saved spec of an existing governed chart by name (so you can copy or adapt it). Call list_charts to discover names.",
-    inputSchema: { name: z2.string() }
+    inputSchema: { name: z2.string() },
+    annotations: READ_ONLY
   }, async (args) => text(getChartSpec({ configLoader: deps.configLoader }, args)));
   return server;
 }
@@ -29730,7 +30153,8 @@ async function mcpRoutes(fastify, options) {
       knowledgeStore,
       embedder,
       answerProvider,
-      aiConnectionName
+      aiConnectionName,
+      baseUrl: process.env["BASE_URL"]
     });
     const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
     reply.raw.on("close", () => {
@@ -29754,7 +30178,7 @@ async function mcpRoutes(fastify, options) {
 }
 
 // ../server/dist/routes/catalog.js
-import { join as join10 } from "path";
+import { join as join12 } from "path";
 import { readFile as readFile5 } from "fs/promises";
 async function catalogRoutes(fastify, options) {
   const { configLoader, projectDir } = options;
@@ -29767,7 +30191,7 @@ async function catalogRoutes(fastify, options) {
       name: m.metadata.name,
       description: m.metadata.description
     }));
-    const catalogPath = join10(projectDir, ".yamchart", "catalog.json");
+    const catalogPath = join12(projectDir, ".yamchart", "catalog.json");
     let tables = [];
     try {
       const catalogData = JSON.parse(await readFile5(catalogPath, "utf-8"));
@@ -29826,10 +30250,14 @@ async function runHunch(deps, id) {
   if (!isReadOnlySql(hunch.sql))
     return { error: "Only read-only SELECT queries can be run." };
   const limited = /\blimit\b/i.test(hunch.sql) ? hunch.sql : `${hunch.sql.replace(/;\s*$/, "")} LIMIT 50`;
-  const res = await deps.queryService.executeRawSql(limited);
-  const sample = { columns: res.columns, rows: res.rows, ranAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await deps.store.updateHunch(id, { lastRunSample: sample });
-  return { sample };
+  try {
+    const res = await deps.queryService.executeRawSql(limited);
+    const sample = { columns: res.columns, rows: res.rows, ranAt: (/* @__PURE__ */ new Date()).toISOString() };
+    await deps.store.updateHunch(id, { lastRunSample: sample });
+    return { sample };
+  } catch (e) {
+    return { error: e.message };
+  }
 }
 async function answerBlindspot(deps, id, body) {
   return deps.store.updateBlindspot(id, { status: "answered", answer: body.answer });
@@ -29895,7 +30323,17 @@ async function learningRoutes(fastify, opts) {
         contextBlock
       });
       const created = await store.createHunches(candidates);
-      send("done", { hunches: created });
+      const threshold = opts.getConnectionThreshold?.(connection);
+      let autoConfirmed = 0;
+      if (threshold != null) {
+        for (const h of created) {
+          if ((h.confidence ?? 0) >= threshold) {
+            await store.updateHunch(h.id, { status: "confirmed" });
+            autoConfirmed++;
+          }
+        }
+      }
+      send("done", { hunches: created, autoConfirmed });
     } catch (e) {
       send("error", { message: e.message });
     }
@@ -29940,7 +30378,12 @@ async function learningRoutes(fastify, opts) {
       reply.code(403).send({ error: "Requires editor or admin role." });
       return;
     }
-    return runHunch({ store, queryService }, request.params.id);
+    const result = await runHunch({ store, queryService }, request.params.id);
+    if (result.error) {
+      reply.code(422).send({ error: result.error });
+      return;
+    }
+    return result;
   });
   fastify.post("/api/blindspots/scan", async (request, reply) => {
     if (!requireStore(reply))
@@ -30017,6 +30460,36 @@ async function learningRoutes(fastify, opts) {
     }
     return dismissBlindspot({ store }, request.params.id);
   });
+  fastify.get("/api/coverage", async (request, reply) => {
+    if (!requireStore(reply))
+      return;
+    const q = request.query;
+    const connection = q.connection ?? opts.defaultConnectionName;
+    const [hunches, blindspots] = await Promise.all([
+      store.listHunches({ connection }),
+      store.listBlindspots({ connection })
+    ]);
+    const profile = await store.getProfile(connection);
+    const profileTables = profile?.tables?.map((t) => t.table) ?? [];
+    const tableCounts = {};
+    const ensure = (t) => {
+      tableCounts[t] ??= { hunches: 0, blindspots: 0 };
+    };
+    profileTables.forEach(ensure);
+    for (const h of hunches) {
+      for (const t of h.tablesUsed ?? []) {
+        ensure(t);
+        tableCounts[t].hunches++;
+      }
+    }
+    for (const b of blindspots) {
+      if (b.subject) {
+        ensure(b.subject);
+        tableCounts[b.subject].blindspots++;
+      }
+    }
+    return Object.entries(tableCounts).map(([name, counts]) => ({ name, ...counts })).sort((a, b) => b.hunches + b.blindspots - (a.hunches + a.blindspots));
+  });
 }
 
 // ../server/dist/routes/data.js
@@ -30105,6 +30578,257 @@ async function dataRoutes(fastify, opts) {
   });
 }
 
+// ../server/dist/routes/admin-config.js
+function redactUrls(msg) {
+  return msg.replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url redacted]");
+}
+function maskSecrets(secrets) {
+  if (!secrets)
+    return void 0;
+  const out = {};
+  for (const [k, v] of Object.entries(secrets))
+    if (typeof v === "string")
+      out[k] = maskSecret(v);
+  return out;
+}
+function maskProviderKey(p) {
+  if (p && typeof p.api_key === "string")
+    return { ...p, api_key: maskSecret(p.api_key) };
+  return p;
+}
+function maskAiConfig(ai) {
+  if (!ai)
+    return null;
+  const providers = ai.providers ? Object.fromEntries(Object.entries(ai.providers).map(([n, p]) => [n, maskProviderKey(p)])) : void 0;
+  return { ...ai, providers, embedding: maskProviderKey(ai.embedding) };
+}
+function mergeAiSecrets(incoming, stored) {
+  const keep = (inc, st) => {
+    if (!inc)
+      return inc;
+    if (inc.api_key === void 0 || inc.api_key === "" || inc.api_key.startsWith("\u2022\u2022\u2022\u2022")) {
+      return { ...inc, api_key: st?.api_key };
+    }
+    return inc;
+  };
+  const providers = incoming.providers ? Object.fromEntries(Object.entries(incoming.providers).map(([n, p]) => [n, keep(p, stored?.providers?.[n])])) : void 0;
+  return { ...incoming, providers, embedding: keep(incoming.embedding, stored?.embedding) };
+}
+async function adminConfigRoutes(fastify, opts) {
+  const guard = (req, reply) => {
+    if (!opts.canAdmin(req)) {
+      reply.code(403).send({ error: "Requires admin role." });
+      return false;
+    }
+    return true;
+  };
+  fastify.get("/api/admin/config", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const runtime = opts.runtimeStore.read();
+    const runtimeByName = new Map((runtime.connections ?? []).map((c) => [c.name, c]));
+    const git = opts.gitConnections();
+    const names = /* @__PURE__ */ new Set([...git.map((g) => g.name), ...runtimeByName.keys()]);
+    const connections = [...names].map((name) => {
+      const rt = runtimeByName.get(name);
+      if (rt) {
+        return { name, type: rt.type, source: "runtime", config: rt.config, secrets: maskSecrets(rt.secrets) };
+      }
+      const g = git.find((x) => x.name === name);
+      return { name, type: g.type, source: "git" };
+    });
+    return {
+      connections,
+      knowledge: { configured: opts.knowledgeDbConfigured, urlSet: !!runtime.knowledge?.database_url },
+      ai: maskAiConfig(opts.aiConfig)
+    };
+  });
+  fastify.post("/api/admin/restart", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    return opts.requestRestart();
+  });
+  const mergeStoredSecrets = (conn, cfg) => {
+    const existing = cfg.connections?.find((c) => c.name === conn.name);
+    const incoming = Object.fromEntries(
+      // Drop blank AND masked-sentinel ("••••…") values so neither wipes nor overwrites the
+      // stored secret (the existing value is kept via the spread below).
+      Object.entries(conn.secrets ?? {}).filter(([, v]) => typeof v === "string" && v !== "" && !v.startsWith("\u2022\u2022\u2022\u2022"))
+    );
+    const merged = { ...existing?.secrets ?? {}, ...incoming };
+    const secrets = Object.keys(merged).length > 0 ? merged : void 0;
+    return { ...conn, secrets };
+  };
+  const upsertConnection = (conn) => {
+    const cfg = opts.runtimeStore.read();
+    const merged = mergeStoredSecrets(conn, cfg);
+    const list = (cfg.connections ?? []).filter((c) => c.name !== merged.name);
+    list.push(merged);
+    opts.runtimeStore.write({ ...cfg, connections: list });
+  };
+  const createOrUpdate = async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const parsed = RuntimeConnectionSchema.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400).send({ error: "Invalid connection", details: parsed.error.flatten() });
+      return;
+    }
+    upsertConnection(parsed.data);
+    return opts.requestRestart();
+  };
+  fastify.post("/api/admin/connections", createOrUpdate);
+  fastify.put("/api/admin/connections/:name", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const parsed = RuntimeConnectionSchema.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400).send({ error: "Invalid connection", details: parsed.error.flatten() });
+      return;
+    }
+    const { name } = req.params;
+    if (parsed.data.name !== name) {
+      reply.code(400).send({ error: `Connection name mismatch: URL "${name}" vs body "${parsed.data.name}". Renaming is not supported.` });
+      return;
+    }
+    upsertConnection(parsed.data);
+    return opts.requestRestart();
+  });
+  fastify.delete("/api/admin/connections/:name", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const { name } = req.params;
+    const refs = opts.findConnectionRefs(name);
+    if (refs.length > 0) {
+      reply.code(409).send({ error: "Connection is in use", references: refs });
+      return;
+    }
+    const cfg = opts.runtimeStore.read();
+    opts.runtimeStore.write({ ...cfg, connections: (cfg.connections ?? []).filter((c) => c.name !== name) });
+    return opts.requestRestart();
+  });
+  fastify.post("/api/admin/connections/test", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const parsed = RuntimeConnectionSchema.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400).send({ error: "Invalid connection", details: parsed.error.flatten() });
+      return;
+    }
+    const cfg = opts.runtimeStore.read();
+    const merged = mergeStoredSecrets(parsed.data, cfg);
+    const { secrets, ...connLike } = merged;
+    return testConnection(connLike, { projectDir: opts.projectDir, secrets });
+  });
+  fastify.post("/api/admin/knowledge-db/test", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const url = req.body?.url;
+    if (!url || url.trim() === "") {
+      reply.code(400).send({ error: "A database URL is required." });
+      return;
+    }
+    const target = opts.createKnowledgeStore(url);
+    try {
+      await target.init();
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: redactUrls(err instanceof Error ? err.message : "Connection failed") };
+    } finally {
+      try {
+        await target.close();
+      } catch {
+      }
+    }
+  });
+  fastify.put("/api/admin/knowledge-db", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const url = req.body?.url;
+    if (!url || url.trim() === "") {
+      reply.code(400).send({ error: "A non-empty database URL is required." });
+      return;
+    }
+    const cfg = opts.runtimeStore.read();
+    opts.runtimeStore.write({ ...cfg, knowledge: { database_url: url } });
+    return opts.requestRestart();
+  });
+  fastify.post("/api/admin/knowledge-db/migrate", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const url = req.body?.url;
+    if (!url) {
+      reply.code(400).send({ error: "A target database URL is required." });
+      return;
+    }
+    if (!opts.knowledgeStore) {
+      reply.code(503).send({ error: "No current knowledge database to copy from." });
+      return;
+    }
+    const target = opts.createKnowledgeStore(url);
+    try {
+      await target.init();
+      const snapshot = await opts.knowledgeStore.exportAll();
+      await target.importAll(snapshot);
+      return {
+        migrated: {
+          hunches: snapshot.hunches.length,
+          blindspots: snapshot.blindspots.length,
+          knowledgeDocs: snapshot.knowledgeDocs.length,
+          embeddings: snapshot.embeddings.length,
+          profiles: snapshot.profiles.length
+        }
+      };
+    } catch (err) {
+      reply.code(500).send({ error: redactUrls(err instanceof Error ? err.message : "Migration failed") });
+    } finally {
+      try {
+        await target.close();
+      } catch {
+      }
+    }
+  });
+  fastify.put("/api/admin/ai", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const parsed = AiConfigSchema.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400).send({ error: "Invalid AI config", details: parsed.error.flatten() });
+      return;
+    }
+    const cfg = opts.runtimeStore.read();
+    const merged = mergeAiSecrets(parsed.data, cfg.ai);
+    opts.runtimeStore.write({ ...cfg, ai: merged });
+    return opts.requestRestart();
+  });
+  fastify.post("/api/admin/ai/test", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    const body = req.body;
+    const parsed = ProviderConfigSchema.safeParse(body?.provider);
+    if (!parsed.success) {
+      reply.code(400).send({ error: "Invalid provider config", details: parsed.error.flatten() });
+      return;
+    }
+    const kind = body?.kind === "embedding" ? "embedding" : "llm";
+    return opts.testAiProvider(parsed.data, kind);
+  });
+  fastify.post("/api/admin/knowledge-db/reembed", async (req, reply) => {
+    if (!guard(req, reply))
+      return;
+    if (!opts.knowledgeStore || !opts.embedder) {
+      reply.code(503).send({ error: "Reindex requires a knowledge database and a configured embedder." });
+      return;
+    }
+    try {
+      const embedded = await reindexEmbeddings({ store: opts.knowledgeStore, embedder: opts.embedder });
+      return { embedded };
+    } catch (err) {
+      reply.code(500).send({ error: redactUrls(err instanceof Error ? err.message : "Reindex failed") });
+    }
+  });
+}
+
 // ../server/dist/oauth/service.js
 import { randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 
@@ -30631,17 +31355,17 @@ data: ${data}
 }
 
 // ../server/dist/server.js
-import { join as join11, dirname as dirname2 } from "path";
+import { join as join13, dirname as dirname4 } from "path";
 import { fileURLToPath } from "url";
 import { access as access2, readFile as readFile6 } from "fs/promises";
 import { watch as fsWatch } from "fs";
-var __dirname = dirname2(fileURLToPath(import.meta.url));
-var packageJsonPath = join11(__dirname, "..", "package.json");
+var __dirname = dirname4(fileURLToPath(import.meta.url));
+var packageJsonPath = join13(__dirname, "..", "package.json");
 var packageJson = JSON.parse(await readFile6(packageJsonPath, "utf-8"));
 var VERSION = packageJson.version;
 async function enrichRefsFromCatalog(projectDir, refs) {
   try {
-    const catalogPath = join11(projectDir, ".yamchart", "catalog.json");
+    const catalogPath = join13(projectDir, ".yamchart", "catalog.json");
     const catalogData = JSON.parse(await readFile6(catalogPath, "utf-8"));
     for (const model of catalogData.models ?? []) {
       if (model.name && model.table) {
@@ -30652,7 +31376,7 @@ async function enrichRefsFromCatalog(projectDir, refs) {
   }
 }
 async function createServer(options) {
-  const { projectDir, port = 3001, host = "0.0.0.0", watch: watch2 = false, serveStatic = process.env.NODE_ENV === "production", staticDir = join11(__dirname, "public"), auth } = options;
+  const { projectDir, port = 3001, host = "0.0.0.0", watch: watch2 = false, serveStatic = process.env.NODE_ENV === "production", staticDir = join13(__dirname, "public"), auth } = options;
   if (auth) {
     initAuthServer(auth.supabaseUrl, auth.supabaseServiceKey);
   }
@@ -30682,12 +31406,35 @@ async function createServer(options) {
   }
   const configLoader = new ConfigLoader(projectDir, options.env);
   await configLoader.load();
+  const runtimeAuthDbPath = options.localAuth?.dbPath;
+  const runtimeConfigPath = RuntimeConfigStore.resolvePath({
+    env: process.env,
+    projectDir,
+    authDbPath: runtimeAuthDbPath
+  });
+  const configKey = getConfigKey(dirname4(runtimeConfigPath), process.env, (m) => fastify.log.warn(m));
+  const runtimeStore = new RuntimeConfigStore(runtimeConfigPath, configKey);
+  const applyRuntime = () => {
+    try {
+      configLoader.applyRuntimeOverrides(runtimeStore.read());
+    } catch (err) {
+      if (err instanceof RuntimeConfigError) {
+        fastify.log.error(`Runtime config ignored (Git-only fallback): ${err.message}`);
+      } else
+        throw err;
+    }
+  };
+  applyRuntime();
+  const effectiveAi = configLoader.getAiConfig();
   const gitService = new GitService(projectDir);
   const defaultConnection = configLoader.getDefaultConnection();
   if (!defaultConnection) {
     throw new Error("No connection configured");
   }
-  const rawConnector = createConnectorFromConfig(defaultConnection, { projectDir });
+  const rawConnector = createConnectorFromConfig(defaultConnection, {
+    projectDir,
+    secrets: configLoader.getConnectionSecrets(defaultConnection.name)
+  });
   const connector = new ReconnectingConnector(rawConnector);
   await connector.connect();
   const project = configLoader.getProject();
@@ -30697,7 +31444,7 @@ async function createServer(options) {
     defaultTtlMs: cacheTtl
   });
   const knowledgeUrlVar = project.knowledge?.database_url_var ?? "KNOWLEDGE_DATABASE_URL";
-  const knowledgeDbUrl = process.env[knowledgeUrlVar];
+  const knowledgeDbUrl = configLoader.getKnowledgeDbUrl(knowledgeUrlVar, process.env);
   let knowledgeStore;
   if (knowledgeDbUrl) {
     const store = new PostgresKnowledgeStore(knowledgeDbUrl);
@@ -30751,20 +31498,6 @@ async function createServer(options) {
       authType: defaultConnection.type === "snowflake" && defaultConnection.auth ? defaultConnection.auth.type : void 0
     };
   });
-  fastify.post("/api/connections/reconnect", async (_request2, reply) => {
-    try {
-      try {
-        await connector.disconnect();
-      } catch {
-      }
-      await connector.connect();
-      return { success: true };
-    } catch (err) {
-      return reply.status(500).send({
-        error: err instanceof Error ? err.message : "Reconnection failed"
-      });
-    }
-  });
   await fastify.register(semanticRoutes, { semanticService, queryService, projectDir });
   if (authDb) {
     const secureCookies = process.env.NODE_ENV === "production";
@@ -30827,31 +31560,31 @@ async function createServer(options) {
     await fastify.register(async (protectedRoutes) => {
       protectedRoutes.addHook("preHandler", authMiddleware);
       protectedRoutes.addHook("preHandler", orgMiddleware);
-      await protectedRoutes.register(configRoutes, { configLoader, projectDir, queryService });
+      await protectedRoutes.register(configRoutes, { configLoader, projectDir, queryService, getConnectionSecrets: (name) => configLoader.getConnectionSecrets(name) });
       await protectedRoutes.register(chartRoutes, { configLoader, queryService });
       await protectedRoutes.register(chartEventsRoutes, { configLoader, projectDir });
       await protectedRoutes.register(dashboardRoutes, { configLoader, gitService, projectDir, queryService });
-      await protectedRoutes.register(chatRoutes, { configLoader, queryService, projectDir });
+      await protectedRoutes.register(chatRoutes, { configLoader, queryService, projectDir, aiConfig: effectiveAi });
       await protectedRoutes.register(catalogRoutes, { configLoader, projectDir });
     });
   } else if (authDb) {
     const localMiddleware = createLocalAuthMiddleware(authDb);
     await fastify.register(async (protectedRoutes) => {
       protectedRoutes.addHook("preHandler", localMiddleware);
-      await protectedRoutes.register(configRoutes, { configLoader, projectDir, queryService });
+      await protectedRoutes.register(configRoutes, { configLoader, projectDir, queryService, getConnectionSecrets: (name) => configLoader.getConnectionSecrets(name) });
       await protectedRoutes.register(chartRoutes, { configLoader, queryService });
       await protectedRoutes.register(chartEventsRoutes, { configLoader, projectDir });
       await protectedRoutes.register(dashboardRoutes, { configLoader, gitService, projectDir, queryService });
-      await protectedRoutes.register(chatRoutes, { configLoader, queryService, projectDir });
+      await protectedRoutes.register(chatRoutes, { configLoader, queryService, projectDir, aiConfig: effectiveAi });
       await protectedRoutes.register(catalogRoutes, { configLoader, projectDir });
       await protectedRoutes.register(sharesRoutes, { authDb });
     });
   } else {
-    await fastify.register(configRoutes, { configLoader, projectDir, queryService });
+    await fastify.register(configRoutes, { configLoader, projectDir, queryService, getConnectionSecrets: (name) => configLoader.getConnectionSecrets(name) });
     await fastify.register(chartRoutes, { configLoader, queryService });
     await fastify.register(chartEventsRoutes, { configLoader, projectDir });
     await fastify.register(dashboardRoutes, { configLoader, gitService, projectDir, queryService });
-    await fastify.register(chatRoutes, { configLoader, queryService, projectDir });
+    await fastify.register(chatRoutes, { configLoader, queryService, projectDir, aiConfig: effectiveAi });
     await fastify.register(catalogRoutes, { configLoader, projectDir });
   }
   const mcpBaseUrl = process.env.BASE_URL || project.defaults?.base_url || `http://localhost:${port}`;
@@ -30868,12 +31601,12 @@ async function createServer(options) {
   let embedder;
   let answerProvider;
   try {
-    embedder = createEmbedder(project.ai?.embedding, process.env);
+    embedder = createEmbedder(effectiveAi?.embedding, process.env);
   } catch (err) {
     fastify.log.warn({ err }, "Failed to build embedder; answer_question tool disabled");
   }
   try {
-    answerProvider = createProviderForTask(project.ai, "answer", process.env);
+    answerProvider = createProviderForTask(effectiveAi, "answer", process.env);
   } catch (err) {
     fastify.log.warn({ err }, "Failed to build answer provider; answer_question tool disabled");
   }
@@ -30906,7 +31639,7 @@ async function createServer(options) {
     dialect: defaultConnection?.type ?? "duckdb",
     metricNames: semanticLayer?.listMetrics().map((m) => m.name) ?? [],
     getConnectionTables: async (connection) => {
-      const catalogPath = join11(projectDir, ".yamchart", "catalog.json");
+      const catalogPath = join13(projectDir, ".yamchart", "catalog.json");
       try {
         const catalogData = JSON.parse(await readFile6(catalogPath, "utf-8"));
         return (catalogData.models ?? []).filter((m) => !m.connection || m.connection === connection).map((m) => ({
@@ -30925,7 +31658,11 @@ async function createServer(options) {
         return true;
       return user.role !== "viewer";
     },
-    aiConfig: project.ai
+    aiConfig: effectiveAi,
+    getConnectionThreshold: (name) => {
+      const conn = configLoader.getConnections().find((c) => c.name === name);
+      return conn?.hunch_confidence_threshold;
+    }
   };
   const dataOptions = {
     store: knowledgeStore,
@@ -30933,12 +31670,76 @@ async function createServer(options) {
     getConnectionTables: learningOptions.getConnectionTables,
     canWrite: learningOptions.canWrite
   };
+  const adminConfigOptions = {
+    runtimeStore,
+    gitConnections: () => configLoader.getConnections().map((c) => ({ name: c.name, type: c.type })),
+    knowledgeDbConfigured: !!knowledgeStore,
+    aiConfig: effectiveAi,
+    projectDir,
+    findConnectionRefs: (name) => findConnectionRefs(name, {
+      charts: configLoader.getCharts().map((c) => ({
+        name: c.name,
+        source: { connection: c.source.connection }
+      })),
+      models: configLoader.getModels().map((m) => ({
+        metadata: {
+          name: m.metadata.name,
+          connection: m.metadata.connection
+        }
+      })),
+      defaultConnection: configLoader.getDefaultConnection()?.name
+    }),
+    requestRestart: () => requestRestart(process.env),
+    // Admin-only: when auth disabled (no req.user) allow (dev); else require admin role.
+    canAdmin: (req) => {
+      const user = req.user;
+      if (!user)
+        return true;
+      return user.role === "admin";
+    },
+    knowledgeStore,
+    embedder,
+    createKnowledgeStore: (url) => new PostgresKnowledgeStore(url),
+    testAiProvider: async (cfg, kind) => {
+      try {
+        if (kind === "embedding") {
+          const e = createEmbedder(cfg, process.env);
+          if (!e)
+            return { ok: false, error: "Could not build embedder for this config." };
+          await e.embed(["ping"]);
+        } else {
+          const provider = buildProvider(cfg, process.env);
+          await provider.chat({ system: "", messages: [{ role: "user", content: "ping" }], tools: [], maxTokens: 1 });
+        }
+        return { ok: true };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Test failed";
+        return { ok: false, error: redactProviderError(msg, cfg.api_key) };
+      }
+    }
+  };
+  const registerReconnect = async (scope) => {
+    scope.post("/api/connections/reconnect", async (_request2, reply) => {
+      try {
+        try {
+          await connector.disconnect();
+        } catch {
+        }
+        await connector.connect();
+        return { success: true };
+      } catch (err) {
+        return reply.status(500).send({ error: err instanceof Error ? err.message : "Reconnection failed" });
+      }
+    });
+  };
   if (auth) {
     await fastify.register(async (protectedRoutes) => {
       protectedRoutes.addHook("preHandler", authMiddleware);
       protectedRoutes.addHook("preHandler", orgMiddleware);
       await protectedRoutes.register(learningRoutes, learningOptions);
       await protectedRoutes.register(dataRoutes, dataOptions);
+      await protectedRoutes.register(adminConfigRoutes, adminConfigOptions);
+      await registerReconnect(protectedRoutes);
     });
   } else if (authDb) {
     const localMiddleware = createLocalAuthMiddleware(authDb);
@@ -30946,12 +31747,16 @@ async function createServer(options) {
       protectedRoutes.addHook("preHandler", localMiddleware);
       await protectedRoutes.register(learningRoutes, learningOptions);
       await protectedRoutes.register(dataRoutes, dataOptions);
+      await protectedRoutes.register(adminConfigRoutes, adminConfigOptions);
+      await registerReconnect(protectedRoutes);
     });
   } else {
     await fastify.register(learningRoutes, learningOptions);
     await fastify.register(dataRoutes, dataOptions);
+    await fastify.register(adminConfigRoutes, adminConfigOptions);
+    await registerReconnect(fastify);
   }
-  const assetsDir = join11(projectDir, "assets");
+  const assetsDir = join13(projectDir, "assets");
   try {
     await access2(assetsDir);
     await fastify.register(fastifyStatic, {
@@ -30962,7 +31767,7 @@ async function createServer(options) {
   } catch {
   }
   if (project.theme?.customCss) {
-    const cssPath = join11(projectDir, project.theme.customCss);
+    const cssPath = join13(projectDir, project.theme.customCss);
     fastify.get("/api/theme/custom.css", async (_request2, reply) => {
       try {
         const content = await readFile6(cssPath, "utf-8");
@@ -31009,6 +31814,7 @@ async function createServer(options) {
     configLoader.startWatching();
     configLoader.onChange(async () => {
       fastify.log.info("Config reloaded");
+      applyRuntime();
       const { models: newModels, refs: newRefs } = await buildModelsAndRefs();
       queryService.updateCompiler({ models: newModels, refs: newRefs });
       queryService.invalidateAll();
@@ -31021,7 +31827,7 @@ async function createServer(options) {
       fastify.log.info(`Semantic model rebuilt: ${semanticService.getModel()?.entities.length ?? 0} entities`);
       broadcastConfigChange();
     });
-    const catalogPath = join11(projectDir, ".yamchart", "catalog.json");
+    const catalogPath = join13(projectDir, ".yamchart", "catalog.json");
     try {
       catalogWatcher = fsWatch(catalogPath, () => {
         semanticService.buildFromDisk();
@@ -31085,15 +31891,15 @@ async function runDevServer(projectDir, options) {
   let usesBrowserAuth = false;
   let localAuth;
   try {
-    const { readFileSync: readFileSync3 } = await import("fs");
+    const { readFileSync: readFileSync5 } = await import("fs");
     const { parse: parse2 } = await import("yaml");
-    const { resolveProjectConfig: resolveProjectConfig2, deepMerge: deepMerge3 } = await import("./dist-PPAD6KOM.js");
-    const raw = readFileSync3(resolve2(projectDir, "yamchart.yaml"), "utf-8");
+    const { resolveProjectConfig: resolveProjectConfig2, deepMerge: deepMerge3 } = await import("./dist-WMP7BFKP.js");
+    const raw = readFileSync5(resolve2(projectDir, "yamchart.yaml"), "utf-8");
     const rawConfig = parse2(raw);
     const resolvedEnv = options.env || process.env.YAMCHART_ENV || void 0;
     let projectConfig = resolveProjectConfig2(rawConfig, resolvedEnv);
     try {
-      const localRaw = readFileSync3(resolve2(projectDir, "yamchart.local.yaml"), "utf-8");
+      const localRaw = readFileSync5(resolve2(projectDir, "yamchart.local.yaml"), "utf-8");
       const localOverrides = parse2(localRaw);
       if (localOverrides && typeof localOverrides === "object") {
         projectConfig = deepMerge3(projectConfig, localOverrides);
@@ -31111,7 +31917,7 @@ async function runDevServer(projectDir, options) {
     const targetConn = process.env.YAMCHART_CONNECTION || projectConfig?.defaults?.connection;
     if (targetConn) {
       try {
-        const connRaw = readFileSync3(resolve2(connectionDir, `${targetConn}.yaml`), "utf-8");
+        const connRaw = readFileSync5(resolve2(connectionDir, `${targetConn}.yaml`), "utf-8");
         const connConfig = parse2(connRaw);
         if (connConfig?.auth?.type === "externalbrowser") {
           usesBrowserAuth = true;
@@ -31191,4 +31997,4 @@ async function runDevServer(projectDir, options) {
 export {
   runDevServer
 };
-//# sourceMappingURL=dev-H6SJZ5UA.js.map
+//# sourceMappingURL=dev-KOWFGDOP.js.map