feat: 接入一库一工具知识检索

- 编译知识库英文运行名、描述、检索配置和独立 Registration

- 统一最终分数阈值并保持模型上下文、检索事件与引用一致

- 完善 AG-UI 知识库检索运行态与完成态展示

easyflow-api/easyflow-api-admin/pom.xml

@@ -40,6 +40,10 @@
             <groupId>tech.easyflow</groupId>
             <artifactId>easyflow-module-job</artifactId>
         </dependency>
+        <dependency>
+            <groupId>tech.easyflow</groupId>
+            <artifactId>easyflow-module-dataspace</artifactId>
+        </dependency>
         <dependency>
             <groupId>tech.easyflow</groupId>
             <artifactId>easyflow-common-captcha</artifactId>

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/controller/datacenter/DatacenterDatasetController.java

@@ -24,6 +24,11 @@ import java.util.List;
 @RequestMapping("/api/v1/datacenterDataset")
 public class DatacenterDatasetController {
 
+    /** 对外 Schema 接口的默认字段页码。 */
+    private static final long DEFAULT_FIELD_PAGE_NUMBER = 1L;
+    /** 对外 Schema 接口的默认字段页大小。 */
+    private static final long DEFAULT_FIELD_PAGE_SIZE = 200L;
+
     @Resource
     private DatacenterDatasetQueryService queryService;
     @Resource
@@ -32,13 +37,18 @@ public class DatacenterDatasetController {
     @PostMapping("/queryPage")
     @SaCheckPermission("/api/v1/datacenterSource/query")
     public Result<Page<Row>> queryPage(@RequestBody DatacenterQueryRequest request) {
-        return Result.ok(queryService.queryPage(request));
+        return Result.ok(queryService.queryPage(
+                request, SaTokenUtil.getLoginAccount()));
     }
 
     @GetMapping("/schema")
     @SaCheckPermission("/api/v1/datacenterSource/query")
-    public Result<DatacenterSchemaResponse> schema(DatasetRef datasetRef) {
-        return Result.ok(queryService.getSchema(datasetRef));
+    public Result<DatacenterSchemaResponse> schema(
+            DatasetRef datasetRef,
+            @RequestParam(defaultValue = "1") Long fieldPageNumber,
+            @RequestParam(defaultValue = "200") Long fieldPageSize) {
+        return Result.ok(queryService.getSchema(
+                datasetRef, fieldPageNumber, fieldPageSize));
     }
 
     @GetMapping("/managedTables")
@@ -63,6 +73,13 @@ public class DatacenterDatasetController {
                 request == null ? List.of() : request.getFields(),
                 account
         );
-        return Result.ok(queryService.getSchema(registryService.resolveDatasetRef(table.getId())));
+        return Result.ok(queryService.getSchema(
+                registryService.resolveDatasetRef(table.getId()),
+                request == null || request.getFieldPageNumber() == null
+                        ? DEFAULT_FIELD_PAGE_NUMBER
+                        : request.getFieldPageNumber(),
+                request == null || request.getFieldPageSize() == null
+                        ? DEFAULT_FIELD_PAGE_SIZE
+                        : request.getFieldPageSize()));
     }
 }

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/controller/datacenter/DatacenterQueryController.java

@@ -0,0 +1,84 @@
+package tech.easyflow.admin.controller.datacenter;
+
+import cn.dev33.satoken.annotation.SaCheckPermission;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import tech.easyflow.common.domain.Result;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.common.satoken.util.SaTokenUtil;
+import tech.easyflow.datacenter.execution.model.DatacenterSqlConsoleRequest;
+import tech.easyflow.datacenter.execution.model.DatacenterSqlConsoleResult;
+import tech.easyflow.datacenter.execution.model.DatacenterSqlCancelRequest;
+import tech.easyflow.datacenter.federation.DatacenterFederationQueryService;
+import tech.easyflow.datacenter.federation.DatacenterFederationQueryCancellationService;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.service.DatacenterDatasetRegistryService;
+
+/**
+ * 数据中枢管理端只读 SQL 控制台。
+ */
+@RestController
+@RequestMapping("/api/v1/datacenterQuery")
+public class DatacenterQueryController {
+
+    private final DatacenterDatasetRegistryService registryService;
+    private final DatacenterFederationQueryService queryService;
+    private final DatacenterFederationQueryCancellationService cancellationService;
+
+    /**
+     * 创建查询 Controller。
+     *
+     * @param registryService 数据集注册服务
+     * @param queryService Federation 查询服务
+     * @param cancellationService 跨节点查询取消服务
+     */
+    public DatacenterQueryController(
+            DatacenterDatasetRegistryService registryService,
+            DatacenterFederationQueryService queryService,
+            DatacenterFederationQueryCancellationService cancellationService) {
+        this.registryService = registryService;
+        this.queryService = queryService;
+        this.cancellationService = cancellationService;
+    }
+
+    /**
+     * 执行一条受 Calcite 与业务 Policy 校验的只读 SQL。
+     *
+     * @param request 查询请求
+     * @return 有界查询结果
+     */
+    @PostMapping("/execute")
+    @SaCheckPermission("/api/v1/datacenterSource/query")
+    public Result<DatacenterSqlConsoleResult> execute(
+            @RequestBody DatacenterSqlConsoleRequest request) {
+        LoginAccount account = SaTokenUtil.getLoginAccount();
+        DatacenterSource source = registryService.getSourceRequired(
+                request == null ? null : request.sourceId());
+        return Result.ok(queryService.execute(
+                source,
+                request == null ? null : request.sql(),
+                java.util.List.of(),
+                request == null ? null : request.maxRows(),
+                account,
+                "MANUAL",
+                account == null || account.getId() == null
+                        ? null : account.getId().toString(),
+                request == null ? null : request.queryId()));
+    }
+
+    /**
+     * 取消当前租户在任一节点执行的 SQL 查询。
+     *
+     * @param request 取消请求
+     * @return 是否在本地或集群中接受取消提示
+     */
+    @PostMapping("/cancel")
+    @SaCheckPermission("/api/v1/datacenterSource/query")
+    public Result<Boolean> cancel(@RequestBody DatacenterSqlCancelRequest request) {
+        LoginAccount account = SaTokenUtil.getLoginAccount();
+        return Result.ok(cancellationService.cancel(
+                request == null ? null : request.queryId(), account));
+    }
+}

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/controller/datacenter/DatacenterSourceController.java

@@ -8,10 +8,16 @@ import tech.easyflow.common.entity.LoginAccount;
 import tech.easyflow.common.satoken.util.SaTokenUtil;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.execution.model.DatacenterConnectionTestResult;
-import tech.easyflow.datacenter.meta.entity.DatacenterSource;
 import tech.easyflow.datacenter.meta.model.DatacenterBatchRegisterRequest;
 import tech.easyflow.datacenter.meta.model.DatacenterCatalogMeta;
+import tech.easyflow.datacenter.meta.model.DatacenterMetadataPage;
 import tech.easyflow.datacenter.meta.model.DatacenterRemoveSourceRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceActivateRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceCandidateMetadataRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceCandidateCatalogRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceDraftRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceReconfigureRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceView;
 import tech.easyflow.datacenter.meta.model.DatacenterTableDetailMeta;
 import tech.easyflow.datacenter.meta.service.DatacenterSourceService;
 
@@ -19,6 +25,9 @@ import javax.annotation.Resource;
 import java.math.BigInteger;
 import java.util.List;
 
+/**
+ * 数据源绑定、生命周期与元数据浏览接口。
+ */
 @RestController
 @RequestMapping("/api/v1/datacenterSource")
 public class DatacenterSourceController {
@@ -26,23 +35,100 @@ public class DatacenterSourceController {
     @Resource
     private DatacenterSourceService sourceService;
 
-    @PostMapping("/testConnection")
-    @SaCheckPermission("/api/v1/datacenterSource/query")
-    public Result<DatacenterConnectionTestResult> testConnection(@RequestBody DatacenterSource source) {
+    @PostMapping("/draft")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterSourceView> saveDraft(@RequestBody DatacenterSourceDraftRequest request) {
         LoginAccount account = SaTokenUtil.getLoginAccount();
-        return Result.ok(sourceService.testConnection(source, account));
+        return Result.ok(sourceService.saveDraft(request, account));
     }
 
-    @PostMapping("/save")
-    @SaCheckPermission("/api/v1/datacenterSource/save")
-    public Result<DatacenterSource> save(@RequestBody DatacenterSource source) {
+    @PostMapping("/{sourceId}/probe")
+    @SaCheckPermission("/api/v1/datacenterSource/query")
+    public Result<DatacenterConnectionTestResult> probe(@PathVariable BigInteger sourceId) {
         LoginAccount account = SaTokenUtil.getLoginAccount();
-        return Result.ok(sourceService.saveSource(source, account));
+        return Result.ok(sourceService.probe(sourceId, account));
+    }
+
+    @PostMapping("/activate")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterSourceView> activate(@RequestBody DatacenterSourceActivateRequest request) {
+        LoginAccount account = SaTokenUtil.getLoginAccount();
+        return Result.ok(sourceService.activate(request, account));
+    }
+
+    /**
+     * 探测活动数据源的未发布候选配置。
+     *
+     * @param request 候选连接配置
+     * @return 连接探测结果
+     */
+    @PostMapping("/candidate/probe")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterConnectionTestResult> probeCandidate(
+            @RequestBody DatacenterSourceDraftRequest request) {
+        return Result.ok(sourceService.probeCandidate(
+                request, SaTokenUtil.getLoginAccount()));
+    }
+
+    /**
+     * 浏览活动数据源候选配置可访问的命名空间。
+     *
+     * @param request 候选连接配置
+     * @return 命名空间列表
+     */
+    @PostMapping("/candidate/catalogs")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<List<DatacenterCatalogMeta>> candidateCatalogs(
+            @RequestBody DatacenterSourceDraftRequest request) {
+        return Result.ok(sourceService.listCandidateCatalogs(
+                request, SaTokenUtil.getLoginAccount()));
+    }
+
+    /**
+     * 分页浏览候选配置可访问的命名空间。
+     *
+     * @param request 候选配置和分页条件
+     * @return 有界命名空间列表
+     */
+    @PostMapping("/candidate/catalogs/page")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterMetadataPage<DatacenterCatalogMeta>> candidateCatalogsPage(
+            @RequestBody DatacenterSourceCandidateCatalogRequest request) {
+        return Result.ok(sourceService.listCandidateCatalogsPage(
+                request, SaTokenUtil.getLoginAccount()));
+    }
+
+    /**
+     * 分页浏览活动数据源候选配置可访问的表。
+     *
+     * @param request 候选配置与分页条件
+     * @return 有界表列表
+     */
+    @PostMapping("/candidate/tables")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterMetadataPage<DatacenterTable>> candidateTables(
+            @RequestBody DatacenterSourceCandidateMetadataRequest request) {
+        return Result.ok(sourceService.listCandidateTables(
+                request, SaTokenUtil.getLoginAccount()));
+    }
+
+    /**
+     * 原地发布活动数据源的新连接配置和纳管范围。
+     *
+     * @param request 重配置请求
+     * @return 发布后的数据源视图
+     */
+    @PostMapping("/reconfigure")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterSourceView> reconfigure(
+            @RequestBody DatacenterSourceReconfigureRequest request) {
+        return Result.ok(sourceService.reconfigure(
+                request, SaTokenUtil.getLoginAccount()));
     }
 
     @GetMapping("/page")
     @SaCheckPermission("/api/v1/datacenterSource/query")
-    public Result<Page<DatacenterSource>> page(Long pageNumber, Long pageSize) {
+    public Result<Page<DatacenterSourceView>> page(Long pageNumber, Long pageSize) {
         LoginAccount account = SaTokenUtil.getLoginAccount();
         return Result.ok(sourceService.pageSources(pageNumber, pageSize, account));
     }
@@ -54,19 +140,53 @@ public class DatacenterSourceController {
         return Result.ok(sourceService.listCatalogs(sourceId, account));
     }
 
+    /**
+     * 分页浏览当前数据源的命名空间。
+     *
+     * @param sourceId 数据源 ID
+     * @param keyword 名称搜索词
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @return 有界命名空间列表
+     */
+    @GetMapping("/catalogs/page")
+    @SaCheckPermission("/api/v1/datacenterSource/query")
+    public Result<DatacenterMetadataPage<DatacenterCatalogMeta>> catalogsPage(
+            BigInteger sourceId,
+            String keyword,
+            Long pageNumber,
+            Long pageSize) {
+        return Result.ok(sourceService.listCatalogsPage(
+                sourceId, keyword, pageNumber, pageSize,
+                SaTokenUtil.getLoginAccount()));
+    }
+
     @GetMapping("/tables")
     @SaCheckPermission("/api/v1/datacenterSource/query")
-    public Result<List<DatacenterTable>> tables(BigInteger sourceId, String catalogName) {
+    public Result<DatacenterMetadataPage<DatacenterTable>> tables(
+            BigInteger sourceId,
+            String catalogName,
+            String keyword,
+            Long pageNumber,
+            Long pageSize) {
         LoginAccount account = SaTokenUtil.getLoginAccount();
-        return Result.ok(sourceService.listTables(sourceId, catalogName, account));
+        return Result.ok(sourceService.listTables(
+                sourceId, catalogName, keyword, pageNumber, pageSize, account));
     }
 
     @GetMapping("/tableDetail")
     @SaCheckPermission("/api/v1/datacenterSource/query")
-    public Result<DatacenterTableDetailMeta> tableDetail(BigInteger sourceId, String catalogName, String tableName,
-                                                         @RequestParam(defaultValue = "false") boolean register) {
+    public Result<DatacenterTableDetailMeta> tableDetail(
+            BigInteger sourceId,
+            String catalogName,
+            String tableName,
+            @RequestParam(defaultValue = "false") boolean register,
+            Long fieldPageNumber,
+            Long fieldPageSize) {
         LoginAccount account = SaTokenUtil.getLoginAccount();
-        return Result.ok(sourceService.getTableDetail(sourceId, catalogName, tableName, register, account));
+        return Result.ok(sourceService.getTableDetail(
+                sourceId, catalogName, tableName, register,
+                fieldPageNumber, fieldPageSize, account));
     }
 
     @PostMapping("/registerBatch")
@@ -83,4 +203,44 @@ public class DatacenterSourceController {
         sourceService.removeSource(request == null ? null : request.getSourceId(), account);
         return Result.ok();
     }
+
+    /**
+     * 停用活动数据源。
+     *
+     * @param sourceId 数据源 ID
+     * @return 停用后的数据源视图
+     */
+    @PostMapping("/{sourceId}/disable")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterSourceView> disable(@PathVariable BigInteger sourceId) {
+        return Result.ok(sourceService.disable(
+                sourceId, SaTokenUtil.getLoginAccount()));
+    }
+
+    /**
+     * 重新启用已停用数据源。
+     *
+     * @param sourceId 数据源 ID
+     * @return 启用后的数据源视图
+     */
+    @PostMapping("/{sourceId}/enable")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterSourceView> enable(@PathVariable BigInteger sourceId) {
+        return Result.ok(sourceService.enable(
+                sourceId, SaTokenUtil.getLoginAccount()));
+    }
+
+    /**
+     * 刷新已纳管对象的 JDBC 元数据观测状态。
+     *
+     * @param sourceId 数据源 ID
+     * @return 刷新后的数据源视图
+     */
+    @PostMapping("/{sourceId}/metadata/refresh")
+    @SaCheckPermission("/api/v1/datacenterSource/save")
+    public Result<DatacenterSourceView> refreshMetadata(
+            @PathVariable BigInteger sourceId) {
+        return Result.ok(sourceService.refreshMetadata(
+                sourceId, SaTokenUtil.getLoginAccount()));
+    }
 }

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/controller/dataspace/DataspaceConnectionController.java

@@ -0,0 +1,161 @@
+package tech.easyflow.admin.controller.dataspace;
+
+import cn.dev33.satoken.annotation.SaCheckPermission;
+import java.math.BigInteger;
+import java.util.List;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import tech.easyflow.common.domain.Result;
+import tech.easyflow.common.web.jsonbody.JsonBody;
+import tech.easyflow.common.web.exceptions.BusinessException;
+import tech.easyflow.dataspace.model.ConnectionDefinition;
+import tech.easyflow.dataspace.model.ConnectionView;
+import tech.easyflow.dataspace.model.ObjectView;
+import tech.easyflow.dataspace.provider.DataspaceProbe;
+import tech.easyflow.dataspace.service.DataspaceConnectionService;
+
+/**
+ * 数据空间物理连接管理端 API。
+ */
+@RestController
+@RequestMapping("/api/v1/dataspaceConnection")
+public class DataspaceConnectionController {
+
+    private final DataspaceConnectionService connectionService;
+
+    /**
+     * 创建连接控制器。
+     *
+     * @param connectionService 连接服务
+     */
+    public DataspaceConnectionController(DataspaceConnectionService connectionService) {
+        this.connectionService = connectionService;
+    }
+
+    /**
+     * 查询当前租户连接列表。
+     *
+     * @param keyword 搜索关键词
+     * @return 连接列表
+     */
+    @GetMapping("/list")
+    @SaCheckPermission("/api/v1/dataspaceConnection/query")
+    public Result<List<ConnectionView>> list(String keyword) {
+        return Result.ok(connectionService.list(keyword));
+    }
+
+    /**
+     * 获取连接详情。
+     *
+     * @param id 连接 ID
+     * @return 连接详情
+     */
+    @GetMapping("/detail")
+    @SaCheckPermission("/api/v1/dataspaceConnection/query")
+    public Result<ConnectionView> detail(BigInteger id) {
+        return Result.ok(connectionService.detail(id));
+    }
+
+    /**
+     * 测试候选或已保存连接。
+     *
+     * @param definition 连接定义
+     * @return 测试结果
+     */
+    @PostMapping("/test")
+    @SaCheckPermission("/api/v1/dataspaceConnection/test")
+    public Result<DataspaceProbe> test(
+            @JsonBody(required = true, skipConvertError = false) ConnectionDefinition definition) {
+        return Result.ok(connectionService.test(definition));
+    }
+
+    /**
+     * 创建或更新连接。
+     *
+     * @param definition 连接定义
+     * @return 保存后的连接
+     */
+    @PostMapping("/save")
+    @SaCheckPermission("/api/v1/dataspaceConnection/save")
+    public Result<ConnectionView> save(
+            @JsonBody(required = true, skipConvertError = false) ConnectionDefinition definition) {
+        return Result.ok(connectionService.save(definition));
+    }
+
+    /**
+     * 启用或禁用连接。
+     *
+     * @param request 状态变更请求
+     * @return 变更后的连接
+     */
+    @PostMapping("/status")
+    @SaCheckPermission("/api/v1/dataspaceConnection/save")
+    public Result<ConnectionView> status(
+            @JsonBody(required = true, skipConvertError = false) StatusRequest request) {
+        if (request == null || request.enabled() == null) {
+            throw new BusinessException("连接状态不能为空");
+        }
+        return Result.ok(connectionService.setEnabled(request.id(), request.enabled()));
+    }
+
+    /**
+     * 查询当前连接的对象树数据。
+     *
+     * @param connectionId 连接 ID
+     * @param keyword Schema 或表名关键词
+     * @return 对象列表
+     */
+    @GetMapping("/objects")
+    @SaCheckPermission("/api/v1/dataspaceConnection/query")
+    public Result<List<ObjectView>> objects(BigInteger connectionId, String keyword) {
+        return Result.ok(connectionService.objects(connectionId, keyword));
+    }
+
+    /**
+     * 刷新连接元数据。
+     *
+     * @param request 刷新请求
+     * @return 新 revision 对象列表
+     */
+    @PostMapping("/refreshMetadata")
+    @SaCheckPermission("/api/v1/dataspaceConnection/metadata")
+    public Result<List<ObjectView>> refreshMetadata(
+            @JsonBody(required = true, skipConvertError = false) RefreshRequest request) {
+        return Result.ok(connectionService.refreshMetadata(
+                request.connectionId(), request.expectedRevision()));
+    }
+
+    /**
+     * 删除未被引用的连接。
+     *
+     * @param id 连接 ID
+     * @return 成功结果
+     */
+    @PostMapping("/remove")
+    @SaCheckPermission("/api/v1/dataspaceConnection/remove")
+    public Result<Void> remove(
+            @JsonBody(value = "id", required = true, skipConvertError = false) BigInteger id) {
+        connectionService.remove(id);
+        return Result.ok();
+    }
+
+    /**
+     * 元数据刷新请求。
+     *
+     * @param connectionId 连接 ID
+     * @param expectedRevision 期望 revision
+     */
+    public record RefreshRequest(BigInteger connectionId, long expectedRevision) {
+    }
+
+    /**
+     * 连接状态变更请求。
+     *
+     * @param id 连接 ID
+     * @param enabled 是否启用
+     */
+    public record StatusRequest(BigInteger id, Boolean enabled) {
+    }
+}

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/controller/dataspace/DataspaceController.java

@@ -0,0 +1,113 @@
+package tech.easyflow.admin.controller.dataspace;
+
+import cn.dev33.satoken.annotation.SaCheckPermission;
+import java.math.BigInteger;
+import java.util.List;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RestController;
+import tech.easyflow.common.domain.Result;
+import tech.easyflow.common.web.jsonbody.JsonBody;
+import tech.easyflow.common.web.exceptions.BusinessException;
+import tech.easyflow.dataspace.model.DataspaceDefinition;
+import tech.easyflow.dataspace.model.DataspaceSummary;
+import tech.easyflow.dataspace.model.DataspaceView;
+import tech.easyflow.dataspace.service.DataspaceService;
+
+/**
+ * 虚拟数据空间管理端 API。
+ */
+@RestController
+@RequestMapping("/api/v1/dataspace")
+public class DataspaceController {
+
+    private final DataspaceService dataspaceService;
+
+    /**
+     * 创建数据空间控制器。
+     *
+     * @param dataspaceService 数据空间服务
+     */
+    public DataspaceController(DataspaceService dataspaceService) {
+        this.dataspaceService = dataspaceService;
+    }
+
+    /**
+     * 查询数据空间列表。
+     *
+     * @param keyword 搜索关键词
+     * @return 数据空间摘要
+     */
+    @GetMapping("/list")
+    @SaCheckPermission("/api/v1/dataspace/query")
+    public Result<List<DataspaceSummary>> list(String keyword) {
+        return Result.ok(dataspaceService.list(keyword));
+    }
+
+    /**
+     * 获取数据空间当前 revision 详情。
+     *
+     * @param id 数据空间 ID
+     * @return 数据空间详情
+     */
+    @GetMapping("/detail")
+    @SaCheckPermission("/api/v1/dataspace/detail")
+    public Result<DataspaceView> detail(BigInteger id) {
+        return Result.ok(dataspaceService.detail(id));
+    }
+
+    /**
+     * 保存数据空间并生成新 revision。
+     *
+     * @param definition 数据空间定义
+     * @return 保存后的详情
+     */
+    @PostMapping("/save")
+    @SaCheckPermission("/api/v1/dataspace/save")
+    public Result<DataspaceView> save(
+            @RequestBody DataspaceDefinition definition) {
+        return Result.ok(dataspaceService.save(definition));
+    }
+
+    /**
+     * 启用或禁用数据空间。
+     *
+     * @param request 状态变更请求
+     * @return 成功结果
+     */
+    @PostMapping("/status")
+    @SaCheckPermission("/api/v1/dataspace/save")
+    public Result<Void> status(
+            @JsonBody(required = true, skipConvertError = false) StatusRequest request) {
+        if (request == null || request.enabled() == null) {
+            throw new BusinessException("数据空间状态不能为空");
+        }
+        dataspaceService.setEnabled(request.id(), request.enabled());
+        return Result.ok();
+    }
+
+    /**
+     * 逻辑删除数据空间。
+     *
+     * @param id 数据空间 ID
+     * @return 成功结果
+     */
+    @PostMapping("/remove")
+    @SaCheckPermission("/api/v1/dataspace/remove")
+    public Result<Void> remove(
+            @JsonBody(value = "id", required = true, skipConvertError = false) BigInteger id) {
+        dataspaceService.remove(id);
+        return Result.ok();
+    }
+
+    /**
+     * 数据空间状态变更请求。
+     *
+     * @param id 数据空间 ID
+     * @param enabled 是否启用
+     */
+    public record StatusRequest(BigInteger id, Boolean enabled) {
+    }
+}

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/controller/dataspace/DataspaceSqlController.java

@@ -0,0 +1,86 @@
+package tech.easyflow.admin.controller.dataspace;
+
+import cn.dev33.satoken.annotation.SaCheckPermission;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import tech.easyflow.common.domain.Result;
+import tech.easyflow.common.web.jsonbody.JsonBody;
+import tech.easyflow.dataspace.model.DataspaceExplainResult;
+import tech.easyflow.dataspace.model.DataspaceQueryRequest;
+import tech.easyflow.dataspace.model.DataspaceQueryResult;
+import tech.easyflow.dataspace.model.DataspaceSqlCompletionRequest;
+import tech.easyflow.dataspace.model.DataspaceSqlCompletionResult;
+import tech.easyflow.dataspace.service.DataspaceQueryService;
+
+/**
+ * 数据空间 SQL 工作台 Query、Explain、Complete 与 Cancel API。
+ */
+@RestController
+@RequestMapping("/api/v1/dataspaceSql")
+public class DataspaceSqlController {
+
+    private final DataspaceQueryService queryService;
+
+    /**
+     * 创建 SQL 控制器。
+     *
+     * @param queryService 查询服务
+     */
+    public DataspaceSqlController(DataspaceQueryService queryService) {
+        this.queryService = queryService;
+    }
+
+    /**
+     * 执行只读 SQL。
+     *
+     * @param request 查询请求
+     * @return 查询结果与指标
+     */
+    @PostMapping("/query")
+    @SaCheckPermission("/api/v1/dataspaceSql/query")
+    public Result<DataspaceQueryResult> query(
+            @JsonBody(required = true, skipConvertError = false) DataspaceQueryRequest request) {
+        return Result.ok(queryService.query(request));
+    }
+
+    /**
+     * 显式执行非 ANALYZE Explain。
+     *
+     * @param request Explain 请求
+     * @return Explain 与索引信息
+     */
+    @PostMapping("/explain")
+    @SaCheckPermission("/api/v1/dataspaceSql/explain")
+    public Result<DataspaceExplainResult> explain(
+            @JsonBody(required = true, skipConvertError = false) DataspaceQueryRequest request) {
+        return Result.ok(queryService.explain(request));
+    }
+
+    /**
+     * 返回当前数据空间内的 Calcite SQL 补全候选。
+     *
+     * @param request 补全请求
+     * @return 补全替换区间与候选
+     */
+    @PostMapping("/complete")
+    @SaCheckPermission("/api/v1/dataspaceSql/query")
+    public Result<DataspaceSqlCompletionResult> complete(
+            @JsonBody(required = true, skipConvertError = false)
+            DataspaceSqlCompletionRequest request) {
+        return Result.ok(queryService.complete(request));
+    }
+
+    /**
+     * 尝试取消当前节点查询。
+     *
+     * @param queryId 查询 ID
+     * @return 是否找到并发起取消
+     */
+    @PostMapping("/cancel")
+    @SaCheckPermission("/api/v1/dataspaceSql/query")
+    public Result<Boolean> cancel(
+            @JsonBody(value = "queryId", required = true, skipConvertError = false) String queryId) {
+        return Result.ok(queryService.cancel(queryId));
+    }
+}

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/model/ai/WorkflowDesignerOptionsView.java

@@ -126,6 +126,7 @@ public record WorkflowDesignerOptionsView(
      * 已接入数据集安全选项。
      *
      * @param id 数据集 ID
+     * @param tenantId 租户 ID
      * @param sourceId 数据源 ID
      * @param catalogId 目录 ID
      * @param tableName 数据表名称
@@ -133,6 +134,7 @@ public record WorkflowDesignerOptionsView(
      */
     public record DatasetOption(
             @JsonSerialize(using = ToStringSerializer.class) BigInteger id,
+            @JsonSerialize(using = ToStringSerializer.class) BigInteger tenantId,
             @JsonSerialize(using = ToStringSerializer.class) BigInteger sourceId,
             @JsonSerialize(using = ToStringSerializer.class) BigInteger catalogId,
             String tableName,

easyflow-api/easyflow-api-admin/src/main/java/tech/easyflow/admin/service/ai/WorkflowDesignerOptionService.java

@@ -653,6 +653,7 @@ public class WorkflowDesignerOptionService {
     private WorkflowDesignerOptionsView.DatasetOption toDatasetOption(DatacenterTable table) {
         return new WorkflowDesignerOptionsView.DatasetOption(
                 table.getId(),
+                table.getTenantId(),
                 table.getSourceId(),
                 table.getCatalogId(),
                 table.getTableName(),

easyflow-api/easyflow-api-admin/src/test/java/tech/easyflow/admin/controller/dataspace/DataspaceControllerContractTest.java

@@ -0,0 +1,77 @@
+package tech.easyflow.admin.controller.dataspace;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.lang.reflect.Method;
+import java.lang.reflect.Parameter;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.testng.annotations.Test;
+import tech.easyflow.common.web.jsonbody.JsonBody;
+import tech.easyflow.dataspace.model.DataspaceDefinition;
+
+/**
+ * 数据空间管理接口请求绑定契约测试。
+ */
+public class DataspaceControllerContractTest {
+
+    /**
+     * 验证保存接口使用 Jackson 请求体绑定，避免嵌套定义残留为 JSONObject。
+     *
+     * @throws Exception 反射或 JSON 转换失败时抛出
+     */
+    @Test
+    public void shouldBindNestedDataspaceDefinitionWithJackson() throws Exception {
+        Method method = DataspaceController.class.getMethod(
+                "save", DataspaceDefinition.class);
+        Parameter parameter = method.getParameters()[0];
+        assertNotNull(parameter.getAnnotation(RequestBody.class));
+        assertNull(parameter.getAnnotation(JsonBody.class));
+
+        String request = """
+                {
+                  "name": "网点经营分析",
+                  "tables": [
+                    {
+                      "clientKey": "table:outlet",
+                      "objectId": "1001",
+                      "sourceAlias": "MYSQL_1",
+                      "schemaAlias": "MAIN",
+                      "tableAlias": "outlet",
+                      "positionX": 80,
+                      "positionY": 120
+                    },
+                    {
+                      "clientKey": "table:region",
+                      "objectId": "1002",
+                      "sourceAlias": "PG_1",
+                      "schemaAlias": "PUBLIC",
+                      "tableAlias": "outlet_region",
+                      "positionX": 420,
+                      "positionY": 120
+                    }
+                  ],
+                  "relations": [
+                    {
+                      "leftClientKey": "table:outlet",
+                      "rightClientKey": "table:region",
+                      "joinType": "INNER",
+                      "leftColumn": "institution_id",
+                      "rightColumn": "institution_id"
+                    }
+                  ]
+                }
+                """;
+
+        DataspaceDefinition definition = new ObjectMapper().readValue(
+                request, DataspaceDefinition.class);
+
+        assertEquals(2, definition.tables().size());
+        assertEquals("outlet", definition.tables().get(0).tableAlias());
+        assertEquals("outlet_region", definition.tables().get(1).tableAlias());
+        assertEquals(1, definition.relations().size());
+        assertEquals("institution_id", definition.relations().get(0).leftColumn());
+    }
+}

easyflow-commons/easyflow-common-file-storage/src/main/java/tech/easyflow/common/filestorage/FileStorageManager.java

@@ -11,6 +11,7 @@ import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.function.Function;
 import java.util.function.Supplier;
 
@@ -151,6 +152,19 @@ public class FileStorageManager implements FileStorageService {
         return serviceForHandle(handle).readRecoverable(handle);
     }
 
+    /**
+     * 使用当前后端解析服务端可信文件引用。
+     *
+     * @param reference 文件 URL 或其他后端可识别引用
+     * @return 可信文件的物理读取句柄；引用无法确认时为空
+     * @throws IOException 文件记录无法安全解析时抛出
+     */
+    @Override
+    public Optional<FileStorageWriteHandle> resolveTrustedFile(String reference)
+            throws IOException {
+        return currentService().resolveTrustedFile(reference);
+    }
+
     /**
      * 严格按句柄中的后端精确删除物理对象。
      *

easyflow-commons/easyflow-common-file-storage/src/main/java/tech/easyflow/common/filestorage/FileStorageService.java

@@ -5,6 +5,7 @@ import org.springframework.web.multipart.MultipartFile;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.Optional;
 
 /**
  * EasyFlow 文件存储统一接口。
@@ -105,6 +106,21 @@ public interface FileStorageService {
         throw unsupportedRecoverableOperation("readRecoverable");
     }
 
+    /**
+     * 将服务端可信文件引用解析为物理读取句柄。
+     *
+     * <p>实现必须以服务端持久化记录或存储平台配置为信任来源，并要求外部引用与可信来源
+     * 精确匹配；不得仅根据客户端传入的 URL、路径或 locator 构造句柄。</p>
+     *
+     * @param reference 文件 URL 或其他后端可识别引用
+     * @return 可信文件的物理读取句柄；引用无法确认时为空
+     * @throws IOException 文件记录损坏或存储配置不兼容时抛出
+     */
+    default Optional<FileStorageWriteHandle> resolveTrustedFile(String reference)
+            throws IOException {
+        return Optional.empty();
+    }
+
     /**
      * 精确且幂等地删除句柄对应的物理对象。
      *

easyflow-commons/easyflow-common-file-storage/src/main/java/tech/easyflow/common/filestorage/impl/XFIleStorageServiceImpl.java

@@ -21,6 +21,7 @@ import java.io.*;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.util.Objects;
+import java.util.Optional;
 
 /**
  * 基于 x-file-storage 的 EasyFlow 文件存储实现。
@@ -268,6 +269,47 @@ public class XFIleStorageServiceImpl implements FileStorageService {
         }
     }
 
+    /**
+     * 使用 x-file-storage 文件记录或服务端平台配置恢复可信物理读取句柄。
+     *
+     * <p>优先使用 recorder 的精确记录。记录不存在时，仅允许与已配置平台 domain、basePath
+     * 及重建后的完整 URL 完全一致的引用。其他 URL 返回空，由上层继续执行公网地址安全校验。</p>
+     *
+     * @param reference 文件 URL
+     * @return 可信文件的物理读取句柄；引用无法确认时为空
+     * @throws IOException 文件记录损坏或平台配置不兼容时抛出
+     */
+    @Override
+    public Optional<FileStorageWriteHandle> resolveTrustedFile(String reference)
+            throws IOException {
+        if (!StringUtils.hasText(reference)) {
+            return Optional.empty();
+        }
+        FileInfo fileInfo = null;
+        try {
+            fileInfo = fileStorageService.getFileInfoByUrl(reference);
+        } catch (RuntimeException exception) {
+            // 存储平台配置本身仍可提供精确可信边界，记录器异常不应阻断内部对象读取。
+            LOG.warn("查询 x-file-storage 文件记录失败，继续按服务端存储配置识别，reference={}",
+                    reference, exception);
+        }
+        if (fileInfo != null) {
+            if (!reference.equals(fileInfo.getUrl())) {
+                throw new IOException("x-file-storage 文件记录 URL 与请求引用不一致");
+            }
+            try {
+                FileStorageWriteHandle handle = handleFromFileInfo(fileInfo);
+                FileStorage storage = requireStorage(handle);
+                requirePersistedBasePathSupport(storage, handle);
+                verifyRecordedLocation(fileInfo, handle);
+                return Optional.of(handle);
+            } catch (RuntimeException exception) {
+                throw new IOException("x-file-storage 文件记录无法恢复为安全读取位置", exception);
+            }
+        }
+        return resolveConfiguredStorageReference(reference);
+    }
+
     /**
      * 直接调用句柄指定平台的物理删除与存在检查，绕过依赖 URL 记录的聚合删除路径。
      *
@@ -391,6 +433,108 @@ public class XFIleStorageServiceImpl implements FileStorageService {
         }
     }
 
+    /**
+     * 校验 recorder 中的物理定位字段可由恢复句柄无损重建。
+     *
+     * @param fileInfo 服务端文件记录
+     * @param handle 恢复出的物理读取句柄
+     */
+    private void verifyRecordedLocation(FileInfo fileInfo, FileStorageWriteHandle handle) {
+        String actualBasePath = fileInfo.getBasePath() == null ? "" : fileInfo.getBasePath();
+        String actualPath = fileInfo.getPath() == null ? "" : fileInfo.getPath();
+        if (!handle.getPlatform().equals(fileInfo.getPlatform())
+                || !handle.getBasePath().equals(actualBasePath)
+                || !physicalPath(handle).equals(actualPath)
+                || !handle.getFilename().equals(fileInfo.getFilename())) {
+            throw new IllegalStateException("x-file-storage 文件记录包含非规范物理位置");
+        }
+    }
+
+    /**
+     * 从 FileInfo 的物理定位字段构造严格校验的读取句柄。
+     *
+     * @param fileInfo 服务端文件信息
+     * @return 可信物理读取句柄
+     */
+    private FileStorageWriteHandle handleFromFileInfo(FileInfo fileInfo) {
+        String basePath = fileInfo.getBasePath() == null ? "" : fileInfo.getBasePath();
+        return new FileStorageWriteHandle(
+                RECOVERABLE_BACKEND,
+                fileInfo.getPlatform(),
+                basePath,
+                recordedRelativePath(basePath, fileInfo.getPath()),
+                fileInfo.getFilename());
+    }
+
+    /**
+     * 按服务端配置的平台 domain 与 basePath 识别内部存储 URL。
+     *
+     * <p>解析后会再次通过平台自身的 getFileKey 重建完整 URL 并进行精确比较，避免仅凭
+     * host 或字符串前缀放行其他私网目标。</p>
+     *
+     * @param reference 待识别 URL
+     * @return 精确匹配配置的读取句柄；不匹配任何平台时为空
+     * @throws IOException 匹配平台前缀但路径无法安全恢复时抛出
+     */
+    private Optional<FileStorageWriteHandle> resolveConfiguredStorageReference(
+            String reference) throws IOException {
+        if (fileStorageService.getFileStorageList() == null) {
+            return Optional.empty();
+        }
+        for (FileStorage storage : fileStorageService.getFileStorageList()) {
+            String domain = readDomainBestEffort(storage);
+            if (!StringUtils.hasText(domain)) {
+                continue;
+            }
+            String basePath = readRequiredBasePath(storage);
+            String prefix = domain + basePath;
+            if (!reference.startsWith(prefix)) {
+                continue;
+            }
+            try {
+                String remainder = reference.substring(prefix.length());
+                int filenameIndex = remainder.lastIndexOf('/') + 1;
+                FileInfo fileInfo = new FileInfo()
+                        .setUrl(reference)
+                        .setPlatform(storage.getPlatform())
+                        .setBasePath(basePath)
+                        .setPath(remainder.substring(0, filenameIndex))
+                        .setFilename(remainder.substring(filenameIndex));
+                FileStorageWriteHandle handle = handleFromFileInfo(fileInfo);
+                requirePersistedBasePathSupport(storage, handle);
+                verifyRecordedLocation(fileInfo, handle);
+                if (!reference.equals(deriveUrlBestEffort(storage, toFileInfo(handle)))) {
+                    throw new IllegalArgumentException("重建 URL 与请求引用不一致");
+                }
+                return Optional.of(handle);
+            } catch (RuntimeException exception) {
+                throw new IOException("服务端存储 URL 无法恢复为安全读取位置", exception);
+            }
+        }
+        return Optional.empty();
+    }
+
+    /**
+     * 将 recorder 保存的 x-file-storage 物理路径还原为句柄相对路径。
+     *
+     * @param basePath 平台基础路径
+     * @param recordedPath recorder 中保存的物理目录
+     * @return 不带前导斜杠的相对目录
+     */
+    private String recordedRelativePath(String basePath, String recordedPath) {
+        String path = recordedPath == null ? "" : recordedPath;
+        if (basePath.isEmpty() || basePath.endsWith("/")) {
+            if (path.startsWith("/")) {
+                throw new IllegalArgumentException("文件记录路径与平台基础路径格式不一致");
+            }
+            return path;
+        }
+        if (!path.startsWith("/")) {
+            throw new IllegalArgumentException("文件记录路径缺少必要的前导斜杠");
+        }
+        return path.substring(1);
+    }
+
     /**
      * 构造仅包含精确物理定位字段的 FileInfo。
      *
@@ -487,16 +631,26 @@ public class XFIleStorageServiceImpl implements FileStorageService {
      * @return 可推导 URL；平台不支持时返回 null
      */
     private String deriveUrlBestEffort(FileStorage storage, FileInfo fileInfo) {
+        String domain = readDomainBestEffort(storage);
+        if (domain == null) {
+            return null;
+        }
+        return domain + storage.getFileKey(fileInfo);
+    }
+
+    /**
+     * 使用平台公开的 getDomain 方法读取文件访问域名。
+     *
+     * @param storage 具体平台存储
+     * @return 平台访问域名；平台不支持时返回 null
+     */
+    private String readDomainBestEffort(FileStorage storage) {
         try {
             Method method = storage.getClass().getMethod("getDomain");
             if (!String.class.equals(method.getReturnType())) {
                 return null;
             }
-            String domain = (String) method.invoke(storage);
-            if (domain == null) {
-                return null;
-            }
-            return domain + storage.getFileKey(fileInfo);
+            return (String) method.invoke(storage);
         } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException | RuntimeException exception) {
             LOG.debug("当前 x-file-storage 平台无法推导 recorder URL: {}", storage.getClass().getName());
             return null;

easyflow-commons/easyflow-common-file-storage/src/test/java/tech/easyflow/common/filestorage/FileStorageManagerTest.java

@@ -7,6 +7,7 @@ import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.Assert.assertEquals;
@@ -49,6 +50,27 @@ public class FileStorageManagerTest {
         assertFalse(exists);
     }
 
+    /**
+     * 验证服务端文件记录解析使用当前配置的具体存储后端。
+     *
+     * @throws IOException 文件记录解析失败时抛出
+     */
+    @Test
+    public void recordedFileResolutionUsesCurrentBackend() throws IOException {
+        RecordingStorage local = new RecordingStorage("local");
+        RecordingStorage xFile = new RecordingStorage("xFileStorage");
+        FileStorageManager manager = new FileStorageManager(
+                () -> "xFileStorage",
+                backend -> Map.of("local", local, "xFileStorage", xFile).get(backend));
+
+        Optional<FileStorageWriteHandle> resolved = manager.resolveTrustedFile(
+                "http://127.0.0.1:39000/easyflow/attachment/demo.pdf");
+
+        assertSame(xFile.recordedHandle, resolved.orElseThrow());
+        assertEquals(1, xFile.resolveCalls);
+        assertEquals(0, local.resolveCalls);
+    }
+
     /**
      * 可记录可恢复调用的存储测试替身。
      */
@@ -57,6 +79,8 @@ public class FileStorageManagerTest {
         private final String backend;
         /** 固定结果。 */
         private final FileStorageWriteResult result;
+        /** 固定服务端文件记录句柄。 */
+        private final FileStorageWriteHandle recordedHandle;
         /** 固定可恢复读取流。 */
         private final InputStream recoverableInput = InputStream.nullInputStream();
         /** prepare 调用次数。 */
@@ -69,6 +93,8 @@ public class FileStorageManagerTest {
         private int deleteCalls;
         /** exists 调用次数。 */
         private int existsCalls;
+        /** 服务端文件记录解析调用次数。 */
+        private int resolveCalls;
 
         /**
          * 创建指定名称的存储替身。
@@ -80,6 +106,8 @@ public class FileStorageManagerTest {
             FileStorageWriteHandle handle = new FileStorageWriteHandle(
                     backend, "", "/tmp/easyflow", "skill-content", "content.bin");
             this.result = new FileStorageWriteResult("/files/content.bin", handle.encodeLocator());
+            this.recordedHandle = new FileStorageWriteHandle(
+                    backend, "", "/tmp/easyflow", "attachment", "demo.pdf");
         }
 
         /** {@inheritDoc} */
@@ -114,6 +142,13 @@ public class FileStorageManagerTest {
             return recoverableInput;
         }
 
+        /** {@inheritDoc} */
+        @Override
+        public Optional<FileStorageWriteHandle> resolveTrustedFile(String reference) {
+            resolveCalls++;
+            return Optional.of(recordedHandle);
+        }
+
         /** {@inheritDoc} */
         @Override
         public void deleteRecoverable(FileStorageWriteHandle handle) {

easyflow-commons/easyflow-common-file-storage/src/test/java/tech/easyflow/common/filestorage/impl/XFIleStorageServiceImplTest.java

@@ -212,6 +212,123 @@ public class XFIleStorageServiceImplTest {
                 client.lastArgs.object());
     }
 
+    /**
+     * 验证 recorder 登记的回环地址附件可恢复为可信句柄并通过 MinIO 客户端直读。
+     *
+     * @throws Exception 测试替身配置或流读取失败
+     */
+    @Test
+    public void recordedLoopbackUrlUsesExactMinioObject() throws Exception {
+        byte[] content = "workflow-content".getBytes(java.nio.charset.StandardCharsets.UTF_8);
+        RecordingMinioClient client = new RecordingMinioClient(content);
+        MinioFileStorage platform = new MinioFileStorage();
+        platform.setPlatform("minio-main");
+        platform.setBucketName("easyflow");
+        platform.setBasePath("attachment");
+        platform.setDomain("http://127.0.0.1:39000/easyflow/");
+        platform.setClientFactory(new FixedMinioClientFactory(client));
+        RecoverableStorageService delegate = new RecoverableStorageService(platform);
+        String fileUrl = "http://127.0.0.1:39000/easyflow/attachment/1/2026/8/26/"
+                + "d6186b17-4ab7-4f99-9299-b19df7ff0a3b/投标文件否决（废标）违规事项汇总.pdf";
+        delegate.recordedFileInfo = new FileInfo()
+                .setUrl(fileUrl)
+                .setPlatform("minio-main")
+                .setBasePath("attachment")
+                .setPath("/1/2026/8/26/d6186b17-4ab7-4f99-9299-b19df7ff0a3b/")
+                .setFilename("投标文件否决（废标）违规事项汇总.pdf");
+        XFIleStorageServiceImpl service = createService(delegate);
+
+        FileStorageWriteHandle handle = service.resolveTrustedFile(fileUrl).orElseThrow();
+        byte[] actual;
+        try (InputStream inputStream = service.readRecoverable(handle)) {
+            actual = inputStream.readAllBytes();
+        }
+
+        assertEquals("attachment", handle.getBasePath());
+        assertEquals(
+                "1/2026/8/26/d6186b17-4ab7-4f99-9299-b19df7ff0a3b/",
+                handle.getPath());
+        assertArrayEquals(content, actual);
+        assertEquals("easyflow", client.lastArgs.bucket());
+        assertEquals(
+                "attachment/1/2026/8/26/d6186b17-4ab7-4f99-9299-b19df7ff0a3b/"
+                        + "投标文件否决（废标）违规事项汇总.pdf",
+                client.lastArgs.object());
+    }
+
+    /**
+     * 验证 recorder 没有记录时，服务端配置的存储 URL 仍可通过 MinIO 客户端直读。
+     *
+     * @throws Exception 测试替身配置或流读取失败
+     */
+    @Test
+    public void configuredStorageUrlWithoutRecorderUsesExactMinioObject() throws Exception {
+        byte[] content = "configured-content".getBytes(java.nio.charset.StandardCharsets.UTF_8);
+        RecordingMinioClient client = new RecordingMinioClient(content);
+        MinioFileStorage platform = new MinioFileStorage();
+        platform.setPlatform("minio-main");
+        platform.setBucketName("easyflow");
+        platform.setBasePath("attachment");
+        platform.setDomain("http://127.0.0.1:39000/easyflow/");
+        platform.setClientFactory(new FixedMinioClientFactory(client));
+        XFIleStorageServiceImpl service = createService(new RecoverableStorageService(platform));
+        String fileUrl = "http://127.0.0.1:39000/easyflow/attachment/1/2026/8/26/"
+                + "0f0db465-7fa0-46b1-9fae-4f5a8c85f881/投标文件否决（废标）违规事项汇总.pdf";
+
+        FileStorageWriteHandle handle = service.resolveTrustedFile(fileUrl).orElseThrow();
+        byte[] actual;
+        try (InputStream inputStream = service.readRecoverable(handle)) {
+            actual = inputStream.readAllBytes();
+        }
+
+        assertArrayEquals(content, actual);
+        assertEquals(
+                "attachment/1/2026/8/26/0f0db465-7fa0-46b1-9fae-4f5a8c85f881/"
+                        + "投标文件否决（废标）违规事项汇总.pdf",
+                client.lastArgs.object());
+    }
+
+    /**
+     * 验证未配置为存储地址的回环 URL 不会被识别为可信附件。
+     *
+     * @throws Exception 测试替身注入失败
+     */
+    @Test
+    public void unconfiguredLoopbackUrlIsNotResolved() throws Exception {
+        RecoverablePlatform platform = new RecoverablePlatform(
+                "minio-main", "attachment", "http://127.0.0.1:39000/easyflow/");
+        XFIleStorageServiceImpl service = createService(new RecoverableStorageService(platform));
+
+        assertTrue(service.resolveTrustedFile(
+                "http://127.0.0.1:39000/other/unconfigured.pdf").isEmpty());
+    }
+
+    /**
+     * 验证 recorder 中非规范物理路径会失败关闭。
+     *
+     * @throws Exception 测试替身注入失败
+     */
+    @Test
+    public void corruptedRecordedLocationIsRejected() throws Exception {
+        RecoverablePlatform platform = new RecoverablePlatform(
+                "minio-main", "attachment", "http://127.0.0.1:39000/easyflow/");
+        RecoverableStorageService delegate = new RecoverableStorageService(platform);
+        String fileUrl = "http://127.0.0.1:39000/easyflow/attachment/demo.pdf";
+        delegate.recordedFileInfo = new FileInfo()
+                .setUrl(fileUrl)
+                .setPlatform("minio-main")
+                .setBasePath("attachment")
+                .setPath("missing-leading-slash/")
+                .setFilename("demo.pdf");
+        XFIleStorageServiceImpl service = createService(delegate);
+
+        IOException exception = assertThrows(
+                IOException.class,
+                () -> service.resolveTrustedFile(fileUrl));
+
+        assertTrue(exception.getMessage().contains("无法恢复"));
+    }
+
     /**
      * 验证 recorder 完全缺失目标记录时，精确删除仍直接作用于物理平台并成功。
      *
@@ -471,6 +588,8 @@ public class XFIleStorageServiceImplTest {
         private int recorderDeleteCalls;
         /** recorder 删除是否抛出异常。 */
         private boolean recorderDeleteThrows;
+        /** recorder 返回的服务端文件记录。 */
+        private FileInfo recordedFileInfo;
 
         /**
          * 创建聚合服务替身。
@@ -479,10 +598,17 @@ public class XFIleStorageServiceImplTest {
          */
         private RecoverableStorageService(FileStorage platform) {
             this.platform = platform;
+            setFileStorageList(new java.util.concurrent.CopyOnWriteArrayList<>(
+                    java.util.List.of(platform)));
             setFileRecorder(new FileRecorder() {
                 @Override public boolean save(FileInfo fileInfo) { return true; }
                 @Override public void update(FileInfo fileInfo) { }
-                @Override public FileInfo getByUrl(String url) { return null; }
+                @Override public FileInfo getByUrl(String url) {
+                    return recordedFileInfo != null
+                            && url.equals(recordedFileInfo.getUrl())
+                            ? recordedFileInfo
+                            : null;
+                }
                 @Override public boolean delete(String url) {
                     recorderDeleteCalls++;
                     if (recorderDeleteThrows) {
@@ -506,6 +632,15 @@ public class XFIleStorageServiceImplTest {
             return platform.getPlatform().equals(name) ? (T) platform : null;
         }
 
+        /** {@inheritDoc} */
+        @Override
+        public FileInfo getFileInfoByUrl(String url) {
+            return recordedFileInfo != null
+                    && url.equals(recordedFileInfo.getUrl())
+                    ? recordedFileInfo
+                    : null;
+        }
+
         /** {@inheritDoc} */
         @Override
         public org.dromara.x.file.storage.core.upload.UploadPretreatment of(Object file) {

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/runtime/AgentRunService.java

@@ -423,7 +423,7 @@ public class AgentRunService {
             chatContext.getExt().put(DOCUMENT_CONTEXT_TOKEN_ESTIMATE_EXT_KEY,
                     documentContext.tokenEstimate());
             String runtimePrompt = effectivePrompt(prompt, !boundDocuments.isEmpty(), !boundMedia.isEmpty());
-            AgentMessage userMessage = buildAgentMessage(runtimePrompt, boundMedia);
+            AgentMessage userMessage = buildAgentMessage(runtimePrompt, boundMedia, documentContext);
             threadPoolTaskExecutor.execute(() -> startRuntime(
                     agent, userMessage, documentContext, account, requestId, traceId, runtimeSessionId,
                     assistantCode, chatContext, runOutput, persistChatlog, runtimeSessionStore, lockHandle));
@@ -646,24 +646,6 @@ public class AgentRunService {
         return agentDocumentService.bindDraft(documentUploads);
     }
 
-    /**
-     * 将本轮文档正文追加到临时运行定义的系统提示词中。
-     *
-     * <p>正文只存在于本轮模型调用定义，不写入 chatlog 或 AgentScope 消息记忆。</p>
-     *
-     * @param bundle 临时运行时编译结果
-     * @param documentContext 本轮文档上下文
-     */
-    private void appendDocumentContext(AgentRuntimeBundle bundle, AgentDocumentContext documentContext) {
-        if (bundle == null || bundle.getDefinition() == null
-                || documentContext == null || documentContext.text().isBlank()) {
-            return;
-        }
-        String current = bundle.getDefinition().getSystemPrompt();
-        bundle.getDefinition().setSystemPrompt(
-                (current == null ? "" : current) + documentContext.text());
-    }
-
     /**
      * 为仅附件输入生成可持久化的最小用户意图。
      *
@@ -1187,6 +1169,8 @@ public class AgentRunService {
         StringBuilder answer = new StringBuilder();
         ChatAssistantAccumulator assistantAccumulator = new ChatAssistantAccumulator();
         LegacyThinkingTagParser legacyThinkingTagParser = new LegacyThinkingTagParser();
+        KnowledgeRetrievalStatusTracker knowledgeRetrievalStatusTracker =
+                new KnowledgeRetrievalStatusTracker();
         // 注册 emit 服务
         registerEmitterCancellation(requestId, runOutput, chatContext, answer,
                 assistantAccumulator, legacyThinkingTagParser, finished, persistChatlog);
@@ -1195,7 +1179,7 @@ public class AgentRunService {
             if (isAguiCancellationRequested(runOutput)) {
                 handleRuntimeEvent(cancellationEvent("用户已停止生成"), requestId, runOutput,
                         answer, assistantAccumulator, legacyThinkingTagParser,
-                        chatContext, finished, persistChatlog);
+                        knowledgeRetrievalStatusTracker, chatContext, finished, persistChatlog);
                 if (lockHandle != null) {
                     releaseRunLockQuietly(lockHandle, requestId);
                 }
@@ -1206,7 +1190,6 @@ public class AgentRunService {
             }
             AgentRuntimeContext runtimeContext = buildAgentRuntimeContext(chatContext, traceId, runtimeSessionId);
             AgentRuntimeBundle bundle = agentRuntimeCompiler.compile(agent, runtimeContext, !persistChatlog);
-            appendDocumentContext(bundle, documentContext);
             AgentRuntime runtime = agentRuntimeFactory.create();
             // 会话初始化请求
             AgentInitRequest request = new AgentInitRequest();
@@ -1214,7 +1197,7 @@ public class AgentRunService {
             request.setAgentDefinition(bundle.getDefinition());
             request.setRuntimeContext(runtimeContext);
             request.setToolInvokers(bundle.getToolInvokers());
-            request.setKnowledgeRetrievers(bundle.getKnowledgeRetrievers());
+            request.setKnowledgeRegistrations(bundle.getKnowledgeRegistrations());
             request.setSessionStore(runtimeSessionStore);
             request.setMediaResolver(agentMediaService.runtimeResolver(account));
             request.getMetadata().put("assistantCode", assistantCode);
@@ -1243,6 +1226,7 @@ public class AgentRunService {
                             runRuntimeCallbackSafely(
                                     () -> handleRuntimeEvent(event, requestId, runOutput, answer,
                                             assistantAccumulator, legacyThinkingTagParser,
+                                            knowledgeRetrievalStatusTracker,
                                             chatContext, finished, persistChatlog),
                                     requestId, runOutput, chatContext, finished, persistChatlog);
                         }
@@ -1532,7 +1516,8 @@ public class AgentRunService {
                                     AtomicBoolean finished,
                                     boolean persistChatlog) {
         handleRuntimeEvent(event, requestId, runOutput, answer, assistantAccumulator,
-                new LegacyThinkingTagParser(), chatContext, finished, persistChatlog);
+                new LegacyThinkingTagParser(), new KnowledgeRetrievalStatusTracker(),
+                chatContext, finished, persistChatlog);
     }
 
     private void handleRuntimeEvent(AgentRuntimeEvent event,
@@ -1544,6 +1529,35 @@ public class AgentRunService {
                                     ChatRuntimeContext chatContext,
                                     AtomicBoolean finished,
                                     boolean persistChatlog) {
+        handleRuntimeEvent(event, requestId, runOutput, answer, assistantAccumulator,
+                legacyThinkingTagParser, new KnowledgeRetrievalStatusTracker(),
+                chatContext, finished, persistChatlog);
+    }
+
+    /**
+     * 将单个 Runtime 事件投影到聊天协议，并复用本轮知识库工具状态追踪器。
+     *
+     * @param event Runtime 事件
+     * @param requestId 请求 ID
+     * @param runOutput 运行输出
+     * @param answer 回答累积器
+     * @param assistantAccumulator Assistant 结构化累积器
+     * @param legacyThinkingTagParser 旧思考标签解析器
+     * @param knowledgeRetrievalStatusTracker 知识库工具状态追踪器
+     * @param chatContext 聊天上下文
+     * @param finished 终态仲裁标记
+     * @param persistChatlog 是否持久化聊天日志
+     */
+    private void handleRuntimeEvent(AgentRuntimeEvent event,
+                                    String requestId,
+                                    AgentRunOutput runOutput,
+                                    StringBuilder answer,
+                                    ChatAssistantAccumulator assistantAccumulator,
+                                    LegacyThinkingTagParser legacyThinkingTagParser,
+                                    KnowledgeRetrievalStatusTracker knowledgeRetrievalStatusTracker,
+                                    ChatRuntimeContext chatContext,
+                                    AtomicBoolean finished,
+                                    boolean persistChatlog) {
         if (event == null || event.getEventType() == null) {
             return;
         }
@@ -1661,6 +1675,17 @@ public class AgentRunService {
                 return;
             }
             Map<String, Object> toolPayload = toolStatus;
+            if (isKnowledgeToolEvent(event)) {
+                Map<String, Object> statusPayload = buildKnowledgeRetrievalStatusPayload(
+                        knowledgeRetrievalStatusTracker.update(event));
+                LOG.info("Agent runtime knowledge tool call, requestId={}, toolCallId={}, toolName={}",
+                        requestId, event.getToolCallId(), stringValue(toolPayload, "toolName"));
+                if (!sendEnvelope(runOutput, ChatDomain.BUSINESS, ChatType.STATUS, statusPayload)) {
+                    cancelDisconnectedRun(requestId, chatContext, answer, assistantAccumulator,
+                            legacyThinkingTagParser, finished, persistChatlog);
+                }
+                return;
+            }
             if (!runOutput.emitRuntimeEvent(publicRuntimeEvent(event, toolPayload))) {
                 cancelDisconnectedRun(requestId, chatContext, answer, assistantAccumulator,
                         legacyThinkingTagParser, finished, persistChatlog);
@@ -1683,6 +1708,20 @@ public class AgentRunService {
         }
         if (event.getEventType() == AgentRuntimeEventType.TOOL_RESULT) {
             Map<String, Object> toolPayload = toolStatus;
+            if (isKnowledgeToolEvent(event)) {
+                Map<String, Object> statusPayload = buildKnowledgeRetrievalStatusPayload(
+                        knowledgeRetrievalStatusTracker.update(event));
+                LOG.info("Agent runtime knowledge tool result, requestId={}, toolCallId={}, toolName={}, status={}",
+                        requestId, event.getToolCallId(), stringValue(toolPayload, "toolName"),
+                        stringValue(statusPayload, "status"));
+                if (!sendEnvelope(runOutput, ChatDomain.BUSINESS, ChatType.STATUS, statusPayload)) {
+                    cancelDisconnectedRun(requestId, chatContext, answer, assistantAccumulator,
+                            legacyThinkingTagParser, finished, persistChatlog);
+                    return;
+                }
+                legacyThinkingTagParser.reset();
+                return;
+            }
             LOG.info("Agent runtime tool result, requestId={}, toolCallId={}, toolName={}, status={}",
                     requestId, event.getToolCallId(), stringValue(toolPayload, "toolName"),
                     stringValue(toolPayload, "status"));
@@ -1708,10 +1747,7 @@ public class AgentRunService {
         if (event.getEventType() == AgentRuntimeEventType.KNOWLEDGE_RETRIEVAL) {
             LOG.info("Agent runtime knowledge retrieval, requestId={}, payload={}, metadata={}",
                     requestId, event.getPayload(), event.getMetadata());
-            if (!sendEnvelope(runOutput, ChatDomain.BUSINESS, ChatType.STATUS, buildKnowledgeRetrievalStatusPayload(event))) {
-                cancelDisconnectedRun(requestId, chatContext, answer, assistantAccumulator,
-                        legacyThinkingTagParser, finished, persistChatlog);
-            }
+            // 文档摘要事件用于引用与监察；UI 完成态统一以 TOOL_RESULT 为准。
             return;
         }
         if (event.getEventType() == AgentRuntimeEventType.MEMORY_COMPRESSION_STARTED
@@ -1769,6 +1805,10 @@ public class AgentRunService {
         if (event.getEventType() == AgentRuntimeEventType.FAILED) {
             emitAssistantSegments(legacyThinkingTagParser.finish(), requestId, runOutput, chatContext,
                     answer, assistantAccumulator, legacyThinkingTagParser, finished, persistChatlog);
+            if (knowledgeRetrievalStatusTracker.failActiveCalls()) {
+                sendEnvelope(runOutput, ChatDomain.BUSINESS, ChatType.STATUS,
+                        buildKnowledgeRetrievalStatusPayload("error"));
+            }
             runOutput.emitRuntimeEvent(event);
             assistantAccumulator.finalizePendingSkillInvocations("FAILED", "技能调用失败");
             if (persistChatlog) {
@@ -2340,13 +2380,30 @@ public class AgentRunService {
         return message;
     }
 
-    private AgentMessage buildAgentMessage(String prompt, List<AgentBoundMedia> media) {
+    /**
+     * 构建发送给 AgentScope 的用户消息。
+     *
+     * <p>文档正文属于用户提供的不可信材料，作为用户内容块进入本轮模型调用和 AgentScope
+     * memory。聊天记录仍单独保存原始输入与附件引用，页面不会展示正文内容块。</p>
+     *
+     * @param prompt 用户输入
+     * @param media 图片附件
+     * @param documentContext 本轮选中的文档上下文
+     * @return 可持久化的运行时用户消息
+     */
+    private AgentMessage buildAgentMessage(String prompt,
+                                           List<AgentBoundMedia> media,
+                                           AgentDocumentContext documentContext) {
         AgentMessage message = new AgentMessage();
         message.setRole(AgentMessageRole.USER);
         List<com.easyagents.agent.runtime.message.AgentContentBlock> blocks = new ArrayList<>();
         if (prompt != null && !prompt.isBlank()) {
             blocks.add(new AgentTextBlock(prompt));
         }
+        if (documentContext != null && documentContext.text() != null
+                && !documentContext.text().isBlank()) {
+            blocks.add(new AgentTextBlock(documentContext.text()));
+        }
         if (media != null) {
             for (AgentBoundMedia item : media) {
                 AgentMediaBlock image = new AgentMediaBlock("image");
@@ -2815,7 +2872,8 @@ public class AgentRunService {
         Map<String, Object> rawPayload = event.getPayload() == null ? Map.of() : event.getPayload();
         Map<String, Object> payload = selectPayload(rawPayload,
                 "name", "status", "success", "toolDisplayName", "toolName",
-                "skillDisplayName", "skillId");
+                "skillDisplayName", "skillId", "toolCategory",
+                "knowledgeId", "knowledgeName", "knowledgeRuntimeName");
         String toolCallId = firstText(event.getToolCallId(), stringValue(rawPayload, "toolCallId"));
         if (toolCallId != null && !toolCallId.isBlank()) {
             payload.put("toolCallId", toolCallId);
@@ -2951,17 +3009,110 @@ public class AgentRunService {
     /**
      * 构建知识库检索状态载荷，确保前端可按稳定 key 合并同一轮状态行。
      *
-     * @param event 知识库检索运行时事件
+     * @param status running、done 或 error
      * @return 知识库检索状态载荷
      */
-    private Map<String, Object> buildKnowledgeRetrievalStatusPayload(AgentRuntimeEvent event) {
+    private Map<String, Object> buildKnowledgeRetrievalStatusPayload(String status) {
+        String normalizedStatus = "running".equals(status) || "error".equals(status)
+                ? status : "done";
         Map<String, Object> payload = new LinkedHashMap<>();
         payload.put("statusKey", "knowledge-retrieval");
-        payload.put("status", "done");
-        payload.put("label", "已检索知识库");
+        payload.put("status", normalizedStatus);
+        payload.put("label", switch (normalizedStatus) {
+            case "running" -> "正在检索知识库";
+            case "error" -> "知识库检索失败";
+            default -> "已检索知识库";
+        });
         return payload;
     }
 
+    /**
+     * 判断标准工具生命周期事件是否属于知识库工具。
+     *
+     * @param event 运行时工具事件
+     * @return 知识库工具事件时为 true
+     */
+    private boolean isKnowledgeToolEvent(AgentRuntimeEvent event) {
+        String category = stringPayload(event, "toolCategory");
+        if ("KNOWLEDGE".equalsIgnoreCase(category)) {
+            return true;
+        }
+        String toolName = firstText(stringPayload(event, "toolName"), stringPayload(event, "name"));
+        if (toolName == null) {
+            return false;
+        }
+        String normalizedName = toolName.trim().toLowerCase(Locale.ROOT);
+        return "retrieve_knowledge".equals(normalizedName)
+                || normalizedName.startsWith("retrieve_knowledge_");
+    }
+
+    /**
+     * 聚合同一批知识库工具调用，避免并行检索中首个结果提前结束 UI 状态。
+     */
+    static final class KnowledgeRetrievalStatusTracker {
+
+        private final Set<String> activeToolCallIds = new LinkedHashSet<>();
+        private boolean failed;
+
+        /**
+         * 应用一次知识库工具生命周期事件。
+         *
+         * @param event TOOL_CALL 或 TOOL_RESULT 事件
+         * @return 聚合后的 running、done 或 error 状态
+         */
+        String update(AgentRuntimeEvent event) {
+            String toolCallId = toolCallIdentity(event);
+            if (event.getEventType() == AgentRuntimeEventType.TOOL_CALL) {
+                if (activeToolCallIds.isEmpty()) {
+                    failed = false;
+                }
+                activeToolCallIds.add(toolCallId);
+                return "running";
+            }
+            if (event.getEventType() == AgentRuntimeEventType.TOOL_RESULT) {
+                activeToolCallIds.remove(toolCallId);
+                failed = failed || !toolSucceeded(event);
+                if (!activeToolCallIds.isEmpty()) {
+                    return "running";
+                }
+                return failed ? "error" : "done";
+            }
+            throw new IllegalArgumentException("Knowledge status only accepts TOOL_CALL or TOOL_RESULT events.");
+        }
+
+        /**
+         * 将运行失败时仍未结束的知识库调用收口为失败。
+         *
+         * @return 存在未结束调用时为 true
+         */
+        boolean failActiveCalls() {
+            if (activeToolCallIds.isEmpty()) {
+                return false;
+            }
+            activeToolCallIds.clear();
+            failed = true;
+            return true;
+        }
+
+        private String toolCallIdentity(AgentRuntimeEvent event) {
+            String toolCallId = event.getToolCallId();
+            if (toolCallId == null || toolCallId.isBlank()) {
+                Object payloadId = event.getPayload() == null ? null : event.getPayload().get("toolCallId");
+                toolCallId = payloadId == null ? event.getEventId() : String.valueOf(payloadId);
+            }
+            return toolCallId;
+        }
+
+        private boolean toolSucceeded(AgentRuntimeEvent event) {
+            Map<String, Object> payload = event.getPayload() == null ? Map.of() : event.getPayload();
+            if (Boolean.FALSE.equals(payload.get("success"))) {
+                return false;
+            }
+            Object status = payload.get("status");
+            return status == null || !"FAILED".equalsIgnoreCase(String.valueOf(status));
+        }
+    }
+
     /**
      * 构建不含 Runtime 原始上下文的内存压缩公开状态载荷。
      *

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/runtime/AgentRuntimeBundle.java

@@ -1,10 +1,12 @@
 package tech.easyflow.agent.runtime;
 
 import com.easyagents.agent.runtime.AgentDefinition;
-import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRetriever;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRegistration;
 import com.easyagents.agent.runtime.tool.AgentToolInvoker;
 
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 /**
@@ -14,7 +16,7 @@ public class AgentRuntimeBundle {
 
     private AgentDefinition definition;
     private Map<String, AgentToolInvoker> toolInvokers = new LinkedHashMap<>();
-    private Map<String, AgentKnowledgeRetriever> knowledgeRetrievers = new LinkedHashMap<>();
+    private List<AgentKnowledgeRegistration> knowledgeRegistrations = new ArrayList<>();
 
     /**
      * 获取 Agent 定义。
@@ -57,16 +59,18 @@ public class AgentRuntimeBundle {
      *
      * @return 知识库检索器
      */
-    public Map<String, AgentKnowledgeRetriever> getKnowledgeRetrievers() {
-        return knowledgeRetrievers;
+    public List<AgentKnowledgeRegistration> getKnowledgeRegistrations() {
+        return knowledgeRegistrations;
     }
 
     /**
      * 设置知识库检索器。
      *
-     * @param knowledgeRetrievers 知识库检索器
+     * @param knowledgeRegistrations 知识库运行时绑定
      */
-    public void setKnowledgeRetrievers(Map<String, AgentKnowledgeRetriever> knowledgeRetrievers) {
-        this.knowledgeRetrievers = knowledgeRetrievers == null ? new LinkedHashMap<>() : knowledgeRetrievers;
+    public void setKnowledgeRegistrations(List<AgentKnowledgeRegistration> knowledgeRegistrations) {
+        this.knowledgeRegistrations = knowledgeRegistrations == null
+                ? new ArrayList<>()
+                : new ArrayList<>(knowledgeRegistrations);
     }
 }

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/runtime/AgentRuntimeCompiler.java

@@ -6,9 +6,10 @@ import com.easyagents.agent.runtime.AgentRuntimeContext;
 import com.easyagents.agent.runtime.event.AgentRuntimeEvent;
 import com.easyagents.agent.runtime.event.AgentRuntimeEventType;
 import com.easyagents.agent.runtime.knowledge.AgentKnowledgeDocument;
-import com.easyagents.agent.runtime.knowledge.AgentKnowledgePolicy;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRegistration;
 import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRetrievalResult;
 import com.easyagents.agent.runtime.knowledge.AgentKnowledgeSpec;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeToolNames;
 import com.easyagents.agent.runtime.memory.AgentMemoryCompressionParameter;
 import com.easyagents.agent.runtime.memory.AgentMemoryPolicy;
 import com.easyagents.agent.runtime.memory.AgentMemoryType;
@@ -118,11 +119,11 @@ public class AgentRuntimeCompiler {
         bundle.setDefinition(definition);
 
         compileTools(agent, definition, bundle);
+        compileKnowledge(agent, definition, bundle);
         if (agentBuiltinToolsConfigResolver != null) {
             validateBuiltinTools(definition,
                     agentBuiltinToolsConfigResolver.resolvePublishedRuntime(agent.getExecutionConfigJson()));
         }
-        compileKnowledge(agent, definition, bundle);
         return bundle;
     }
 
@@ -294,7 +295,7 @@ public class AgentRuntimeCompiler {
         if (config.artifactPublish().enabled()) {
             specs.add(buildArtifactPublishSpec(config.artifactPublish()));
         }
-        assertToolBudget(specs, definition.getMcpSpecs());
+        assertToolBudget(specs, definition.getMcpSpecs(), definition.getKnowledgeSpecs().size());
     }
 
     private void attachBuiltinTools(Agent agent,
@@ -510,11 +511,21 @@ public class AgentRuntimeCompiler {
         return names;
     }
 
+    /**
+     * 校验内置工具与普通工具、知识库工具及 MCP 工具不存在运行名冲突。
+     *
+     * @param definition 已编译 Agent 定义
+     * @param builtinNames 待启用内置工具名称
+     * @throws BusinessException 工具名称冲突时抛出
+     */
     private void assertNoBuiltinNameConflict(AgentDefinition definition, Set<String> builtinNames) {
         Set<String> existing = new LinkedHashSet<>();
         for (AgentToolSpec spec : definition.getToolSpecs()) {
             existing.add(spec.getName());
         }
+        for (AgentKnowledgeSpec spec : definition.getKnowledgeSpecs()) {
+            existing.add(AgentKnowledgeToolNames.build(spec.getRuntimeName()));
+        }
         for (McpSpec mcp : definition.getMcpSpecs()) {
             if (mcp.getFrozenToolManifest() != null) {
                 mcp.getFrozenToolManifest().forEach(entry -> existing.add(entry.getName()));
@@ -540,6 +551,14 @@ public class AgentRuntimeCompiler {
         assertToolBudget(toolSpecs, mcpSpecs, 0);
     }
 
+    /**
+     * 校验最终工具数量和 Schema 大小预算。
+     *
+     * @param toolSpecs 静态 Tool 声明
+     * @param mcpSpecs MCP 声明
+     * @param additionalToolCount 知识库等额外工具数量
+     * @throws BusinessException 超出预算时抛出
+     */
     private void assertToolBudget(List<AgentToolSpec> toolSpecs,
                                   List<McpSpec> mcpSpecs,
                                   int additionalToolCount) {
@@ -570,7 +589,7 @@ public class AgentRuntimeCompiler {
             }
         }
         if (toolCount > MAX_RUNTIME_TOOL_COUNT) {
-            throw new BusinessException("Agent Runtime Tool 数量超过 128 个，请减少直接工具或 Skill 绑定");
+            throw new BusinessException("Agent Runtime Tool 数量超过 128 个，请减少工具、知识库或 Skill 绑定");
         }
         if (schemaBytes > MAX_RUNTIME_SCHEMA_BYTES) {
             throw new BusinessException("Agent Runtime Tool Schema 超过 2 MiB，请减少工具或精简 Schema");
@@ -591,12 +610,27 @@ public class AgentRuntimeCompiler {
         }
     }
 
+    /**
+     * 将 EasyFlow 知识库绑定编译为一库一工具所需的声明和 Retriever 绑定。
+     *
+     * @param agent Agent 发布视图
+     * @param definition 中立 Agent 定义
+     * @param bundle 运行时编译结果
+     * @throws BusinessException 知识库不存在、英文运行名非法或工具名冲突时抛出
+     */
     private void compileKnowledge(Agent agent, AgentDefinition definition, AgentRuntimeBundle bundle) {
         if (agent.getKnowledgeBindings() == null) {
             return;
         }
         List<AgentKnowledgeSpec> specs = new ArrayList<>();
-        Map<String, com.easyagents.agent.runtime.knowledge.AgentKnowledgeRetriever> retrievers = new LinkedHashMap<>();
+        List<AgentKnowledgeRegistration> registrations = new ArrayList<>();
+        Set<String> knowledgeToolNames = new LinkedHashSet<>();
+        Set<String> existingToolNames = new LinkedHashSet<>();
+        definition.getToolSpecs().stream()
+                .filter(Objects::nonNull)
+                .map(AgentToolSpec::getName)
+                .filter(Objects::nonNull)
+                .forEach(existingToolNames::add);
         for (AgentKnowledgeBinding binding : agent.getKnowledgeBindings()) {
             if (!Boolean.TRUE.equals(binding.getEnabled())) {
                 continue;
@@ -607,9 +641,9 @@ public class AgentRuntimeCompiler {
             }
             AgentKnowledgeSpec spec = new AgentKnowledgeSpec();
             spec.setKnowledgeId(binding.getKnowledgeId().toString());
+            spec.setRuntimeName(requireKnowledgeRuntimeName(knowledge));
             spec.setName(knowledge.getTitle());
             spec.setDescription(knowledge.getDescription());
-            spec.setRetrievalMode(AgentKnowledgePolicy.AGENTIC);
             spec.getMetadata().put("knowledgeType", knowledge.getCollectionType());
             spec.getMetadata().put("faqCollection", knowledge.isFaqCollection());
             Integer limit = intValue(binding.getOptionsJson(), "limit");
@@ -618,11 +652,37 @@ public class AgentRuntimeCompiler {
             if (threshold != null) {
                 spec.setScoreThreshold(threshold);
             }
+            String toolName = AgentKnowledgeToolNames.build(spec.getRuntimeName());
+            if (!knowledgeToolNames.add(toolName) || existingToolNames.contains(toolName)) {
+                throw new BusinessException("Agent 知识库工具运行名冲突：" + toolName);
+            }
             specs.add(spec);
-            retrievers.put(spec.getKnowledgeId(), request -> retrieveKnowledge(binding, request.getQuery(), request.getLimit(), request.getScoreThreshold()));
+            registrations.add(new AgentKnowledgeRegistration(spec,
+                    request -> retrieveKnowledge(binding, request.getQuery(), request.getLimit(), request.getScoreThreshold())));
         }
         definition.setKnowledgeSpecs(specs);
-        bundle.setKnowledgeRetrievers(retrievers);
+        bundle.setKnowledgeRegistrations(registrations);
+    }
+
+    /**
+     * 获取并校验知识库英文运行名。
+     *
+     * @param knowledge 知识库发布视图
+     * @return 合法英文运行名
+     * @throws BusinessException 英文运行名缺失或非法时抛出
+     */
+    private String requireKnowledgeRuntimeName(DocumentCollection knowledge) {
+        String runtimeName = knowledge == null ? null : knowledge.getEnglishName();
+        try {
+            AgentKnowledgeToolNames.build(runtimeName);
+            return runtimeName.trim();
+        } catch (RuntimeException exception) {
+            String knowledgeName = knowledge == null || knowledge.getTitle() == null
+                    ? "未知知识库"
+                    : knowledge.getTitle();
+            throw new BusinessException(400, 400, "知识库“" + knowledgeName
+                    + "”的英文名称不能为空，且只能包含字母、数字、下划线和连字符", exception);
+        }
     }
 
     private AgentKnowledgeRetrievalResult retrieveKnowledge(AgentKnowledgeBinding binding, String query, int limit, double scoreThreshold) {

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/runtime/output/AguiAgentRunOutput.java

@@ -18,6 +18,7 @@ import java.time.Instant;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.UUID;
 
@@ -563,7 +564,9 @@ public final class AguiAgentRunOutput implements AgentRunOutput {
     }
 
     private static boolean isHiddenToolName(String toolName) {
-        return "retrieve_knowledge".equalsIgnoreCase(toolName)
+        String normalizedName = toolName == null ? "" : toolName.trim().toLowerCase(Locale.ROOT);
+        return "retrieve_knowledge".equals(normalizedName)
+                || normalizedName.startsWith("retrieve_knowledge_")
                 || "context_reload".equalsIgnoreCase(toolName)
                 || "__fragment__".equalsIgnoreCase(toolName);
     }

easyflow-modules/easyflow-module-agent/src/main/java/tech/easyflow/agent/service/impl/AgentSkillReferenceProvider.java

@@ -51,6 +51,9 @@ public class AgentSkillReferenceProvider implements SkillReferenceProvider {
                 ids.add(agent.getId());
             }
         }
+        if (ids.isEmpty()) {
+            return List.of();
+        }
         List<String> result = new ArrayList<>();
         for (Agent agent : agentService.listByIds(ids)) {
             result.add("智能体“" + (agent.getName() == null ? "未命名智能体" : agent.getName()) + "”");

easyflow-modules/easyflow-module-agent/src/test/java/tech/easyflow/agent/runtime/AgentDefinitionCompilerMcpTest.java

@@ -8,6 +8,7 @@ import org.junit.Test;
 import tech.easyflow.agent.entity.Agent;
 import tech.easyflow.agent.entity.AgentToolBinding;
 import tech.easyflow.agent.enums.AgentToolType;
+import tech.easyflow.agent.runtime.skill.AgentSkillRuntimeCompiler;
 import tech.easyflow.agent.runtime.tool.AgentToolRuntimeCompiler;
 import tech.easyflow.ai.entity.Mcp;
 import tech.easyflow.ai.entity.Model;
@@ -44,6 +45,8 @@ public class AgentDefinitionCompilerMcpTest {
         setField(toolCompiler, "objectMapper", new com.fasterxml.jackson.databind.ObjectMapper());
         setField(toolCompiler, "mcpService", mcpService(mcp));
         setField(compiler, "agentToolRuntimeCompiler", toolCompiler);
+        setField(compiler, "agentSkillRuntimeCompiler", new AgentSkillRuntimeCompiler(
+                null, toolCompiler, new com.fasterxml.jackson.databind.ObjectMapper()));
 
         Agent agent = agent(modelId, mcpId);
 

easyflow-modules/easyflow-module-agent/src/test/java/tech/easyflow/agent/runtime/AgentRunServiceDraftAndHitlTest.java

@@ -10,6 +10,7 @@ import com.easyagents.agent.runtime.event.AgentRuntimeEventType;
 import com.easyagents.agent.runtime.message.AgentKnowledgeReference;
 import com.easyagents.agent.runtime.message.AgentMessage;
 import com.easyagents.agent.runtime.message.AgentMessageRole;
+import com.easyagents.agent.runtime.message.AgentTextBlock;
 import com.easyagents.agent.runtime.persistence.session.AgentSessionStore;
 import com.easyagents.agent.runtime.persistence.session.memory.InMemoryAgentSessionStore;
 import org.junit.Assert;
@@ -69,6 +70,28 @@ import java.util.concurrent.atomic.AtomicBoolean;
  */
 public class AgentRunServiceDraftAndHitlTest {
 
+    /**
+     * 验证文档上下文随用户消息进入可持久化 memory，同时保持独立内容块边界。
+     *
+     * @throws Exception 反射调用失败时抛出
+     */
+    @Test
+    public void buildAgentMessageShouldIncludeDocumentContext() throws Exception {
+        AgentRunService service = new AgentRunService();
+        AgentDocumentContext documentContext = new AgentDocumentContext(
+                "\n<<<DOCUMENT name=\"demo.docx\">>>\n正文\n<<<END_DOCUMENT>>>", 8, List.of());
+
+        AgentMessage message = invoke(service, "buildAgentMessage",
+                new Class<?>[]{String.class, List.class, AgentDocumentContext.class},
+                "请介绍文档", List.of(), documentContext);
+
+        Assert.assertEquals(2, message.getContentBlocks().size());
+        Assert.assertEquals("请介绍文档",
+                ((AgentTextBlock) message.getContentBlocks().get(0)).getText());
+        Assert.assertEquals(documentContext.text(),
+                ((AgentTextBlock) message.getContentBlocks().get(1)).getText());
+    }
+
     /**
      * 创建用于 owner 恢复测试的运行描述。
      *
@@ -453,18 +476,48 @@ public class AgentRunServiceDraftAndHitlTest {
     }
 
     /**
-     * 验证知识检索状态不会携带命中文档和内部 metadata。
+     * 验证知识库工具开始事件会投影为脱敏的检索中状态。
      *
      * @throws Exception 反射调用失败时抛出
      */
     @Test
-    public void handleRuntimeEventShouldWhitelistKnowledgeStatusPayload() throws Exception {
+    public void handleRuntimeEventShouldProjectKnowledgeToolCallAsRunningStatus() throws Exception {
         AgentRunService service = new AgentRunService();
         RecordingChatSseEmitter emitter = new RecordingChatSseEmitter();
-        AgentRuntimeEvent event = AgentRuntimeEvent.of(AgentRuntimeEventType.KNOWLEDGE_RETRIEVAL);
+        AgentRuntimeEvent event = AgentRuntimeEvent.of(AgentRuntimeEventType.TOOL_CALL);
+        event.setToolCallId("knowledge-call-1");
+        event.getPayload().put("toolCallId", "knowledge-call-1");
+        event.getPayload().put("toolName", "retrieve_knowledge_homeinn_faq");
+        event.getPayload().put("toolCategory", "KNOWLEDGE");
         event.getPayload().put("documents", List.of(Map.of("chunkContent", "private chunk")));
         event.getPayload().put("metadata", Map.of("sourceUri", "private://document"));
 
+        invoke(service, "handleRuntimeEvent",
+                runtimeEventParameterTypes(),
+                event, "request-knowledge", legacyOutput(emitter), new StringBuilder(),
+                new ChatAssistantAccumulator(), chatContext(), new AtomicBoolean(false), false);
+
+        Assert.assertEquals(1, emitter.envelopes.size());
+        @SuppressWarnings("unchecked")
+        Map<String, Object> payload = (Map<String, Object>) emitter.envelopes.get(0).getPayload();
+        Assert.assertEquals(Map.of(
+                "label", "正在检索知识库",
+                "status", "running",
+                "statusKey", "knowledge-retrieval"), payload);
+    }
+
+    /**
+     * 验证知识库工具结果事件会投影为完成状态。
+     *
+     * @throws Exception 反射调用失败时抛出
+     */
+    @Test
+    public void handleRuntimeEventShouldProjectKnowledgeToolResultAsDoneStatus() throws Exception {
+        AgentRunService service = new AgentRunService();
+        RecordingChatSseEmitter emitter = new RecordingChatSseEmitter();
+        AgentRuntimeEvent event = knowledgeToolEvent(
+                AgentRuntimeEventType.TOOL_RESULT, "knowledge-call-1", true);
+
         invoke(service, "handleRuntimeEvent",
                 runtimeEventParameterTypes(),
                 event, "request-knowledge", legacyOutput(emitter), new StringBuilder(),
@@ -479,6 +532,48 @@ public class AgentRunServiceDraftAndHitlTest {
                 "statusKey", "knowledge-retrieval"), payload);
     }
 
+    /**
+     * 验证文档摘要事件不会抢先把知识库工具状态标记为完成。
+     *
+     * @throws Exception 反射调用失败时抛出
+     */
+    @Test
+    public void handleRuntimeEventShouldNotCompleteKnowledgeStatusFromDocumentEvent() throws Exception {
+        AgentRunService service = new AgentRunService();
+        RecordingChatSseEmitter emitter = new RecordingChatSseEmitter();
+        AgentRuntimeEvent event = AgentRuntimeEvent.of(AgentRuntimeEventType.KNOWLEDGE_RETRIEVAL);
+        event.getPayload().put("documents", List.of(Map.of("chunkContent", "private chunk")));
+
+        invoke(service, "handleRuntimeEvent",
+                runtimeEventParameterTypes(),
+                event, "request-knowledge", legacyOutput(emitter), new StringBuilder(),
+                new ChatAssistantAccumulator(), chatContext(), new AtomicBoolean(false), false);
+
+        Assert.assertTrue(emitter.envelopes.isEmpty());
+    }
+
+    /**
+     * 验证并行知识库调用全部结束后才进入终态，并保留任一调用失败结果。
+     */
+    @Test
+    public void knowledgeStatusTrackerShouldAggregateParallelToolCalls() {
+        AgentRunService.KnowledgeRetrievalStatusTracker tracker =
+                new AgentRunService.KnowledgeRetrievalStatusTracker();
+        AgentRuntimeEvent firstCall = knowledgeToolEvent(
+                AgentRuntimeEventType.TOOL_CALL, "knowledge-call-1", true);
+        AgentRuntimeEvent secondCall = knowledgeToolEvent(
+                AgentRuntimeEventType.TOOL_CALL, "knowledge-call-2", true);
+        AgentRuntimeEvent firstResult = knowledgeToolEvent(
+                AgentRuntimeEventType.TOOL_RESULT, "knowledge-call-1", false);
+        AgentRuntimeEvent secondResult = knowledgeToolEvent(
+                AgentRuntimeEventType.TOOL_RESULT, "knowledge-call-2", true);
+
+        Assert.assertEquals("running", tracker.update(firstCall));
+        Assert.assertEquals("running", tracker.update(secondCall));
+        Assert.assertEquals("running", tracker.update(firstResult));
+        Assert.assertEquals("error", tracker.update(secondResult));
+    }
+
     /**
      * 验证完成事件不会再次发送正文消息，只用于最终收口。
      *
@@ -1556,6 +1651,29 @@ public class AgentRunServiceDraftAndHitlTest {
         }
     }
 
+    /**
+     * 创建知识库工具生命周期测试事件。
+     *
+     * @param eventType 工具开始或结果事件类型
+     * @param toolCallId 工具调用 ID
+     * @param success 工具结果是否成功
+     * @return 知识库工具事件
+     */
+    private AgentRuntimeEvent knowledgeToolEvent(AgentRuntimeEventType eventType,
+                                                 String toolCallId,
+                                                 boolean success) {
+        AgentRuntimeEvent event = AgentRuntimeEvent.of(eventType);
+        event.setToolCallId(toolCallId);
+        event.getPayload().put("toolCallId", toolCallId);
+        event.getPayload().put("toolName", "retrieve_knowledge_homeinn_faq");
+        event.getPayload().put("toolCategory", "KNOWLEDGE");
+        if (eventType == AgentRuntimeEventType.TOOL_RESULT) {
+            event.getPayload().put("success", success);
+            event.getPayload().put("status", success ? "SUCCESS" : "FAILED");
+        }
+        return event;
+    }
+
     private Class<?>[] runtimeEventParameterTypes() {
         return new Class<?>[]{AgentRuntimeEvent.class, String.class, AgentRunOutput.class, StringBuilder.class,
                 ChatAssistantAccumulator.class,

easyflow-modules/easyflow-module-agent/src/test/java/tech/easyflow/agent/runtime/AgentRuntimeCompilerKnowledgeTest.java

@@ -0,0 +1,268 @@
+package tech.easyflow.agent.runtime;
+
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeDocument;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRegistration;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRetrievalRequest;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeRetrievalResult;
+import com.easyagents.agent.runtime.knowledge.AgentKnowledgeSpec;
+import com.easyagents.core.document.Document;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.Assert;
+import org.junit.Test;
+import tech.easyflow.agent.entity.Agent;
+import tech.easyflow.agent.entity.AgentKnowledgeBinding;
+import tech.easyflow.agent.runtime.skill.AgentSkillRuntimeCompiler;
+import tech.easyflow.agent.runtime.tool.AgentToolRuntimeCompiler;
+import tech.easyflow.ai.entity.Model;
+import tech.easyflow.ai.entity.ModelProvider;
+import tech.easyflow.ai.rag.KnowledgeRetrievalRequest;
+import tech.easyflow.ai.service.DocumentCollectionService;
+import tech.easyflow.ai.service.ModelService;
+import tech.easyflow.common.web.exceptions.BusinessException;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Proxy;
+import java.math.BigInteger;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * Agent 知识库一库一工具运行时编译测试。
+ */
+public class AgentRuntimeCompilerKnowledgeTest {
+
+    /**
+     * 验证知识库英文名称、描述和检索配置会编译到中立声明及独立 Retriever。
+     *
+     * @throws Exception 反射注入依赖失败时抛出
+     */
+    @Test
+    public void compileShouldBuildOneKnowledgeRegistrationWithEnglishRuntimeName() throws Exception {
+        AtomicReference<KnowledgeRetrievalRequest> capturedRequest = new AtomicReference<>();
+        Document document = new Document("如家酒店通常在入住日 14:00 后办理入住。");
+        document.setId("chunk-1");
+        document.setTitle("如家 FAQ");
+        document.setScore(0.92D);
+        document.addMetadata("documentId", "faq-document-1");
+        document.addMetadata("chunkId", "faq-chunk-1");
+        AgentRuntimeCompiler compiler = compiler(capturedRequest, List.of(document));
+        Agent agent = agent(knowledgeBinding("homeinn_faq", BigInteger.valueOf(20L)));
+
+        AgentRuntimeBundle bundle = compiler.compile(agent);
+
+        Assert.assertEquals(1, bundle.getDefinition().getKnowledgeSpecs().size());
+        AgentKnowledgeSpec spec = bundle.getDefinition().getKnowledgeSpecs().get(0);
+        Assert.assertEquals("homeinn_faq", spec.getRuntimeName());
+        Assert.assertEquals("如家 FAQ", spec.getName());
+        Assert.assertTrue(spec.getDescription().contains("入住"));
+        Assert.assertEquals(7, spec.getLimit());
+        Assert.assertEquals(0.55D, spec.getScoreThreshold(), 0.0001D);
+        Assert.assertEquals(1, bundle.getKnowledgeRegistrations().size());
+
+        AgentKnowledgeRegistration registration = bundle.getKnowledgeRegistrations().get(0);
+        AgentKnowledgeRetrievalRequest retrievalRequest = new AgentKnowledgeRetrievalRequest();
+        retrievalRequest.setQuery("如家几点入住");
+        retrievalRequest.setLimit(spec.getLimit());
+        retrievalRequest.setScoreThreshold(spec.getScoreThreshold());
+        AgentKnowledgeRetrievalResult result = registration.getRetriever().retrieve(retrievalRequest);
+
+        Assert.assertEquals("如家几点入住", capturedRequest.get().getQuery());
+        Assert.assertEquals(Integer.valueOf(7), capturedRequest.get().getLimit());
+        Assert.assertEquals(Double.valueOf(0.55D), capturedRequest.get().getMinSimilarity());
+        Assert.assertEquals("AGENT_KNOWLEDGE", capturedRequest.get().getCallerType());
+        Assert.assertEquals(1, result.getDocuments().size());
+        AgentKnowledgeDocument mapped = result.getDocuments().get(0);
+        Assert.assertEquals("faq-document-1", mapped.getDocumentId());
+        Assert.assertEquals("faq-chunk-1", mapped.getChunkId());
+        Assert.assertEquals(0.92D, mapped.getScore(), 0.0001D);
+    }
+
+    /**
+     * 验证缺失知识库英文名称时在发布编译阶段明确失败。
+     *
+     * @throws Exception 反射注入依赖失败时抛出
+     */
+    @Test
+    public void compileShouldRejectMissingKnowledgeEnglishName() throws Exception {
+        AgentRuntimeCompiler compiler = compiler(new AtomicReference<>(), List.of());
+        Agent agent = agent(knowledgeBinding(null, BigInteger.valueOf(20L)));
+
+        try {
+            compiler.compile(agent);
+            Assert.fail("缺失英文名称时应拒绝编译");
+        } catch (BusinessException expected) {
+            Assert.assertTrue(expected.getMessage().contains("英文名称不能为空"));
+        }
+    }
+
+    /**
+     * 验证多个知识库生成相同工具名时在编译阶段拒绝发布。
+     *
+     * @throws Exception 反射注入依赖失败时抛出
+     */
+    @Test
+    public void compileShouldRejectDuplicateKnowledgeToolNames() throws Exception {
+        AgentRuntimeCompiler compiler = compiler(new AtomicReference<>(), List.of());
+        AgentKnowledgeBinding first = knowledgeBinding("homeinn_faq", BigInteger.valueOf(20L));
+        AgentKnowledgeBinding second = knowledgeBinding("homeinn_faq", BigInteger.valueOf(21L));
+        Agent agent = agent(first, second);
+
+        try {
+            compiler.compile(agent);
+            Assert.fail("重复知识库工具名时应拒绝编译");
+        } catch (BusinessException expected) {
+            Assert.assertTrue(expected.getMessage().contains("retrieve_knowledge_homeinn_faq"));
+        }
+    }
+
+    /**
+     * 创建仅含测试模型与知识库服务的运行时编译器。
+     *
+     * @param capturedRequest 检索请求捕获器
+     * @param documents 检索服务返回文档
+     * @return 已注入依赖的编译器
+     * @throws Exception 反射注入失败时抛出
+     */
+    private AgentRuntimeCompiler compiler(AtomicReference<KnowledgeRetrievalRequest> capturedRequest,
+                                          List<Document> documents) throws Exception {
+        ObjectMapper objectMapper = new ObjectMapper();
+        AgentToolRuntimeCompiler toolCompiler = new AgentToolRuntimeCompiler();
+        AgentRuntimeCompiler compiler = new AgentRuntimeCompiler();
+        setField(compiler, "objectMapper", objectMapper);
+        setField(compiler, "modelService", modelService(model()));
+        setField(compiler, "documentCollectionService", documentCollectionService(capturedRequest, documents));
+        setField(compiler, "agentToolRuntimeCompiler", toolCompiler);
+        setField(compiler, "agentSkillRuntimeCompiler",
+                new AgentSkillRuntimeCompiler(null, toolCompiler, objectMapper));
+        return compiler;
+    }
+
+    /**
+     * 创建带知识库绑定的 Agent。
+     *
+     * @param bindings 知识库绑定
+     * @return Agent 测试对象
+     */
+    private Agent agent(AgentKnowledgeBinding... bindings) {
+        Agent agent = new Agent();
+        agent.setId(BigInteger.ONE);
+        agent.setName("如家助手");
+        agent.setModelId(BigInteger.TEN);
+        agent.setKnowledgeBindings(List.of(bindings));
+        return agent;
+    }
+
+    /**
+     * 创建冻结知识库绑定。
+     *
+     * @param englishName 知识库英文名称
+     * @param knowledgeId 知识库 ID
+     * @return 知识库绑定
+     */
+    private AgentKnowledgeBinding knowledgeBinding(String englishName, BigInteger knowledgeId) {
+        AgentKnowledgeBinding binding = new AgentKnowledgeBinding();
+        binding.setAgentId(BigInteger.ONE);
+        binding.setKnowledgeId(knowledgeId);
+        binding.setRetrievalMode("HYBRID");
+        binding.setEnabled(true);
+        binding.setOptionsJson(Map.of("limit", 7, "scoreThreshold", 0.55D));
+        binding.setResourceSnapshot(Map.of(
+                "id", knowledgeId,
+                "title", "如家 FAQ",
+                "description", "如家酒店入住、退房和会员服务常见问题",
+                "collectionType", "FAQ",
+                "englishName", englishName == null ? "" : englishName));
+        return binding;
+    }
+
+    /**
+     * 创建模型服务代理。
+     *
+     * @param model 测试模型
+     * @return 模型服务代理
+     */
+    private ModelService modelService(Model model) {
+        return (ModelService) Proxy.newProxyInstance(
+                ModelService.class.getClassLoader(),
+                new Class<?>[]{ModelService.class},
+                (proxy, method, args) -> "getModelInstance".equals(method.getName())
+                        ? model
+                        : defaultValue(method.getReturnType()));
+    }
+
+    /**
+     * 创建知识库服务代理。
+     *
+     * @param capturedRequest 检索请求捕获器
+     * @param documents 返回文档
+     * @return 知识库服务代理
+     */
+    private DocumentCollectionService documentCollectionService(
+            AtomicReference<KnowledgeRetrievalRequest> capturedRequest,
+            List<Document> documents) {
+        return (DocumentCollectionService) Proxy.newProxyInstance(
+                DocumentCollectionService.class.getClassLoader(),
+                new Class<?>[]{DocumentCollectionService.class},
+                (proxy, method, args) -> {
+                    if ("search".equals(method.getName()) && args != null && args.length == 1
+                            && args[0] instanceof KnowledgeRetrievalRequest request) {
+                        capturedRequest.set(request);
+                        return documents;
+                    }
+                    return defaultValue(method.getReturnType());
+                });
+    }
+
+    /**
+     * 创建可映射为 AgentScope 模型配置的测试模型。
+     *
+     * @return 测试模型
+     */
+    private Model model() {
+        ModelProvider provider = new ModelProvider();
+        provider.setProviderType("openai");
+        provider.setProviderName("OpenAI");
+        Model model = new Model();
+        model.setId(BigInteger.TEN);
+        model.setModelProvider(provider);
+        model.setModelName("gpt-test");
+        model.setEndpoint("https://example.com");
+        model.setRequestPath("/v1/chat/completions");
+        model.setApiKey("test-key");
+        return model;
+    }
+
+    /**
+     * 返回代理方法所需的默认值。
+     *
+     * @param type 返回类型
+     * @return 对应默认值
+     */
+    private Object defaultValue(Class<?> type) {
+        if (type == boolean.class) {
+            return false;
+        }
+        if (type == int.class || type == long.class || type == short.class || type == byte.class) {
+            return 0;
+        }
+        if (type == double.class || type == float.class) {
+            return 0D;
+        }
+        return null;
+    }
+
+    /**
+     * 反射注入测试依赖。
+     *
+     * @param target 目标对象
+     * @param fieldName 字段名称
+     * @param value 字段值
+     * @throws Exception 字段不存在或不可写时抛出
+     */
+    private void setField(Object target, String fieldName, Object value) throws Exception {
+        Field field = target.getClass().getDeclaredField(fieldName);
+        field.setAccessible(true);
+        field.set(target, value);
+    }
+}

easyflow-modules/easyflow-module-agent/src/test/java/tech/easyflow/agent/service/impl/AgentSkillReferenceProviderTest.java

@@ -50,6 +50,22 @@ public class AgentSkillReferenceProviderTest {
                 "智能体“线上引用智能体”"), references);
     }
 
+    /**
+     * 没有 Agent 引用 Skill 时不应执行空主键集合查询。
+     */
+    @Test
+    public void shouldSkipEntityQueryWhenSkillHasNoReferences() {
+        AgentService agentService = Mockito.mock(AgentService.class);
+        AgentSkillBindingService bindingService = Mockito.mock(AgentSkillBindingService.class);
+        Mockito.when(bindingService.list(Mockito.any(QueryWrapper.class))).thenReturn(List.of());
+        Mockito.when(agentService.list(Mockito.any(QueryWrapper.class))).thenReturn(List.of());
+        AgentSkillReferenceProvider provider = new AgentSkillReferenceProvider(
+                agentService, bindingService);
+
+        Assert.assertTrue(provider.listReferences(BigInteger.TEN).isEmpty());
+        Mockito.verify(agentService, Mockito.never()).listByIds(Mockito.anyCollection());
+    }
+
     /**
      * 创建 Agent 摘要。
      *

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/document/support/DocumentSourceLoader.java

@@ -10,6 +10,7 @@ import tech.easyflow.ai.document.exception.DocumentParseBridgeException;
 import tech.easyflow.ai.document.model.DocumentSourceRef;
 import tech.easyflow.ai.easyagentsflow.upload.WorkflowApiUploadedFileReader;
 import tech.easyflow.common.filestorage.FileStorageService;
+import tech.easyflow.common.filestorage.FileStorageWriteHandle;
 import tech.easyflow.common.filestorage.utils.PathGeneratorUtil;
 
 import java.io.IOException;
@@ -164,7 +165,7 @@ public class DocumentSourceLoader {
     }
 
     /**
-     * 优先打开经过上传记录验证的受管 URL，再执行普通公网 URL 校验与下载。
+     * 优先打开经过上传记录验证的受管 URL 和服务端已登记附件，再执行普通公网 URL 校验与下载。
      *
      * @param remoteUrl 远端 URL
      * @param maxBytes 最大允许读取字节数
@@ -176,6 +177,13 @@ public class DocumentSourceLoader {
         if (managed.isPresent()) {
             return DocumentInputStreamSupport.limit(managed.get(), maxBytes);
         }
+        Optional<FileStorageWriteHandle> trusted =
+                fileStorageService.resolveTrustedFile(remoteUrl);
+        if (trusted.isPresent()) {
+            return DocumentInputStreamSupport.limit(
+                    fileStorageService.readRecoverable(trusted.get()),
+                    maxBytes);
+        }
         return DocumentInputStreamSupport.openRemote(remoteUrl, maxBytes);
     }
 

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/documentimport/DocumentImportBatchDtos.java

@@ -252,6 +252,7 @@ public final class DocumentImportBatchDtos {
         private BigInteger batchId;
         private String importMode;
         private String status;
+        private Boolean actualCompleted;
         private Integer totalCount;
         private Long totalBytes;
         private Integer completedCount;
@@ -292,6 +293,24 @@ public final class DocumentImportBatchDtos {
             this.status = status;
         }
 
+        /**
+         * 获取批次关联任务是否已经按真实文档状态全部完成。
+         *
+         * @return 全部完成时返回 {@code true}
+         */
+        public Boolean getActualCompleted() {
+            return actualCompleted;
+        }
+
+        /**
+         * 设置批次关联任务是否已经按真实文档状态全部完成。
+         *
+         * @param actualCompleted 是否全部完成
+         */
+        public void setActualCompleted(Boolean actualCompleted) {
+            this.actualCompleted = actualCompleted;
+        }
+
         public Integer getTotalCount() {
             return totalCount;
         }

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/documentimport/task/DocumentImportBatchAppService.java

@@ -21,6 +21,7 @@ import tech.easyflow.ai.enums.DocumentImportBatchItemStage;
 import tech.easyflow.ai.enums.DocumentImportBatchItemStatus;
 import tech.easyflow.ai.enums.DocumentImportBatchStatus;
 import tech.easyflow.ai.enums.DocumentImportMode;
+import tech.easyflow.ai.enums.DocumentProcessStatus;
 import tech.easyflow.ai.mapper.DocumentImportBatchItemMapper;
 import tech.easyflow.ai.mapper.DocumentImportBatchMapper;
 import tech.easyflow.ai.mapper.DocumentMapper;
@@ -435,7 +436,79 @@ public class DocumentImportBatchAppService {
                 .orderBy(DocumentImportBatch::getCreated, false)
                 .limit(1)
         );
-        return batch == null ? null : batchTracker.toStatusResponse(batch);
+        if (batch == null) {
+            return null;
+        }
+        DocumentImportBatchDtos.StatusResponse response =
+            batchTracker.toStatusResponse(batch);
+        response.setActualCompleted(isAutoBatchActuallyCompleted(batch));
+        return response;
+    }
+
+    /**
+     * 根据批次项及其关联文档的真实状态判断失败批次是否已经完成。
+     *
+     * <p>正常完成批次直接返回成功；仅对部分失败或中断批次执行补充查询，
+     * 避免运行中轮询产生额外数据库压力。批次项数量不完整、文档缺失、
+     * 跨知识库或文档仍未完成时均保持失败提示。</p>
+     *
+     * @param batch 自动导入批次
+     * @return 批次关联任务是否已经全部完成
+     */
+    private boolean isAutoBatchActuallyCompleted(DocumentImportBatch batch) {
+        if (DocumentImportBatchStatus.COMPLETED.name().equals(batch.getStatus())) {
+            return true;
+        }
+        if (!DocumentImportBatchStatus.PARTIAL_SUCCEEDED.name().equals(batch.getStatus())
+            && !DocumentImportBatchStatus.INTERRUPTED.name().equals(batch.getStatus())) {
+            return false;
+        }
+        List<DocumentImportBatchItem> items = itemService.list(
+            QueryWrapper.create()
+                .eq(DocumentImportBatchItem::getBatchId, batch.getId())
+                .orderBy(DocumentImportBatchItem::getId, true)
+        );
+        int totalCount = valueOrZero(batch.getTotalCount());
+        if (items == null || totalCount <= 0 || items.size() != totalCount) {
+            return false;
+        }
+
+        Set<BigInteger> unresolvedDocumentIds = new LinkedHashSet<BigInteger>();
+        for (DocumentImportBatchItem item : items) {
+            String itemStatus = item.getStatus();
+            if (DocumentImportBatchItemStatus.COMPLETED.name().equals(itemStatus)
+                || DocumentImportBatchItemStatus.SKIPPED.name().equals(itemStatus)
+                || DocumentImportBatchItemStatus.CANCELLED.name().equals(itemStatus)) {
+                continue;
+            }
+            if (item.getDocumentId() == null
+                || !batch.getKnowledgeId().equals(item.getKnowledgeId())) {
+                return false;
+            }
+            unresolvedDocumentIds.add(item.getDocumentId());
+        }
+        if (unresolvedDocumentIds.isEmpty()) {
+            return true;
+        }
+
+        List<tech.easyflow.ai.entity.Document> completedDocuments =
+            documentMapper.selectListByQuery(
+                QueryWrapper.create()
+                    .select(tech.easyflow.ai.entity.Document::getId)
+                    .eq(tech.easyflow.ai.entity.Document::getCollectionId,
+                        batch.getKnowledgeId())
+                    .eq(tech.easyflow.ai.entity.Document::getProcessStatus,
+                        DocumentProcessStatus.COMPLETED.name())
+                    .in(tech.easyflow.ai.entity.Document::getId,
+                        unresolvedDocumentIds)
+            );
+        if (completedDocuments == null) {
+            return false;
+        }
+        Set<BigInteger> completedDocumentIds = completedDocuments.stream()
+            .map(tech.easyflow.ai.entity.Document::getId)
+            .collect(java.util.stream.Collectors.toSet());
+        return completedDocumentIds.containsAll(unresolvedDocumentIds);
     }
 
     /**

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/easyagentsflow/cancellation/WorkflowDatasetQueryCancellationListener.java

@@ -0,0 +1,42 @@
+package tech.easyflow.ai.easyagentsflow.cancellation;
+
+import com.easyagents.flow.core.chain.Chain;
+import com.easyagents.flow.core.chain.ChainStatus;
+import com.easyagents.flow.core.chain.Event;
+import com.easyagents.flow.core.chain.event.ChainStatusChangeEvent;
+import com.easyagents.flow.core.chain.listener.ChainEventListener;
+import org.springframework.stereotype.Component;
+
+/**
+ * 将工作流取消终态桥接到活动数据集查询。
+ */
+@Component
+public class WorkflowDatasetQueryCancellationListener
+        implements ChainEventListener {
+
+    private final WorkflowDatasetQueryCancellationRegistry registry;
+
+    /**
+     * 创建工作流查询取消监听器。
+     *
+     * @param registry 工作流查询取消登记表
+     */
+    public WorkflowDatasetQueryCancellationListener(
+            WorkflowDatasetQueryCancellationRegistry registry) {
+        this.registry = registry;
+    }
+
+    /**
+     * 在工作流进入取消终态后取消该实例的活动查询。
+     *
+     * @param event 工作流事件
+     * @param chain 工作流实例
+     */
+    @Override
+    public void onEvent(Event event, Chain chain) {
+        if (event instanceof ChainStatusChangeEvent statusChangeEvent
+                && statusChangeEvent.getStatus() == ChainStatus.CANCELLED) {
+            registry.cancelExecution(chain.getStateInstanceId());
+        }
+    }
+}

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/easyagentsflow/cancellation/WorkflowDatasetQueryCancellationRegistry.java

@@ -0,0 +1,279 @@
+package tech.easyflow.ai.easyagentsflow.cancellation;
+
+import java.math.BigInteger;
+import java.time.Duration;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.common.web.exceptions.BusinessException;
+import tech.easyflow.datacenter.federation.DatacenterFederationQueryCancellationService;
+
+/**
+ * 维护工作流实例到活动数据集查询的跨节点取消映射。
+ */
+@Component
+public class WorkflowDatasetQueryCancellationRegistry {
+
+    private static final String ACTIVE_KEY_PREFIX =
+            "easyflow:workflow:dataset-query:active:";
+    private static final String CANCELLED_KEY_PREFIX =
+            "easyflow:workflow:dataset-query:cancelled:";
+    private static final Duration STATE_TTL = Duration.ofHours(24);
+    private static final Logger log = LoggerFactory.getLogger(
+            WorkflowDatasetQueryCancellationRegistry.class);
+
+    private final DatacenterFederationQueryCancellationService cancellationService;
+    private final ObjectProvider<StringRedisTemplate> redisTemplateProvider;
+    private final ConcurrentHashMap<String, ConcurrentHashMap<String, BigInteger>>
+            localActive = new ConcurrentHashMap<>();
+    private final ConcurrentHashMap<String, Long> localCancelledUntil =
+            new ConcurrentHashMap<>();
+
+    /**
+     * 创建工作流查询取消登记表。
+     *
+     * @param cancellationService 数据中枢查询取消服务
+     * @param redisTemplateProvider 可选 Redis 模板
+     */
+    public WorkflowDatasetQueryCancellationRegistry(
+            DatacenterFederationQueryCancellationService cancellationService,
+            ObjectProvider<StringRedisTemplate> redisTemplateProvider) {
+        this.cancellationService = cancellationService;
+        this.redisTemplateProvider = redisTemplateProvider;
+    }
+
+    /**
+     * 在数据库查询开始前登记工作流与 QueryId。
+     *
+     * @param stateInstanceId 工作流实例 ID
+     * @param account 执行账号
+     * @param queryId 查询 UUID
+     * @return 必须关闭的登记句柄
+     * @throws BusinessException 参数缺失时抛出
+     */
+    public Registration register(
+            String stateInstanceId,
+            LoginAccount account,
+            String queryId) {
+        String instanceId = requireText(stateInstanceId, "工作流实例 ID 不能为空");
+        String normalizedQueryId = requireText(queryId, "queryId 不能为空");
+        BigInteger tenantId = requireTenantId(account);
+        localActive.computeIfAbsent(
+                        instanceId,
+                        ignored -> new ConcurrentHashMap<>())
+                .put(normalizedQueryId, tenantId);
+        persistActive(instanceId, normalizedQueryId, tenantId);
+        Registration registration = new Registration(
+                instanceId, normalizedQueryId, tenantId);
+        if (isExecutionCancelled(instanceId)) {
+            cancelQuery(normalizedQueryId, tenantId);
+        }
+        return registration;
+    }
+
+    /**
+     * 取消工作流当前登记的全部数据集查询。
+     *
+     * @param stateInstanceId 工作流实例 ID
+     * @return 是否发现至少一个活动查询
+     */
+    public boolean cancelExecution(String stateInstanceId) {
+        String instanceId = requireText(stateInstanceId, "工作流实例 ID 不能为空");
+        long expiresAt = System.currentTimeMillis() + STATE_TTL.toMillis();
+        localCancelledUntil.put(instanceId, expiresAt);
+        persistCancellationMarker(instanceId);
+
+        Map<String, BigInteger> active = new LinkedHashMap<>();
+        ConcurrentHashMap<String, BigInteger> local = localActive.get(instanceId);
+        if (local != null) {
+            active.putAll(local);
+        }
+        loadPersistedActive(instanceId).forEach(active::putIfAbsent);
+        active.forEach((queryId, tenantId) -> {
+            try {
+                cancelQuery(queryId, tenantId);
+            } catch (RuntimeException exception) {
+                // 单个驱动取消失败不能阻断同一工作流的其他活动查询。
+                log.error("Failed to cancel workflow dataset query {} for {}",
+                        queryId, instanceId, exception);
+            }
+        });
+        return !active.isEmpty();
+    }
+
+    /**
+     * 清理本机已过期的取消墓碑，避免不可达工作流持续占用内存。
+     */
+    @Scheduled(fixedDelayString =
+            "${easyflow.workflow.dataset-query-cancel-cleanup-ms:60000}")
+    public void cleanupExpiredLocalMarkers() {
+        long now = System.currentTimeMillis();
+        localCancelledUntil.entrySet().removeIf(
+                entry -> entry.getValue() <= now);
+    }
+
+    private void cancelQuery(String queryId, BigInteger tenantId) {
+        LoginAccount account = new LoginAccount();
+        account.setTenantId(tenantId);
+        cancellationService.cancel(queryId, account);
+    }
+
+    private boolean isExecutionCancelled(String stateInstanceId) {
+        Long localDeadline = localCancelledUntil.get(stateInstanceId);
+        if (localDeadline != null && localDeadline > System.currentTimeMillis()) {
+            return true;
+        }
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return false;
+        }
+        try {
+            return Boolean.TRUE.equals(redisTemplate.hasKey(
+                    cancelledKey(stateInstanceId)));
+        } catch (RuntimeException exception) {
+            log.warn("Failed to read workflow dataset cancellation marker for {}",
+                    stateInstanceId, exception);
+            return false;
+        }
+    }
+
+    private void persistActive(
+            String stateInstanceId,
+            String queryId,
+            BigInteger tenantId) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+        try {
+            String key = activeKey(stateInstanceId);
+            redisTemplate.opsForHash().put(key, queryId, tenantId.toString());
+            redisTemplate.expire(key, STATE_TTL);
+        } catch (RuntimeException exception) {
+            log.warn("Failed to persist workflow dataset query mapping for {}",
+                    stateInstanceId, exception);
+        }
+    }
+
+    private Map<String, BigInteger> loadPersistedActive(String stateInstanceId) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return Map.of();
+        }
+        try {
+            Map<Object, Object> entries = redisTemplate.opsForHash()
+                    .entries(activeKey(stateInstanceId));
+            Map<String, BigInteger> active = new LinkedHashMap<>();
+            entries.forEach((queryId, tenantId) -> {
+                try {
+                    active.put(String.valueOf(queryId),
+                            new BigInteger(String.valueOf(tenantId)));
+                } catch (RuntimeException exception) {
+                    log.warn("Ignored invalid workflow dataset query mapping for {}",
+                            stateInstanceId, exception);
+                }
+            });
+            return active;
+        } catch (RuntimeException exception) {
+            log.warn("Failed to load workflow dataset query mappings for {}",
+                    stateInstanceId, exception);
+            return Map.of();
+        }
+    }
+
+    private void persistCancellationMarker(String stateInstanceId) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+        try {
+            redisTemplate.opsForValue().set(
+                    cancelledKey(stateInstanceId), "1", STATE_TTL);
+        } catch (RuntimeException exception) {
+            log.warn("Failed to persist workflow dataset cancellation marker for {}",
+                    stateInstanceId, exception);
+        }
+    }
+
+    private void unregister(
+            String stateInstanceId,
+            String queryId,
+            BigInteger tenantId) {
+        localActive.computeIfPresent(stateInstanceId, (ignored, queries) -> {
+            queries.remove(queryId, tenantId);
+            return queries.isEmpty() ? null : queries;
+        });
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+        try {
+            redisTemplate.opsForHash().delete(
+                    activeKey(stateInstanceId), queryId);
+        } catch (RuntimeException exception) {
+            log.warn("Failed to remove workflow dataset query mapping for {}",
+                    stateInstanceId, exception);
+        }
+    }
+
+    private String activeKey(String stateInstanceId) {
+        return ACTIVE_KEY_PREFIX + stateInstanceId;
+    }
+
+    private String cancelledKey(String stateInstanceId) {
+        return CANCELLED_KEY_PREFIX + stateInstanceId;
+    }
+
+    private String requireText(String value, String message) {
+        if (value == null || value.isBlank()) {
+            throw new BusinessException(message);
+        }
+        return value.trim();
+    }
+
+    private BigInteger requireTenantId(LoginAccount account) {
+        if (account == null || account.getTenantId() == null) {
+            throw new BusinessException("工作流数据集查询缺少执行租户");
+        }
+        return account.getTenantId();
+    }
+
+    /**
+     * 单次工作流查询登记句柄。
+     */
+    public final class Registration implements AutoCloseable {
+
+        private final String stateInstanceId;
+        private final String queryId;
+        private final BigInteger tenantId;
+        private final AtomicBoolean closed = new AtomicBoolean();
+
+        private Registration(
+                String stateInstanceId,
+                String queryId,
+                BigInteger tenantId) {
+            this.stateInstanceId = stateInstanceId;
+            this.queryId = queryId;
+            this.tenantId = tenantId;
+        }
+
+        /**
+         * 幂等注销当前工作流查询。
+         */
+        @Override
+        public void close() {
+            if (closed.compareAndSet(false, true)) {
+                unregister(stateInstanceId, queryId, tenantId);
+            }
+        }
+    }
+}

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/easyagentsflow/config/ChainExecutorConfig.java

@@ -14,6 +14,7 @@ import org.springframework.context.annotation.Configuration;
 import tech.easyflow.ai.easyagentsflow.listener.ChainErrorListenerForSave;
 import tech.easyflow.ai.easyagentsflow.listener.ChainEventListenerForSave;
 import tech.easyflow.ai.easyagentsflow.listener.NodeErrorListenerForSave;
+import tech.easyflow.ai.easyagentsflow.cancellation.WorkflowDatasetQueryCancellationListener;
 import tech.easyflow.ai.easyagentsflow.upload.WorkflowApiUploadCleanupListener;
 
 import javax.annotation.Resource;
@@ -40,6 +41,9 @@ public class ChainExecutorConfig {
     @Resource
     private WorkflowApiUploadCleanupListener workflowApiUploadCleanupListener;
     @Resource
+    private WorkflowDatasetQueryCancellationListener
+            workflowDatasetQueryCancellationListener;
+    @Resource
     private WorkflowExecutionBudgetProperties workflowExecutionBudgetProperties;
     @Resource
     private WorkflowRuntimeProperties workflowRuntimeProperties;
@@ -91,6 +95,9 @@ public class ChainExecutorConfig {
         chainExecutor.addEventListener(
                 ChainStatusChangeEvent.class,
                 workflowApiUploadCleanupListener);
+        chainExecutor.addEventListener(
+                ChainStatusChangeEvent.class,
+                workflowDatasetQueryCancellationListener);
         chainExecutor.addErrorListener(new ChainErrorListenerForSave());
         chainExecutor.addNodeErrorListener(new NodeErrorListenerForSave());
     }

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/easyagentsflow/service/WorkflowDatacenterContentService.java

@@ -14,12 +14,13 @@ import tech.easyflow.datacenter.execution.model.DatasetRef;
 import tech.easyflow.datacenter.execution.service.DatacenterDatasetQueryService;
 import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSensitivityLevel;
 import tech.easyflow.datacenter.meta.service.DatacenterDatasetRegistryService;
 
 import javax.annotation.Resource;
 import java.math.BigInteger;
 import java.util.ArrayList;
-import java.util.Comparator;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
 import java.util.List;
@@ -34,6 +35,7 @@ public class WorkflowDatacenterContentService {
     public static final String LLM_NODE_TYPE = "llmNode";
     public static final String QUERY_DATA_CONTEXT = "queryDataContext";
     public static final String SEARCH_SOURCE_MISSING_MESSAGE = "查询数据节点未选择连接服务";
+    public static final String SEARCH_TABLE_MISSING_MESSAGE = "查询数据节点未选择已接入表";
     public static final String SEARCH_SQL_MISSING_MESSAGE = "查询数据节点未设置 SQL";
     public static final String SAVE_EXPIRED_MESSAGE = "写入数据节点配置已过期，请重新选择已接入表";
     public static final String INVALID_QUERY_CONTEXT_MESSAGE = "查询上下文配置无效，请重新选择查询数据节点";
@@ -135,11 +137,16 @@ public class WorkflowDatacenterContentService {
         if (datasetRef == null || datasetRef.getSourceId() == null) {
             throw new BusinessException(SEARCH_SOURCE_MISSING_MESSAGE);
         }
+        if (datasetRef.getTableId() == null) {
+            throw new BusinessException(SEARCH_TABLE_MISSING_MESSAGE);
+        }
         String querySql = data == null ? null : trimToNull(data.getString("querySql"));
         if (!StringUtils.hasText(querySql)) {
             throw new BusinessException(SEARCH_SQL_MISSING_MESSAGE);
         }
-        return datasetRef;
+        DatasetRef boundRef = bindAuthoritativeTenant(datasetRef);
+        data.put("datasetRef", boundRef);
+        return boundRef;
     }
 
     public DatasetRef requireSaveDatasetRef(JSONObject data) {
@@ -150,6 +157,31 @@ public class WorkflowDatacenterContentService {
         if (datasetRef == null || datasetRef.getTableId() == null) {
             throw new BusinessException(SAVE_EXPIRED_MESSAGE);
         }
+        DatasetRef boundRef = bindAuthoritativeTenant(datasetRef);
+        data.put("datasetRef", boundRef);
+        return boundRef;
+    }
+
+    /**
+     * 依据当前租户可见的权威 Source/Table 覆盖调用方声明的租户字段。
+     *
+     * @param datasetRef 工作流数据集引用
+     * @return 已绑定权威租户的数据集引用
+     */
+    private DatasetRef bindAuthoritativeTenant(DatasetRef datasetRef) {
+        DatacenterTable table = datasetRef.getTableId() == null
+                ? null : registryService.getTableWithFields(datasetRef.getTableId());
+        BigInteger sourceId = table == null ? datasetRef.getSourceId() : table.getSourceId();
+        if (sourceId == null) {
+            throw new BusinessException(SEARCH_SOURCE_MISSING_MESSAGE);
+        }
+        DatacenterSource source = registryService.getSourceRequired(sourceId);
+        if (table != null && (!sourceId.equals(table.getSourceId())
+                || !java.util.Objects.equals(source.getTenantId(), table.getTenantId()))) {
+            throw new BusinessException("数据集引用与当前租户不一致");
+        }
+        datasetRef.setTenantId(source.getTenantId());
+        datasetRef.setSourceId(sourceId);
         return datasetRef;
     }
 
@@ -172,20 +204,30 @@ public class WorkflowDatacenterContentService {
         if (datasetRef == null || datasetRef.getSourceId() == null) {
             throw new BusinessException(SEARCH_SOURCE_MISSING_MESSAGE);
         }
+        if (datasetRef.getTableId() == null) {
+            throw new BusinessException(SEARCH_TABLE_MISSING_MESSAGE);
+        }
         DatacenterSource source = registryService.getSourceRequired(datasetRef.getSourceId());
-        List<DatacenterTable> managedTables = registryService.listManagedTables(datasetRef.getSourceId(), datasetRef.getCatalogId());
-        managedTables.sort(Comparator.comparing(table -> table.getTableName() == null ? "" : table.getTableName()));
+        DatacenterTable fullTable = registryService.getTableWithFields(
+                datasetRef.getTableId());
+        if (fullTable == null
+                || !datasetRef.getSourceId().equals(fullTable.getSourceId())
+                || !Integer.valueOf(1).equals(fullTable.getQueryable())
+                || !DatacenterMetadataStatus.ACTIVE.name().equals(
+                        fullTable.getMetadataStatus())) {
+            throw new BusinessException("查询数据节点绑定的表不可用");
+        }
+        DatacenterCatalog catalog = registryService.getCatalogById(
+                fullTable.getCatalogId());
+        if (StringUtils.hasText(datasetRef.getCatalogName())
+                && (catalog == null || !datasetRef.getCatalogName().equals(
+                        catalog.getCatalogName()))) {
+            throw new BusinessException("查询数据节点绑定的命名空间已变化");
+        }
         JSONObject sourceSummary = new JSONObject();
         sourceSummary.put("sourceName", source.getSourceName());
         sourceSummary.put("sourceType", source.getSourceType());
         JSONArray tables = new JSONArray();
-        for (DatacenterTable table : managedTables) {
-            DatacenterTable fullTable = registryService.getTableWithFields(table.getId());
-            DatacenterCatalog catalog = registryService.getCatalogById(fullTable.getCatalogId());
-            if (StringUtils.hasText(datasetRef.getCatalogName())
-                    && (catalog == null || !datasetRef.getCatalogName().equals(catalog.getCatalogName()))) {
-                continue;
-            }
         JSONObject tableSummary = new JSONObject();
         tableSummary.put("catalogName", catalog == null ? null : catalog.getCatalogName());
         tableSummary.put("tableName", fullTable.getTableName());
@@ -193,6 +235,9 @@ public class WorkflowDatacenterContentService {
         JSONArray fields = new JSONArray();
         if (fullTable.getFields() != null) {
             for (DatacenterTableField field : fullTable.getFields()) {
+                if (!isQueryablePublicField(field)) {
+                    continue;
+                }
                 JSONObject fieldSummary = new JSONObject();
                 fieldSummary.put("fieldName", field.getFieldName());
                 fieldSummary.put("fieldDesc", field.getFieldDesc());
@@ -202,11 +247,25 @@ public class WorkflowDatacenterContentService {
         }
         tableSummary.put("fields", fields);
         tables.add(tableSummary);
-        }
         sourceSummary.put("tables", tables);
         return sourceSummary;
     }
 
+    /**
+     * 判断字段是否允许暴露给 SQL 生成上下文。
+     *
+     * @param field 字段元数据
+     * @return 是否为当前可查询的公开字段
+     */
+    private boolean isQueryablePublicField(DatacenterTableField field) {
+        return field != null
+                && Integer.valueOf(1).equals(field.getQueryable())
+                && DatacenterMetadataStatus.ACTIVE.name().equals(
+                        field.getMetadataStatus())
+                && DatacenterSensitivityLevel.PUBLIC.name().equals(
+                        field.getSensitivityLevel());
+    }
+
     private void injectQueryDataContext(JSONObject data, Map<String, JSONObject> nodeMap) {
         if (data == null) {
             return;
@@ -217,7 +276,7 @@ public class WorkflowDatacenterContentService {
             removeQueryDataContextPlaceholder(data);
             return;
         }
-        Map<BigInteger, JSONObject> sourceSummaries = new LinkedHashMap<>();
+        Map<String, JSONObject> sourceSummaries = new LinkedHashMap<>();
         Set<String> visitedNodeIds = new LinkedHashSet<>();
         for (int i = 0; i < nodeIds.size(); i++) {
             String nodeId = trimToNull(nodeIds.getString(i));
@@ -229,7 +288,10 @@ public class WorkflowDatacenterContentService {
                 throw new BusinessException(INVALID_QUERY_CONTEXT_MESSAGE);
             }
             DatasetRef datasetRef = requireSearchDatasetRef(targetNode.getJSONObject("data"));
-            sourceSummaries.putIfAbsent(datasetRef.getSourceId(), buildSourceSummary(datasetRef));
+            String summaryKey = datasetRef.getSourceId() + ":" + datasetRef.getTableId();
+            if (!sourceSummaries.containsKey(summaryKey)) {
+                sourceSummaries.put(summaryKey, buildSourceSummary(datasetRef));
+            }
         }
         String contextValue = QUERY_CONTEXT_PROMPT + "\n" + JSON.toJSONString(new ArrayList<>(sourceSummaries.values()));
         upsertQueryDataContextParameter(data, contextValue);
@@ -343,6 +405,7 @@ public class WorkflowDatacenterContentService {
 
     private DatasetRef copyDatasetRef(DatasetRef datasetRef) {
         DatasetRef copy = new DatasetRef();
+        copy.setTenantId(datasetRef.getTenantId());
         copy.setSourceId(datasetRef.getSourceId());
         copy.setCatalogId(datasetRef.getCatalogId());
         copy.setCatalogName(datasetRef.getCatalogName());

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/node/DocNodeFileContentExtractor.java

@@ -15,6 +15,7 @@ import tech.easyflow.ai.document.support.DocumentInputStreamSupport;
 import tech.easyflow.ai.document.support.DocumentParseSourceType;
 import tech.easyflow.ai.easyagentsflow.upload.WorkflowApiUploadedFileReader;
 import tech.easyflow.common.filestorage.FileStorageService;
+import tech.easyflow.common.filestorage.FileStorageWriteHandle;
 import tech.easyflow.common.util.StringUtil;
 import tech.easyflow.common.web.exceptions.BusinessException;
 
@@ -326,20 +327,29 @@ public class DocNodeFileContentExtractor {
     private void copySourceToTemporaryFile(
             DocumentSourceRef sourceRef, Path target) throws IOException {
         String filePath = sourceRef.getFilePath();
+        boolean managedUpload = StringUtil.hasText(filePath)
+                && uploadedFileReader != null
+                && uploadedFileReader.isManagedPathCandidate(filePath);
+        Optional<FileStorageWriteHandle> trustedFile = Optional.empty();
+        if (StringUtil.hasText(filePath)
+                && isRemoteUrl(filePath)
+                && !managedUpload) {
+            trustedFile = fileStorageService.resolveTrustedFile(filePath);
+        }
         boolean localStorage = StringUtil.hasText(filePath)
                 && (!isRemoteUrl(filePath)
-                || (uploadedFileReader != null
-                && uploadedFileReader.isManagedPathCandidate(filePath)));
+                || managedUpload
+                || trustedFile.isPresent());
         if (localStorage) {
             try (IoBulkhead.Permit ignored =
                          IoBulkhead.storage().acquire("storage:document-read");
-                 InputStream inputStream = openInputStream(sourceRef);
+                 InputStream inputStream = openInputStream(sourceRef, trustedFile);
                  OutputStream outputStream = Files.newOutputStream(target)) {
                 copy(inputStream, outputStream);
             }
             return;
         }
-        try (InputStream inputStream = openInputStream(sourceRef);
+        try (InputStream inputStream = openInputStream(sourceRef, trustedFile);
              OutputStream outputStream = Files.newOutputStream(target)) {
             copy(inputStream, outputStream);
         }
@@ -362,7 +372,17 @@ public class DocNodeFileContentExtractor {
         }
     }
 
-    private InputStream openInputStream(DocumentSourceRef sourceRef) throws IOException {
+    /**
+     * 按可信受管上传、服务端文件记录、本地路径和普通公网 URL 的顺序打开源流。
+     *
+     * @param sourceRef 文档源
+     * @param trustedFile 已通过服务端记录或存储配置确认的物理读取句柄
+     * @return 受实际字节数限制的输入流
+     * @throws IOException 文件无法安全读取时抛出
+     */
+    private InputStream openInputStream(
+            DocumentSourceRef sourceRef,
+            Optional<FileStorageWriteHandle> trustedFile) throws IOException {
         String filePath = sourceRef.getFilePath();
         if (uploadedFileReader != null && StringUtil.hasText(filePath)) {
             Optional<InputStream> managed = uploadedFileReader.openVerified(filePath);
@@ -372,6 +392,11 @@ public class DocNodeFileContentExtractor {
                         FILE_MAX_SINGLE_SIZE);
             }
         }
+        if (trustedFile.isPresent()) {
+            return DocumentInputStreamSupport.limit(
+                    fileStorageService.readRecoverable(trustedFile.get()),
+                    FILE_MAX_SINGLE_SIZE);
+        }
         if (StringUtil.hasText(filePath) && isRemoteUrl(filePath)) {
             return DocumentInputStreamSupport.openRemote(filePath, FILE_MAX_SINGLE_SIZE);
         }

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/node/SaveDatasetNode.java

@@ -6,7 +6,6 @@ import com.easyagents.flow.core.chain.Chain;
 import com.easyagents.flow.core.chain.runtime.RetryableTriggerException;
 import com.easyagents.flow.core.node.BaseNode;
 import com.easyagents.flow.core.util.IoBulkhead;
-import com.mybatisflex.core.tenant.TenantManager;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import tech.easyflow.ai.utils.WorkFlowUtil;
@@ -55,7 +54,6 @@ public class SaveDatasetNode extends BaseNode {
             rows.add(item instanceof JSONObject json ? json : JSONObject.from(item));
         }
         try {
-            TenantManager.ignoreTenantCondition();
             try (IoBulkhead.Permit ignored = IoBulkhead.dataset().acquire(resolveIoTarget())) {
                 writeService.saveRowsIdempotently(
                         datasetRef,
@@ -77,8 +75,6 @@ public class SaveDatasetNode extends BaseNode {
         } catch (Exception ex) {
             log.error("工作流保存数据到统一数据集失败，datasetRef={}", datasetRef, ex);
             throw ex;
-        } finally {
-            TenantManager.restoreTenantCondition();
         }
     }
 

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/node/SearchDatasetNode.java

@@ -7,12 +7,13 @@ import com.easyagents.flow.core.chain.repository.LoopInputReference;
 import com.easyagents.flow.core.node.BaseNode;
 import com.easyagents.flow.core.util.IoBulkhead;
 import com.mybatisflex.core.row.Row;
-import com.mybatisflex.core.tenant.TenantManager;
 import tech.easyflow.common.util.SpringContextUtil;
+import tech.easyflow.common.entity.LoginAccount;
 import tech.easyflow.common.web.exceptions.BusinessException;
 import tech.easyflow.datacenter.execution.model.DatacenterSqlQueryRequest;
 import tech.easyflow.datacenter.execution.model.DatasetRef;
 import tech.easyflow.datacenter.execution.service.DatacenterDatasetQueryService;
+import tech.easyflow.ai.easyagentsflow.cancellation.WorkflowDatasetQueryCancellationRegistry;
 
 import java.util.HashMap;
 import java.util.List;
@@ -55,20 +56,29 @@ public class SearchDatasetNode extends BaseNode {
         Map<String, Object> params =
                 chain.getExecutionState().resolveParameters(this);
         DatacenterDatasetQueryService queryService = SpringContextUtil.getBean(DatacenterDatasetQueryService.class);
+        WorkflowDatasetQueryCancellationRegistry cancellationRegistry =
+                SpringContextUtil.getBean(
+                        WorkflowDatasetQueryCancellationRegistry.class);
+        LoginAccount account = tech.easyflow.ai.utils.WorkFlowUtil.getOperator(chain);
         DatacenterSqlQueryRequest request = buildRuntimeRequest(params);
         Map<String, Object> result = new HashMap<>();
-        try {
-            TenantManager.ignoreTenantCondition();
-            try (IoBulkhead.Permit ignored = IoBulkhead.dataset().acquire(resolveIoTarget())) {
+        String queryId = UUID.randomUUID().toString();
+        try (WorkflowDatasetQueryCancellationRegistry.Registration registration =
+                     cancellationRegistry.register(
+                             chain.getStateInstanceId(), account, queryId);
+             IoBulkhead.Permit ignored = IoBulkhead.dataset()
+                     .acquire(resolveIoTarget())) {
             String resultId = chain.getStateInstanceId()
                     + ":dataset:"
-                        + UUID.randomUUID();
+                    + queryId;
             int rowCount =
                     chain.storeProducedLoopInputOutsideLock(
                     resultId,
                     sink -> queryService.consumeBySql(
                             request,
                             QUERY_PAGE_SIZE,
+                            account,
+                            queryId,
                             sink::accept),
                     0L,
                     chain.currentFencingClaimId(),
@@ -79,9 +89,6 @@ public class SearchDatasetNode extends BaseNode {
                             resultId, rowCount));
             return result;
         }
-        } finally {
-            TenantManager.restoreTenantCondition();
-        }
     }
 
     /**
@@ -97,6 +104,9 @@ public class SearchDatasetNode extends BaseNode {
     }
 
     private DatacenterSqlQueryRequest buildRuntimeRequest(Map<String, Object> params) {
+        if (datasetRef == null || datasetRef.getSourceId() == null) {
+            throw new BusinessException("数据集绑定缺少连接信息，请重新选择数据集");
+        }
         DatacenterSqlQueryRequest request = new DatacenterSqlQueryRequest();
         request.setDatasetRef(copyDatasetRef());
         request.setSql(resolveQuerySql(params));
@@ -128,12 +138,13 @@ public class SearchDatasetNode extends BaseNode {
 
     private DatasetRef copyDatasetRef() {
         DatasetRef copy = new DatasetRef();
+        copy.setTenantId(datasetRef == null ? null : datasetRef.getTenantId());
         copy.setSourceId(datasetRef == null ? null : datasetRef.getSourceId());
         copy.setCatalogId(datasetRef == null ? null : datasetRef.getCatalogId());
         copy.setCatalogName(datasetRef == null ? null : datasetRef.getCatalogName());
-        copy.setTableId(null);
-        copy.setTableName(null);
-        copy.setVersionId(null);
+        copy.setTableId(datasetRef == null ? null : datasetRef.getTableId());
+        copy.setTableName(datasetRef == null ? null : datasetRef.getTableName());
+        copy.setVersionId(datasetRef == null ? null : datasetRef.getVersionId());
         return copy;
     }
 

easyflow-modules/easyflow-module-ai/src/main/java/tech/easyflow/ai/service/impl/DocumentCollectionServiceImpl.java

@@ -187,7 +187,7 @@ public class DocumentCollectionServiceImpl extends ServiceImpl<DocumentCollectio
         RagScoreNormalizer.normalize(searchDocuments, retrievalMode, reranked);
         List<Document> formattedDocuments = formatDocuments(
             searchDocuments,
-            shouldApplyMinSimilarityFilter(retrievalMode, reranked),
+            true,
             minSimilarity,
             docRecallMaxNum
         );
@@ -396,10 +396,6 @@ public class DocumentCollectionServiceImpl extends ServiceImpl<DocumentCollectio
         return modelRerank.toRerankModel();
     }
 
-    private boolean shouldApplyMinSimilarityFilter(RetrievalMode retrievalMode, boolean reranked) {
-        return !reranked && retrievalMode == RetrievalMode.VECTOR;
-    }
-
     /**
      * 解析本次查询使用的召回上限，优先采用请求参数，其次回退到知识库默认配置。
      *

easyflow-modules/easyflow-module-ai/src/test/java/tech/easyflow/ai/document/support/DocumentSourceLoaderTest.java

@@ -7,6 +7,7 @@ import tech.easyflow.ai.easyagentsflow.upload.WorkflowApiUploadedFileReader;
 import tech.easyflow.ai.document.exception.DocumentParseBridgeException;
 import tech.easyflow.ai.document.model.DocumentSourceRef;
 import tech.easyflow.common.filestorage.FileStorageService;
+import tech.easyflow.common.filestorage.FileStorageWriteHandle;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
@@ -73,6 +74,24 @@ public class DocumentSourceLoaderTest {
         }
     }
 
+    /**
+     * 验证服务端已登记的普通附件 URL 在公网地址校验前通过物理句柄直读。
+     */
+    @Test
+    public void shouldLoadRecordedInternalStorageUrlBeforeRemoteAddressGuard() {
+        String fileUrl = "http://127.0.0.1:39000/easyflow/attachment/1/2026/8/26/demo.pdf";
+        byte[] body = "recorded-pdf".getBytes(StandardCharsets.UTF_8);
+        DocumentSourceLoader loader = new DocumentSourceLoader(
+                new RecordedFileStorageService(fileUrl, body));
+        DocumentSourceRef sourceRef = new DocumentSourceRef();
+        sourceRef.setFileName("demo.pdf");
+        sourceRef.setFilePath(fileUrl);
+
+        LoadedDocumentSource loadedSource = loader.load(sourceRef);
+
+        Assert.assertArrayEquals(body, loadedSource.getContentBytes());
+    }
+
     /**
      * 验证已通过上传记录校验的内网存储 URL 会走恢复句柄读取。
      *
@@ -217,4 +236,42 @@ public class DocumentSourceLoaderTest {
             return 0L;
         }
     }
+
+    /**
+     * 仅允许通过服务端记录句柄读取内容的存储测试替身。
+     */
+    private static class RecordedFileStorageService
+            extends FailingFileStorageService {
+        /** 允许解析的精确 URL。 */
+        private final String recordedUrl;
+        /** 固定文件内容。 */
+        private final byte[] content;
+        /** 固定可信读取句柄。 */
+        private final FileStorageWriteHandle handle = new FileStorageWriteHandle(
+                "recorded", "", "/storage", "attachment", "demo.pdf");
+
+        /**
+         * 创建服务端记录存储替身。
+         *
+         * @param recordedUrl 允许解析的精确 URL
+         * @param content 固定文件内容
+         */
+        private RecordedFileStorageService(String recordedUrl, byte[] content) {
+            this.recordedUrl = recordedUrl;
+            this.content = content.clone();
+        }
+
+        /** {@inheritDoc} */
+        @Override
+        public Optional<FileStorageWriteHandle> resolveTrustedFile(String reference) {
+            return recordedUrl.equals(reference) ? Optional.of(handle) : Optional.empty();
+        }
+
+        /** {@inheritDoc} */
+        @Override
+        public InputStream readRecoverable(FileStorageWriteHandle requestedHandle) {
+            Assert.assertSame(handle, requestedHandle);
+            return new ByteArrayInputStream(content);
+        }
+    }
 }

easyflow-modules/easyflow-module-ai/src/test/java/tech/easyflow/ai/documentimport/task/DocumentImportBatchAppServiceTest.java

@@ -19,6 +19,7 @@ import tech.easyflow.ai.enums.DocumentImportBatchItemStage;
 import tech.easyflow.ai.enums.DocumentImportBatchItemStatus;
 import tech.easyflow.ai.enums.DocumentImportBatchStatus;
 import tech.easyflow.ai.enums.DocumentImportMode;
+import tech.easyflow.ai.enums.DocumentProcessStatus;
 import tech.easyflow.ai.mapper.DocumentImportBatchItemMapper;
 import tech.easyflow.ai.mapper.DocumentImportBatchMapper;
 import tech.easyflow.ai.mapper.DocumentMapper;
@@ -47,6 +48,89 @@ import java.util.function.BooleanSupplier;
  */
 public class DocumentImportBatchAppServiceTest {
 
+    /**
+     * 验证历史失败批次关联文档均已完成时返回真实完成标记。
+     */
+    @Test
+    public void latestAutoBatchShouldDetectActuallyCompletedDocuments() {
+        TestContext context = createContext();
+        DocumentImportBatch batch = context.batchService.getOne(
+            QueryWrapper.create()
+        );
+        batch.setImportMode(DocumentImportMode.AUTO.name());
+        batch.setStatus(DocumentImportBatchStatus.PARTIAL_SUCCEEDED.name());
+        batch.setTotalCount(2);
+
+        DocumentImportBatchItem completed = uploadedItem(
+            BigInteger.valueOf(11), batch.getId()
+        );
+        completed.setStatus(DocumentImportBatchItemStatus.COMPLETED.name());
+        completed.setDocumentId(BigInteger.valueOf(101));
+        DocumentImportBatchItem staleFailed = uploadedItem(
+            BigInteger.valueOf(12), batch.getId()
+        );
+        staleFailed.setStatus(DocumentImportBatchItemStatus.FAILED.name());
+        staleFailed.setDocumentId(BigInteger.valueOf(102));
+        Mockito.when(context.itemService.list(Mockito.any(QueryWrapper.class)))
+            .thenReturn(List.of(completed, staleFailed));
+
+        tech.easyflow.ai.entity.Document recovered =
+            new tech.easyflow.ai.entity.Document();
+        recovered.setId(staleFailed.getDocumentId());
+        recovered.setCollectionId(batch.getKnowledgeId());
+        recovered.setProcessStatus(DocumentProcessStatus.COMPLETED.name());
+        Mockito.when(context.documentMapper.selectListByQuery(Mockito.any()))
+            .thenReturn(List.of(recovered));
+
+        DocumentImportBatchDtos.StatusResponse batchResponse =
+            new DocumentImportBatchDtos.StatusResponse();
+        batchResponse.setStatus(batch.getStatus());
+        Mockito.when(context.batchTracker.toStatusResponse(batch))
+            .thenReturn(batchResponse);
+
+        DocumentImportBatchDtos.StatusResponse response =
+            context.service.getLatestAutoBatch(batch.getKnowledgeId());
+
+        Assert.assertTrue(response.getActualCompleted());
+        Mockito.verify(context.documentMapper)
+            .selectListByQuery(Mockito.any(QueryWrapper.class));
+    }
+
+    /**
+     * 验证失败项关联文档仍未完成时继续保留批次提示。
+     */
+    @Test
+    public void latestAutoBatchShouldKeepIncompleteFailureVisible() {
+        TestContext context = createContext();
+        DocumentImportBatch batch = context.batchService.getOne(
+            QueryWrapper.create()
+        );
+        batch.setImportMode(DocumentImportMode.AUTO.name());
+        batch.setStatus(DocumentImportBatchStatus.PARTIAL_SUCCEEDED.name());
+        batch.setTotalCount(1);
+
+        DocumentImportBatchItem failed = uploadedItem(
+            BigInteger.valueOf(13), batch.getId()
+        );
+        failed.setStatus(DocumentImportBatchItemStatus.FAILED.name());
+        failed.setDocumentId(BigInteger.valueOf(103));
+        Mockito.when(context.itemService.list(Mockito.any(QueryWrapper.class)))
+            .thenReturn(List.of(failed));
+        Mockito.when(context.documentMapper.selectListByQuery(Mockito.any()))
+            .thenReturn(List.of());
+
+        DocumentImportBatchDtos.StatusResponse batchResponse =
+            new DocumentImportBatchDtos.StatusResponse();
+        batchResponse.setStatus(batch.getStatus());
+        Mockito.when(context.batchTracker.toStatusResponse(batch))
+            .thenReturn(batchResponse);
+
+        DocumentImportBatchDtos.StatusResponse response =
+            context.service.getLatestAutoBatch(batch.getKnowledgeId());
+
+        Assert.assertFalse(response.getActualCompleted());
+    }
+
     /**
      * 验证上传领取通过单条多表更新同步刷新批次进度时间。
      */

easyflow-modules/easyflow-module-ai/src/test/java/tech/easyflow/ai/easyagentsflow/cancellation/WorkflowDatasetQueryCancellationRegistryTest.java

@@ -0,0 +1,131 @@
+package tech.easyflow.ai.easyagentsflow.cancellation;
+
+import com.easyagents.flow.core.chain.Chain;
+import com.easyagents.flow.core.chain.ChainStatus;
+import com.easyagents.flow.core.chain.event.ChainStatusChangeEvent;
+import java.math.BigInteger;
+import java.util.UUID;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.datacenter.federation.DatacenterFederationQueryCancellationService;
+
+/**
+ * {@link WorkflowDatasetQueryCancellationRegistry} 取消竞态回归测试。
+ */
+public class WorkflowDatasetQueryCancellationRegistryTest {
+
+    /**
+     * 验证工作流取消会使用登记租户取消活动 QueryId。
+     */
+    @Test
+    public void shouldCancelRegisteredQuery() {
+        Fixture fixture = fixture();
+        String queryId = UUID.randomUUID().toString();
+        LoginAccount account = account(BigInteger.valueOf(7L));
+
+        try (WorkflowDatasetQueryCancellationRegistry.Registration ignored =
+                     fixture.registry.register("instance-a", account, queryId)) {
+            Assert.assertTrue(fixture.registry.cancelExecution("instance-a"));
+        }
+
+        ArgumentCaptor<LoginAccount> accountCaptor =
+                ArgumentCaptor.forClass(LoginAccount.class);
+        Mockito.verify(fixture.cancellationService).cancel(
+                Mockito.eq(queryId), accountCaptor.capture());
+        Assert.assertEquals(BigInteger.valueOf(7L),
+                accountCaptor.getValue().getTenantId());
+    }
+
+    /**
+     * 验证单个查询取消失败不会阻断同一工作流的其他活动查询。
+     */
+    @Test
+    public void shouldIsolateCancellationFailuresBetweenQueries() {
+        Fixture fixture = fixture();
+        String failedQueryId = UUID.randomUUID().toString();
+        String succeedingQueryId = UUID.randomUUID().toString();
+        LoginAccount account = account(BigInteger.valueOf(7L));
+        Mockito.doThrow(new IllegalStateException("simulated cancellation failure"))
+                .when(fixture.cancellationService)
+                .cancel(Mockito.eq(failedQueryId), Mockito.any(LoginAccount.class));
+
+        try (WorkflowDatasetQueryCancellationRegistry.Registration ignoredA =
+                     fixture.registry.register("instance-failure", account, failedQueryId);
+             WorkflowDatasetQueryCancellationRegistry.Registration ignoredB =
+                     fixture.registry.register("instance-failure", account, succeedingQueryId)) {
+            Assert.assertTrue(fixture.registry.cancelExecution("instance-failure"));
+        }
+
+        Mockito.verify(fixture.cancellationService).cancel(
+                Mockito.eq(failedQueryId), Mockito.any(LoginAccount.class));
+        Mockito.verify(fixture.cancellationService).cancel(
+                Mockito.eq(succeedingQueryId), Mockito.any(LoginAccount.class));
+    }
+
+    /**
+     * 验证取消先于节点登记发生时，后续查询仍会立即收到取消。
+     */
+    @Test
+    public void shouldCancelQueryRegisteredAfterWorkflowCancellation() {
+        Fixture fixture = fixture();
+        String queryId = UUID.randomUUID().toString();
+
+        Assert.assertFalse(fixture.registry.cancelExecution("instance-b"));
+        try (WorkflowDatasetQueryCancellationRegistry.Registration ignored =
+                     fixture.registry.register(
+                             "instance-b", account(BigInteger.ONE), queryId)) {
+            Mockito.verify(fixture.cancellationService).cancel(
+                    Mockito.eq(queryId), Mockito.any(LoginAccount.class));
+        }
+    }
+
+    /**
+     * 验证监听器只桥接取消终态。
+     */
+    @Test
+    public void listenerShouldBridgeOnlyCancelledStatus() {
+        WorkflowDatasetQueryCancellationRegistry registry = Mockito.mock(
+                WorkflowDatasetQueryCancellationRegistry.class);
+        WorkflowDatasetQueryCancellationListener listener =
+                new WorkflowDatasetQueryCancellationListener(registry);
+        Chain chain = Mockito.mock(Chain.class);
+        Mockito.when(chain.getStateInstanceId()).thenReturn("instance-c");
+
+        listener.onEvent(new ChainStatusChangeEvent(
+                chain, ChainStatus.SUCCEEDED, ChainStatus.RUNNING), chain);
+        listener.onEvent(new ChainStatusChangeEvent(
+                chain, ChainStatus.CANCELLED, ChainStatus.RUNNING), chain);
+
+        Mockito.verify(registry).cancelExecution("instance-c");
+    }
+
+    @SuppressWarnings("unchecked")
+    private Fixture fixture() {
+        DatacenterFederationQueryCancellationService cancellationService =
+                Mockito.mock(
+                        DatacenterFederationQueryCancellationService.class);
+        ObjectProvider<StringRedisTemplate> redisProvider =
+                Mockito.mock(ObjectProvider.class);
+        Mockito.when(redisProvider.getIfAvailable()).thenReturn(null);
+        return new Fixture(
+                new WorkflowDatasetQueryCancellationRegistry(
+                        cancellationService, redisProvider),
+                cancellationService);
+    }
+
+    private LoginAccount account(BigInteger tenantId) {
+        LoginAccount account = new LoginAccount();
+        account.setTenantId(tenantId);
+        return account;
+    }
+
+    private record Fixture(
+            WorkflowDatasetQueryCancellationRegistry registry,
+            DatacenterFederationQueryCancellationService cancellationService) {
+    }
+}

easyflow-modules/easyflow-module-ai/src/test/java/tech/easyflow/ai/easyagentsflow/service/WorkflowDatacenterContentServiceTest.java

@@ -9,6 +9,8 @@ import org.mockito.Mockito;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.entity.DatacenterTableField;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSensitivityLevel;
 import tech.easyflow.datacenter.meta.service.DatacenterDatasetRegistryService;
 
 import java.lang.reflect.Field;
@@ -41,13 +43,22 @@ public class WorkflowDatacenterContentServiceTest {
         DatacenterSource source = Mockito.mock(DatacenterSource.class);
         Mockito.when(source.getSourceName()).thenReturn("ama 实验基线模型预算");
         Mockito.when(source.getSourceType()).thenReturn("EXCEL");
+        Mockito.when(source.getTenantId()).thenReturn(BigInteger.ONE);
 
         DatacenterTableField modelId = mockField("col_id", "模型ID", "VARCHAR");
         DatacenterTableField inputPrice = mockField("token", "输入价格", "DECIMAL");
+        DatacenterTableField hidden = mockField("hidden_col", "受限字段", "VARCHAR");
+        Mockito.when(hidden.getQueryable()).thenReturn(0);
         DatacenterTable table = Mockito.mock(DatacenterTable.class);
         Mockito.when(table.getId()).thenReturn(TABLE_ID);
+        Mockito.when(table.getSourceId()).thenReturn(SOURCE_ID);
+        Mockito.when(table.getTenantId()).thenReturn(BigInteger.ONE);
         Mockito.when(table.getTableName()).thenReturn("Sheet1");
-        Mockito.when(table.getFields()).thenReturn(List.of(modelId, inputPrice));
+        Mockito.when(table.getQueryable()).thenReturn(1);
+        Mockito.when(table.getMetadataStatus()).thenReturn(
+                DatacenterMetadataStatus.ACTIVE.name());
+        Mockito.when(table.getFields()).thenReturn(List.of(
+                modelId, inputPrice, hidden));
 
         Mockito.when(registryService.getSourceRequired(SOURCE_ID)).thenReturn(source);
         Mockito.when(registryService.listManagedTables(SOURCE_ID, null))
@@ -77,6 +88,7 @@ public class WorkflowDatacenterContentServiceTest {
         Assert.assertTrue(contextValue.contains("col_id"));
         Assert.assertTrue(contextValue.contains("模型ID"));
         Assert.assertTrue(contextValue.contains("token AS input_price"));
+        Assert.assertFalse(contextValue.contains("hidden_col"));
     }
 
     /**
@@ -103,6 +115,7 @@ public class WorkflowDatacenterContentServiceTest {
     private JSONObject buildWorkflowRoot() {
         JSONObject datasetRef = new JSONObject();
         datasetRef.put("sourceId", SOURCE_ID);
+        datasetRef.put("tableId", TABLE_ID);
 
         JSONObject queryData = new JSONObject();
         queryData.put("datasetRef", datasetRef);
@@ -160,6 +173,11 @@ public class WorkflowDatacenterContentServiceTest {
         Mockito.when(field.getFieldName()).thenReturn(fieldName);
         Mockito.when(field.getFieldDesc()).thenReturn(fieldDesc);
         Mockito.when(field.getJdbcType()).thenReturn(jdbcType);
+        Mockito.when(field.getQueryable()).thenReturn(1);
+        Mockito.when(field.getMetadataStatus()).thenReturn(
+                DatacenterMetadataStatus.ACTIVE.name());
+        Mockito.when(field.getSensitivityLevel()).thenReturn(
+                DatacenterSensitivityLevel.PUBLIC.name());
         return field;
     }
 

easyflow-modules/easyflow-module-ai/src/test/java/tech/easyflow/ai/node/DocNodeFileContentExtractorTest.java

@@ -10,6 +10,7 @@ import tech.easyflow.ai.document.model.DocumentParsedResult;
 import tech.easyflow.ai.document.model.DocumentSourceRef;
 import tech.easyflow.ai.document.service.DocumentParseBridgeService;
 import tech.easyflow.common.filestorage.FileStorageService;
+import tech.easyflow.common.filestorage.FileStorageWriteHandle;
 import tech.easyflow.common.web.exceptions.BusinessException;
 
 import java.io.ByteArrayInputStream;
@@ -203,6 +204,27 @@ public class DocNodeFileContentExtractorTest {
         Assert.assertNull(bridgeService.lastSource);
     }
 
+    /**
+     * 验证默认读取器也能通过服务端文件记录读取内部附件 URL。
+     */
+    @Test
+    public void shouldReadRecordedInternalUrlForUnsupportedType() {
+        RecordingDocumentParseBridgeService bridgeService = new RecordingDocumentParseBridgeService();
+        String fileUrl = "http://127.0.0.1:39000/easyflow/attachment/1/2026/8/26/note.txt";
+        DocNodeFileContentExtractor extractor = new DocNodeFileContentExtractor(
+                bridgeService,
+                new RecordedFileStorageService(fileUrl, "recorded text"),
+                new ReadingReaderManager());
+
+        String content = extractor.extract(buildFileValue(
+                "note.txt",
+                fileUrl,
+                "text/plain"));
+
+        Assert.assertEquals("recorded text", content);
+        Assert.assertNull(bridgeService.lastSource);
+    }
+
     /**
      * 验证受管上传 URL 的非桥接文件通过记录校验后走内部存储读取。
      *
@@ -574,4 +596,42 @@ public class DocNodeFileContentExtractorTest {
             return 0L;
         }
     }
+
+    /**
+     * 仅允许通过服务端记录句柄读取内容的存储测试替身。
+     */
+    private static class RecordedFileStorageService
+            extends FailingFileStorageService {
+        /** 允许解析的精确 URL。 */
+        private final String recordedUrl;
+        /** 固定内容。 */
+        private final byte[] content;
+        /** 固定可信读取句柄。 */
+        private final FileStorageWriteHandle handle = new FileStorageWriteHandle(
+                "recorded", "", "/storage", "attachment", "note.txt");
+
+        /**
+         * 创建服务端记录存储替身。
+         *
+         * @param recordedUrl 允许解析的精确 URL
+         * @param content 固定文本内容
+         */
+        private RecordedFileStorageService(String recordedUrl, String content) {
+            this.recordedUrl = recordedUrl;
+            this.content = content.getBytes(StandardCharsets.UTF_8);
+        }
+
+        /** {@inheritDoc} */
+        @Override
+        public Optional<FileStorageWriteHandle> resolveTrustedFile(String reference) {
+            return recordedUrl.equals(reference) ? Optional.of(handle) : Optional.empty();
+        }
+
+        /** {@inheritDoc} */
+        @Override
+        public InputStream readRecoverable(FileStorageWriteHandle requestedHandle) {
+            Assert.assertSame(handle, requestedHandle);
+            return new ByteArrayInputStream(content);
+        }
+    }
 }

easyflow-modules/easyflow-module-ai/src/test/java/tech/easyflow/ai/service/impl/DocumentCollectionServiceImplTest.java

@@ -32,6 +32,28 @@ import static tech.easyflow.ai.entity.DocumentCollection.KEY_SIMILARITY_THRESHOL
  */
 public class DocumentCollectionServiceImplTest {
 
+    /**
+     * 验证最终相关度阈值会过滤所有已统一到零到一范围的检索结果。
+     */
+    @Test
+    public void formatDocumentsShouldApplyFinalScoreThreshold() {
+        Document lowScore = buildHit(BigInteger.ONE, 0.49D);
+        Document thresholdScore = buildHit(BigInteger.TWO, 0.5D);
+        Document highScore = buildHit(BigInteger.valueOf(3), 0.9D);
+        DocumentCollectionServiceImpl service = new DocumentCollectionServiceImpl();
+
+        List<Document> result = service.formatDocuments(
+            List.of(lowScore, thresholdScore, highScore),
+            true,
+            0.5F,
+            5
+        );
+
+        Assert.assertEquals(2, result.size());
+        Assert.assertEquals(highScore.getId(), result.get(0).getId());
+        Assert.assertEquals(thresholdScore.getId(), result.get(1).getId());
+    }
+
     /**
      * 验证检索结果会在重排前过滤掉未完成文档，避免高分进行中文档挤占最终名额。
      *

easyflow-modules/easyflow-module-autoconfig/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports

@@ -5,6 +5,7 @@ tech.easyflow.approval.config.ApprovalModuleConfig
 tech.easyflow.auth.config.AuthModuleConfig
 tech.easyflow.chatlog.config.ChatlogModuleConfig
 tech.easyflow.datacenter.config.DatacenterModuleConfig
+tech.easyflow.dataspace.config.DataspaceModuleConfig
 tech.easyflow.job.config.JobModuleConfig
 tech.easyflow.log.config.LogModuleConfig
 tech.easyflow.skill.config.SkillModuleConfig

easyflow-modules/easyflow-module-datacenter/pom.xml

@@ -20,6 +20,10 @@
             <groupId>com.zaxxer</groupId>
             <artifactId>HikariCP</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.easyagents</groupId>
+            <artifactId>easy-agents-federation-sql-adapter-jdbc</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/audit/DatacenterQueryAudit.java

@@ -0,0 +1,168 @@
+package tech.easyflow.datacenter.audit;
+
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.ser.std.ToStringSerializer;
+import com.mybatisflex.annotation.Column;
+import com.mybatisflex.annotation.Id;
+import com.mybatisflex.annotation.KeyType;
+import com.mybatisflex.annotation.Table;
+import com.mybatisflex.core.handler.FastjsonTypeHandler;
+import java.io.Serializable;
+import java.math.BigInteger;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 数据中枢统一只读查询审计记录。
+ */
+@Table(value = "tb_datacenter_query_audit", comment = "数据中枢统一查询审计")
+public class DatacenterQueryAudit implements Serializable {
+
+    @Id(keyType = KeyType.Generator, value = "snowFlakeId", comment = "主键")
+    private BigInteger id;
+    @Column(comment = "查询标识")
+    private String queryId;
+    @Column(tenantId = true, comment = "租户ID")
+    private BigInteger tenantId;
+    @Column(comment = "部门ID")
+    private BigInteger deptId;
+    @Column(comment = "执行账号ID")
+    private BigInteger executorAccountId;
+    @Column(comment = "调用方类型")
+    private String callerType;
+    @Column(comment = "调用方标识")
+    private String callerId;
+    @Column(comment = "数据源ID")
+    private BigInteger sourceId;
+    @Column(comment = "数据源版本")
+    private Long sourceRevision;
+    @Column(comment = "纳管范围版本")
+    private Long scopeRevision;
+    @Column(typeHandler = FastjsonTypeHandler.class, comment = "引用表摘要")
+    private List<String> referencedTablesJson;
+    @Column(typeHandler = FastjsonTypeHandler.class, comment = "引用字段摘要")
+    private List<String> referencedFieldsJson;
+    @Column(comment = "参数化或脱敏SQL")
+    private String parameterizedSql;
+    @Column(typeHandler = FastjsonTypeHandler.class, comment = "脱敏参数摘要")
+    private Map<String, Object> maskedParametersJson;
+    @Column(comment = "执行状态")
+    private String status;
+    @Column(comment = "稳定错误码")
+    private String errorCode;
+    @Column(comment = "有界错误说明")
+    private String errorMessage;
+    @Column(comment = "开始时间")
+    private Date startedAt;
+    @Column(comment = "结束时间")
+    private Date finishedAt;
+    @Column(comment = "总耗时毫秒")
+    private Long durationMs;
+    @Column(comment = "数据库耗时毫秒")
+    private Long databaseDurationMs;
+    @Column(comment = "返回行数")
+    private Long returnedRows;
+    @Column(comment = "是否截断")
+    private Integer truncated;
+    @Column(comment = "创建时间")
+    private Date created;
+
+    /** @return 主键 */
+    @JsonSerialize(using = ToStringSerializer.class)
+    public BigInteger getId() { return id; }
+    /** @param id 主键 */
+    public void setId(BigInteger id) { this.id = id; }
+    /** @return 查询标识 */
+    public String getQueryId() { return queryId; }
+    /** @param queryId 查询标识 */
+    public void setQueryId(String queryId) { this.queryId = queryId; }
+    /** @return 租户 ID */
+    public BigInteger getTenantId() { return tenantId; }
+    /** @param tenantId 租户 ID */
+    public void setTenantId(BigInteger tenantId) { this.tenantId = tenantId; }
+    /** @return 部门 ID */
+    public BigInteger getDeptId() { return deptId; }
+    /** @param deptId 部门 ID */
+    public void setDeptId(BigInteger deptId) { this.deptId = deptId; }
+    /** @return 执行账号 ID；系统任务为空 */
+    public BigInteger getExecutorAccountId() { return executorAccountId; }
+    /** @param executorAccountId 执行账号 ID */
+    public void setExecutorAccountId(BigInteger executorAccountId) { this.executorAccountId = executorAccountId; }
+    /** @return 调用方类型 */
+    public String getCallerType() { return callerType; }
+    /** @param callerType 调用方类型 */
+    public void setCallerType(String callerType) { this.callerType = callerType; }
+    /** @return 调用方标识 */
+    public String getCallerId() { return callerId; }
+    /** @param callerId 调用方标识 */
+    public void setCallerId(String callerId) { this.callerId = callerId; }
+    /** @return 数据源 ID */
+    public BigInteger getSourceId() { return sourceId; }
+    /** @param sourceId 数据源 ID */
+    public void setSourceId(BigInteger sourceId) { this.sourceId = sourceId; }
+    /** @return 数据源版本 */
+    public Long getSourceRevision() { return sourceRevision; }
+    /** @param sourceRevision 数据源版本 */
+    public void setSourceRevision(Long sourceRevision) { this.sourceRevision = sourceRevision; }
+    /** @return 纳管范围版本 */
+    public Long getScopeRevision() { return scopeRevision; }
+    /** @param scopeRevision 纳管范围版本 */
+    public void setScopeRevision(Long scopeRevision) { this.scopeRevision = scopeRevision; }
+    /** @return 引用表 */
+    public List<String> getReferencedTablesJson() { return referencedTablesJson; }
+    /** @param referencedTablesJson 引用表 */
+    public void setReferencedTablesJson(List<String> referencedTablesJson) { this.referencedTablesJson = referencedTablesJson; }
+    /** @return 引用字段 */
+    public List<String> getReferencedFieldsJson() { return referencedFieldsJson; }
+    /** @param referencedFieldsJson 引用字段 */
+    public void setReferencedFieldsJson(List<String> referencedFieldsJson) { this.referencedFieldsJson = referencedFieldsJson; }
+    /** @return 参数化 SQL */
+    public String getParameterizedSql() { return parameterizedSql; }
+    /** @param parameterizedSql 参数化 SQL */
+    public void setParameterizedSql(String parameterizedSql) { this.parameterizedSql = parameterizedSql; }
+    /** @return 脱敏参数 */
+    public Map<String, Object> getMaskedParametersJson() { return maskedParametersJson; }
+    /** @param maskedParametersJson 脱敏参数 */
+    public void setMaskedParametersJson(Map<String, Object> maskedParametersJson) { this.maskedParametersJson = maskedParametersJson; }
+    /** @return 状态 */
+    public String getStatus() { return status; }
+    /** @param status 状态 */
+    public void setStatus(String status) { this.status = status; }
+    /** @return 错误码 */
+    public String getErrorCode() { return errorCode; }
+    /** @param errorCode 错误码 */
+    public void setErrorCode(String errorCode) { this.errorCode = errorCode; }
+    /** @return 错误说明 */
+    public String getErrorMessage() { return errorMessage; }
+    /** @param errorMessage 错误说明 */
+    public void setErrorMessage(String errorMessage) { this.errorMessage = errorMessage; }
+    /** @return 开始时间 */
+    public Date getStartedAt() { return startedAt; }
+    /** @param startedAt 开始时间 */
+    public void setStartedAt(Date startedAt) { this.startedAt = startedAt; }
+    /** @return 结束时间 */
+    public Date getFinishedAt() { return finishedAt; }
+    /** @param finishedAt 结束时间 */
+    public void setFinishedAt(Date finishedAt) { this.finishedAt = finishedAt; }
+    /** @return 总耗时 */
+    public Long getDurationMs() { return durationMs; }
+    /** @param durationMs 总耗时 */
+    public void setDurationMs(Long durationMs) { this.durationMs = durationMs; }
+    /** @return 数据库耗时 */
+    public Long getDatabaseDurationMs() { return databaseDurationMs; }
+    /** @param databaseDurationMs 数据库耗时 */
+    public void setDatabaseDurationMs(Long databaseDurationMs) { this.databaseDurationMs = databaseDurationMs; }
+    /** @return 返回行数 */
+    public Long getReturnedRows() { return returnedRows; }
+    /** @param returnedRows 返回行数 */
+    public void setReturnedRows(Long returnedRows) { this.returnedRows = returnedRows; }
+    /** @return 是否截断 */
+    public Integer getTruncated() { return truncated; }
+    /** @param truncated 是否截断 */
+    public void setTruncated(Integer truncated) { this.truncated = truncated; }
+    /** @return 创建时间 */
+    public Date getCreated() { return created; }
+    /** @param created 创建时间 */
+    public void setCreated(Date created) { this.created = created; }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/audit/DatacenterQueryAuditService.java

@@ -0,0 +1,301 @@
+package tech.easyflow.datacenter.audit;
+
+import java.math.BigInteger;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import com.mybatisflex.core.query.QueryWrapper;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.datacenter.mapper.DatacenterQueryAuditMapper;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+
+/**
+ * 在查询前落账并在资源释放后收口状态的审计服务。
+ */
+@Service
+public class DatacenterQueryAuditService {
+
+    private final DatacenterQueryAuditMapper auditMapper;
+
+    /**
+     * 创建审计服务。
+     *
+     * @param auditMapper 审计 Mapper
+     */
+    public DatacenterQueryAuditService(DatacenterQueryAuditMapper auditMapper) {
+        this.auditMapper = auditMapper;
+    }
+
+    /**
+     * 在数据库查询开始前写入 RUNNING 记录。
+     *
+     * @param queryId 查询标识
+     * @param source 数据源快照
+     * @param sql 参数化或无参数只读 SQL
+     * @param parameters 脱敏参数摘要
+     * @param account 执行账号
+     * @param callerType 调用方类型
+     * @param callerId 调用方标识
+     * @return 已持久化审计记录
+     */
+    public DatacenterQueryAudit start(
+            String queryId,
+            DatacenterSource source,
+            String sql,
+            Map<String, Object> parameters,
+            LoginAccount account,
+            String callerType,
+            String callerId) {
+        Date now = new Date();
+        DatacenterQueryAudit audit = new DatacenterQueryAudit();
+        audit.setQueryId(queryId);
+        audit.setTenantId(account == null || account.getTenantId() == null
+                ? value(source.getTenantId()) : account.getTenantId());
+        audit.setDeptId(account == null || account.getDeptId() == null
+                ? value(source.getDeptId()) : account.getDeptId());
+        audit.setExecutorAccountId(account == null ? null : account.getId());
+        audit.setCallerType(callerType == null ? "SYSTEM" : callerType);
+        audit.setCallerId(callerId);
+        audit.setSourceId(source.getId());
+        audit.setSourceRevision(value(source.getDefinitionRevision()));
+        audit.setScopeRevision(value(source.getScopeRevision()));
+        audit.setReferencedTablesJson(List.of());
+        audit.setReferencedFieldsJson(List.of());
+        audit.setParameterizedSql(redactSql(sql));
+        audit.setMaskedParametersJson(parameters == null ? Map.of() : Map.copyOf(parameters));
+        audit.setStatus("RUNNING");
+        audit.setStartedAt(now);
+        audit.setReturnedRows(0L);
+        audit.setTruncated(0);
+        audit.setCreated(now);
+        auditMapper.insert(audit);
+        return audit;
+    }
+
+    /**
+     * 标记查询成功。
+     *
+     * @param audit 审计记录
+     * @param referencedTables Calcite 解析出的引用表
+     * @param referencedFields Calcite 解析出的引用字段
+     * @param returnedRows 返回行数
+     * @param truncated 是否截断
+     * @param durationMs 总耗时
+     * @param databaseDurationMs 数据库耗时
+     */
+    public void succeed(
+            DatacenterQueryAudit audit,
+            List<String> referencedTables,
+            List<String> referencedFields,
+            long returnedRows,
+            boolean truncated,
+            long durationMs,
+            long databaseDurationMs) {
+        finish(audit, "SUCCESS", null, null, referencedTables, referencedFields,
+                returnedRows, truncated, durationMs, databaseDurationMs);
+    }
+
+    /**
+     * 标记查询失败。
+     *
+     * @param audit 审计记录
+     * @param errorCode 稳定错误码
+     * @param message 有界错误说明
+     * @param referencedTables Calcite 已解析出的引用表
+     * @param referencedFields Calcite 已解析出的引用字段
+     * @param durationMs 总耗时
+     */
+    public void fail(
+            DatacenterQueryAudit audit,
+            String errorCode,
+            String message,
+            List<String> referencedTables,
+            List<String> referencedFields,
+            long durationMs) {
+        finish(audit, "FAILED", errorCode, bounded(message), referencedTables, referencedFields,
+                0L, false, durationMs, null);
+    }
+
+    private void finish(
+            DatacenterQueryAudit audit,
+            String status,
+            String errorCode,
+            String errorMessage,
+            List<String> referencedTables,
+            List<String> referencedFields,
+            long returnedRows,
+            boolean truncated,
+            long durationMs,
+            Long databaseDurationMs) {
+        audit.setStatus(status);
+        audit.setErrorCode(errorCode);
+        audit.setErrorMessage(errorMessage);
+        audit.setReferencedTablesJson(List.copyOf(
+                referencedTables == null ? List.of() : referencedTables));
+        audit.setReferencedFieldsJson(List.copyOf(
+                referencedFields == null ? List.of() : referencedFields));
+        audit.setReturnedRows(returnedRows);
+        audit.setTruncated(truncated ? 1 : 0);
+        audit.setDurationMs(durationMs);
+        audit.setDatabaseDurationMs(databaseDurationMs);
+        audit.setFinishedAt(new Date());
+        auditMapper.update(audit);
+    }
+
+    /**
+     * 将超过十分钟仍为 RUNNING 的遗留审计收口为失败，覆盖进程异常退出场景。
+     */
+    @Scheduled(fixedDelayString = "${easyflow.datacenter.audit-reconcile-ms:60000}")
+    public void reconcileAbandonedQueries() {
+        Date now = new Date();
+        DatacenterQueryAudit patch = new DatacenterQueryAudit();
+        patch.setStatus("FAILED");
+        patch.setErrorCode("QUERY_ABANDONED");
+        patch.setErrorMessage("查询进程异常结束或超出审计存活时间");
+        patch.setFinishedAt(now);
+        QueryWrapper guard = QueryWrapper.create()
+                .eq(DatacenterQueryAudit::getStatus, "RUNNING")
+                .lt(DatacenterQueryAudit::getStartedAt, new Date(now.getTime() - 600_000L));
+        auditMapper.updateByQuery(patch, guard);
+    }
+
+    private long value(Long value) {
+        return value == null ? 0L : value;
+    }
+
+    private BigInteger value(BigInteger value) {
+        return value == null ? BigInteger.ZERO : value;
+    }
+
+    private String redactSql(String sql) {
+        if (sql == null || sql.isBlank()) {
+            return sql;
+        }
+        StringBuilder result = new StringBuilder(Math.min(sql.length(), 100_000));
+        boolean quoted = false;
+        for (int index = 0; index < sql.length(); index++) {
+            char current = sql.charAt(index);
+            if (quoted) {
+                if (current == '\'' && index + 1 < sql.length() && sql.charAt(index + 1) == '\'') {
+                    index++;
+                    continue;
+                }
+                if (current == '\'') {
+                    quoted = false;
+                    result.append('?');
+                }
+                continue;
+            }
+            if (current == '\'') {
+                quoted = true;
+                continue;
+            }
+            if (current == '-' && index + 1 < sql.length() && sql.charAt(index + 1) == '-') {
+                result.append("--?");
+                index += 2;
+                while (index < sql.length() && sql.charAt(index) != '\n'
+                        && sql.charAt(index) != '\r') {
+                    index++;
+                }
+                if (index < sql.length()) {
+                    result.append(sql.charAt(index));
+                }
+                continue;
+            }
+            if (current == '/' && index + 1 < sql.length() && sql.charAt(index + 1) == '*') {
+                result.append("/*?*/");
+                index = skipBlockComment(sql, index + 2);
+                continue;
+            }
+            String dollarDelimiter = current == '$' ? dollarDelimiter(sql, index) : null;
+            if (dollarDelimiter != null) {
+                int end = sql.indexOf(dollarDelimiter, index + dollarDelimiter.length());
+                result.append('?');
+                index = end < 0 ? sql.length() : end + dollarDelimiter.length() - 1;
+                continue;
+            }
+            if (Character.isDigit(current)
+                    && (index == 0 || !Character.isJavaIdentifierPart(sql.charAt(index - 1)))) {
+                result.append('?');
+                while (index + 1 < sql.length()) {
+                    char next = sql.charAt(index + 1);
+                    if (!Character.isDigit(next) && next != '.' && next != 'e' && next != 'E'
+                            && next != '+' && next != '-') {
+                        break;
+                    }
+                    index++;
+                }
+                continue;
+            }
+            result.append(current);
+            if (result.length() >= 100_000) {
+                break;
+            }
+        }
+        if (quoted) {
+            result.append('?');
+        }
+        return result.toString();
+    }
+
+    /**
+     * 跳过支持嵌套的块注释内容。
+     *
+     * @param sql 原始 SQL
+     * @param contentStart 首个注释内容字符位置
+     * @return 外层注释结束标记的末尾位置；未闭合时返回末尾
+     */
+    private int skipBlockComment(String sql, int contentStart) {
+        int depth = 1;
+        for (int index = contentStart; index < sql.length() - 1; index++) {
+            if (sql.charAt(index) == '/' && sql.charAt(index + 1) == '*') {
+                depth++;
+                index++;
+            } else if (sql.charAt(index) == '*' && sql.charAt(index + 1) == '/') {
+                depth--;
+                if (depth == 0) {
+                    return index + 1;
+                }
+                index++;
+            }
+        }
+        return sql.length();
+    }
+
+    /**
+     * 识别 PostgreSQL dollar-quoted 字面量起始分隔符。
+     *
+     * @param sql 原始 SQL
+     * @param start 美元符号位置
+     * @return 完整分隔符；当前位置不是合法起始符时为空
+     */
+    private String dollarDelimiter(String sql, int start) {
+        int end = sql.indexOf('$', start + 1);
+        if (end < 0) {
+            return null;
+        }
+        String tag = sql.substring(start + 1, end);
+        if (tag.isEmpty()) {
+            return "$$";
+        }
+        if (!Character.isLetter(tag.charAt(0)) && tag.charAt(0) != '_') {
+            return null;
+        }
+        for (int index = 1; index < tag.length(); index++) {
+            char character = tag.charAt(index);
+            if (!Character.isLetterOrDigit(character) && character != '_') {
+                return null;
+            }
+        }
+        return '$' + tag + '$';
+    }
+
+    private String bounded(String message) {
+        if (message == null) {
+            return null;
+        }
+        return message.length() <= 500 ? message : message.substring(0, 500);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/config/DatacenterFederationRedisConfig.java

@@ -0,0 +1,55 @@
+package tech.easyflow.datacenter.config;
+
+import com.easyagents.federation.sql.source.SourceId;
+import java.nio.charset.StandardCharsets;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.redis.connection.RedisConnectionFactory;
+import org.springframework.data.redis.listener.ChannelTopic;
+import org.springframework.data.redis.listener.RedisMessageListenerContainer;
+import tech.easyflow.datacenter.federation.DatacenterFederationChangeNotifier;
+import tech.easyflow.datacenter.federation.DatacenterFederationQueryCancellationService;
+import tech.easyflow.datacenter.federation.DatacenterFederationSourceStateProvider;
+
+/**
+ * 数据中枢无凭据 Definition 变更提示订阅配置。
+ */
+@Configuration(proxyBeanMethods = false)
+public class DatacenterFederationRedisConfig {
+
+    private static final Logger log = LoggerFactory.getLogger(DatacenterFederationRedisConfig.class);
+
+    /**
+     * 创建独立 Redis 监听容器，收到提示后始终回源数据库。
+     *
+     * @param connectionFactory Redis 连接工厂
+     * @param stateProvider 数据库权威状态 Provider
+     * @param queryCancellationService 查询取消服务
+     * @return 监听容器
+     */
+    @Bean(name = "datacenterFederationRedisListenerContainer")
+    @ConditionalOnBean(RedisConnectionFactory.class)
+    public RedisMessageListenerContainer datacenterFederationRedisListenerContainer(
+            RedisConnectionFactory connectionFactory,
+            DatacenterFederationSourceStateProvider stateProvider,
+            DatacenterFederationQueryCancellationService queryCancellationService) {
+        RedisMessageListenerContainer container = new RedisMessageListenerContainer();
+        container.setConnectionFactory(connectionFactory);
+        container.addMessageListener((message, pattern) -> {
+            String value = new String(message.getBody(), StandardCharsets.UTF_8);
+            try {
+                stateProvider.refresh(new SourceId(value));
+            } catch (RuntimeException exception) {
+                log.warn("Failed to refresh datacenter Federation source {}", value, exception);
+            }
+        }, new ChannelTopic(DatacenterFederationChangeNotifier.CHANNEL));
+        container.addMessageListener((message, pattern) ->
+                        queryCancellationService.acceptCancellationHint(
+                                new String(message.getBody(), StandardCharsets.UTF_8)),
+                new ChannelTopic(DatacenterFederationQueryCancellationService.CHANNEL));
+        return container;
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/connector/MetadataExplorer.java

@@ -3,6 +3,8 @@ package tech.easyflow.datacenter.connector;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
 import tech.easyflow.datacenter.meta.model.DatacenterCatalogMeta;
+import tech.easyflow.datacenter.meta.model.DatacenterManagedMetadataSnapshot;
+import tech.easyflow.datacenter.meta.model.DatacenterMetadataPage;
 import tech.easyflow.datacenter.meta.model.DatacenterTableDetailMeta;
 
 import java.util.List;
@@ -10,7 +12,97 @@ import java.util.List;
 public interface MetadataExplorer {
     List<DatacenterCatalogMeta> listCatalogs(DatacenterSource source);
 
+    /**
+     * 分页浏览 Catalog 或 Schema。
+     *
+     * @param source 数据源
+     * @param keyword 名称搜索词
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @return 有界命名空间列表
+     */
+    default DatacenterMetadataPage<DatacenterCatalogMeta> listCatalogsPage(
+            DatacenterSource source,
+            String keyword,
+            long pageNumber,
+            long pageSize) {
+        String normalizedKeyword = keyword == null
+                ? "" : keyword.trim().toLowerCase(java.util.Locale.ROOT);
+        List<DatacenterCatalogMeta> filtered = listCatalogs(source).stream()
+                .filter(catalog -> normalizedKeyword.isEmpty()
+                        || String.valueOf(catalog.getCatalogName())
+                        .toLowerCase(java.util.Locale.ROOT)
+                        .contains(normalizedKeyword))
+                .toList();
+        return DatacenterMetadataPage.slice(filtered, pageNumber, pageSize);
+    }
+
     List<DatacenterTable> listTables(DatacenterSource source, String catalogName);
 
-    DatacenterTableDetailMeta getTableDetail(DatacenterSource source, String catalogName, String tableName);
+    /**
+     * 分页浏览表或视图。
+     *
+     * <p>非 JDBC Connector 默认复用已有列表能力；外部 JDBC Connector 应覆盖此方法，
+     * 直接在元数据 ResultSet 上做有界读取。</p>
+     *
+     * @param source 数据源
+     * @param catalogName 物理命名空间
+     * @param keyword 表名搜索词
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @return 有界表列表
+     */
+    default DatacenterMetadataPage<DatacenterTable> listTablesPage(
+            DatacenterSource source,
+            String catalogName,
+            String keyword,
+            long pageNumber,
+            long pageSize) {
+        String normalizedKeyword = keyword == null ? "" : keyword.trim().toLowerCase(java.util.Locale.ROOT);
+        List<DatacenterTable> filtered = listTables(source, catalogName).stream()
+                .filter(table -> normalizedKeyword.isEmpty()
+                        || String.valueOf(table.getTableName())
+                        .toLowerCase(java.util.Locale.ROOT)
+                        .contains(normalizedKeyword))
+                .toList();
+        return DatacenterMetadataPage.slice(filtered, pageNumber, pageSize);
+    }
+
+    DatacenterTableDetailMeta getTableDetail(DatacenterSource source, String catalogName, String tableName);
+
+    /**
+     * 批量读取表详情。
+     *
+     * @param source 数据源
+     * @param catalogName 物理命名空间
+     * @param tableNames 表名集合
+     * @return 表详情集合
+     */
+    default List<DatacenterTableDetailMeta> getTableDetails(
+            DatacenterSource source,
+            String catalogName,
+            List<String> tableNames) {
+        return tableNames.stream()
+                .map(tableName -> getTableDetail(source, catalogName, tableName))
+                .toList();
+    }
+
+    /**
+     * 读取已纳管表的刷新快照。
+     *
+     * <p>默认实现保留 Connector 的既有逐表语义；JDBC Connector 应覆盖此方法以复用
+     * 单个连接，并明确区分物理表缺失与连接故障。</p>
+     *
+     * @param source 数据源
+     * @param catalogName 物理命名空间
+     * @param tableNames 已纳管表名集合
+     * @return 存在与缺失对象的快照
+     */
+    default DatacenterManagedMetadataSnapshot inspectManagedTables(
+            DatacenterSource source,
+            String catalogName,
+            List<String> tableNames) {
+        return new DatacenterManagedMetadataSnapshot(
+                getTableDetails(source, catalogName, tableNames), java.util.Set.of());
+    }
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/connector/impl/MysqlConnector.java

@@ -28,13 +28,12 @@ public class MysqlConnector extends AbstractJdbcConnector {
 
     @Override
     protected <T> T withConnection(DatacenterSource source, boolean cacheable, JdbcCallback<T> callback) throws Exception {
-        HikariDataSource dataSource = cacheable ? datasourceManager.getOrCreateExternalDatasource(source) : datasourceManager.createExternalDatasource(source);
+        // MySQL 查询 Runtime 已由 Federation SQL 独占管理；此 Connector 只保留短生命周期元数据访问。
+        HikariDataSource dataSource = datasourceManager.createExternalDatasource(source);
         try (Connection connection = dataSource.getConnection()) {
             return callback.apply(connection);
         } finally {
-            if (!cacheable || source.getId() == null) {
             dataSource.close();
         }
     }
 }
-}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/connector/impl/PostgresqlConnector.java

@@ -28,13 +28,12 @@ public class PostgresqlConnector extends AbstractJdbcConnector {
 
     @Override
     protected <T> T withConnection(DatacenterSource source, boolean cacheable, JdbcCallback<T> callback) throws Exception {
-        HikariDataSource dataSource = cacheable ? datasourceManager.getOrCreateExternalDatasource(source) : datasourceManager.createExternalDatasource(source);
+        // PostgreSQL 查询 Runtime 已由 Federation SQL 独占管理；此 Connector 只保留短生命周期元数据访问。
+        HikariDataSource dataSource = datasourceManager.createExternalDatasource(source);
         try (Connection connection = dataSource.getConnection()) {
             return callback.apply(connection);
         } finally {
-            if (!cacheable || source.getId() == null) {
             dataSource.close();
         }
     }
 }
-}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/connector/support/AbstractInternalTableConnector.java

@@ -3,6 +3,7 @@ package tech.easyflow.datacenter.connector.support;
 import cn.hutool.core.util.StrUtil;
 import com.alibaba.fastjson2.JSONObject;
 import com.mybatisflex.core.paginate.Page;
+import com.mybatisflex.core.query.QueryColumn;
 import com.mybatisflex.core.query.QueryWrapper;
 import com.mybatisflex.core.row.Db;
 import com.mybatisflex.core.row.Row;
@@ -15,6 +16,7 @@ import tech.easyflow.datacenter.connector.DatacenterConnector;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.entity.DatacenterTableField;
 import tech.easyflow.datacenter.execution.model.DatacenterConnectionTestResult;
+import tech.easyflow.datacenter.execution.model.DatacenterQueryFilter;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryRequest;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
 import tech.easyflow.datacenter.meta.enums.DatacenterCapability;
@@ -85,35 +87,180 @@ public abstract class AbstractInternalTableConnector implements DatacenterConnec
 
     @Override
     public Page<Row> queryPage(DatacenterSource source, DatacenterTable table, DatacenterQueryRequest request) {
+        if (request == null || request.getPageSize() == null
+                || request.getPageSize() < 1L
+                || request.getPageSize() > 500L) {
+            throw new BusinessException("pageSize 必须在 1 到 500 之间");
+        }
         String actualTable = resolveTableName(table);
         long count = Db.selectCountByQuery(
-                actualTable, createQueryWrapper(request.getWhere()));
+                actualTable, createQueryWrapper(table, request, false));
         if (count == 0) {
             return new Page<>(new ArrayList<>(), request.getPageNumber(), request.getPageSize(), count);
         }
         // selectCountByQuery 会把无投影的 QueryWrapper 改为 COUNT(*)，分页查询必须使用独立实例。
+        QueryWrapper pageQuery = createQueryWrapper(table, request, true);
+        pageQuery.select(resolveSelectedColumns(table, request).stream()
+                .map(this::quoteInternalIdentifier)
+                .toArray(String[]::new));
         Page<Row> page = Db.paginate(
                 actualTable,
                 new Page<>(request.getPageNumber(), request.getPageSize(), count),
-                createQueryWrapper(request.getWhere()));
+                pageQuery);
         normalizeRows(page.getRecords());
         return page;
     }
 
+    /**
+     * 将已在服务层校验的逻辑字段映射为内部物理列。
+     *
+     * @param table 绑定表及字段
+     * @param request 查询请求
+     * @return 按请求顺序排列的物理列名
+     * @throws BusinessException 字段元数据缺失时抛出
+     */
+    private List<String> resolveSelectedColumns(
+            DatacenterTable table,
+            DatacenterQueryRequest request) {
+        Map<String, DatacenterTableField> fields = new LinkedHashMap<>();
+        for (DatacenterTableField field : table.getFields()) {
+            fields.put(field.getFieldName(), field);
+        }
+        List<String> columns = new ArrayList<>();
+        for (String selected : request.getSelectedColumns()) {
+            DatacenterTableField field = fields.get(selected);
+            if (field == null) {
+                throw new BusinessException("字段不存在: " + selected);
+            }
+            String sourceColumn = StrUtil.blankToDefault(
+                    field.getSourceColumnName(), field.getFieldName());
+            columns.add(sourceColumn);
+        }
+        if (columns.isEmpty()) {
+            throw new BusinessException("当前数据集没有可查询字段");
+        }
+        return columns;
+    }
+
+    /**
+     * 引用可信元数据列名，避免保留字或特殊字符改变 SQL 结构。
+     *
+     * @param identifier 物理列名
+     * @return MySQL 反引号标识符
+     */
+    private String quoteInternalIdentifier(String identifier) {
+        return "`" + identifier.replace("`", "``") + "`";
+    }
+
     /**
      * 创建用于动态表查询的独立条件包装器。
      *
-     * @param where 已校验的筛选表达式
+     * @param where 调用方传入的旧原始筛选表达式；非空时拒绝
      * @return 新建的查询条件包装器
      */
     static QueryWrapper createQueryWrapper(String where) {
-        QueryWrapper wrapper = QueryWrapper.create();
         if (StrUtil.isNotBlank(where)) {
-            wrapper.where(where);
+            throw new BusinessException("不支持原始 WHERE 条件，请使用结构化筛选条件");
+        }
+        QueryWrapper wrapper = QueryWrapper.create();
+        return wrapper;
+    }
+
+    private QueryWrapper createQueryWrapper(
+            DatacenterTable table,
+            DatacenterQueryRequest request,
+            boolean includeSorts) {
+        QueryWrapper wrapper = createQueryWrapper(request.getWhere());
+        Map<String, DatacenterTableField> fields = table.getFields().stream()
+                .collect(java.util.stream.Collectors.toMap(
+                        DatacenterTableField::getFieldName,
+                        field -> field,
+                        (first, ignored) -> first,
+                        LinkedHashMap::new));
+        List<Object> parameters = new ArrayList<>();
+        StringBuilder condition = new StringBuilder();
+        if (request.getFilters() != null) {
+            for (DatacenterQueryFilter filter : request.getFilters()) {
+                DatacenterTableField field = fields.get(filter.getColumn());
+                if (field == null) {
+                    throw new BusinessException("字段不存在: " + filter.getColumn());
+                }
+                appendFilter(condition, parameters, field, filter);
+            }
+        }
+        if (!condition.isEmpty()) {
+            wrapper.where(condition.toString(), parameters.toArray());
+        }
+        if (includeSorts && request.getSorts() != null && !request.getSorts().isEmpty()) {
+            request.getSorts().forEach(sort -> {
+                DatacenterTableField field = fields.get(sort.getColumn());
+                if (field == null) {
+                    throw new BusinessException("字段不存在: " + sort.getColumn());
+                }
+                wrapper.orderBy(
+                        new QueryColumn(sourceColumnName(field)),
+                        !"DESC".equalsIgnoreCase(sort.getDirection()));
+            });
         }
         return wrapper;
     }
 
+    private void appendFilter(
+            StringBuilder condition,
+            List<Object> parameters,
+            DatacenterTableField field,
+            DatacenterQueryFilter filter) {
+        if (!condition.isEmpty()) {
+            condition.append(" AND ");
+        }
+        String column = quoteInternalIdentifier(sourceColumnName(field));
+        String operator = StrUtil.blankToDefault(filter.getOperator(), "EQ")
+                .toUpperCase(Locale.ROOT);
+        switch (operator) {
+            case "EQ" -> appendComparison(condition, parameters, column, "=", filter.getValue());
+            case "LIKE" -> appendComparison(
+                    condition, parameters, column, "LIKE",
+                    "%" + String.valueOf(filter.getValue()) + "%");
+            case "GT" -> appendComparison(condition, parameters, column, ">", filter.getValue());
+            case "GTE" -> appendComparison(condition, parameters, column, ">=", filter.getValue());
+            case "LT" -> appendComparison(condition, parameters, column, "<", filter.getValue());
+            case "LTE" -> appendComparison(condition, parameters, column, "<=", filter.getValue());
+            case "IS_NULL" -> condition.append(column).append(" IS NULL");
+            case "IN" -> appendInFilter(condition, parameters, column, filter.getValues());
+            default -> throw new BusinessException("不支持的过滤操作: " + operator);
+        }
+    }
+
+    private void appendComparison(
+            StringBuilder condition,
+            List<Object> parameters,
+            String column,
+            String operator,
+            Object value) {
+        condition.append(column).append(' ').append(operator).append(" ?");
+        parameters.add(value);
+    }
+
+    private void appendInFilter(
+            StringBuilder condition,
+            List<Object> parameters,
+            String column,
+            List<Object> values) {
+        if (values == null || values.isEmpty()) {
+            condition.append("1 = 0");
+            return;
+        }
+        condition.append(column).append(" IN (")
+                .append(Collections.nCopies(values.size(), "?").stream()
+                        .collect(java.util.stream.Collectors.joining(", ")))
+                .append(')');
+        parameters.addAll(values);
+    }
+
+    private String sourceColumnName(DatacenterTableField field) {
+        return StrUtil.blankToDefault(field.getSourceColumnName(), field.getFieldName());
+    }
+
     @Override
     public List<Row> queryBySql(DatacenterSource source, String sql) {
         List<Row> rows = Db.selectListBySql(sql);

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/connector/support/AbstractJdbcConnector.java

@@ -16,12 +16,17 @@ import tech.easyflow.datacenter.execution.model.DatacenterConnectionTestResult;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryFilter;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryRequest;
 import tech.easyflow.datacenter.execution.model.DatacenterQuerySort;
+import tech.easyflow.datacenter.federation.DatacenterMetadataIdentity;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
 import tech.easyflow.datacenter.meta.enums.DatacenterCapability;
 import tech.easyflow.datacenter.meta.enums.DatacenterConnectionErrorCode;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSensitivityLevel;
 import tech.easyflow.datacenter.meta.enums.DatacenterSourceType;
 import tech.easyflow.datacenter.meta.enums.DatacenterTableKind;
 import tech.easyflow.datacenter.meta.model.DatacenterCatalogMeta;
+import tech.easyflow.datacenter.meta.model.DatacenterMetadataPage;
+import tech.easyflow.datacenter.meta.model.DatacenterManagedMetadataSnapshot;
 import tech.easyflow.datacenter.meta.model.DatacenterTableDetailMeta;
 
 import java.math.BigDecimal;
@@ -105,6 +110,7 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
             return withConnection(source, true, connection -> {
                 List<DatacenterCatalogMeta> result = new ArrayList<>();
                 DatabaseMetaData metaData = connection.getMetaData();
+                if (usesCatalogNamespace()) {
                     try (ResultSet catalogs = metaData.getCatalogs()) {
                         while (catalogs.next()) {
                             String name = catalogs.getString("TABLE_CAT");
@@ -115,22 +121,30 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
                             meta.setSourceId(source.getId());
                             meta.setCatalogName(name);
                             meta.setCatalogType("CATALOG");
+                            meta.setLogicalSchemaName(name);
+                            meta.setPhysicalCatalogName(name);
                             result.add(meta);
                         }
                     }
+                }
+                if (!usesCatalogNamespace()) {
                     try (ResultSet schemas = metaData.getSchemas()) {
                         while (schemas.next()) {
                             String name = schemas.getString("TABLE_SCHEM");
-                        if (StrUtil.isBlank(name) || containsCatalog(result, name)) {
+                            if (StrUtil.isBlank(name)) {
                                 continue;
                             }
                             DatacenterCatalogMeta meta = new DatacenterCatalogMeta();
                             meta.setSourceId(source.getId());
                             meta.setCatalogName(name);
                             meta.setCatalogType("SCHEMA");
+                            meta.setLogicalSchemaName(name);
+                            meta.setPhysicalCatalogName(source.getDatabaseName());
+                            meta.setPhysicalSchemaName(name);
                             result.add(meta);
                         }
                     }
+                }
                 result = filterConfiguredCatalogs(source, result);
                 if (result.isEmpty()) {
                     String fallback = resolveCatalogName(source, null);
@@ -139,6 +153,13 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
                         meta.setSourceId(source.getId());
                         meta.setCatalogName(fallback);
                         meta.setCatalogType("DEFAULT");
+                        meta.setLogicalSchemaName(fallback);
+                        if (usesCatalogNamespace()) {
+                            meta.setPhysicalCatalogName(fallback);
+                        } else {
+                            meta.setPhysicalCatalogName(source.getDatabaseName());
+                            meta.setPhysicalSchemaName(fallback);
+                        }
                         result.add(meta);
                     }
                 }
@@ -149,24 +170,98 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
         }
     }
 
+    /**
+     * 直接在 JDBC Catalog/Schema 元数据游标上执行有界分页。
+     *
+     * @param source 数据源
+     * @param keyword 名称搜索词
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @return 有界命名空间列表
+     */
+    @Override
+    public DatacenterMetadataPage<DatacenterCatalogMeta> listCatalogsPage(
+            DatacenterSource source,
+            String keyword,
+            long pageNumber,
+            long pageSize) {
+        try {
+            return withConnection(source, true, connection -> {
+                DatabaseMetaData metadata = connection.getMetaData();
+                String normalizedKeyword = keyword == null
+                        ? "" : keyword.trim().toLowerCase(Locale.ROOT);
+                String configuredName = usesCatalogNamespace()
+                        ? StrUtil.trimToNull(source.getDatabaseName())
+                        : StrUtil.trimToNull(source.getSchemaName());
+                long offset = (pageNumber - 1L) * pageSize;
+                long matched = 0L;
+                boolean hasMore = false;
+                List<DatacenterCatalogMeta> records = new ArrayList<>((int) pageSize);
+                try (ResultSet names = usesCatalogNamespace()
+                        ? metadata.getCatalogs() : metadata.getSchemas()) {
+                    String column = usesCatalogNamespace() ? "TABLE_CAT" : "TABLE_SCHEM";
+                    while (names.next()) {
+                        String name = names.getString(column);
+                        if (StrUtil.isBlank(name)
+                                || (configuredName != null && !configuredName.equals(name))
+                                || (!normalizedKeyword.isEmpty()
+                                && !name.toLowerCase(Locale.ROOT).contains(normalizedKeyword))) {
+                            continue;
+                        }
+                        if (matched++ < offset) {
+                            continue;
+                        }
+                        if (records.size() >= pageSize) {
+                            hasMore = true;
+                            break;
+                        }
+                        records.add(catalogMeta(source, name));
+                    }
+                }
+                if (records.isEmpty() && offset == 0L && normalizedKeyword.isEmpty()) {
+                    String fallback = resolveCatalogName(source, null);
+                    if (StrUtil.isNotBlank(fallback)) {
+                        records.add(catalogMeta(source, fallback));
+                    }
+                }
+                return new DatacenterMetadataPage<>(
+                        records, pageNumber, pageSize, hasMore);
+            });
+        } catch (Exception ex) {
+            throw DatacenterConnectorExceptionSupport.wrapAccessException("读取目录失败", ex);
+        }
+    }
+
+    private DatacenterCatalogMeta catalogMeta(
+            DatacenterSource source,
+            String name) {
+        DatacenterCatalogMeta meta = new DatacenterCatalogMeta();
+        meta.setSourceId(source.getId());
+        meta.setCatalogName(name);
+        meta.setCatalogType(usesCatalogNamespace() ? "CATALOG" : "SCHEMA");
+        meta.setLogicalSchemaName(name);
+        if (usesCatalogNamespace()) {
+            meta.setPhysicalCatalogName(name);
+        } else {
+            meta.setPhysicalCatalogName(source.getDatabaseName());
+            meta.setPhysicalSchemaName(name);
+        }
+        return meta;
+    }
+
     @Override
     public List<DatacenterTable> listTables(DatacenterSource source, String catalogName) {
         try {
             return withConnection(source, true, connection -> {
                 DatabaseMetaData metaData = connection.getMetaData();
                 List<DatacenterTable> tables = new ArrayList<>();
-                try (ResultSet resultSet = metaData.getTables(resolveCatalogArgument(source, catalogName), resolveSchemaArgument(source, catalogName), "%", new String[]{"TABLE", "VIEW"})) {
+                try (ResultSet resultSet = metaData.getTables(
+                        resolveCatalogArgument(source, catalogName),
+                        metadataPattern(metaData, resolveSchemaArgument(source, catalogName)),
+                        "%",
+                        new String[]{"TABLE", "VIEW"})) {
                     while (resultSet.next()) {
-                        DatacenterTable table = new DatacenterTable();
-                        table.setSourceId(source.getId());
-                        table.setTableName(resultSet.getString("TABLE_NAME"));
-                        table.setTableDesc(resultSet.getString("REMARKS"));
-                        table.setActualTable(resultSet.getString("TABLE_NAME"));
-                        table.setMaterializedTable(resultSet.getString("TABLE_NAME"));
-                        table.setAccessMode(capabilities.contains(DatacenterCapability.WRITE_MUTATION) ? "READ_WRITE" : "READ_ONLY");
-                        table.setTableKind(resolveTableKind(resultSet.getString("TABLE_TYPE")).name());
-                        table.setCapabilitiesJson(Map.of("capabilities", capabilities.stream().map(Enum::name).toList()));
-                        tables.add(table);
+                        tables.add(tableFromMetadata(source, resultSet));
                     }
                 }
                 return tables;
@@ -176,10 +271,166 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
         }
     }
 
+    /**
+     * 直接在 JDBC 元数据游标上完成表名筛选和有界分页。
+     *
+     * @param source 数据源
+     * @param catalogName 物理命名空间
+     * @param keyword 表名搜索词
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @return 有界表列表
+     */
+    @Override
+    public DatacenterMetadataPage<DatacenterTable> listTablesPage(
+            DatacenterSource source,
+            String catalogName,
+            String keyword,
+            long pageNumber,
+            long pageSize) {
+        try {
+            return withConnection(source, true, connection -> {
+                DatabaseMetaData metaData = connection.getMetaData();
+                String normalizedKeyword = keyword == null
+                        ? "" : keyword.trim().toLowerCase(Locale.ROOT);
+                long offset = (pageNumber - 1L) * pageSize;
+                long matched = 0L;
+                List<DatacenterTable> tables = new ArrayList<>((int) pageSize);
+                boolean hasMore = false;
+                try (ResultSet resultSet = metaData.getTables(
+                        resolveCatalogArgument(source, catalogName),
+                        metadataPattern(metaData, resolveSchemaArgument(source, catalogName)),
+                        "%",
+                        new String[]{"TABLE", "VIEW"})) {
+                    while (resultSet.next()) {
+                        String tableName = resultSet.getString("TABLE_NAME");
+                        if (!normalizedKeyword.isEmpty()
+                                && (tableName == null
+                                || !tableName.toLowerCase(Locale.ROOT).contains(normalizedKeyword))) {
+                            continue;
+                        }
+                        if (matched++ < offset) {
+                            continue;
+                        }
+                        if (tables.size() >= pageSize) {
+                            hasMore = true;
+                            break;
+                        }
+                        tables.add(tableFromMetadata(source, resultSet));
+                    }
+                }
+                return new DatacenterMetadataPage<>(
+                        tables, pageNumber, pageSize, hasMore);
+            });
+        } catch (Exception ex) {
+            throw DatacenterConnectorExceptionSupport.wrapAccessException("读取表列表失败", ex);
+        }
+    }
+
+    private DatacenterTable tableFromMetadata(
+            DatacenterSource source,
+            ResultSet resultSet) throws SQLException {
+        DatacenterTable table = new DatacenterTable();
+        table.setSourceId(source.getId());
+        table.setTableName(resultSet.getString("TABLE_NAME"));
+        table.setTableDesc(resultSet.getString("REMARKS"));
+        table.setActualTable(resultSet.getString("TABLE_NAME"));
+        table.setMaterializedTable(resultSet.getString("TABLE_NAME"));
+        table.setAccessMode(capabilities.contains(DatacenterCapability.WRITE_MUTATION)
+                ? "READ_WRITE" : "READ_ONLY");
+        table.setTableKind(resolveTableKind(resultSet.getString("TABLE_TYPE")).name());
+        table.setQueryable(1);
+        table.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+        table.setLastSeenAt(new java.util.Date());
+        table.setTimeSemantics("NONE");
+        table.setMetadataRevision(1L);
+        table.setCapabilitiesJson(Map.of(
+                "capabilities", capabilities.stream().map(Enum::name).toList()));
+        return table;
+    }
+
     @Override
     public DatacenterTableDetailMeta getTableDetail(DatacenterSource source, String catalogName, String tableName) {
+        try {
+            return withConnection(source, true,
+                    connection -> readTableDetail(connection, source, catalogName, tableName));
+        } catch (Exception ex) {
+            throw DatacenterConnectorExceptionSupport.wrapAccessException("读取表详情失败", ex);
+        }
+    }
+
+    /**
+     * 使用单个元数据连接批量读取表详情，避免每张表重复创建连接池。
+     *
+     * @param source 数据源
+     * @param catalogName 物理命名空间
+     * @param tableNames 表名集合
+     * @return 表详情集合
+     */
+    @Override
+    public List<DatacenterTableDetailMeta> getTableDetails(
+            DatacenterSource source,
+            String catalogName,
+            List<String> tableNames) {
+        if (tableNames == null || tableNames.isEmpty()) {
+            return List.of();
+        }
         try {
             return withConnection(source, true, connection -> {
+                List<DatacenterTableDetailMeta> details = new ArrayList<>(tableNames.size());
+                for (String tableName : tableNames) {
+                    details.add(readTableDetail(connection, source, catalogName, tableName));
+                }
+                return List.copyOf(details);
+            });
+        } catch (Exception ex) {
+            throw DatacenterConnectorExceptionSupport.wrapAccessException("批量读取表详情失败", ex);
+        }
+    }
+
+    /**
+     * 使用单个连接刷新已纳管表，并把物理缺失作为快照状态返回。
+     *
+     * @param source 数据源
+     * @param catalogName 物理命名空间
+     * @param tableNames 已纳管表名集合
+     * @return 已发现详情与缺失表名
+     */
+    @Override
+    public DatacenterManagedMetadataSnapshot inspectManagedTables(
+            DatacenterSource source,
+            String catalogName,
+            List<String> tableNames) {
+        if (tableNames == null || tableNames.isEmpty()) {
+            return new DatacenterManagedMetadataSnapshot(List.of(), Set.of());
+        }
+        try {
+            return withConnection(source, true, connection -> {
+                List<DatacenterTableDetailMeta> details = new ArrayList<>(tableNames.size());
+                Set<String> missing = new java.util.LinkedHashSet<>();
+                for (String tableName : tableNames) {
+                    try {
+                        details.add(readTableDetail(connection, source, catalogName, tableName));
+                    } catch (BusinessException exception) {
+                        if (exception.getMessage() == null
+                                || !exception.getMessage().startsWith("所选数据表已变化")) {
+                            throw exception;
+                        }
+                        missing.add(tableName);
+                    }
+                }
+                return new DatacenterManagedMetadataSnapshot(details, missing);
+            });
+        } catch (Exception ex) {
+            throw DatacenterConnectorExceptionSupport.wrapAccessException("刷新已纳管表失败", ex);
+        }
+    }
+
+    private DatacenterTableDetailMeta readTableDetail(
+            Connection connection,
+            DatacenterSource source,
+            String catalogName,
+            String tableName) throws SQLException {
                 DatabaseMetaData metaData = connection.getMetaData();
                 DatacenterTableDetailMeta detail = new DatacenterTableDetailMeta();
                 DatacenterTable table = new DatacenterTable();
@@ -189,24 +440,35 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
                 table.setMaterializedTable(tableName);
                 table.setAccessMode(capabilities.contains(DatacenterCapability.WRITE_MUTATION) ? "READ_WRITE" : "READ_ONLY");
                 table.setTableKind(DatacenterTableKind.EXTERNAL_TABLE.name());
+                table.setQueryable(1);
+                table.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+                table.setLastSeenAt(new java.util.Date());
+                table.setTimeSemantics("NONE");
+                table.setMetadataRevision(1L);
                 table.setCapabilitiesJson(Map.of("capabilities", capabilities.stream().map(Enum::name).toList()));
                 detail.setTable(table);
 
+                boolean tableFound = false;
                 try (ResultSet tableSet = metaData.getTables(
                         resolveCatalogArgument(source, catalogName),
-                        resolveSchemaArgument(source, catalogName),
-                        tableName,
+                        metadataPattern(metaData, resolveSchemaArgument(source, catalogName)),
+                        metadataPattern(metaData, tableName),
                         new String[]{"TABLE", "VIEW"})) {
                     while (tableSet.next()) {
-                        String currentTableName = tableSet.getString("TABLE_NAME");
-                        if (!matchesTableName(currentTableName, tableName)) {
+                        if (!matchesMetadataTable(
+                                tableSet, source, catalogName, tableName)) {
                             continue;
                         }
                         table.setTableDesc(tableSet.getString("REMARKS"));
                         table.setTableKind(resolveTableKind(tableSet.getString("TABLE_TYPE")).name());
+                        tableFound = true;
                         break;
                     }
                 }
+                if (!tableFound) {
+                    throw new BusinessException(
+                            "所选数据表已变化，请刷新后重试: " + tableName);
+                }
 
                 Set<String> primaryKeys = new HashSet<>();
                 try (ResultSet pkSet = metaData.getPrimaryKeys(resolveCatalogArgument(source, catalogName), resolveSchemaArgument(source, catalogName), tableName)) {
@@ -216,13 +478,24 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
                 }
 
                 List<DatacenterTableField> fields = new ArrayList<>();
-                try (ResultSet columns = metaData.getColumns(resolveCatalogArgument(source, catalogName), resolveSchemaArgument(source, catalogName), tableName, "%")) {
+                try (ResultSet columns = metaData.getColumns(
+                        resolveCatalogArgument(source, catalogName),
+                        metadataPattern(metaData, resolveSchemaArgument(source, catalogName)),
+                        metadataPattern(metaData, tableName),
+                        "%")) {
                     while (columns.next()) {
+                        if (!matchesMetadataTable(
+                                columns, source, catalogName, tableName)) {
+                            continue;
+                        }
                         DatacenterTableField field = new DatacenterTableField();
                         field.setFieldName(columns.getString("COLUMN_NAME"));
                         field.setSourceColumnName(columns.getString("COLUMN_NAME"));
                         field.setFieldDesc(columns.getString("REMARKS"));
                         field.setJdbcType(columns.getString("TYPE_NAME"));
+                        field.setJdbcTypeCode(columns.getInt("DATA_TYPE"));
+                        field.setNativeTypeName(columns.getString("TYPE_NAME"));
+                        field.setOrdinalPosition(columns.getInt("ORDINAL_POSITION"));
                         field.setPrecision(columns.getInt("COLUMN_SIZE"));
                         field.setScale(columns.getInt("DECIMAL_DIGITS"));
                         field.setRequired(columns.getInt("NULLABLE") == DatabaseMetaData.columnNoNulls ? 1 : 0);
@@ -231,15 +504,21 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
                         field.setWritable(capabilities.contains(DatacenterCapability.WRITE_MUTATION) ? 1 : 0);
                         field.setIndexed(primaryKeys.contains(field.getFieldName()) ? 1 : 0);
                         field.setFieldType(mapFieldType(columns.getInt("DATA_TYPE")));
+                        field.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+                        field.setLastSeenAt(new java.util.Date());
+                        field.setSensitivityLevel(DatacenterSensitivityLevel.PUBLIC.name());
+                        field.setMetadataFingerprint(DatacenterMetadataIdentity.fieldFingerprint(field));
                         fields.add(field);
                     }
                 }
+                if (fields.isEmpty()) {
+                    throw new BusinessException(
+                            "无法读取数据表字段，请检查权限: " + tableName);
+                }
+                table.setMetadataFingerprint(DatacenterMetadataIdentity.tableFingerprint(
+                        table.getTableName(), table.getTableKind(), fields));
                 detail.setFields(fields);
                 return detail;
-            });
-        } catch (Exception ex) {
-            throw DatacenterConnectorExceptionSupport.wrapAccessException("读取表详情失败", ex);
-        }
     }
 
     @Override
@@ -247,6 +526,11 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
         if (!capabilities.contains(DatacenterCapability.READ_QUERY)) {
             throw new BusinessException("当前数据源暂不支持查询");
         }
+        if (request == null || request.getPageSize() == null
+                || request.getPageSize() < 1L
+                || request.getPageSize() > 500L) {
+            throw new BusinessException("pageSize 必须在 1 到 500 之间");
+        }
         try {
             return withConnection(source, true, connection -> doQueryPage(connection, source, table, request));
         } catch (Exception ex) {
@@ -325,7 +609,7 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
         String qualifiedTable = sqlDialect.qualifyTable(resolveCatalogName(source, request.getDatasetRef() == null ? null : request.getDatasetRef().getCatalogName()), resolvePhysicalTableName(table));
         StringBuilder whereClause = new StringBuilder();
         if (StrUtil.isNotBlank(request.getWhere())) {
-            whereClause.append(" WHERE ").append(request.getWhere());
+            throw new BusinessException("不支持原始 WHERE 条件，请使用结构化筛选条件");
         } else if (!CollectionUtils.isEmpty(request.getFilters())) {
             whereClause.append(" WHERE 1=1 ");
             for (DatacenterQueryFilter filter : request.getFilters()) {
@@ -622,13 +906,9 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
             return items;
         }
         List<DatacenterCatalogMeta> matched = items.stream()
-                .filter(item -> configuredName.equalsIgnoreCase(item.getCatalogName()))
+                .filter(item -> configuredName.equals(item.getCatalogName()))
                 .collect(Collectors.toList());
-        return matched.isEmpty() ? items : matched;
-    }
-
-    private boolean containsCatalog(List<DatacenterCatalogMeta> items, String catalogName) {
-        return items.stream().anyMatch(item -> catalogName.equalsIgnoreCase(item.getCatalogName()));
+        return matched;
     }
 
     private DatacenterTableKind resolveTableKind(String tableType) {
@@ -639,8 +919,58 @@ public abstract class AbstractJdbcConnector implements DatacenterConnector {
         if (currentTableName == null || targetTableName == null) {
             return false;
         }
-        return currentTableName.equals(targetTableName)
-                || currentTableName.equalsIgnoreCase(targetTableName);
+        return currentTableName.equals(targetTableName);
+    }
+
+    /**
+     * 将精确标识符转换为 JDBC 元数据 Pattern，转义驱动声明的通配符字符。
+     *
+     * @param metaData JDBC 元数据
+     * @param value 精确 Schema 或表名
+     * @return 可安全用于元数据 Pattern 参数的文本
+     * @throws SQLException 驱动无法返回转义字符时抛出
+     */
+    private String metadataPattern(DatabaseMetaData metaData, String value)
+            throws SQLException {
+        if (value == null) {
+            return null;
+        }
+        String escape = metaData.getSearchStringEscape();
+        if (escape == null || escape.isEmpty()) {
+            return value;
+        }
+        return value.replace(escape, escape + escape)
+                .replace("%", escape + "%")
+                .replace("_", escape + "_");
+    }
+
+    /**
+     * 对元数据结果再次执行精确 Catalog、Schema 与表名校验，防御驱动忽略 Pattern 转义。
+     *
+     * @param resultSet 元数据结果集
+     * @param source 数据源
+     * @param catalogName 用户选择的物理命名空间
+     * @param tableName 目标表名
+     * @return 当前结果行是否属于精确目标
+     * @throws SQLException 读取元数据列失败时抛出
+     */
+    private boolean matchesMetadataTable(
+            ResultSet resultSet,
+            DatacenterSource source,
+            String catalogName,
+            String tableName) throws SQLException {
+        if (!matchesTableName(resultSet.getString("TABLE_NAME"), tableName)) {
+            return false;
+        }
+        String expectedCatalog = resolveCatalogArgument(source, catalogName);
+        String expectedSchema = resolveSchemaArgument(source, catalogName);
+        String actualCatalog = resultSet.getString("TABLE_CAT");
+        String actualSchema = resultSet.getString("TABLE_SCHEM");
+        // Schema 型数据库已由当前连接锁定 Database；部分 PostgreSQL 驱动不会回填 TABLE_CAT。
+        return (!usesCatalogNamespace()
+                || expectedCatalog == null
+                || expectedCatalog.equals(actualCatalog))
+                && (expectedSchema == null || expectedSchema.equals(actualSchema));
     }
 
     private Integer mapFieldType(int jdbcType) {

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/entity/base/DatacenterTableBase.java

@@ -65,6 +65,38 @@ public class DatacenterTableBase extends DateEntity implements Serializable {
     @Column(comment = "物理表名")
     private String actualTable;
 
+    /** 物理对象稳定摘要。 */
+    @Column(comment = "物理对象稳定摘要")
+    private String physicalIdentityKey;
+
+    /** 表结构摘要。 */
+    @Column(comment = "表结构摘要")
+    private String metadataFingerprint;
+
+    /** 元数据状态。 */
+    @Column(comment = "元数据状态")
+    private String metadataStatus;
+
+    /** 最近发现时间。 */
+    @Column(comment = "最近发现时间")
+    private Date lastSeenAt;
+
+    /** 是否允许统一只读查询。 */
+    @Column(comment = "是否允许统一只读查询")
+    private Integer queryable;
+
+    /** 时间语义。 */
+    @Column(comment = "时间语义")
+    private String timeSemantics;
+
+    /** 默认时间字段 ID。 */
+    @Column(comment = "默认时间字段ID")
+    private BigInteger defaultTimeFieldId;
+
+    /** 表元数据版本。 */
+    @Column(comment = "表元数据版本")
+    private Long metadataRevision;
+
     /**
      * 表类型
      */
@@ -198,6 +230,39 @@ public class DatacenterTableBase extends DateEntity implements Serializable {
         this.actualTable = actualTable;
     }
 
+    public String getPhysicalIdentityKey() { return physicalIdentityKey; }
+
+    public void setPhysicalIdentityKey(String physicalIdentityKey) { this.physicalIdentityKey = physicalIdentityKey; }
+
+    public String getMetadataFingerprint() { return metadataFingerprint; }
+
+    public void setMetadataFingerprint(String metadataFingerprint) { this.metadataFingerprint = metadataFingerprint; }
+
+    public String getMetadataStatus() { return metadataStatus; }
+
+    public void setMetadataStatus(String metadataStatus) { this.metadataStatus = metadataStatus; }
+
+    public Date getLastSeenAt() { return lastSeenAt; }
+
+    public void setLastSeenAt(Date lastSeenAt) { this.lastSeenAt = lastSeenAt; }
+
+    public Integer getQueryable() { return queryable; }
+
+    public void setQueryable(Integer queryable) { this.queryable = queryable; }
+
+    public String getTimeSemantics() { return timeSemantics; }
+
+    public void setTimeSemantics(String timeSemantics) { this.timeSemantics = timeSemantics; }
+
+    @JsonSerialize(using = ToStringSerializer.class)
+    public BigInteger getDefaultTimeFieldId() { return defaultTimeFieldId; }
+
+    public void setDefaultTimeFieldId(BigInteger defaultTimeFieldId) { this.defaultTimeFieldId = defaultTimeFieldId; }
+
+    public Long getMetadataRevision() { return metadataRevision; }
+
+    public void setMetadataRevision(Long metadataRevision) { this.metadataRevision = metadataRevision; }
+
     public String getTableKind() {
         return tableKind;
     }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/entity/base/DatacenterTableFieldBase.java

@@ -41,6 +41,10 @@ public class DatacenterTableFieldBase extends DateEntity implements Serializable
     @Column(comment = "源字段名")
     private String sourceColumnName;
 
+    /** JDBC 字段顺序。 */
+    @Column(comment = "JDBC字段顺序")
+    private Integer ordinalPosition;
+
     /**
      * 字段描述
      */
@@ -59,6 +63,14 @@ public class DatacenterTableFieldBase extends DateEntity implements Serializable
     @Column(comment = "JDBC类型")
     private String jdbcType;
 
+    /** java.sql.Types 数值。 */
+    @Column(comment = "JDBC类型编码")
+    private Integer jdbcTypeCode;
+
+    /** 数据库原生类型名。 */
+    @Column(comment = "数据库原生类型名")
+    private String nativeTypeName;
+
     /**
      * 精度
      */
@@ -71,6 +83,26 @@ public class DatacenterTableFieldBase extends DateEntity implements Serializable
     @Column(comment = "小数位")
     private Integer scale;
 
+    /** 字段元数据摘要。 */
+    @Column(comment = "字段元数据摘要")
+    private String metadataFingerprint;
+
+    /** 元数据状态。 */
+    @Column(comment = "元数据状态")
+    private String metadataStatus;
+
+    /** 最近发现时间。 */
+    @Column(comment = "最近发现时间")
+    private Date lastSeenAt;
+
+    /** 敏感级别。 */
+    @Column(comment = "敏感级别")
+    private String sensitivityLevel;
+
+    /** 脱敏策略。 */
+    @Column(comment = "脱敏策略")
+    private String maskingStrategy;
+
     /**
      * 是否必填
      */
@@ -165,6 +197,10 @@ public class DatacenterTableFieldBase extends DateEntity implements Serializable
         this.sourceColumnName = sourceColumnName;
     }
 
+    public Integer getOrdinalPosition() { return ordinalPosition; }
+
+    public void setOrdinalPosition(Integer ordinalPosition) { this.ordinalPosition = ordinalPosition; }
+
     public String getFieldDesc() {
         return fieldDesc;
     }
@@ -189,6 +225,14 @@ public class DatacenterTableFieldBase extends DateEntity implements Serializable
         this.jdbcType = jdbcType;
     }
 
+    public Integer getJdbcTypeCode() { return jdbcTypeCode; }
+
+    public void setJdbcTypeCode(Integer jdbcTypeCode) { this.jdbcTypeCode = jdbcTypeCode; }
+
+    public String getNativeTypeName() { return nativeTypeName; }
+
+    public void setNativeTypeName(String nativeTypeName) { this.nativeTypeName = nativeTypeName; }
+
     public Integer getPrecision() {
         return precision;
     }
@@ -205,6 +249,26 @@ public class DatacenterTableFieldBase extends DateEntity implements Serializable
         this.scale = scale;
     }
 
+    public String getMetadataFingerprint() { return metadataFingerprint; }
+
+    public void setMetadataFingerprint(String metadataFingerprint) { this.metadataFingerprint = metadataFingerprint; }
+
+    public String getMetadataStatus() { return metadataStatus; }
+
+    public void setMetadataStatus(String metadataStatus) { this.metadataStatus = metadataStatus; }
+
+    public Date getLastSeenAt() { return lastSeenAt; }
+
+    public void setLastSeenAt(Date lastSeenAt) { this.lastSeenAt = lastSeenAt; }
+
+    public String getSensitivityLevel() { return sensitivityLevel; }
+
+    public void setSensitivityLevel(String sensitivityLevel) { this.sensitivityLevel = sensitivityLevel; }
+
+    public String getMaskingStrategy() { return maskingStrategy; }
+
+    public void setMaskingStrategy(String maskingStrategy) { this.maskingStrategy = maskingStrategy; }
+
     public Integer getRequired() {
         return required;
     }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/excel/service/impl/DatacenterExcelImportServiceImpl.java

@@ -346,7 +346,7 @@ public class DatacenterExcelImportServiceImpl implements DatacenterExcelImportSe
                 queryRequest.setDatasetRef(registryService.resolveDatasetRef(table.getId()));
                 queryRequest.setSelectedColumns(table.getFields().stream().map(DatacenterTableField::getFieldName).toList());
                 final int[] rowIndex = {1};
-                totalRows += iterateRows(queryRequest, row -> {
+                totalRows += iterateRows(queryRequest, account, row -> {
                     org.apache.poi.ss.usermodel.Row excelRow = sheet.createRow(rowIndex[0]++);
                     for (int i = 0; i < table.getFields().size(); i++) {
                         Cell cell = excelRow.createCell(i);
@@ -434,7 +434,7 @@ public class DatacenterExcelImportServiceImpl implements DatacenterExcelImportSe
         String baseName = resolveSplitPrefix(request, sourceTable.getTableName());
         List<BigInteger> derivedIds = new ArrayList<>();
         final Holder holder = new Holder();
-        long totalRows = iterateRows(buildFullQuery(sourceTable), row -> {
+        long totalRows = iterateRows(buildFullQuery(sourceTable), account, row -> {
             if (holder.targetTable == null || holder.currentSize >= rowBatchSize) {
                 holder.batchNo++;
                 holder.targetTable = createDerivedTable(source, catalog, cloneFields(sourceTable.getFields()),
@@ -466,7 +466,7 @@ public class DatacenterExcelImportServiceImpl implements DatacenterExcelImportSe
         String prefix = resolveSplitPrefix(request, sourceTable.getTableName());
         Map<String, DatacenterTable> targets = new LinkedHashMap<>();
         List<BigInteger> derivedIds = new ArrayList<>();
-        long totalRows = iterateRows(buildFullQuery(sourceTable), row -> {
+        long totalRows = iterateRows(buildFullQuery(sourceTable), account, row -> {
             String fieldValue = stringify(row.get(splitField.getFieldName()));
             String bucket = fieldValue == null || fieldValue.isBlank() ? "empty" : fieldValue;
             DatacenterTable targetTable = targets.get(bucket);
@@ -543,7 +543,7 @@ public class DatacenterExcelImportServiceImpl implements DatacenterExcelImportSe
         Map<String, JSONObject> mergedRows = new LinkedHashMap<>();
         for (DatacenterTable table : tables) {
             Map<String, String> mapping = fieldMappings.get(table.getId());
-            iterateRows(buildFullQuery(table), row -> {
+            iterateRows(buildFullQuery(table), account, row -> {
                 String joinValue = stringify(row.get(request.getJoinKey()));
                 if (joinValue == null || joinValue.isBlank()) {
                     return;
@@ -729,16 +729,22 @@ public class DatacenterExcelImportServiceImpl implements DatacenterExcelImportSe
     }
 
     private long copyRows(DatacenterQueryRequest queryRequest, RowMapper mapper, DatacenterTable targetTable, LoginAccount account) {
-        return iterateRows(queryRequest, row -> saveToTable(targetTable, mapper.map(row), account));
+        return iterateRows(
+                queryRequest,
+                account,
+                row -> saveToTable(targetTable, mapper.map(row), account));
     }
 
-    private long iterateRows(DatacenterQueryRequest queryRequest, RowConsumer consumer) {
+    private long iterateRows(
+            DatacenterQueryRequest queryRequest,
+            LoginAccount account,
+            RowConsumer consumer) {
         long total = 0L;
         long pageNumber = 1L;
         while (true) {
             queryRequest.setPageNumber(pageNumber);
             queryRequest.setPageSize(QUERY_BATCH_SIZE);
-            Page<Row> page = queryService.queryPage(queryRequest);
+            Page<Row> page = queryService.queryPage(queryRequest, account);
             if (page.getRecords() == null || page.getRecords().isEmpty()) {
                 break;
             }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/model/DatacenterSchemaResponse.java

@@ -5,31 +5,46 @@ import tech.easyflow.datacenter.entity.DatacenterTableField;
 import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
 import tech.easyflow.datacenter.meta.entity.DatacenterDatasetVersion;
 import tech.easyflow.datacenter.meta.entity.DatacenterDerivedTable;
-import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceView;
 
 import java.util.ArrayList;
 import java.util.List;
 
 public class DatacenterSchemaResponse {
     private DatasetRef datasetRef;
-    private DatacenterSource source;
+    private DatacenterSourceView source;
     private DatacenterCatalog catalog;
     private DatacenterTable table;
     private List<DatacenterTableField> fields = new ArrayList<>();
+    private long fieldPageNumber = 1L;
+    private long fieldPageSize;
+    private boolean hasMoreFields;
     private List<DatacenterDatasetVersion> versions = new ArrayList<>();
     private List<DatacenterDerivedTable> upstreamLineage = new ArrayList<>();
     private List<DatacenterDerivedTable> downstreamLineage = new ArrayList<>();
 
     public DatasetRef getDatasetRef() { return datasetRef; }
     public void setDatasetRef(DatasetRef datasetRef) { this.datasetRef = datasetRef; }
-    public DatacenterSource getSource() { return source; }
-    public void setSource(DatacenterSource source) { this.source = source; }
+    public DatacenterSourceView getSource() { return source; }
+    public void setSource(DatacenterSourceView source) { this.source = source; }
     public DatacenterCatalog getCatalog() { return catalog; }
     public void setCatalog(DatacenterCatalog catalog) { this.catalog = catalog; }
     public DatacenterTable getTable() { return table; }
     public void setTable(DatacenterTable table) { this.table = table; }
     public List<DatacenterTableField> getFields() { return fields; }
     public void setFields(List<DatacenterTableField> fields) { this.fields = fields; }
+    /** @return 当前字段页码 */
+    public long getFieldPageNumber() { return fieldPageNumber; }
+    /** @param fieldPageNumber 当前字段页码 */
+    public void setFieldPageNumber(long fieldPageNumber) { this.fieldPageNumber = fieldPageNumber; }
+    /** @return 当前字段页大小 */
+    public long getFieldPageSize() { return fieldPageSize; }
+    /** @param fieldPageSize 当前字段页大小 */
+    public void setFieldPageSize(long fieldPageSize) { this.fieldPageSize = fieldPageSize; }
+    /** @return 是否还有下一页字段 */
+    public boolean isHasMoreFields() { return hasMoreFields; }
+    /** @param hasMoreFields 是否还有下一页字段 */
+    public void setHasMoreFields(boolean hasMoreFields) { this.hasMoreFields = hasMoreFields; }
     public List<DatacenterDatasetVersion> getVersions() { return versions; }
     public void setVersions(List<DatacenterDatasetVersion> versions) { this.versions = versions; }
     public List<DatacenterDerivedTable> getUpstreamLineage() { return upstreamLineage; }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/model/DatacenterSqlCancelRequest.java

@@ -0,0 +1,9 @@
+package tech.easyflow.datacenter.execution.model;
+
+/**
+ * 管理端取消只读 SQL 查询请求。
+ *
+ * @param queryId 客户端在执行前生成的查询 UUID
+ */
+public record DatacenterSqlCancelRequest(String queryId) {
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/model/DatacenterSqlColumnView.java

@@ -0,0 +1,18 @@
+package tech.easyflow.datacenter.execution.model;
+
+/**
+ * SQL 控制台结果列。
+ *
+ * @param key 前端稳定列键
+ * @param label JDBC 列标签
+ * @param jdbcType JDBC 类型编码
+ * @param typeName 数据库类型名
+ * @param nullable 是否允许空值
+ */
+public record DatacenterSqlColumnView(
+        String key,
+        String label,
+        int jdbcType,
+        String typeName,
+        boolean nullable) {
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/model/DatacenterSqlConsoleRequest.java

@@ -0,0 +1,18 @@
+package tech.easyflow.datacenter.execution.model;
+
+import java.math.BigInteger;
+
+/**
+ * 管理端只读 SQL 控制台请求。
+ *
+ * @param sourceId 已激活数据源 ID
+ * @param queryId 客户端在执行前生成的查询 UUID
+ * @param sql 单条只读 SQL
+ * @param maxRows 最大返回行数
+ */
+public record DatacenterSqlConsoleRequest(
+        BigInteger sourceId,
+        String queryId,
+        String sql,
+        Integer maxRows) {
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/model/DatacenterSqlConsoleResult.java

@@ -0,0 +1,31 @@
+package tech.easyflow.datacenter.execution.model;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 有界 SQL 控制台结果。
+ *
+ * @param queryId 查询标识
+ * @param columns 结果列
+ * @param rows 结果行
+ * @param returnedRows 返回行数
+ * @param truncated 是否因上限截断
+ * @param durationMs 总耗时毫秒
+ */
+public record DatacenterSqlConsoleResult(
+        String queryId,
+        List<DatacenterSqlColumnView> columns,
+        List<Map<String, Object>> rows,
+        long returnedRows,
+        boolean truncated,
+        long durationMs) {
+
+    /**
+     * 防御性复制结果集合。
+     */
+    public DatacenterSqlConsoleResult {
+        columns = List.copyOf(columns == null ? List.of() : columns);
+        rows = List.copyOf(rows == null ? List.of() : rows);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/model/DatasetRef.java

@@ -5,6 +5,7 @@ import java.math.BigInteger;
 public class DatasetRef implements java.io.Serializable {
     private static final long serialVersionUID = 1L;
 
+    private BigInteger tenantId;
     private BigInteger sourceId;
     private BigInteger catalogId;
     private String catalogName;
@@ -12,6 +13,8 @@ public class DatasetRef implements java.io.Serializable {
     private String tableName;
     private BigInteger versionId;
 
+    public BigInteger getTenantId() { return tenantId; }
+    public void setTenantId(BigInteger tenantId) { this.tenantId = tenantId; }
     public BigInteger getSourceId() { return sourceId; }
     public void setSourceId(BigInteger sourceId) { this.sourceId = sourceId; }
     public BigInteger getCatalogId() { return catalogId; }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/service/DatacenterDatasetQueryService.java

@@ -2,6 +2,7 @@ package tech.easyflow.datacenter.execution.service;
 
 import com.mybatisflex.core.paginate.Page;
 import com.mybatisflex.core.row.Row;
+import tech.easyflow.common.entity.LoginAccount;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryRequest;
 import tech.easyflow.datacenter.execution.model.DatacenterSchemaResponse;
 import tech.easyflow.datacenter.execution.model.DatacenterSqlQueryRequest;
@@ -20,6 +21,19 @@ public interface DatacenterDatasetQueryService {
      */
     Page<Row> queryPage(DatacenterQueryRequest request);
 
+    /**
+     * 使用明确执行账号分页查询结构化数据集。
+     *
+     * @param request 查询请求
+     * @param account 执行账号
+     * @return 分页结果
+     */
+    default Page<Row> queryPage(
+            DatacenterQueryRequest request,
+            LoginAccount account) {
+        return queryPage(request);
+    }
+
     /**
      * 执行原生 SQL 并返回完整结果。
      *
@@ -35,9 +49,43 @@ public interface DatacenterDatasetQueryService {
      * @param fetchSize JDBC 建议拉取行数
      * @param consumer 单行消费者
      */
+    default void consumeBySql(
+            DatacenterSqlQueryRequest request,
+            int fetchSize,
+            Consumer<Row> consumer) {
+        consumeBySql(request, fetchSize, null, consumer);
+    }
+
+    /**
+     * 使用明确执行账号流式消费 SQL，后台工作流据此绑定权威租户。
+     *
+     * @param request SQL 查询请求
+     * @param fetchSize JDBC 建议拉取行数
+     * @param account 执行账号
+     * @param consumer 单行消费者
+     */
+    default void consumeBySql(
+            DatacenterSqlQueryRequest request,
+            int fetchSize,
+            LoginAccount account,
+            Consumer<Row> consumer) {
+        consumeBySql(request, fetchSize, account, null, consumer);
+    }
+
+    /**
+     * 使用明确执行账号和调用方 QueryId 流式消费 SQL。
+     *
+     * @param request SQL 查询请求
+     * @param fetchSize JDBC 建议拉取行数
+     * @param account 执行账号
+     * @param requestedQueryId 调用方预生成的查询 UUID；为空时服务端生成
+     * @param consumer 单行消费者
+     */
     void consumeBySql(
             DatacenterSqlQueryRequest request,
             int fetchSize,
+            LoginAccount account,
+            String requestedQueryId,
             Consumer<Row> consumer);
 
     /**
@@ -48,6 +96,19 @@ public interface DatacenterDatasetQueryService {
      */
     DatacenterSchemaResponse getSchema(DatasetRef datasetRef);
 
+    /**
+     * 获取有界字段页的数据集结构。
+     *
+     * @param datasetRef 数据集引用
+     * @param fieldPageNumber 字段页码
+     * @param fieldPageSize 字段页大小
+     * @return 数据集结构和当前字段页
+     */
+    DatacenterSchemaResponse getSchema(
+            DatasetRef datasetRef,
+            Long fieldPageNumber,
+            Long fieldPageSize);
+
     /**
      * 仅解析数据集定位信息，不加载版本和血缘。
      *

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/service/impl/DatacenterDatasetQueryServiceImpl.java

@@ -1,22 +1,43 @@
 package tech.easyflow.datacenter.execution.service.impl;
 
+import com.easyagents.federation.sql.execute.SqlParameter;
+import com.easyagents.federation.sql.execute.QueryId;
 import com.mybatisflex.core.paginate.Page;
 import com.mybatisflex.core.query.QueryWrapper;
 import com.mybatisflex.core.row.Row;
+import java.math.BigInteger;
+import java.sql.Types;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.function.Consumer;
+import java.util.function.Function;
+import java.util.stream.Collectors;
 import org.springframework.stereotype.Service;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.StringUtils;
 import tech.easyflow.common.web.exceptions.BusinessException;
+import tech.easyflow.common.entity.LoginAccount;
 import tech.easyflow.datacenter.connector.DatacenterConnector;
 import tech.easyflow.datacenter.connector.DatacenterConnectorRegistry;
 import tech.easyflow.datacenter.connector.support.AbstractInternalTableConnector;
+import tech.easyflow.datacenter.audit.DatacenterQueryAudit;
+import tech.easyflow.datacenter.audit.DatacenterQueryAuditService;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.entity.DatacenterTableField;
+import tech.easyflow.datacenter.execution.model.DatacenterQueryFilter;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryRequest;
+import tech.easyflow.datacenter.execution.model.DatacenterQuerySort;
 import tech.easyflow.datacenter.execution.model.DatacenterSchemaResponse;
+import tech.easyflow.datacenter.execution.model.DatacenterSqlConsoleResult;
 import tech.easyflow.datacenter.execution.model.DatacenterSqlQueryRequest;
 import tech.easyflow.datacenter.execution.model.DatasetRef;
 import tech.easyflow.datacenter.execution.service.DatacenterDatasetQueryService;
+import tech.easyflow.datacenter.federation.DatacenterFederationQueryService;
 import tech.easyflow.datacenter.mapper.DatacenterCatalogMapper;
 import tech.easyflow.datacenter.mapper.DatacenterDatasetVersionMapper;
 import tech.easyflow.datacenter.mapper.DatacenterDerivedTableMapper;
@@ -25,19 +46,14 @@ import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
 import tech.easyflow.datacenter.meta.entity.DatacenterDatasetVersion;
 import tech.easyflow.datacenter.meta.entity.DatacenterDerivedTable;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceViews;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceType;
+import tech.easyflow.datacenter.meta.enums.DatacenterSensitivityLevel;
 import tech.easyflow.datacenter.meta.service.DatacenterDatasetRegistryService;
 import tech.easyflow.datacenter.utils.SqlSupportUtils;
 
 import javax.annotation.Resource;
-import java.math.BigInteger;
-import java.util.LinkedHashMap;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Function;
-import java.util.function.Consumer;
-import java.util.stream.Collectors;
 
 @Service
 public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQueryService {
@@ -54,18 +70,34 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
     private DatacenterDatasetVersionMapper datasetVersionMapper;
     @Resource
     private DatacenterDerivedTableMapper derivedTableMapper;
+    @Resource
+    private DatacenterFederationQueryService federationQueryService;
+    @Resource
+    private DatacenterQueryAuditService queryAuditService;
 
     @Override
     public Page<Row> queryPage(DatacenterQueryRequest request) {
+        throw new BusinessException("结构化查询必须提供执行账号");
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public Page<Row> queryPage(
+            DatacenterQueryRequest request,
+            LoginAccount account) {
         if (request == null || request.getDatasetRef() == null) {
             throw new BusinessException("datasetRef 不能为空");
         }
         normalizePage(request);
         DatacenterTable table = resolveTable(request.getDatasetRef());
         DatacenterSource source = registryService.getSourceRequired(table.getSourceId());
+        validateStructuredQueryTenant(
+                request.getDatasetRef(), table, source, account);
         DatacenterCatalog catalog = registryService.getCatalogById(table.getCatalogId());
         DatacenterTable queryTable = resolveQueryTable(table, request.getDatasetRef());
-        validateRequest(queryTable, request, source);
+        validateRequest(queryTable, request);
         request.getDatasetRef().setSourceId(table.getSourceId());
         request.getDatasetRef().setCatalogId(table.getCatalogId());
         request.getDatasetRef().setTableId(table.getId());
@@ -73,15 +105,199 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         if (catalog != null) {
             request.getDatasetRef().setCatalogName(catalog.getCatalogName());
         }
+        if (isFederated(source)) {
+            return queryFederatedPage(
+                    source, catalog, queryTable, request, account);
+        }
         DatacenterConnector connector = connectorRegistry.getConnector(source.getSourceType());
-        return connector.queryPage(source, queryTable, request);
+        QueryId queryId = QueryId.create();
+        long startedNanos = System.nanoTime();
+        DatacenterQueryAudit audit = queryAuditService.start(
+                queryId.value(), source, structuredQueryDescription(queryTable, request),
+                structuredParameterSummary(request), account,
+                "DATASET_PAGE", table.getId().toString());
+        try {
+            Page<Row> result = connector.queryPage(source, queryTable, request);
+            long durationMs = elapsedMillis(startedNanos);
+            queryAuditService.succeed(
+                    audit,
+                    List.of(table.getTableName()),
+                    structuredReferencedFields(request),
+                    result.getRecords().size(),
+                    false,
+                    durationMs,
+                    durationMs);
+            return result;
+        } catch (RuntimeException exception) {
+            queryAuditService.fail(
+                    audit,
+                    "DATASET_PAGE_QUERY_FAILED",
+                    safeMessage(exception),
+                    List.of(table.getTableName()),
+                    structuredReferencedFields(request),
+                    elapsedMillis(startedNanos));
+            throw exception;
+        }
+    }
+
+    /**
+     * 使用执行账号绑定结构化查询的权威租户。
+     *
+     * @param datasetRef 数据集引用
+     * @param table 已解析表
+     * @param source 已解析数据源
+     * @param account 执行账号
+     * @throws BusinessException 账号或租户边界不合法时抛出
+     */
+    private void validateStructuredQueryTenant(
+            DatasetRef datasetRef,
+            DatacenterTable table,
+            DatacenterSource source,
+            LoginAccount account) {
+        if (account == null || account.getTenantId() == null) {
+            throw new BusinessException("结构化查询缺少执行账号租户");
+        }
+        BigInteger tenantId = account.getTenantId();
+        if ((datasetRef.getTenantId() != null
+                && !tenantId.equals(datasetRef.getTenantId()))
+                || !tenantId.equals(table.getTenantId())
+                || !tenantId.equals(source.getTenantId())) {
+            throw new BusinessException("数据集不属于当前租户");
+        }
+        datasetRef.setTenantId(tenantId);
+    }
+
+    private String structuredQueryDescription(
+            DatacenterTable table,
+            DatacenterQueryRequest request) {
+        StringBuilder sql = new StringBuilder("SELECT ")
+                .append(String.join(", ", request.getSelectedColumns()))
+                .append(" FROM ").append(table.getTableName());
+        if (!CollectionUtils.isEmpty(request.getFilters())) {
+            sql.append(" WHERE ");
+            for (int index = 0; index < request.getFilters().size(); index++) {
+                DatacenterQueryFilter filter = request.getFilters().get(index);
+                if (index > 0) {
+                    sql.append(" AND ");
+                }
+                String operator = normalizeFilterOperator(filter.getOperator());
+                sql.append(filter.getColumn()).append(' ');
+                switch (operator) {
+                    case "IS_NULL" -> sql.append("IS NULL");
+                    case "IN" -> sql.append("IN (?)");
+                    default -> sql.append(operator).append(" ?");
+                }
+            }
+        }
+        if (!CollectionUtils.isEmpty(request.getSorts())) {
+            sql.append(" ORDER BY ");
+            for (int index = 0; index < request.getSorts().size(); index++) {
+                DatacenterQuerySort sort = request.getSorts().get(index);
+                if (index > 0) {
+                    sql.append(", ");
+                }
+                sql.append(sort.getColumn()).append(' ')
+                        .append("DESC".equalsIgnoreCase(sort.getDirection())
+                                ? "DESC" : "ASC");
+            }
+        }
+        return sql.toString();
+    }
+
+    /**
+     * 构建不包含实际值的结构化查询参数摘要。
+     *
+     * @param request 查询请求
+     * @return 脱敏参数摘要
+     */
+    private Map<String, Object> structuredParameterSummary(
+            DatacenterQueryRequest request) {
+        List<Map<String, Object>> filters = new ArrayList<>();
+        if (!CollectionUtils.isEmpty(request.getFilters())) {
+            for (DatacenterQueryFilter filter : request.getFilters()) {
+                String operator = normalizeFilterOperator(filter.getOperator());
+                int valueCount = "IN".equals(operator)
+                        ? (filter.getValues() == null ? 0 : filter.getValues().size())
+                        : "IS_NULL".equals(operator) ? 0 : 1;
+                filters.add(Map.of(
+                        "column", filter.getColumn(),
+                        "operator", operator,
+                        "valueCount", valueCount));
+            }
+        }
+        return Map.of(
+                "filters", List.copyOf(filters),
+                "pageNumber", request.getPageNumber(),
+                "pageSize", request.getPageSize());
+    }
+
+    /**
+     * 收集结构化查询实际引用的投影、筛选和排序字段。
+     *
+     * @param request 查询请求
+     * @return 去重后的字段列表
+     */
+    private List<String> structuredReferencedFields(
+            DatacenterQueryRequest request) {
+        Set<String> fields = new LinkedHashSet<>(request.getSelectedColumns());
+        if (!CollectionUtils.isEmpty(request.getFilters())) {
+            request.getFilters().stream()
+                    .map(DatacenterQueryFilter::getColumn)
+                    .forEach(fields::add);
+        }
+        if (!CollectionUtils.isEmpty(request.getSorts())) {
+            request.getSorts().stream()
+                    .map(DatacenterQuerySort::getColumn)
+                    .forEach(fields::add);
+        }
+        return List.copyOf(fields);
+    }
+
+    /**
+     * 将结构化筛选操作符归一化为审计中的稳定名称。
+     *
+     * @param operator 原始操作符
+     * @return 大写稳定操作符
+     */
+    private String normalizeFilterOperator(String operator) {
+        return trimToNull(operator) == null
+                ? "EQ" : operator.trim().toUpperCase(java.util.Locale.ROOT);
     }
 
     @Override
     public List<Row> queryBySql(DatacenterSqlQueryRequest request) {
         ResolvedSqlQuery query = resolveSqlQuery(request);
-        return query.connector.queryBySql(
-                query.source, query.sql);
+        if (isFederated(query.source)) {
+            DatacenterSqlConsoleResult result = federationQueryService.execute(
+                    query.source,
+                    query.sql,
+                    List.of(),
+                    1_000,
+                    null,
+                    "DATASET",
+                    request.getDatasetRef().getTableId() == null
+                            ? null : request.getDatasetRef().getTableId().toString());
+            if (result.truncated()) {
+                throw new BusinessException("数据集查询结果超过返回上限，请使用流式消费");
+            }
+            return toRows(result);
+        }
+        QueryId queryId = QueryId.create();
+        long startedNanos = System.nanoTime();
+        DatacenterQueryAudit audit = queryAuditService.start(
+                queryId.value(), query.source, query.sql, Map.of(), null,
+                "DATASET", request.getDatasetRef().getTableId().toString());
+        try {
+            List<Row> rows = query.connector.queryBySql(query.source, query.sql);
+            long durationMs = elapsedMillis(startedNanos);
+            queryAuditService.succeed(audit, query.referencedTables, List.of(),
+                    rows.size(), false, durationMs, durationMs);
+            return rows;
+        } catch (RuntimeException exception) {
+            queryAuditService.fail(audit, "DATASET_QUERY_FAILED", safeMessage(exception),
+                    query.referencedTables, List.of(), elapsedMillis(startedNanos));
+            throw exception;
+        }
     }
 
     /**
@@ -91,12 +307,38 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
     public void consumeBySql(
             DatacenterSqlQueryRequest request,
             int fetchSize,
+            LoginAccount account,
+            String requestedQueryId,
             Consumer<Row> consumer) {
         if (fetchSize <= 0 || consumer == null) {
             throw new IllegalArgumentException(
                     "fetchSize and consumer must be valid");
         }
-        ResolvedSqlQuery query = resolveSqlQuery(request);
+        ResolvedSqlQuery query = resolveSqlQuery(request, account);
+        if (isFederated(query.source)) {
+            int maxRows = Integer.getInteger(
+                    "easyflow.datacenter.query.max-rows", 1_000_000);
+            long maxBytes = Long.getLong(
+                    "easyflow.datacenter.query.max-bytes", 512L * 1024L * 1024L);
+            federationQueryService.consume(
+                    query.source,
+                    query.sql,
+                    List.of(),
+                    fetchSize,
+                    maxRows,
+                    maxBytes,
+                    account,
+                    "DATASET",
+                    request.getDatasetRef().getTableId() == null
+                            ? null : request.getDatasetRef().getTableId().toString(),
+                    requestedQueryId,
+                    sourceRow -> {
+                        Row row = new Row();
+                        sourceRow.forEach(row::put);
+                        consumer.accept(row);
+                    });
+            return;
+        }
         int maxRows = Integer.getInteger(
                 "easyflow.datacenter.query.max-rows",
                 1_000_000);
@@ -105,6 +347,12 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
                 512L * 1024L * 1024L);
         long[] accumulatedRows = {0L};
         long[] accumulatedBytes = {0L};
+        QueryId queryId = resolveQueryId(requestedQueryId);
+        long startedNanos = System.nanoTime();
+        DatacenterQueryAudit audit = queryAuditService.start(
+                queryId.value(), query.source, query.sql, Map.of(), account,
+                "DATASET", request.getDatasetRef().getTableId().toString());
+        try {
             query.connector.consumeBySql(
                     query.source,
                     query.sql,
@@ -133,6 +381,14 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
                         consumer.accept(row);
                     }
             );
+            long durationMs = elapsedMillis(startedNanos);
+            queryAuditService.succeed(audit, query.referencedTables, List.of(),
+                    accumulatedRows[0], false, durationMs, durationMs);
+        } catch (RuntimeException exception) {
+            queryAuditService.fail(audit, "DATASET_QUERY_FAILED", safeMessage(exception),
+                    query.referencedTables, List.of(), elapsedMillis(startedNanos));
+            throw exception;
+        }
     }
 
     /**
@@ -171,6 +427,19 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
      */
     private ResolvedSqlQuery resolveSqlQuery(
             DatacenterSqlQueryRequest request) {
+        return resolveSqlQuery(request, null);
+    }
+
+    /**
+     * 校验请求、执行账号租户并解析实际连接器与可执行 SQL。
+     *
+     * @param request SQL 查询请求
+     * @param account 后台执行账号；普通同步调用可为空
+     * @return 已解析查询
+     */
+    private ResolvedSqlQuery resolveSqlQuery(
+            DatacenterSqlQueryRequest request,
+            LoginAccount account) {
         if (request == null || request.getDatasetRef() == null) {
             throw new BusinessException("datasetRef 不能为空");
         }
@@ -183,8 +452,28 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
             throw new BusinessException("缺少连接服务配置");
         }
         DatacenterSource source = registryService.getSourceRequired(datasetRef.getSourceId());
+        BigInteger authoritativeTenantId = account != null && account.getTenantId() != null
+                ? account.getTenantId() : datasetRef.getTenantId();
+        if (authoritativeTenantId == null) {
+            throw new BusinessException("数据集绑定缺少租户信息");
+        }
+        if ((datasetRef.getTenantId() != null
+                && !datasetRef.getTenantId().equals(authoritativeTenantId))
+                || !authoritativeTenantId.equals(source.getTenantId())) {
+            throw new BusinessException("数据集不属于当前租户");
+        }
+        datasetRef.setTenantId(authoritativeTenantId);
         BigInteger catalogId = resolveRequestedCatalogId(datasetRef);
-        List<DatacenterTable> managedTables = registryService.listManagedTables(datasetRef.getSourceId(), catalogId);
+        if (datasetRef.getTableId() == null) {
+            throw new BusinessException("数据集 SQL 查询必须绑定具体表");
+        }
+        DatacenterTable boundTable = registryService.getTableWithFields(datasetRef.getTableId());
+        if (!datasetRef.getSourceId().equals(boundTable.getSourceId())
+                || (catalogId != null && !catalogId.equals(boundTable.getCatalogId()))
+                || !authoritativeTenantId.equals(boundTable.getTenantId())) {
+            throw new BusinessException("数据集引用与绑定表不一致");
+        }
+        List<DatacenterTable> managedTables = List.of(boundTable);
         if (CollectionUtils.isEmpty(managedTables)) {
             throw new BusinessException("当前连接下没有已接入表");
         }
@@ -198,12 +487,15 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         // 内部连接的 catalog 是逻辑命名空间，底层项目 MySQL 只执行物理表名。
         SqlSupportUtils.ResolvedSql resolvedSql =
                 connector instanceof AbstractInternalTableConnector
+                                || DatacenterSourceType.PROJECT_MYSQL.name()
+                                .equals(source.getSourceType())
                         ? SqlSupportUtils.resolveInternalMysql(sql, sqlTables)
                         : SqlSupportUtils.resolve(sql, sqlTables);
         return new ResolvedSqlQuery(
                 source,
                 connector,
-                resolvedSql.getExecutableSql());
+                isFederated(source) ? sql : resolvedSql.getExecutableSql(),
+                resolvedSql.getLogicalTables());
     }
 
     /**
@@ -212,30 +504,123 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
      * @param source 数据源
      * @param connector 数据连接器
      * @param sql 可执行 SQL
+     * @param referencedTables 已校验引用表
      */
     private record ResolvedSqlQuery(
             DatacenterSource source,
             DatacenterConnector connector,
-            String sql) {
+            String sql,
+            List<String> referencedTables) {
+    }
+
+    private long elapsedMillis(long startedNanos) {
+        return Math.max(0L, (System.nanoTime() - startedNanos) / 1_000_000L);
+    }
+
+    /**
+     * 校验调用方查询 UUID，内部连接也使用同一标识完成审计关联。
+     *
+     * @param requestedQueryId 调用方标识；为空时生成
+     * @return 查询标识
+     */
+    private QueryId resolveQueryId(String requestedQueryId) {
+        if (!StringUtils.hasText(requestedQueryId)) {
+            return QueryId.create();
+        }
+        try {
+            return new QueryId(UUID.fromString(
+                    requestedQueryId.trim()).toString());
+        } catch (IllegalArgumentException exception) {
+            throw new BusinessException("queryId 必须是 UUID");
+        }
+    }
+
+    private String safeMessage(RuntimeException exception) {
+        String message = exception.getMessage();
+        if (message == null || message.isBlank()) {
+            return "数据集查询失败";
+        }
+        return message.length() <= 500 ? message : message.substring(0, 500);
     }
 
     @Override
     public DatacenterSchemaResponse getSchema(DatasetRef datasetRef) {
+        return getSchema(datasetRef, null, null);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public DatacenterSchemaResponse getSchema(
+            DatasetRef datasetRef,
+            Long fieldPageNumber,
+            Long fieldPageSize) {
         DatacenterTable table = resolveTable(datasetRef);
+        List<DatacenterTableField> allFields = List.copyOf(table.getFields());
+        long actualPage = fieldPageNumber == null ? 1L : Math.max(1L, fieldPageNumber);
+        long actualSize = fieldPageSize == null
+                ? Math.max(1L, allFields.size())
+                : Math.min(200L, Math.max(1L, fieldPageSize));
+        List<DatacenterTableField> pageFields = sliceFields(
+                allFields, actualPage, actualSize);
+        long offset = safePageOffset(actualPage, actualSize);
+        boolean hasMoreFields = offset < allFields.size()
+                && offset + pageFields.size() < allFields.size();
+        // 字段只通过顶层分页字段返回，避免在 table 内重复序列化完整列表。
+        table.setFields(List.of());
         DatacenterSource source = registryService.getSourceRequired(table.getSourceId());
         DatacenterCatalog catalog = registryService.getCatalogById(table.getCatalogId());
         DatacenterSchemaResponse response = new DatacenterSchemaResponse();
         response.setDatasetRef(registryService.resolveDatasetRef(table.getId()));
-        response.setSource(source);
+        response.setSource(DatacenterSourceViews.from(source));
         response.setCatalog(catalog);
         response.setTable(table);
-        response.setFields(table.getFields());
+        response.setFields(pageFields);
+        response.setFieldPageNumber(actualPage);
+        response.setFieldPageSize(actualSize);
+        response.setHasMoreFields(hasMoreFields);
         response.setVersions(listVersions(table.getId()));
         response.setUpstreamLineage(listUpstream(table.getId()));
         response.setDownstreamLineage(listDownstream(table.getId()));
         return response;
     }
 
+    /**
+     * 截取字段页并避免向响应暴露可变子列表。
+     *
+     * @param fields 完整字段列表
+     * @param pageNumber 页码
+     * @param pageSize 页大小
+     * @return 当前页字段
+     */
+    private List<DatacenterTableField> sliceFields(
+            List<DatacenterTableField> fields,
+            long pageNumber,
+            long pageSize) {
+        long offset = safePageOffset(pageNumber, pageSize);
+        if (offset >= fields.size()) {
+            return List.of();
+        }
+        int fromIndex = Math.toIntExact(offset);
+        int toIndex = (int) Math.min((long) fields.size(), offset + pageSize);
+        return List.copyOf(fields.subList(fromIndex, toIndex));
+    }
+
+    /**
+     * 计算字段页偏移并防止长整型乘法溢出。
+     *
+     * @param pageNumber 页码
+     * @param pageSize 页大小
+     * @return 安全偏移；溢出时返回最大长整型
+     */
+    private long safePageOffset(long pageNumber, long pageSize) {
+        if (pageNumber - 1L > Long.MAX_VALUE / pageSize) {
+            return Long.MAX_VALUE;
+        }
+        return (pageNumber - 1L) * pageSize;
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -245,8 +630,8 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         DatacenterSchemaResponse response =
                 new DatacenterSchemaResponse();
         response.setDatasetRef(datasetRef);
-        response.setSource(
-                registryService.getSourceRequired(table.getSourceId()));
+        response.setSource(DatacenterSourceViews.from(
+                registryService.getSourceRequired(table.getSourceId())));
         response.setCatalog(
                 registryService.getCatalogById(table.getCatalogId()));
         response.setTable(table);
@@ -319,13 +704,29 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         DatacenterCatalog catalog = catalogId == null
                 ? null
                 : catalogsById.get(catalogId);
+        List<String> knownColumns = table.getFields().stream()
+                .filter(field -> DatacenterMetadataStatus.ACTIVE.name()
+                        .equals(field.getMetadataStatus()))
+                .map(this::sourceColumnName)
+                .toList();
+        List<String> queryableColumns = table.getFields().stream()
+                .filter(this::isQueryable)
+                .map(this::sourceColumnName)
+                .toList();
         return new SqlSupportUtils.ManagedTable(
                 catalog == null ? null : catalog.getCatalogName(),
                 table.getTableName(),
-                resolvePhysicalTableName(table)
+                resolvePhysicalTableName(table),
+                knownColumns,
+                queryableColumns
         );
     }
 
+    private String sourceColumnName(DatacenterTableField field) {
+        String sourceColumnName = trimToNull(field.getSourceColumnName());
+        return sourceColumnName == null ? field.getFieldName() : sourceColumnName;
+    }
+
     /**
      * 一次批量加载 SQL 白名单表关联的目录，避免逐表查询。
      *
@@ -367,6 +768,153 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         return actualTable != null ? actualTable : table.getTableName();
     }
 
+    /**
+     * 使用逻辑 Schema 构建参数化 ANSI SQL，再由 Calcite 转换为目标方言。
+     */
+    private Page<Row> queryFederatedPage(
+            DatacenterSource source,
+            DatacenterCatalog catalog,
+            DatacenterTable table,
+            DatacenterQueryRequest request,
+            LoginAccount account) {
+        if (catalog == null || catalog.getLogicalSchemaName() == null) {
+            throw new BusinessException("数据集缺少 Federation Schema 绑定");
+        }
+        if (request.getPageSize() > 500L) {
+            throw new BusinessException("外部数据源单页最多返回 500 行");
+        }
+        Map<String, DatacenterTableField> fields = table.getFields().stream()
+                .collect(Collectors.toMap(
+                        DatacenterTableField::getFieldName,
+                        Function.identity(),
+                        (first, ignored) -> first,
+                        LinkedHashMap::new));
+        FederatedWhere where = buildFederatedWhere(request.getFilters(), fields);
+        String from = quote(catalog.getLogicalSchemaName()) + "." + quote(table.getTableName());
+        String countSql = "SELECT COUNT(*) AS total FROM " + from + where.sql();
+        DatacenterSqlConsoleResult countResult = federationQueryService.execute(
+                source, countSql, where.parameters(), 1, account,
+                "DATASET", table.getId().toString());
+        long total = countResult.rows().isEmpty()
+                ? 0L : Long.parseLong(String.valueOf(countResult.rows().get(0).get("c1")));
+
+        if (total == 0L) {
+            return new Page<>(List.of(), request.getPageNumber(), request.getPageSize(), 0L);
+        }
+        String columns = request.getSelectedColumns().stream()
+                .map(name -> quote(requireField(fields, name).getSourceColumnName()))
+                .collect(Collectors.joining(", "));
+        String orderBy = buildFederatedOrderBy(request.getSorts(), fields);
+        long offset = (request.getPageNumber() - 1L) * request.getPageSize();
+        String pageSql = "SELECT " + columns + " FROM " + from + where.sql() + orderBy
+                + " OFFSET " + offset + " ROWS FETCH NEXT " + request.getPageSize() + " ROWS ONLY";
+        DatacenterSqlConsoleResult pageResult = federationQueryService.execute(
+                source, pageSql, where.parameters(), request.getPageSize().intValue(),
+                account, "DATASET", table.getId().toString());
+        return new Page<>(toRows(pageResult), request.getPageNumber(), request.getPageSize(), total);
+    }
+
+    private FederatedWhere buildFederatedWhere(
+            List<DatacenterQueryFilter> filters,
+            Map<String, DatacenterTableField> fields) {
+        if (CollectionUtils.isEmpty(filters)) {
+            return new FederatedWhere("", List.of());
+        }
+        StringBuilder sql = new StringBuilder(" WHERE 1 = 1");
+        List<SqlParameter> parameters = new ArrayList<>();
+        for (DatacenterQueryFilter filter : filters) {
+            DatacenterTableField field = requireField(fields, filter.getColumn());
+            String column = quote(field.getSourceColumnName());
+            String operator = trimToNull(filter.getOperator()) == null
+                    ? "EQ" : filter.getOperator().trim().toUpperCase(java.util.Locale.ROOT);
+            switch (operator) {
+                case "EQ", "GT", "GTE", "LT", "LTE", "LIKE" -> {
+                    String sqlOperator = switch (operator) {
+                        case "GT" -> ">";
+                        case "GTE" -> ">=";
+                        case "LT" -> "<";
+                        case "LTE" -> "<=";
+                        case "LIKE" -> "LIKE";
+                        default -> "=";
+                    };
+                    sql.append(" AND ").append(column).append(' ').append(sqlOperator).append(" ?");
+                    Object value = "LIKE".equals(operator)
+                            ? "%" + filter.getValue() + "%" : filter.getValue();
+                    parameters.add(parameter(field, value));
+                }
+                case "IS_NULL" -> sql.append(" AND ").append(column).append(" IS NULL");
+                case "IN" -> {
+                    List<Object> values = filter.getValues() == null ? List.of() : filter.getValues();
+                    if (values.isEmpty()) {
+                        sql.append(" AND 1 = 0");
+                    } else {
+                        sql.append(" AND ").append(column).append(" IN (")
+                                .append(values.stream().map(ignored -> "?").collect(Collectors.joining(",")))
+                                .append(')');
+                        values.forEach(value -> parameters.add(parameter(field, value)));
+                    }
+                }
+                default -> throw new BusinessException("不支持的过滤操作: " + operator);
+            }
+        }
+        return new FederatedWhere(sql.toString(), List.copyOf(parameters));
+    }
+
+    private String buildFederatedOrderBy(
+            List<DatacenterQuerySort> sorts,
+            Map<String, DatacenterTableField> fields) {
+        if (CollectionUtils.isEmpty(sorts)) {
+            return "";
+        }
+        return " ORDER BY " + sorts.stream()
+                .map(sort -> quote(requireField(fields, sort.getColumn()).getSourceColumnName())
+                        + ("DESC".equalsIgnoreCase(sort.getDirection()) ? " DESC" : " ASC"))
+                .collect(Collectors.joining(", "));
+    }
+
+    private DatacenterTableField requireField(
+            Map<String, DatacenterTableField> fields,
+            String name) {
+        DatacenterTableField field = fields.get(name);
+        if (field == null || !isEnabled(field.getQueryable())) {
+            throw new BusinessException("字段不可查询: " + name);
+        }
+        return field;
+    }
+
+    private SqlParameter parameter(DatacenterTableField field, Object value) {
+        int jdbcType = field.getJdbcTypeCode() == null ? Types.VARCHAR : field.getJdbcTypeCode();
+        return value == null ? new SqlParameter(jdbcType, null) : new SqlParameter(jdbcType, value);
+    }
+
+    private String quote(String identifier) {
+        if (!StringUtils.hasText(identifier)) {
+            throw new BusinessException("数据集物理名称为空");
+        }
+        return '"' + identifier.replace("\"", "\"\"") + '"';
+    }
+
+    private List<Row> toRows(DatacenterSqlConsoleResult result) {
+        List<Row> rows = new ArrayList<>(result.rows().size());
+        for (Map<String, Object> sourceRow : result.rows()) {
+            Row row = new Row();
+            for (int index = 0; index < result.columns().size(); index++) {
+                var column = result.columns().get(index);
+                row.put(column.label(), sourceRow.get(column.key()));
+            }
+            rows.add(row);
+        }
+        return rows;
+    }
+
+    private boolean isFederated(DatacenterSource source) {
+        return source != null && (DatacenterSourceType.MYSQL.name().equals(source.getSourceType())
+                || DatacenterSourceType.POSTGRESQL.name().equals(source.getSourceType()));
+    }
+
+    private record FederatedWhere(String sql, List<SqlParameter> parameters) {
+    }
+
     private void normalizePage(DatacenterQueryRequest request) {
         if (request.getPageNumber() == null || request.getPageNumber() < 1L) {
             request.setPageNumber(1L);
@@ -374,6 +922,9 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         if (request.getPageSize() == null || request.getPageSize() < 1L) {
             throw new BusinessException("pageSize 必须大于 0");
         }
+        if (request.getPageSize() > 500L) {
+            throw new BusinessException("单页最多返回 500 行");
+        }
     }
 
     private DatacenterTable resolveQueryTable(DatacenterTable table, DatasetRef datasetRef) {
@@ -400,7 +951,7 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         return queryTable;
     }
 
-    private void validateRequest(DatacenterTable table, DatacenterQueryRequest request, DatacenterSource source) {
+    private void validateRequest(DatacenterTable table, DatacenterQueryRequest request) {
         Map<String, DatacenterTableField> fieldMap = new LinkedHashMap<>();
         for (DatacenterTableField field : table.getFields()) {
             fieldMap.put(field.getFieldName(), field);
@@ -408,22 +959,25 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         if (!CollectionUtils.isEmpty(request.getSelectedColumns())) {
             for (String column : request.getSelectedColumns()) {
                 DatacenterTableField field = fieldMap.get(column);
-                if (field == null || !isEnabled(field.getQueryable())) {
+                if (field == null || !isQueryable(field)) {
                     throw new BusinessException("字段不可查询: " + column);
                 }
             }
         } else {
             request.setSelectedColumns(
                     table.getFields().stream()
-                            .filter(field -> isEnabled(field.getQueryable()))
+                            .filter(this::isQueryable)
                             .map(DatacenterTableField::getFieldName)
                             .toList()
             );
         }
+        if (CollectionUtils.isEmpty(request.getSelectedColumns())) {
+            throw new BusinessException("当前数据集没有可查询字段");
+        }
         if (!CollectionUtils.isEmpty(request.getFilters())) {
             request.getFilters().forEach(filter -> {
                 DatacenterTableField field = fieldMap.get(filter.getColumn());
-                if (field == null || !isEnabled(field.getQueryable())) {
+                if (field == null || !isQueryable(field)) {
                     throw new BusinessException("字段不可过滤: " + filter.getColumn());
                 }
             });
@@ -431,18 +985,13 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         if (!CollectionUtils.isEmpty(request.getSorts())) {
             request.getSorts().forEach(sort -> {
                 DatacenterTableField field = fieldMap.get(sort.getColumn());
-                if (field == null || !isEnabled(field.getSortable())) {
+                if (field == null || !isQueryable(field) || !isEnabled(field.getSortable())) {
                     throw new BusinessException("字段不可排序: " + sort.getColumn());
                 }
             });
         }
         if (request.getWhere() != null && !request.getWhere().isBlank()) {
-            boolean allowLegacyWhere = "PROJECT_MYSQL".equals(source.getSourceType())
-                    || "MYSQL".equals(source.getSourceType())
-                    || "POSTGRESQL".equals(source.getSourceType());
-            if (!allowLegacyWhere) {
-                throw new BusinessException("当前数据源仅支持结构化 DSL 查询");
-            }
+            throw new BusinessException("不支持原始 WHERE 条件，请使用结构化筛选条件");
         }
     }
 
@@ -450,6 +999,13 @@ public class DatacenterDatasetQueryServiceImpl implements DatacenterDatasetQuery
         return value == null || value == 1;
     }
 
+    private boolean isQueryable(DatacenterTableField field) {
+        return field != null
+                && isEnabled(field.getQueryable())
+                && DatacenterMetadataStatus.ACTIVE.name().equals(field.getMetadataStatus())
+                && DatacenterSensitivityLevel.PUBLIC.name().equals(field.getSensitivityLevel());
+    }
+
     private String trimToNull(String value) {
         if (!StringUtils.hasText(value)) {
             return null;

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/execution/service/impl/DatacenterDatasetWriteServiceImpl.java

@@ -38,7 +38,7 @@ public class DatacenterDatasetWriteServiceImpl implements DatacenterDatasetWrite
      */
     @Override
     public void saveRow(DatasetRef datasetRef, JSONObject data, LoginAccount account) {
-        DatacenterTable table = resolveTable(datasetRef);
+        DatacenterTable table = resolveTable(datasetRef, account);
         DatacenterSource source = registryService.getSourceRequired(table.getSourceId());
         DatacenterConnector connector = connectorRegistry.getConnector(source.getSourceType());
         connector.saveRow(source, table, data, account);
@@ -52,7 +52,7 @@ public class DatacenterDatasetWriteServiceImpl implements DatacenterDatasetWrite
         if (rows == null || rows.isEmpty()) {
             return;
         }
-        DatacenterTable table = resolveTable(datasetRef);
+        DatacenterTable table = resolveTable(datasetRef, account);
         DatacenterSource source = registryService.getSourceRequired(table.getSourceId());
         DatacenterConnector connector = connectorRegistry.getConnector(source.getSourceType());
         connector.saveRows(source, table, rows, account, Math.max(1, batchSize));
@@ -70,7 +70,7 @@ public class DatacenterDatasetWriteServiceImpl implements DatacenterDatasetWrite
         if (rows == null || rows.isEmpty()) {
             return true;
         }
-        DatacenterTable table = resolveTable(datasetRef);
+        DatacenterTable table = resolveTable(datasetRef, account);
         DatacenterSource source = registryService.getSourceRequired(table.getSourceId());
         DatacenterConnector connector = connectorRegistry.getConnector(source.getSourceType());
         String payloadHash = sha256Rows(rows);
@@ -95,17 +95,27 @@ public class DatacenterDatasetWriteServiceImpl implements DatacenterDatasetWrite
      */
     @Override
     public void deleteRow(DatasetRef datasetRef, BigInteger id, LoginAccount account) {
-        DatacenterTable table = resolveTable(datasetRef);
+        DatacenterTable table = resolveTable(datasetRef, account);
         DatacenterSource source = registryService.getSourceRequired(table.getSourceId());
         DatacenterConnector connector = connectorRegistry.getConnector(source.getSourceType());
         connector.deleteRow(source, table, id, account);
     }
 
-    private DatacenterTable resolveTable(DatasetRef datasetRef) {
+    private DatacenterTable resolveTable(DatasetRef datasetRef, LoginAccount account) {
         if (datasetRef == null || datasetRef.getTableId() == null) {
             throw new BusinessException("缺少 tableId");
         }
-        return registryService.getTableWithFields(datasetRef.getTableId());
+        if (account == null || account.getTenantId() == null) {
+            throw new BusinessException("数据集写入缺少执行租户");
+        }
+        DatacenterTable table = registryService.getTableWithFields(datasetRef.getTableId());
+        if (!account.getTenantId().equals(table.getTenantId())
+                || (datasetRef.getTenantId() != null
+                && !account.getTenantId().equals(datasetRef.getTenantId()))) {
+            throw new BusinessException("数据集不属于当前租户");
+        }
+        datasetRef.setTenantId(account.getTenantId());
+        return table;
     }
 
     /**

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationAdmissionController.java

@@ -0,0 +1,308 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.api.FederationSqlErrorCode;
+import com.easyagents.federation.sql.api.FederationSqlException;
+import com.easyagents.federation.sql.execute.FederationQueryAdmissionController;
+import com.easyagents.federation.sql.execute.FederationQueryPermit;
+import com.easyagents.federation.sql.execute.LocalFederationQueryAdmissionController;
+import com.easyagents.federation.sql.execute.QueryId;
+import com.easyagents.federation.sql.source.SourceId;
+import java.time.Duration;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.BooleanSupplier;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+/**
+ * 对查询执行租户、数据源与节点三级本地并发准入。
+ */
+@Component
+public class DatacenterFederationAdmissionController
+        implements FederationQueryAdmissionController {
+
+    private final LocalFederationQueryAdmissionController globalAdmission;
+    private final int maximumConcurrentQueriesPerTenant;
+    private final int maximumConcurrentQueriesPerSource;
+    private final Map<String, AdmissionEntry>
+            tenantAdmissions = new ConcurrentHashMap<>();
+    private final Map<SourceId, AdmissionEntry>
+            sourceAdmissions = new ConcurrentHashMap<>();
+    private final Object lifecycleLock = new Object();
+    private final AtomicBoolean closed = new AtomicBoolean();
+
+    /**
+     * 创建三级准入控制器。
+     *
+     * @param maximumConcurrentQueries 节点查询上限
+     * @param maximumConcurrentQueriesPerTenant 单租户查询上限
+     * @param maximumConcurrentQueriesPerSource 单数据源查询上限
+     */
+    public DatacenterFederationAdmissionController(
+            @Value("${easyflow.datacenter.query-admission.maximum-concurrent-queries:64}")
+            int maximumConcurrentQueries,
+            @Value("${easyflow.datacenter.query-admission.maximum-concurrent-queries-per-tenant:20}")
+            int maximumConcurrentQueriesPerTenant,
+            @Value("${easyflow.datacenter.query-admission.maximum-concurrent-queries-per-source:10}")
+            int maximumConcurrentQueriesPerSource) {
+        if (maximumConcurrentQueries <= 0
+                || maximumConcurrentQueriesPerTenant <= 0
+                || maximumConcurrentQueriesPerSource <= 0) {
+            throw new IllegalArgumentException(
+                    "query admission limits must be positive");
+        }
+        this.globalAdmission = new LocalFederationQueryAdmissionController(
+                maximumConcurrentQueries);
+        this.maximumConcurrentQueriesPerTenant =
+                maximumConcurrentQueriesPerTenant;
+        this.maximumConcurrentQueriesPerSource =
+                maximumConcurrentQueriesPerSource;
+    }
+
+    /**
+     * 获取三级查询许可。
+     *
+     * @param sourceId 数据源标识
+     * @param queryId 查询标识
+     * @param timeout 最大等待时间
+     * @return 查询许可
+     */
+    @Override
+    public FederationQueryPermit acquire(
+            SourceId sourceId,
+            QueryId queryId,
+            Duration timeout) {
+        return acquire(sourceId, queryId, timeout, () -> false);
+    }
+
+    /**
+     * 按数据源、租户、节点顺序获取许可，避免热点连接池等待占满全局配额。
+     *
+     * @param sourceId 数据源标识
+     * @param queryId 查询标识
+     * @param timeout 最大等待时间
+     * @param cancellationRequested 查询取消状态
+     * @return 查询许可
+     */
+    @Override
+    public FederationQueryPermit acquire(
+            SourceId sourceId,
+            QueryId queryId,
+            Duration timeout,
+            BooleanSupplier cancellationRequested) {
+        long started = System.nanoTime();
+        String tenantKey = tenantKey(sourceId);
+        AdmissionEntry sourceEntry;
+        AdmissionEntry tenantEntry;
+        synchronized (lifecycleLock) {
+            ensureOpen();
+            sourceEntry = retain(sourceAdmissions, sourceId,
+                    maximumConcurrentQueriesPerSource);
+            tenantEntry = retain(tenantAdmissions, tenantKey,
+                    maximumConcurrentQueriesPerTenant);
+        }
+        FederationQueryPermit sourcePermit = null;
+        FederationQueryPermit tenantPermit = null;
+        FederationQueryPermit globalPermit = null;
+        try {
+            sourcePermit = sourceEntry.controller.acquire(
+                    sourceId, queryId, remaining(timeout, started),
+                    cancellationRequested);
+            tenantPermit = tenantEntry.controller.acquire(
+                    sourceId, queryId, remaining(timeout, started),
+                    cancellationRequested);
+            globalPermit = globalAdmission.acquire(
+                    sourceId, queryId, remaining(timeout, started),
+                    cancellationRequested);
+            FederationQueryPermit acquiredSource = sourcePermit;
+            FederationQueryPermit acquiredTenant = tenantPermit;
+            FederationQueryPermit acquiredGlobal = globalPermit;
+            AtomicBoolean released = new AtomicBoolean();
+            return () -> {
+                if (released.compareAndSet(false, true)) {
+                    try {
+                        acquiredGlobal.close();
+                    } finally {
+                        try {
+                            acquiredTenant.close();
+                        } finally {
+                            try {
+                                acquiredSource.close();
+                            } finally {
+                                releaseEntries(
+                                        sourceId, sourceEntry,
+                                        tenantKey, tenantEntry);
+                            }
+                        }
+                    }
+                }
+            };
+        } catch (RuntimeException exception) {
+            closeQuietly(globalPermit);
+            closeQuietly(tenantPermit);
+            closeQuietly(sourcePermit);
+            releaseEntries(sourceId, sourceEntry, tenantKey, tenantEntry);
+            throw exception;
+        }
+    }
+
+    /**
+     * 关闭全部准入控制器并唤醒等待线程。
+     */
+    @Override
+    public void close() {
+        synchronized (lifecycleLock) {
+            if (!closed.compareAndSet(false, true)) {
+                return;
+            }
+            globalAdmission.close();
+            tenantAdmissions.values().forEach(
+                    entry -> entry.controller.close());
+            sourceAdmissions.values().forEach(
+                    entry -> entry.controller.close());
+            tenantAdmissions.clear();
+            sourceAdmissions.clear();
+        }
+    }
+
+    private Duration remaining(Duration timeout, long started) {
+        if (timeout == null || timeout.isZero() || timeout.isNegative()) {
+            return Duration.ZERO;
+        }
+        long remaining = timeout.toNanos() - (System.nanoTime() - started);
+        return remaining <= 0L ? Duration.ZERO : Duration.ofNanos(remaining);
+    }
+
+    private String tenantKey(SourceId sourceId) {
+        String value = sourceId == null ? "" : sourceId.value();
+        int marker = value.lastIndexOf("-source-");
+        return marker <= 0 ? value : value.substring(0, marker);
+    }
+
+    /**
+     * 获取或创建分层准入项并登记一个活动查询或等待者。
+     *
+     * @param admissions 准入项映射
+     * @param key 租户或数据源键
+     * @param maximumConcurrentQueries 并发上限
+     * @param <K> 键类型
+     * @return 已登记引用的准入项
+     */
+    private <K> AdmissionEntry retain(
+            Map<K, AdmissionEntry> admissions,
+            K key,
+            int maximumConcurrentQueries) {
+        AdmissionEntry entry = admissions.computeIfAbsent(
+                key,
+                ignored -> new AdmissionEntry(
+                        new LocalFederationQueryAdmissionController(
+                                maximumConcurrentQueries)));
+        entry.references++;
+        return entry;
+    }
+
+    /**
+     * 同步释放数据源与租户准入项引用。
+     *
+     * @param sourceId 数据源标识
+     * @param sourceEntry 数据源准入项
+     * @param tenantKey 租户键
+     * @param tenantEntry 租户准入项
+     */
+    private void releaseEntries(
+            SourceId sourceId,
+            AdmissionEntry sourceEntry,
+            String tenantKey,
+            AdmissionEntry tenantEntry) {
+        synchronized (lifecycleLock) {
+            release(sourceAdmissions, sourceId, sourceEntry);
+            release(tenantAdmissions, tenantKey, tenantEntry);
+        }
+    }
+
+    /**
+     * 释放一个准入项引用，并在无查询或等待者时移除并关闭该项。
+     *
+     * @param admissions 准入项映射
+     * @param key 租户或数据源键
+     * @param entry 待释放准入项
+     * @param <K> 键类型
+     */
+    private <K> void release(
+            Map<K, AdmissionEntry> admissions,
+            K key,
+            AdmissionEntry entry) {
+        entry.references--;
+        if (entry.references < 0) {
+            throw new IllegalStateException(
+                    "query admission reference count became negative");
+        }
+        if (entry.references == 0 && admissions.remove(key, entry)) {
+            entry.controller.close();
+        }
+    }
+
+    /**
+     * 返回当前仍有查询或等待者的数据源准入项数量。
+     *
+     * @return 活动数据源准入项数量
+     */
+    int trackedSourceAdmissionCount() {
+        return sourceAdmissions.size();
+    }
+
+    /**
+     * 返回当前仍有查询或等待者的租户准入项数量。
+     *
+     * @return 活动租户准入项数量
+     */
+    int trackedTenantAdmissionCount() {
+        return tenantAdmissions.size();
+    }
+
+    /**
+     * 返回指定数据源当前活动查询与等待者的引用总数。
+     *
+     * @param sourceId 数据源标识
+     * @return 当前引用数
+     */
+    int trackedSourceReferenceCount(SourceId sourceId) {
+        synchronized (lifecycleLock) {
+            AdmissionEntry entry = sourceAdmissions.get(sourceId);
+            return entry == null ? 0 : entry.references;
+        }
+    }
+
+    private void ensureOpen() {
+        if (closed.get()) {
+            throw new FederationSqlException(
+                    FederationSqlErrorCode.ENGINE_CLOSED,
+                    "datacenter query admission controller is closed");
+        }
+    }
+
+    private void closeQuietly(FederationQueryPermit permit) {
+        if (permit != null) {
+            permit.close();
+        }
+    }
+
+    /**
+     * 共享公平信号量及其活动查询、等待者引用计数。
+     */
+    private static final class AdmissionEntry {
+
+        private final LocalFederationQueryAdmissionController controller;
+        private int references;
+
+        /**
+         * 创建准入项。
+         *
+         * @param controller 本地公平准入控制器
+         */
+        private AdmissionEntry(LocalFederationQueryAdmissionController controller) {
+            this.controller = controller;
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationChangeNotifier.java

@@ -0,0 +1,70 @@
+package tech.easyflow.datacenter.federation;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.support.TransactionSynchronization;
+import org.springframework.transaction.support.TransactionSynchronizationManager;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+
+/**
+ * 发布不含凭据的 Federation Definition 变更提示。
+ */
+@Component
+public class DatacenterFederationChangeNotifier {
+
+    /** Redis Pub/Sub 频道。 */
+    public static final String CHANNEL = "easyflow:datacenter:federation-source-changed";
+
+    private static final Logger log = LoggerFactory.getLogger(DatacenterFederationChangeNotifier.class);
+
+    private final ObjectProvider<StringRedisTemplate> redisTemplateProvider;
+    private final DatacenterFederationDefinitionFactory definitionFactory;
+
+    /**
+     * 创建通知器。
+     *
+     * @param redisTemplateProvider 可选 Redis 模板
+     * @param definitionFactory Definition 工厂
+     */
+    public DatacenterFederationChangeNotifier(
+            ObjectProvider<StringRedisTemplate> redisTemplateProvider,
+            DatacenterFederationDefinitionFactory definitionFactory) {
+        this.redisTemplateProvider = redisTemplateProvider;
+        this.definitionFactory = definitionFactory;
+    }
+
+    /**
+     * 在当前事务提交后发布 SourceId；无 Redis 时不影响数据库权威状态。
+     *
+     * @param source 已提交或即将提交的数据源
+     */
+    public void publishAfterCommit(DatacenterSource source) {
+        String sourceId = definitionFactory.sourceId(source).value();
+        if (TransactionSynchronizationManager.isSynchronizationActive()) {
+            TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronization() {
+                @Override
+                public void afterCommit() {
+                    publish(sourceId);
+                }
+            });
+            return;
+        }
+        publish(sourceId);
+    }
+
+    private void publish(String sourceId) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return;
+        }
+        try {
+            redisTemplate.convertAndSend(CHANNEL, sourceId);
+        } catch (RuntimeException exception) {
+            // Redis 仅缩短传播时间；数据库按需读取继续保证 minimumRevision 正确性。
+            log.warn("Failed to publish datacenter source change hint for {}", sourceId, exception);
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationDataSourceFactory.java

@@ -0,0 +1,64 @@
+package tech.easyflow.datacenter.federation;
+
+import com.zaxxer.hikari.HikariConfig;
+import com.zaxxer.hikari.HikariDataSource;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.security.DatacenterCredentialCipher;
+
+/**
+ * 创建由 Federation Runtime 独占的只读 HikariCP 连接池。
+ */
+@Component
+public class DatacenterFederationDataSourceFactory {
+
+    private final DatacenterCredentialCipher credentialCipher;
+    private final int maximumPoolSize;
+
+    /**
+     * 创建数据源工厂。
+     *
+     * @param credentialCipher 凭据解密器
+     * @param maximumPoolSize 单数据源连接池上限，与单源查询准入共用配置
+     */
+    public DatacenterFederationDataSourceFactory(
+            DatacenterCredentialCipher credentialCipher,
+            @Value("${easyflow.datacenter.connection-pool.maximum-size:10}")
+            int maximumPoolSize) {
+        if (maximumPoolSize <= 0) {
+            throw new IllegalArgumentException(
+                    "datacenter connection pool maximum size must be positive");
+        }
+        this.credentialCipher = credentialCipher;
+        this.maximumPoolSize = maximumPoolSize;
+    }
+
+    /**
+     * 根据持久化数据源快照创建只读池。
+     *
+     * @param source 数据源快照
+     * @return 未共享的 HikariCP 池
+     */
+    public HikariDataSource create(DatacenterSource source) {
+        HikariConfig config = new HikariConfig();
+        config.setPoolName("dc-fed-" + source.getId() + "-r" + source.getDefinitionRevision());
+        config.setJdbcUrl(source.getJdbcUrl());
+        config.setUsername(source.getUsername());
+        config.setPassword(credentialCipher.decrypt(source.getCredentialCipher()));
+        if (source.getDriverClassName() != null && !source.getDriverClassName().isBlank()) {
+            config.setDriverClassName(source.getDriverClassName());
+        }
+        config.setReadOnly(true);
+        config.setAutoCommit(true);
+        config.setMaximumPoolSize(maximumPoolSize);
+        config.setMinimumIdle(Integer.getInteger("easyflow.datacenter.pool.minimum-idle", 0));
+        config.setConnectionTimeout(Long.getLong("easyflow.datacenter.pool.connection-timeout-ms", 5_000L));
+        config.setValidationTimeout(Long.getLong("easyflow.datacenter.pool.validation-timeout-ms", 3_000L));
+        config.setIdleTimeout(Long.getLong("easyflow.datacenter.pool.idle-timeout-ms", 600_000L));
+        config.setMaxLifetime(Long.getLong("easyflow.datacenter.pool.max-lifetime-ms", 1_800_000L));
+        config.setInitializationFailTimeout(
+                Long.getLong("easyflow.datacenter.pool.initialization-timeout-ms", 5_000L));
+        return new HikariDataSource(config);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationDataSourceResolver.java

@@ -0,0 +1,140 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.source.FederationDataSourceHandle;
+import com.easyagents.federation.sql.source.FederationDataSourceHandles;
+import com.easyagents.federation.sql.source.FederationDataSourceResolver;
+import com.easyagents.federation.sql.source.FederationSourceDefinition;
+import com.easyagents.federation.sql.source.RuntimeFingerprint;
+import com.zaxxer.hikari.HikariDataSource;
+import java.sql.Connection;
+import java.sql.DatabaseMetaData;
+import java.sql.SQLException;
+import java.util.Objects;
+import java.util.function.Supplier;
+import org.springframework.stereotype.Component;
+import tech.easyflow.datacenter.mapper.DatacenterSourceMapper;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
+
+/**
+ * 从 EasyFlow 权威配置解析节点本地 Federation DataSource Handle。
+ */
+@Component
+public class DatacenterFederationDataSourceResolver implements FederationDataSourceResolver {
+
+    private final DatacenterSourceMapper sourceMapper;
+    private final DatacenterFederationDefinitionFactory definitionFactory;
+    private final DatacenterFederationDataSourceFactory dataSourceFactory;
+    private final ThreadLocal<CandidateResolution> candidateSource = new ThreadLocal<>();
+
+    /**
+     * 创建 Resolver。
+     *
+     * @param sourceMapper 数据源 Mapper
+     * @param definitionFactory Definition 工厂
+     * @param dataSourceFactory 连接池工厂
+     */
+    public DatacenterFederationDataSourceResolver(
+            DatacenterSourceMapper sourceMapper,
+            DatacenterFederationDefinitionFactory definitionFactory,
+            DatacenterFederationDataSourceFactory dataSourceFactory) {
+        this.sourceMapper = sourceMapper;
+        this.definitionFactory = definitionFactory;
+        this.dataSourceFactory = dataSourceFactory;
+    }
+
+    /**
+     * 创建由 Runtime 独占并在 revision 淘汰后关闭的 Handle。
+     *
+     * @param definition 无凭据 Definition
+     * @return 独占 Handle
+     */
+    @Override
+    public FederationDataSourceHandle resolve(FederationSourceDefinition definition) {
+        CandidateResolution candidate = candidateSource.get();
+        DatacenterSource source = candidate != null
+                && Objects.equals(candidate.source().getId(), definitionFactory.sourceRecordId(definition))
+                ? candidate.source() : sourceMapper.selectOneById(definitionFactory.sourceRecordId(definition));
+        if (source == null) {
+            throw new IllegalStateException("data source no longer exists");
+        }
+        DatacenterSourceStatus status = DatacenterSourceStatus.fromCode(source.getStatus());
+        boolean draftProbe = status == DatacenterSourceStatus.DRAFT;
+        if (!draftProbe
+                && status != DatacenterSourceStatus.READY
+                && status != DatacenterSourceStatus.DEGRADED) {
+            throw new IllegalStateException("data source cannot be resolved in its current state");
+        }
+        if (!definition.sourceId().equals(definitionFactory.sourceId(source))) {
+            throw new IllegalStateException("data source tenant identity does not match definition");
+        }
+        long revision = source.getDefinitionRevision() == null ? 0L : source.getDefinitionRevision();
+        if (revision != definition.revision()) {
+            throw new IllegalStateException("data source revision changed while runtime was resolving");
+        }
+        FederationSourceDefinition currentDefinition = candidate != null
+                ? candidate.definition()
+                : definitionFactory.create(source);
+        if (!currentDefinition.checksum().equals(definition.checksum())) {
+            throw new IllegalStateException("data source definition checksum mismatch");
+        }
+        // 草稿只通过 probe 创建短生命周期连接池，尚未发布持久化 checksum；
+        // READY/DEGRADED Runtime 必须同时匹配已发布 checksum。
+        if (!draftProbe && (source.getDefinitionChecksum() == null
+                || !source.getDefinitionChecksum().equals(definition.checksum()))) {
+            throw new IllegalStateException("published data source definition checksum mismatch");
+        }
+        HikariDataSource pool = dataSourceFactory.create(source);
+        try (Connection connection = pool.getConnection()) {
+            DatabaseMetaData metadata = connection.getMetaData();
+            RuntimeFingerprint fingerprint = new RuntimeFingerprint(
+                    metadata.getDatabaseProductName(),
+                    metadata.getDatabaseProductVersion(),
+                    metadata.getDriverName(),
+                    metadata.getDriverVersion(),
+                    "easyflow-xl01-wp1");
+            return FederationDataSourceHandles.owned(pool, fingerprint, pool::close);
+        } catch (SQLException | RuntimeException exception) {
+            try {
+                pool.close();
+            } catch (RuntimeException closeException) {
+                exception.addSuppressed(closeException);
+            }
+            throw new IllegalStateException("failed to initialize data source runtime", exception);
+        }
+    }
+
+    /**
+     * 在当前线程内使用未发布的候选配置完成一次 XL15 probe。
+     *
+     * <p>候选配置不会进入共享状态、Redis 或持久化记录，并在操作结束后立即移除。</p>
+     *
+     * @param source 已完成凭据加密和连接归一化的候选配置
+     * @param action 需要解析候选配置的同步操作
+     * @param <T> 操作结果类型
+     * @return 操作结果
+     * @throws IllegalStateException 当前线程已经存在候选配置时抛出
+     */
+    public <T> T withCandidate(
+            DatacenterSource source,
+            FederationSourceDefinition definition,
+            Supplier<T> action) {
+        Objects.requireNonNull(source, "source");
+        Objects.requireNonNull(definition, "definition");
+        Objects.requireNonNull(action, "action");
+        if (candidateSource.get() != null) {
+            throw new IllegalStateException("nested data source candidate resolution is not supported");
+        }
+        candidateSource.set(new CandidateResolution(source, definition));
+        try {
+            return action.get();
+        } finally {
+            candidateSource.remove();
+        }
+    }
+
+    private record CandidateResolution(
+            DatacenterSource source,
+            FederationSourceDefinition definition) {
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationDefinitionFactory.java

@@ -0,0 +1,208 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.adapter.jdbc.JdbcFederationSqlAdapterProvider;
+import com.easyagents.federation.sql.adapter.jdbc.JdbcSchemaDefinition;
+import com.easyagents.federation.sql.source.FederationSourceDefinition;
+import com.easyagents.federation.sql.source.SourceId;
+import com.mybatisflex.core.query.QueryWrapper;
+import java.math.BigInteger;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+import org.springframework.stereotype.Component;
+import tech.easyflow.datacenter.mapper.DatacenterCatalogMapper;
+import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceType;
+
+/**
+ * 将 EasyFlow 持久化数据源快照转换为无凭据 Federation Definition。
+ */
+@Component
+public class DatacenterFederationDefinitionFactory {
+
+    /** Definition 中用于解析业务数据源主键的选项。 */
+    public static final String SOURCE_RECORD_ID_OPTION = "sourceRecordId";
+
+    private final DatacenterCatalogMapper catalogMapper;
+
+    /**
+     * 创建 Definition 工厂。
+     *
+     * @param catalogMapper 命名空间 Mapper
+     */
+    public DatacenterFederationDefinitionFactory(DatacenterCatalogMapper catalogMapper) {
+        this.catalogMapper = catalogMapper;
+    }
+
+    /**
+     * 创建用于探测或执行的 Definition。
+     *
+     * @param source 数据源当前快照
+     * @return 无凭据 Definition
+     * @throws IllegalArgumentException 数据源不是当前 JDBC 支持类型
+     */
+    public FederationSourceDefinition create(DatacenterSource source) {
+        return create(source, loadCatalogs(source));
+    }
+
+    /**
+     * 为尚未发布的连接候选创建只包含默认命名空间的 Definition。
+     *
+     * @param source 候选数据源
+     * @return 不读取旧持久化 Catalog 的候选 Definition
+     */
+    public FederationSourceDefinition createCandidate(DatacenterSource source) {
+        return create(source, List.of());
+    }
+
+    /**
+     * 为即将发布的单命名空间配置创建与持久化结果一致的 Definition。
+     *
+     * @param source 候选数据源
+     * @param catalogName 即将纳管的物理 Catalog 或 Schema
+     * @return 不读取旧 Catalog 的候选 Definition
+     */
+    public FederationSourceDefinition createCandidate(
+            DatacenterSource source,
+            String catalogName) {
+        if (catalogName == null || catalogName.isBlank()) {
+            throw new IllegalArgumentException("candidate catalog name is required");
+        }
+        String normalized = catalogName.trim();
+        DatacenterCatalog catalog = new DatacenterCatalog();
+        catalog.setLogicalSchemaName(normalized);
+        if (DatacenterSourceType.MYSQL.name().equals(source.getSourceType())) {
+            catalog.setPhysicalCatalogName(normalized);
+        } else {
+            catalog.setPhysicalCatalogName(source.getDatabaseName());
+            catalog.setPhysicalSchemaName(normalized);
+        }
+        return create(source, List.of(catalog));
+    }
+
+    /**
+     * 批量创建 Definition，一次加载全部活动 Catalog，供周期 reconcile 避免 N+1。
+     *
+     * @param sources 数据源快照
+     * @return 按数据源记录 ID 索引的 Definition
+     */
+    public Map<BigInteger, FederationSourceDefinition> createBatch(
+            Collection<DatacenterSource> sources) {
+        List<DatacenterSource> sourceList = sources == null
+                ? List.of() : sources.stream().filter(java.util.Objects::nonNull).toList();
+        if (sourceList.isEmpty()) {
+            return Map.of();
+        }
+        List<BigInteger> sourceIds = sourceList.stream()
+                .map(DatacenterSource::getId)
+                .filter(java.util.Objects::nonNull)
+                .toList();
+        Map<BigInteger, List<DatacenterCatalog>> catalogsBySource = sourceIds.isEmpty()
+                ? Map.of()
+                : catalogMapper.selectListByQuery(QueryWrapper.create()
+                        .in(DatacenterCatalog::getSourceId, sourceIds)
+                        .eq(DatacenterCatalog::getMetadataStatus, DatacenterMetadataStatus.ACTIVE.name())
+                        .orderBy("created asc"))
+                        .stream()
+                        .collect(Collectors.groupingBy(DatacenterCatalog::getSourceId));
+        Map<BigInteger, FederationSourceDefinition> definitions = new LinkedHashMap<>();
+        for (DatacenterSource source : sourceList) {
+            definitions.put(source.getId(), create(
+                    source, catalogsBySource.getOrDefault(source.getId(), List.of())));
+        }
+        return Map.copyOf(definitions);
+    }
+
+    private FederationSourceDefinition create(
+            DatacenterSource source,
+            List<DatacenterCatalog> catalogs) {
+        requireExternalJdbc(source);
+        long revision = Math.max(1L, source.getDefinitionRevision() == null
+                ? 0L : source.getDefinitionRevision());
+        List<JdbcSchemaDefinition> schemas = schemas(source, catalogs);
+        Map<String, String> options = new LinkedHashMap<>();
+        if (source.getAdapterOptionsJson() != null) {
+            options.putAll(source.getAdapterOptionsJson());
+        }
+        options.put(SOURCE_RECORD_ID_OPTION, source.getId().toString());
+        return new FederationSourceDefinition(
+                sourceId(source),
+                revision,
+                source.getAdapterId() == null || source.getAdapterId().isBlank()
+                        ? JdbcFederationSqlAdapterProvider.ADAPTER_ID
+                        : source.getAdapterId(),
+                new ArrayList<>(schemas),
+                options);
+    }
+
+    /**
+     * 派生租户隔离且不随显示名称变化的 SourceId。
+     *
+     * @param source 数据源
+     * @return Federation SourceId
+     */
+    public SourceId sourceId(DatacenterSource source) {
+        BigInteger tenantId = source.getTenantId() == null ? BigInteger.ZERO : source.getTenantId();
+        return new SourceId("tenant-" + tenantId + "-source-" + source.getId());
+    }
+
+    /**
+     * 从 Definition 读取 EasyFlow 数据源主键。
+     *
+     * @param definition Definition
+     * @return 数据源主键
+     */
+    public BigInteger sourceRecordId(FederationSourceDefinition definition) {
+        String value = definition.adapterOptions().get(SOURCE_RECORD_ID_OPTION);
+        if (value == null || value.isBlank()) {
+            throw new IllegalArgumentException("sourceRecordId is missing from Federation Definition");
+        }
+        return new BigInteger(value);
+    }
+
+    private List<DatacenterCatalog> loadCatalogs(DatacenterSource source) {
+        QueryWrapper query = QueryWrapper.create()
+                .eq(DatacenterCatalog::getSourceId, source.getId())
+                .eq(DatacenterCatalog::getMetadataStatus, DatacenterMetadataStatus.ACTIVE.name())
+                .orderBy("created asc");
+        return catalogMapper.selectListByQuery(query);
+    }
+
+    private List<JdbcSchemaDefinition> schemas(
+            DatacenterSource source,
+            List<DatacenterCatalog> catalogs) {
+        if (catalogs.isEmpty()) {
+            return List.of(defaultSchema(source));
+        }
+        return catalogs.stream()
+                .map(catalog -> new JdbcSchemaDefinition(
+                        catalog.getLogicalSchemaName(),
+                        catalog.getPhysicalCatalogName(),
+                        catalog.getPhysicalSchemaName()))
+                .toList();
+    }
+
+    private JdbcSchemaDefinition defaultSchema(DatacenterSource source) {
+        if (DatacenterSourceType.MYSQL.name().equals(source.getSourceType())) {
+            return new JdbcSchemaDefinition("MAIN", source.getDatabaseName(), null);
+        }
+        String schema = source.getSchemaName() == null || source.getSchemaName().isBlank()
+                ? "public" : source.getSchemaName();
+        return new JdbcSchemaDefinition("MAIN", source.getDatabaseName(), schema);
+    }
+
+    private void requireExternalJdbc(DatacenterSource source) {
+        if (source == null || source.getId() == null) {
+            throw new IllegalArgumentException("persisted source is required");
+        }
+        if (!DatacenterSourceType.MYSQL.name().equals(source.getSourceType())
+                && !DatacenterSourceType.POSTGRESQL.name().equals(source.getSourceType())) {
+            throw new IllegalArgumentException("Federation JDBC currently supports MySQL and PostgreSQL sources");
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationQueryCancellationService.java

@@ -0,0 +1,292 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.execute.QueryId;
+import java.math.BigInteger;
+import java.time.Duration;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.common.web.exceptions.BusinessException;
+
+/**
+ * 管理查询从编译到游标关闭的取消状态，并通过 Redis 将取消提示广播到执行节点。
+ */
+@Component
+public class DatacenterFederationQueryCancellationService {
+
+    /** 查询取消 Redis Pub/Sub 频道。 */
+    public static final String CHANNEL = "easyflow:datacenter:federation-query-cancel";
+    private static final String CANCEL_KEY_PREFIX =
+            "easyflow:datacenter:federation-query-cancelled:";
+    private static final Duration CANCEL_TTL = Duration.ofMinutes(10);
+
+    private static final Logger log = LoggerFactory.getLogger(
+            DatacenterFederationQueryCancellationService.class);
+
+    private final DatacenterFederationRuntime runtime;
+    private final ObjectProvider<StringRedisTemplate> redisTemplateProvider;
+    private final ConcurrentHashMap<String, ActiveQuery> activeQueries = new ConcurrentHashMap<>();
+
+    /**
+     * 创建查询取消服务。
+     *
+     * @param runtime 节点本地 Federation Runtime
+     * @param redisTemplateProvider 可选 Redis 模板
+     */
+    public DatacenterFederationQueryCancellationService(
+            DatacenterFederationRuntime runtime,
+            ObjectProvider<StringRedisTemplate> redisTemplateProvider) {
+        this.runtime = runtime;
+        this.redisTemplateProvider = redisTemplateProvider;
+    }
+
+    /**
+     * 校验或创建查询标识。
+     *
+     * @param requestedQueryId 调用方预生成的 UUID；为空时由服务端生成
+     * @return 已校验的查询标识
+     * @throws BusinessException 标识格式不合法
+     */
+    public QueryId resolveQueryId(String requestedQueryId) {
+        if (requestedQueryId == null || requestedQueryId.isBlank()) {
+            return QueryId.create();
+        }
+        try {
+            return new QueryId(UUID.fromString(requestedQueryId.trim()).toString());
+        } catch (IllegalArgumentException exception) {
+            throw new BusinessException("queryId 必须是 UUID");
+        }
+    }
+
+    /**
+     * 在编译前登记查询，防止重复 QueryId 混淆取消目标。
+     *
+     * @param queryId 查询标识
+     * @param account 执行账号
+     * @return 必须关闭的登记句柄
+     * @throws BusinessException QueryId 正在使用
+     */
+    public QueryRegistration register(QueryId queryId, LoginAccount account) {
+        ActiveQuery activeQuery = new ActiveQuery(tenantId(account));
+        if (activeQueries.putIfAbsent(queryId.value(), activeQuery) != null) {
+            throw new BusinessException(409, 14123, "queryId 正在使用", null);
+        }
+        if (isCancellationPersisted(activeQuery.tenantId, queryId)) {
+            try {
+                cancelLocal(activeQuery.tenantId, queryId);
+            } catch (RuntimeException exception) {
+                activeQueries.remove(queryId.value(), activeQuery);
+                throw exception;
+            }
+        }
+        return new QueryRegistration(queryId, activeQuery);
+    }
+
+    /**
+     * 向所有节点广播取消提示，并立即取消当前节点已登记的 Statement。
+     *
+     * @param requestedQueryId 查询标识
+     * @param account 当前账号
+     * @return 当前节点已找到查询或 Redis 已接收广播
+     */
+    public boolean cancel(String requestedQueryId, LoginAccount account) {
+        if (requestedQueryId == null || requestedQueryId.isBlank()) {
+            throw new BusinessException("queryId 不能为空");
+        }
+        QueryId queryId = resolveQueryId(requestedQueryId);
+        BigInteger tenantId = tenantId(account);
+        boolean distributedCancellationPersisted = persistAndPublishCancellation(
+                tenantId, queryId);
+        boolean localCancelled;
+        try {
+            localCancelled = cancelLocal(tenantId, queryId);
+        } catch (RuntimeException exception) {
+            log.error("Failed to cancel local datacenter query for tenant {} query {}",
+                    tenantId, queryId.value(), exception);
+            if (!distributedCancellationPersisted) {
+                throw exception;
+            }
+            localCancelled = false;
+        }
+        return localCancelled || distributedCancellationPersisted;
+    }
+
+    /**
+     * 先持久化取消终态，再尽力发布低延迟提示。
+     *
+     * @param tenantId 租户 ID
+     * @param queryId 查询标识
+     * @return Redis 是否已可靠保存取消终态
+     */
+    private boolean persistAndPublishCancellation(
+            BigInteger tenantId,
+            QueryId queryId) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return false;
+        }
+        try {
+            redisTemplate.opsForValue().set(
+                    cancellationKey(tenantId, queryId), "1", CANCEL_TTL);
+        } catch (RuntimeException exception) {
+            log.warn("Failed to persist datacenter query cancellation for tenant {} query {}",
+                    tenantId, queryId.value(), exception);
+            return false;
+        }
+        try {
+            redisTemplate.convertAndSend(
+                    CHANNEL, tenantId + "|" + queryId.value());
+        } catch (RuntimeException exception) {
+            // Pub/Sub 仅缩短生效延迟；持久取消终态已由周期核对保证交付。
+            log.warn("Failed to publish datacenter query cancellation hint for tenant {} query {}",
+                    tenantId, queryId.value(), exception);
+        }
+        return true;
+    }
+
+    /**
+     * 处理 Redis 取消提示；格式无效时安全忽略。
+     *
+     * @param payload 租户与 QueryId 组合文本
+     */
+    public void acceptCancellationHint(String payload) {
+        if (payload == null) {
+            return;
+        }
+        int separator = payload.indexOf('|');
+        if (separator <= 0 || separator == payload.length() - 1) {
+            return;
+        }
+        try {
+            BigInteger tenantId = new BigInteger(payload.substring(0, separator));
+            QueryId queryId = resolveQueryId(payload.substring(separator + 1));
+            cancelLocal(tenantId, queryId);
+        } catch (RuntimeException exception) {
+            log.warn("Ignored invalid datacenter query cancellation hint", exception);
+        }
+    }
+
+    /**
+     * 在编译或取数边界检查查询是否已取消。
+     *
+     * @param queryId 查询标识
+     * @throws BusinessException 查询已取消
+     */
+    public void throwIfCancelled(QueryId queryId) {
+        ActiveQuery activeQuery = activeQueries.get(queryId.value());
+        if (activeQuery != null && activeQuery.cancelled.get()) {
+            throw new BusinessException(409, 14118, "查询已取消", null);
+        }
+    }
+
+    /**
+     * 返回查询当前是否已收到取消请求。
+     *
+     * @param queryId 查询标识
+     * @return 是否取消
+     */
+    public boolean isCancelled(QueryId queryId) {
+        ActiveQuery activeQuery = activeQueries.get(queryId.value());
+        return activeQuery != null && activeQuery.cancelled.get();
+    }
+
+    /**
+     * 周期核对 Redis 持久取消标记，覆盖 Pub/Sub 提示丢失或节点短暂断连。
+     */
+    @Scheduled(fixedDelayString =
+            "${easyflow.datacenter.query-cancel-reconcile-ms:1000}")
+    public void reconcilePersistedCancellations() {
+        activeQueries.forEach((queryIdValue, activeQuery) -> {
+            if (activeQuery.localCancellationApplied.get()) {
+                return;
+            }
+            QueryId queryId = new QueryId(queryIdValue);
+            if (activeQuery.cancelled.get()
+                    || isCancellationPersisted(activeQuery.tenantId, queryId)) {
+                try {
+                    cancelLocal(activeQuery.tenantId, queryId);
+                } catch (RuntimeException exception) {
+                    log.error("Failed to reconcile datacenter query cancellation for tenant {} query {}",
+                            activeQuery.tenantId, queryId.value(), exception);
+                }
+            }
+        });
+    }
+
+    private boolean cancelLocal(BigInteger tenantId, QueryId queryId) {
+        ActiveQuery activeQuery = activeQueries.get(queryId.value());
+        if (activeQuery == null || !activeQuery.tenantId.equals(tenantId)) {
+            return false;
+        }
+        activeQuery.cancelled.set(true);
+        runtime.engine().cancel(queryId);
+        activeQuery.localCancellationApplied.set(true);
+        return true;
+    }
+
+    private boolean isCancellationPersisted(BigInteger tenantId, QueryId queryId) {
+        StringRedisTemplate redisTemplate = redisTemplateProvider.getIfAvailable();
+        if (redisTemplate == null) {
+            return false;
+        }
+        try {
+            return Boolean.TRUE.equals(redisTemplate.hasKey(
+                    cancellationKey(tenantId, queryId)));
+        } catch (RuntimeException exception) {
+            log.warn("Failed to read datacenter query cancellation for tenant {} query {}",
+                    tenantId, queryId.value(), exception);
+            return false;
+        }
+    }
+
+    private String cancellationKey(BigInteger tenantId, QueryId queryId) {
+        return CANCEL_KEY_PREFIX + tenantId + ":" + queryId.value();
+    }
+
+    private BigInteger tenantId(LoginAccount account) {
+        return account == null || account.getTenantId() == null
+                ? BigInteger.ZERO : account.getTenantId();
+    }
+
+    private record ActiveQuery(
+            BigInteger tenantId,
+            AtomicBoolean cancelled,
+            AtomicBoolean localCancellationApplied) {
+
+        private ActiveQuery(BigInteger tenantId) {
+            this(tenantId, new AtomicBoolean(), new AtomicBoolean());
+        }
+    }
+
+    /**
+     * 查询活动登记句柄。
+     */
+    public final class QueryRegistration implements AutoCloseable {
+
+        private final QueryId queryId;
+        private final ActiveQuery activeQuery;
+        private final AtomicBoolean closed = new AtomicBoolean();
+
+        private QueryRegistration(QueryId queryId, ActiveQuery activeQuery) {
+            this.queryId = queryId;
+            this.activeQuery = activeQuery;
+        }
+
+        /**
+         * 仅移除当前登记实例，避免误删随后复用的同名查询。
+         */
+        @Override
+        public void close() {
+            if (closed.compareAndSet(false, true)) {
+                activeQueries.remove(queryId.value(), activeQuery);
+            }
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationQueryService.java

@@ -0,0 +1,731 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.api.FederationSqlException;
+import com.easyagents.federation.sql.api.SqlExecutionContext;
+import com.easyagents.federation.sql.compile.FederationSqlPlan;
+import com.easyagents.federation.sql.compile.SqlCompileRequest;
+import com.easyagents.federation.sql.execute.FederationColumn;
+import com.easyagents.federation.sql.execute.FederationResultCursor;
+import com.easyagents.federation.sql.execute.QueryId;
+import com.easyagents.federation.sql.execute.SqlExecutionOptions;
+import com.easyagents.federation.sql.execute.SqlParameter;
+import com.easyagents.federation.sql.federation.FederationQueryScopeDefinition;
+import com.easyagents.federation.sql.source.SourceId;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.Reader;
+import java.math.BigInteger;
+import java.sql.Blob;
+import java.sql.Clob;
+import java.sql.SQLXML;
+import java.sql.SQLException;
+import java.sql.Struct;
+import java.sql.Types;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Consumer;
+import org.apache.calcite.rel.RelNode;
+import org.apache.calcite.rel.RelVisitor;
+import org.apache.calcite.rel.core.TableScan;
+import org.apache.calcite.sql.SqlIdentifier;
+import org.apache.calcite.sql.util.SqlBasicVisitor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Service;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.common.web.exceptions.BusinessException;
+import tech.easyflow.datacenter.audit.DatacenterQueryAudit;
+import tech.easyflow.datacenter.audit.DatacenterQueryAuditService;
+import tech.easyflow.datacenter.execution.model.DatacenterSqlColumnView;
+import tech.easyflow.datacenter.execution.model.DatacenterSqlConsoleResult;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
+
+/**
+ * 通过 Federation SQL 完成有界只读查询、资源关闭和统一审计。
+ */
+@Service
+public class DatacenterFederationQueryService {
+
+    private static final Logger log = LoggerFactory.getLogger(DatacenterFederationQueryService.class);
+    private static final int DEFAULT_MAX_ROWS = 200;
+    private static final int MAX_ALLOWED_ROWS = 1_000;
+    private static final long MAX_RESULT_BYTES = 4L * 1024L * 1024L;
+    private static final int MAX_TEXT_CELL_CHARS = 65_536;
+
+    private final DatacenterFederationRuntime runtime;
+    private final DatacenterQueryAuditService auditService;
+    private final DatacenterFederationQueryCancellationService cancellationService;
+
+    /**
+     * 创建查询服务。
+     *
+     * @param runtime Federation Runtime
+     * @param auditService 查询审计服务
+     * @param cancellationService 跨节点查询取消服务
+     */
+    public DatacenterFederationQueryService(
+            DatacenterFederationRuntime runtime,
+            DatacenterQueryAuditService auditService,
+            DatacenterFederationQueryCancellationService cancellationService) {
+        this.runtime = runtime;
+        this.auditService = auditService;
+        this.cancellationService = cancellationService;
+    }
+
+    /**
+     * 执行一条单数据源只读 SQL。
+     *
+     * @param source 已激活数据源
+     * @param sql 只读 SQL
+     * @param parameters 显式 JDBC 参数
+     * @param requestedMaxRows 请求行数上限
+     * @param account 执行账号
+     * @param callerType 调用方类型
+     * @param callerId 调用方标识
+     * @return 有界查询结果
+     */
+    public DatacenterSqlConsoleResult execute(
+            DatacenterSource source,
+            String sql,
+            List<SqlParameter> parameters,
+            Integer requestedMaxRows,
+            LoginAccount account,
+            String callerType,
+            String callerId) {
+        return execute(source, sql, parameters, requestedMaxRows, account,
+                callerType, callerId, null);
+    }
+
+    /**
+     * 使用调用方预生成的 QueryId 执行只读 SQL，以支持请求完成前取消。
+     *
+     * @param source 已激活数据源
+     * @param sql 只读 SQL
+     * @param parameters 显式 JDBC 参数
+     * @param requestedMaxRows 请求行数上限
+     * @param account 执行账号
+     * @param callerType 调用方类型
+     * @param callerId 调用方标识
+     * @param requestedQueryId 调用方预生成的查询 UUID；为空时服务端生成
+     * @return 有界查询结果
+     */
+    public DatacenterSqlConsoleResult execute(
+            DatacenterSource source,
+            String sql,
+            List<SqlParameter> parameters,
+            Integer requestedMaxRows,
+            LoginAccount account,
+            String callerType,
+            String callerId,
+            String requestedQueryId) {
+        requireExecutable(source, sql);
+        int maxRows = normalizeMaxRows(requestedMaxRows);
+        List<SqlParameter> safeParameters = List.copyOf(parameters == null ? List.of() : parameters);
+        QueryId queryId = cancellationService.resolveQueryId(requestedQueryId);
+        DatacenterFederationQueryCancellationService.QueryRegistration registration =
+                cancellationService.register(queryId, account);
+        long startedNanos = System.nanoTime();
+        DatacenterQueryAudit audit;
+        try {
+            audit = auditService.start(
+                    queryId.value(), source, sql, maskedParameterSummary(safeParameters),
+                    account, callerType, callerId);
+        } catch (RuntimeException exception) {
+            registration.close();
+            throw exception;
+        }
+        List<String> referencedTables = List.of();
+        List<String> referencedFields = List.of();
+        try {
+            cancellationService.throwIfCancelled(queryId);
+            SqlCompileRequest compileRequest = compileRequest(source, sql, safeParameters);
+            FederationSqlPlan plan = runtime.engine().compile(compileRequest);
+            cancellationService.throwIfCancelled(queryId);
+            referencedTables = referencedTables(plan.relRoot().rel);
+            referencedFields = referencedFields(plan.sqlNode());
+            SqlExecutionOptions options = new SqlExecutionOptions(
+                    200,
+                    maxRows + 1,
+                    30,
+                    true);
+            long databaseStartedNanos = System.nanoTime();
+            List<DatacenterSqlColumnView> columns;
+            List<Map<String, Object>> rows = new ArrayList<>(maxRows);
+            boolean truncated = false;
+            long resultBytes = 0L;
+            try (FederationResultCursor cursor = runtime.engine().execute(
+                    plan,
+                    new SqlExecutionContext(
+                            queryId,
+                            safeParameters,
+                            options,
+                            Duration.ofSeconds(5)))) {
+                columns = columns(cursor.columns());
+                while (cursor.next()) {
+                    cancellationService.throwIfCancelled(queryId);
+                    if (rows.size() >= maxRows) {
+                        truncated = true;
+                        break;
+                    }
+                    Map<String, Object> row = new LinkedHashMap<>();
+                    for (int index = 0; index < columns.size(); index++) {
+                        Object value = readColumn(cursor, cursor.columns().get(index), index + 1);
+                        resultBytes += estimateBytes(columns.get(index).label(), value);
+                        if (resultBytes > MAX_RESULT_BYTES) {
+                            truncated = true;
+                            break;
+                        }
+                        row.put(columns.get(index).key(), value);
+                    }
+                    if (truncated && resultBytes > MAX_RESULT_BYTES) {
+                        break;
+                    }
+                    rows.add(Collections.unmodifiableMap(new LinkedHashMap<>(row)));
+                }
+            }
+            long databaseDurationMs = elapsedMillis(databaseStartedNanos);
+            long durationMs = elapsedMillis(startedNanos);
+            auditService.succeed(audit, referencedTables, referencedFields, rows.size(), truncated,
+                    durationMs, databaseDurationMs);
+            return new DatacenterSqlConsoleResult(
+                    queryId.value(), columns, rows, rows.size(), truncated, durationMs);
+        } catch (RuntimeException exception) {
+            long durationMs = elapsedMillis(startedNanos);
+            String errorCode = cancellationService.isCancelled(queryId)
+                    ? "QUERY_CANCELLED"
+                    : exception instanceof FederationSqlException federationException
+                            ? federationException.errorCode().name()
+                            : "DATACENTER_QUERY_FAILED";
+            try {
+                auditService.fail(audit, errorCode, safeMessage(exception),
+                        referencedTables, referencedFields, durationMs);
+            } catch (RuntimeException auditException) {
+                exception.addSuppressed(auditException);
+                log.error("Failed to finalize datacenter query audit {}", queryId.value(), auditException);
+            }
+            if (exception instanceof BusinessException businessException) {
+                throw businessException;
+            }
+            logUnexpectedFailure(queryId, source, exception);
+            throw toBusinessException(exception);
+        } finally {
+            registration.close();
+        }
+    }
+
+    /**
+     * 使用 Federation 游标流式消费单数据源只读 SQL，并在触及资源上限时显式失败。
+     *
+     * @param source 已激活数据源
+     * @param sql 只读 SQL
+     * @param parameters 显式 JDBC 参数
+     * @param fetchSize JDBC 拉取批次
+     * @param maxRows 最大消费行数
+     * @param maxBytes 最大估算字节数
+     * @param account 执行账号
+     * @param callerType 调用方类型
+     * @param callerId 调用方标识
+     * @param consumer 单行消费者
+     * @return 已消费行数
+     */
+    public long consume(
+            DatacenterSource source,
+            String sql,
+            List<SqlParameter> parameters,
+            int fetchSize,
+            long maxRows,
+            long maxBytes,
+            LoginAccount account,
+            String callerType,
+            String callerId,
+            Consumer<Map<String, Object>> consumer) {
+        return consume(source, sql, parameters, fetchSize, maxRows, maxBytes,
+                account, callerType, callerId, null, consumer);
+    }
+
+    /**
+     * 使用调用方预生成的 QueryId 流式消费只读 SQL，以支持流消费期间取消。
+     *
+     * @param source 已激活数据源
+     * @param sql 只读 SQL
+     * @param parameters 显式 JDBC 参数
+     * @param fetchSize JDBC 拉取批次
+     * @param maxRows 最大消费行数
+     * @param maxBytes 最大估算字节数
+     * @param account 执行账号
+     * @param callerType 调用方类型
+     * @param callerId 调用方标识
+     * @param requestedQueryId 调用方预生成的查询 UUID；为空时服务端生成
+     * @param consumer 单行消费者
+     * @return 已消费行数
+     */
+    public long consume(
+            DatacenterSource source,
+            String sql,
+            List<SqlParameter> parameters,
+            int fetchSize,
+            long maxRows,
+            long maxBytes,
+            LoginAccount account,
+            String callerType,
+            String callerId,
+            String requestedQueryId,
+            Consumer<Map<String, Object>> consumer) {
+        requireExecutable(source, sql);
+        if (fetchSize <= 0 || maxRows <= 0 || maxRows >= Integer.MAX_VALUE
+                || maxBytes <= 0 || consumer == null) {
+            throw new IllegalArgumentException("stream query limits and consumer must be valid");
+        }
+        List<SqlParameter> safeParameters = List.copyOf(parameters == null ? List.of() : parameters);
+        QueryId queryId = cancellationService.resolveQueryId(requestedQueryId);
+        DatacenterFederationQueryCancellationService.QueryRegistration registration =
+                cancellationService.register(queryId, account);
+        long startedNanos = System.nanoTime();
+        DatacenterQueryAudit audit;
+        try {
+            audit = auditService.start(
+                    queryId.value(), source, sql,
+                    maskedParameterSummary(safeParameters),
+                    account, callerType, callerId);
+        } catch (RuntimeException exception) {
+            registration.close();
+            throw exception;
+        }
+        List<String> referencedTables = List.of();
+        List<String> referencedFields = List.of();
+        long consumedRows = 0L;
+        try {
+            cancellationService.throwIfCancelled(queryId);
+            SqlCompileRequest compileRequest = compileRequest(source, sql, safeParameters);
+            FederationSqlPlan plan = runtime.engine().compile(compileRequest);
+            cancellationService.throwIfCancelled(queryId);
+            referencedTables = referencedTables(plan.relRoot().rel);
+            referencedFields = referencedFields(plan.sqlNode());
+            SqlExecutionOptions options = new SqlExecutionOptions(
+                    fetchSize, Math.toIntExact(maxRows + 1L), 30, true);
+            long databaseStartedNanos = System.nanoTime();
+            long resultBytes = 0L;
+            try (FederationResultCursor cursor = runtime.engine().execute(
+                    plan,
+                    new SqlExecutionContext(queryId, safeParameters, options, Duration.ofSeconds(5)))) {
+                List<DatacenterSqlColumnView> columns = columns(cursor.columns());
+                while (cursor.next()) {
+                    cancellationService.throwIfCancelled(queryId);
+                    if (consumedRows >= maxRows) {
+                        throw new BusinessException("数据集查询结果超过行数上限: " + maxRows);
+                    }
+                    Map<String, Object> row = new LinkedHashMap<>();
+                    for (int index = 0; index < columns.size(); index++) {
+                        Object value = readColumn(cursor, cursor.columns().get(index), index + 1);
+                        resultBytes += estimateBytes(columns.get(index).label(), value);
+                        if (resultBytes > maxBytes) {
+                            throw new BusinessException("数据集查询结果超过字节上限: " + maxBytes);
+                        }
+                        row.put(columns.get(index).label(), value);
+                    }
+                    consumer.accept(Collections.unmodifiableMap(row));
+                    consumedRows++;
+                }
+            }
+            long durationMs = elapsedMillis(startedNanos);
+            auditService.succeed(
+                    audit, referencedTables, referencedFields, consumedRows, false,
+                    durationMs, elapsedMillis(databaseStartedNanos));
+            return consumedRows;
+        } catch (RuntimeException exception) {
+            long durationMs = elapsedMillis(startedNanos);
+            String errorCode = cancellationService.isCancelled(queryId)
+                    ? "QUERY_CANCELLED"
+                    : exception instanceof FederationSqlException federationException
+                            ? federationException.errorCode().name()
+                            : "DATACENTER_QUERY_FAILED";
+            try {
+                auditService.fail(audit, errorCode, safeMessage(exception),
+                        referencedTables, referencedFields, durationMs);
+            } catch (RuntimeException auditException) {
+                exception.addSuppressed(auditException);
+                log.error("Failed to finalize datacenter stream query audit {}", queryId.value(), auditException);
+            }
+            if (exception instanceof BusinessException businessException) {
+                throw businessException;
+            }
+            logUnexpectedFailure(queryId, source, exception);
+            throw toBusinessException(exception);
+        } finally {
+            registration.close();
+        }
+    }
+
+    private SqlCompileRequest compileRequest(
+            DatacenterSource source,
+            String sql,
+            List<SqlParameter> parameters) {
+        SourceId sourceId = runtime.definitions().sourceId(source);
+        return new SqlCompileRequest(
+                sql,
+                FederationQueryScopeDefinition.single(
+                        "datacenter-source:" + source.getId(),
+                        source.getScopeRevision(),
+                        sourceId.value(),
+                        sourceId,
+                        source.getDefinitionRevision()),
+                parameters.stream().map(SqlParameter::jdbcType).toList(),
+                "scope-" + source.getScopeRevision());
+    }
+
+    private void requireExecutable(DatacenterSource source, String sql) {
+        if (source == null || DatacenterSourceStatus.fromCode(source.getStatus())
+                != DatacenterSourceStatus.READY) {
+            throw new BusinessException("数据连接尚未就绪");
+        }
+        if (sql == null || sql.isBlank()) {
+            throw new BusinessException("SQL 不能为空");
+        }
+        if (sql.length() > 100_000) {
+            throw new BusinessException("SQL 长度超过限制");
+        }
+    }
+
+    private int normalizeMaxRows(Integer requested) {
+        if (requested == null) {
+            return DEFAULT_MAX_ROWS;
+        }
+        if (requested <= 0) {
+            throw new BusinessException("maxRows 必须大于 0");
+        }
+        return Math.min(requested, MAX_ALLOWED_ROWS);
+    }
+
+    private List<DatacenterSqlColumnView> columns(List<FederationColumn> columns) {
+        List<DatacenterSqlColumnView> result = new ArrayList<>(columns.size());
+        for (FederationColumn column : columns) {
+            result.add(new DatacenterSqlColumnView(
+                    "c" + column.index(),
+                    column.label(),
+                    column.jdbcType(),
+                    column.typeName(),
+                    column.nullable()));
+        }
+        return List.copyOf(result);
+    }
+
+    private List<String> referencedTables(RelNode root) {
+        Set<String> names = new LinkedHashSet<>();
+        new RelVisitor() {
+            @Override
+            public void visit(RelNode node, int ordinal, RelNode parent) {
+                if (node instanceof TableScan scan) {
+                    names.add(String.join(".", scan.getTable().getQualifiedName()));
+                }
+                super.visit(node, ordinal, parent);
+            }
+        }.go(root);
+        return List.copyOf(names);
+    }
+
+    private List<String> referencedFields(org.apache.calcite.sql.SqlNode sqlNode) {
+        Set<String> names = new LinkedHashSet<>();
+        sqlNode.accept(new SqlBasicVisitor<Void>() {
+            @Override
+            public Void visit(SqlIdentifier identifier) {
+                if (!identifier.isStar() && !identifier.names.isEmpty()) {
+                    names.add(String.join(".", identifier.names));
+                }
+                return null;
+            }
+        });
+        return List.copyOf(names);
+    }
+
+    private Map<String, Object> maskedParameterSummary(List<SqlParameter> parameters) {
+        Map<String, Object> summary = new LinkedHashMap<>();
+        for (int index = 0; index < parameters.size(); index++) {
+            SqlParameter parameter = parameters.get(index);
+            summary.put("p" + (index + 1), Map.of(
+                    "jdbcType", parameter.jdbcType(),
+                    "present", parameter.value() != null));
+        }
+        return Map.copyOf(summary);
+    }
+
+    private Object normalizeValue(Object value) {
+        try {
+            if (value instanceof byte[] bytes) {
+                if (bytes.length > MAX_TEXT_CELL_CHARS) {
+                    return "[binary " + bytes.length + " bytes]";
+                }
+                return Base64.getEncoder().encodeToString(bytes);
+            }
+            if (value instanceof Blob blob) {
+                return "[binary " + blob.length() + " bytes]";
+            }
+            if (value instanceof Clob clob) {
+                long length = Math.min(clob.length(), 4_096L);
+                return clob.getSubString(1L, (int) length);
+            }
+            if (value instanceof SQLXML sqlxml) {
+                String text = sqlxml.getString();
+                return boundedText(text);
+            }
+            if (value instanceof java.sql.Array array) {
+                return "[array " + array.getBaseTypeName() + "]";
+            }
+            if (value instanceof Struct struct) {
+                return "[struct " + struct.getSQLTypeName() + "]";
+            }
+            if (value instanceof CharSequence text) {
+                return boundedText(text.toString());
+            }
+            if (value instanceof BigInteger || value instanceof Long) {
+                return value.toString();
+            }
+            Package valuePackage = value.getClass().getPackage();
+            if (valuePackage != null && valuePackage.getName().startsWith("org.postgresql")) {
+                return boundedText(String.valueOf(value));
+            }
+            return value instanceof Number || value instanceof Boolean
+                    || value instanceof java.time.temporal.TemporalAccessor
+                    || value instanceof java.util.Date
+                    ? value : boundedText(String.valueOf(value));
+        } catch (SQLException exception) {
+            throw new BusinessException("查询结果包含无法读取的大对象");
+        }
+    }
+
+    /**
+     * 按 JDBC 类型选择有界流式读取或普通对象读取。
+     *
+     * @param cursor 当前结果游标
+     * @param column 列元数据
+     * @param columnIndex 从 1 开始的列序号
+     * @return 可安全序列化的有界值
+     */
+    private Object readColumn(
+            FederationResultCursor cursor,
+            FederationColumn column,
+            int columnIndex) {
+        try {
+            if (isBinaryType(column.jdbcType())) {
+                try (InputStream stream = cursor.getBinaryStream(columnIndex)) {
+                    return readBoundedBinary(stream);
+                }
+            }
+            if (isCharacterType(column.jdbcType(), column.typeName())) {
+                try (Reader reader = cursor.getCharacterStream(columnIndex)) {
+                    return readBoundedText(reader);
+                }
+            }
+        } catch (UnsupportedOperationException ignored) {
+            // 第三方 Adapter 可暂不实现流式列读取；保留兼容的对象读取路径。
+        } catch (IOException exception) {
+            throw new BusinessException("查询结果流读取失败");
+        }
+        return normalizeValue(cursor.getObject(columnIndex));
+    }
+
+    /**
+     * 有界读取二进制流，小值编码为 Base64，大值返回摘要。
+     *
+     * @param stream 二进制流；可为空
+     * @return Base64 文本、大小摘要或 null
+     * @throws IOException 流读取失败
+     */
+    private Object readBoundedBinary(InputStream stream) throws IOException {
+        if (stream == null) {
+            return null;
+        }
+        byte[] bytes = stream.readNBytes(MAX_TEXT_CELL_CHARS + 1);
+        if (bytes.length > MAX_TEXT_CELL_CHARS) {
+            return "[binary exceeds " + MAX_TEXT_CELL_CHARS + " bytes]";
+        }
+        return Base64.getEncoder().encodeToString(bytes);
+    }
+
+    /**
+     * 有界读取字符流，超过单元格限制时附加截断标识。
+     *
+     * @param reader 字符流；可为空
+     * @return 有界文本或 null
+     * @throws IOException 流读取失败
+     */
+    private String readBoundedText(Reader reader) throws IOException {
+        if (reader == null) {
+            return null;
+        }
+        StringBuilder text = new StringBuilder(Math.min(MAX_TEXT_CELL_CHARS, 4_096));
+        char[] buffer = new char[4_096];
+        while (text.length() <= MAX_TEXT_CELL_CHARS) {
+            int remaining = MAX_TEXT_CELL_CHARS + 1 - text.length();
+            int read = reader.read(buffer, 0, Math.min(buffer.length, remaining));
+            if (read < 0) {
+                break;
+            }
+            text.append(buffer, 0, read);
+        }
+        if (text.length() > MAX_TEXT_CELL_CHARS) {
+            return text.substring(0, MAX_TEXT_CELL_CHARS) + "…[truncated]";
+        }
+        return text.toString();
+    }
+
+    /**
+     * 判断 JDBC 类型是否应使用二进制流读取。
+     *
+     * @param jdbcType JDBC 类型
+     * @return 是否为二进制大字段类型
+     */
+    private boolean isBinaryType(int jdbcType) {
+        return jdbcType == Types.BINARY
+                || jdbcType == Types.VARBINARY
+                || jdbcType == Types.LONGVARBINARY
+                || jdbcType == Types.BLOB;
+    }
+
+    /**
+     * 判断 JDBC 类型或数据库类型名是否应使用字符流读取。
+     *
+     * @param jdbcType JDBC 类型
+     * @param typeName 数据库类型名
+     * @return 是否为字符大字段类型
+     */
+    private boolean isCharacterType(int jdbcType, String typeName) {
+        if (jdbcType == Types.CHAR
+                || jdbcType == Types.VARCHAR
+                || jdbcType == Types.LONGVARCHAR
+                || jdbcType == Types.NCHAR
+                || jdbcType == Types.NVARCHAR
+                || jdbcType == Types.LONGNVARCHAR
+                || jdbcType == Types.CLOB
+                || jdbcType == Types.NCLOB
+                || jdbcType == Types.SQLXML) {
+            return true;
+        }
+        String normalized = typeName == null ? "" : typeName.toLowerCase(java.util.Locale.ROOT);
+        return normalized.equals("json") || normalized.equals("jsonb") || normalized.equals("xml");
+    }
+
+    private String boundedText(String value) {
+        if (value == null || value.length() <= MAX_TEXT_CELL_CHARS) {
+            return value;
+        }
+        return value.substring(0, MAX_TEXT_CELL_CHARS)
+                + "…[truncated " + value.length() + " chars]";
+    }
+
+    private long estimateBytes(String label, Object value) {
+        long bytes = label == null ? 0L : (long) label.length() * Character.BYTES;
+        if (value == null) {
+            return bytes + 8L;
+        }
+        if (value instanceof CharSequence text) {
+            return bytes + (long) text.length() * Character.BYTES;
+        }
+        return bytes + 64L;
+    }
+
+    private long elapsedMillis(long startedNanos) {
+        return Math.max(0L, (System.nanoTime() - startedNanos) / 1_000_000L);
+    }
+
+    private String safeMessage(Throwable exception) {
+        String message = exception.getMessage();
+        if (message == null || message.isBlank()) {
+            return "数据查询失败";
+        }
+        return message.length() <= 500 ? message : message.substring(0, 500);
+    }
+
+    private BusinessException toBusinessException(RuntimeException exception) {
+        if (exception instanceof FederationSqlException federationException) {
+            int status = switch (federationException.errorCode()) {
+                case QUERY_ADMISSION_TIMEOUT, QUERY_TIMEOUT,
+                        SQL_COMPILE_TIMEOUT -> 408;
+                case NODE_MEMORY_ADMISSION_TIMEOUT -> 429;
+                case SOURCE_NOT_FOUND, SOURCE_REMOVED -> 404;
+                case SOURCE_REVISION_NOT_READY, SOURCE_DEFINITION_CONFLICT -> 409;
+                case PLAN_STALE -> 409;
+                case FEDERATION_RESOURCE_LIMIT_EXCEEDED -> 422;
+                case EXECUTION_FAILED, RESOURCE_CLOSE_FAILED,
+                        SOURCE_INITIALIZATION_FAILED, ENGINE_CLOSED,
+                        EXPLAIN_FAILED, SQL_COMPLETION_FAILED,
+                        CONNECTION_ACQUISITION_TIMEOUT,
+                        CONNECTION_ACQUISITION_FAILED -> 503;
+                default -> 400;
+            };
+            int code = switch (federationException.errorCode()) {
+                case INVALID_ARGUMENT -> 14101;
+                case SQL_PARSE_FAILED -> 14102;
+                case SQL_VALIDATION_FAILED -> 14103;
+                case SQL_NOT_READ_ONLY -> 14104;
+                case SQL_COMPILE_FAILED -> 14105;
+                case SQL_NOT_FULLY_PUSHDOWN -> 14106;
+                case CROSS_SOURCE_DISABLED -> 14107;
+                case CROSS_SOURCE_EXECUTION_UNSUPPORTED -> 14108;
+                case SOURCE_NOT_FOUND -> 14109;
+                case SOURCE_REMOVED -> 14110;
+                case SOURCE_REVISION_NOT_READY -> 14111;
+                case SOURCE_DEFINITION_CONFLICT -> 14112;
+                case SOURCE_INITIALIZATION_FAILED -> 14113;
+                case ADAPTER_NOT_FOUND -> 14114;
+                case ADAPTER_UNSUPPORTED -> 14115;
+                case PARAMETER_COUNT_MISMATCH -> 14116;
+                case QUERY_ADMISSION_TIMEOUT -> 14117;
+                case QUERY_CANCELLED -> 14118;
+                case QUERY_TIMEOUT -> 14119;
+                case EXECUTION_FAILED -> 14120;
+                case RESOURCE_CLOSE_FAILED -> 14121;
+                case ENGINE_CLOSED -> 14122;
+                case INVALID_QUERY_SCOPE -> 14124;
+                case FEDERATION_OPERATOR_UNSUPPORTED -> 14125;
+                case FEDERATION_RESOURCE_LIMIT_EXCEEDED -> 14126;
+                case PLAN_STALE -> 14127;
+                case EXPLAIN_FAILED -> 14128;
+                case SQL_COMPLETION_FAILED -> 14129;
+                case SQL_COMPILE_TIMEOUT -> 14130;
+                case NODE_MEMORY_ADMISSION_TIMEOUT -> 14131;
+                case CONNECTION_ACQUISITION_TIMEOUT -> 14132;
+                case CONNECTION_ACQUISITION_FAILED -> 14133;
+            };
+            String message = switch (federationException.errorCode()) {
+                case EXECUTION_FAILED, RESOURCE_CLOSE_FAILED,
+                        SOURCE_INITIALIZATION_FAILED, ENGINE_CLOSED -> "数据库查询暂时不可用";
+                case QUERY_TIMEOUT, QUERY_ADMISSION_TIMEOUT -> "数据库查询超时";
+                case QUERY_CANCELLED -> "查询已取消";
+                case FEDERATION_RESOURCE_LIMIT_EXCEEDED -> "联邦查询超过资源限制";
+                case EXPLAIN_FAILED -> "数据库查询计划分析失败";
+                case SQL_COMPLETION_FAILED -> "SQL 补全暂时不可用";
+                case SQL_COMPILE_TIMEOUT -> "SQL 编译超时，请简化语句后重试";
+                case NODE_MEMORY_ADMISSION_TIMEOUT -> "节点查询资源繁忙，请稍后重试";
+                case CONNECTION_ACQUISITION_TIMEOUT -> "数据库连接池繁忙，请稍后重试";
+                case CONNECTION_ACQUISITION_FAILED -> "无法获取数据库连接，请检查连接状态";
+                default -> safeMessage(exception);
+            };
+            return new BusinessException(status, code, message, exception);
+        }
+        return new BusinessException(500, 14999, "数据查询失败", exception);
+    }
+
+    private void logUnexpectedFailure(
+            QueryId queryId,
+            DatacenterSource source,
+            RuntimeException exception) {
+        if (!(exception instanceof FederationSqlException federationException)
+                || switch (federationException.errorCode()) {
+                    case EXECUTION_FAILED, RESOURCE_CLOSE_FAILED,
+                            SOURCE_INITIALIZATION_FAILED, ENGINE_CLOSED,
+                            EXPLAIN_FAILED, CONNECTION_ACQUISITION_FAILED -> true;
+                    default -> false;
+                }) {
+            log.error("Datacenter query failed, queryId={}, sourceId={}",
+                    queryId.value(), source == null ? null : source.getId(), exception);
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationRuntime.java

@@ -0,0 +1,175 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.adapter.jdbc.JdbcFederationSqlAdapterProvider;
+import com.easyagents.federation.sql.api.FederationSqlEngine;
+import com.easyagents.federation.sql.api.FederationSqlEngines;
+import com.easyagents.federation.sql.source.FederationSourceDefinition;
+import com.easyagents.federation.sql.source.PreparedSourceRuntime;
+import com.easyagents.federation.sql.source.SourceApplyOptions;
+import com.easyagents.federation.sql.source.SourceApplyResult;
+import com.easyagents.federation.sql.source.SourceApplyStatus;
+import com.easyagents.federation.sql.source.SourceProbeResult;
+import com.easyagents.federation.sql.source.SourceRemoveResult;
+import com.easyagents.federation.sql.source.SourceTombstone;
+import jakarta.annotation.PreDestroy;
+import org.springframework.stereotype.Component;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+
+/**
+ * EasyFlow 数据中枢持有的单例 Federation SQL Engine。
+ */
+@Component
+public class DatacenterFederationRuntime {
+
+    private final DatacenterFederationDefinitionFactory definitionFactory;
+    private final DatacenterFederationDataSourceResolver resolver;
+    private final FederationSqlEngine engine;
+
+    /**
+     * 组装 DataSource Resolver、数据库状态 Provider 与业务 Policy。
+     *
+     * @param definitionFactory Definition 工厂
+     * @param resolver HikariCP Resolver
+     * @param stateProvider 数据库权威状态 Provider
+     * @param policy 纳管范围 Policy
+     * @param admissionController 租户与数据源分层准入控制器
+     */
+    public DatacenterFederationRuntime(
+            DatacenterFederationDefinitionFactory definitionFactory,
+            DatacenterFederationDataSourceResolver resolver,
+            DatacenterFederationSourceStateProvider stateProvider,
+            DatacenterFederationSqlPolicy policy,
+            DatacenterFederationAdmissionController admissionController) {
+        this.definitionFactory = definitionFactory;
+        this.resolver = resolver;
+        this.engine = FederationSqlEngines.builder()
+                .dataSourceResolver(resolver)
+                .stateProvider(stateProvider)
+                .adapter(new JdbcFederationSqlAdapterProvider())
+                .policy(policy)
+                .admissionController(admissionController)
+                .maximumPlanCacheEntries(512)
+                .maximumConcurrentCompilations(Math.max(1, Math.min(4,
+                        Runtime.getRuntime().availableProcessors())))
+                .build();
+    }
+
+    /**
+     * 探测草稿数据源，不保留临时连接池。
+     *
+     * @param source 数据源草稿
+     * @return 探测结果
+     */
+    public SourceProbeResult probe(DatacenterSource source) {
+        return engine.sources().probe(definitionFactory.create(source));
+    }
+
+    /**
+     * 使用未发布候选配置执行短生命周期探测。
+     *
+     * @param source 候选数据源
+     * @return 探测结果
+     */
+    public SourceProbeResult probeCandidate(DatacenterSource source) {
+        FederationSourceDefinition definition = definitionFactory.createCandidate(source);
+        return resolver.withCandidate(source, definition,
+                () -> engine.sources().probe(definition));
+    }
+
+    /**
+     * 预构建单命名空间候选 Runtime，且不修改共享 Source Slot。
+     *
+     * @param source 候选数据源
+     * @param catalogName 即将发布的 Catalog 或 Schema
+     * @return 由调用方暂时持有的候选 Runtime
+     */
+    public PreparedSourceRuntime prepareCandidate(
+            DatacenterSource source,
+            String catalogName) {
+        FederationSourceDefinition definition =
+                definitionFactory.createCandidate(source, catalogName);
+        return resolver.withCandidate(source, definition,
+                () -> engine.sources().prepare(definition));
+    }
+
+    /**
+     * 使用当前持久化命名空间预构建候选 Runtime，且不修改共享 Source Slot。
+     *
+     * @param source 候选数据源
+     * @return 由调用方暂时持有的候选 Runtime
+     */
+    public PreparedSourceRuntime prepareCandidate(DatacenterSource source) {
+        FederationSourceDefinition definition = definitionFactory.create(source);
+        return resolver.withCandidate(source, definition,
+                () -> engine.sources().prepare(definition));
+    }
+
+    /**
+     * 原子接管已经通过业务 revision CAS 的候选 Runtime。
+     *
+     * @param prepared 预构建 Runtime
+     * @return Definition 应用结果
+     * @throws IllegalStateException Slot 已被更高版本或冲突版本占用时抛出
+     */
+    public SourceApplyResult commitPrepared(PreparedSourceRuntime prepared) {
+        SourceApplyResult result = engine.sources().commit(prepared);
+        if (result.status() == SourceApplyStatus.CONFLICT
+                || result.status() == SourceApplyStatus.IGNORED_STALE) {
+            throw new IllegalStateException(
+                    "prepared runtime was superseded before commit: " + result.status());
+        }
+        return result;
+    }
+
+    /**
+     * 应用已持久化 Definition。
+     *
+     * @param source 数据源当前快照
+     * @param prewarm 是否立即预热
+     * @return 应用结果
+     */
+    public SourceApplyResult apply(DatacenterSource source, boolean prewarm) {
+        FederationSourceDefinition definition = definitionFactory.create(source);
+        return engine.sources().apply(
+                definition,
+                prewarm ? SourceApplyOptions.prewarmNow() : SourceApplyOptions.lazy());
+    }
+
+    /**
+     * 应用禁用或删除墓碑。
+     *
+     * @param source 数据源当前快照
+     * @return 删除结果
+     */
+    public SourceRemoveResult remove(DatacenterSource source) {
+        return engine.sources().remove(SourceTombstone.of(
+                definitionFactory.sourceId(source),
+                source.getDefinitionRevision() == null ? 0L : source.getDefinitionRevision()));
+    }
+
+    /**
+     * 返回统一查询 Engine。
+     *
+     * @return Engine
+     */
+    public FederationSqlEngine engine() {
+        return engine;
+    }
+
+    /**
+     * 返回 Definition 工厂。
+     *
+     * @return Definition 工厂
+     */
+    public DatacenterFederationDefinitionFactory definitions() {
+        return definitionFactory;
+    }
+
+    /**
+     * 应用停止时关闭查询、计划缓存和所有 Runtime 句柄。
+     */
+    @PreDestroy
+    public void close() {
+        engine.close();
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationSourceStateProvider.java

@@ -0,0 +1,177 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.source.ActiveSourceState;
+import com.easyagents.federation.sql.source.FederationSourceState;
+import com.easyagents.federation.sql.source.FederationSourceStateProvider;
+import com.easyagents.federation.sql.source.SourceId;
+import com.easyagents.federation.sql.source.SourceStateSubscription;
+import com.easyagents.federation.sql.source.SourceTombstone;
+import com.mybatisflex.core.query.QueryWrapper;
+import java.math.BigInteger;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.function.Consumer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+import tech.easyflow.datacenter.mapper.DatacenterSourceMapper;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceType;
+
+/**
+ * 数据库权威、Redis 仅提示的 Federation Source State Provider。
+ */
+@Component
+public class DatacenterFederationSourceStateProvider implements FederationSourceStateProvider {
+
+    private static final Logger log = LoggerFactory.getLogger(DatacenterFederationSourceStateProvider.class);
+
+    private final DatacenterSourceMapper sourceMapper;
+    private final DatacenterFederationDefinitionFactory definitionFactory;
+    private final CopyOnWriteArrayList<Consumer<FederationSourceState>> subscribers =
+            new CopyOnWriteArrayList<>();
+
+    /**
+     * 创建状态 Provider。
+     *
+     * @param sourceMapper 数据源 Mapper
+     * @param definitionFactory Definition 工厂
+     */
+    public DatacenterFederationSourceStateProvider(
+            DatacenterSourceMapper sourceMapper,
+            DatacenterFederationDefinitionFactory definitionFactory) {
+        this.sourceMapper = sourceMapper;
+        this.definitionFactory = definitionFactory;
+    }
+
+    /**
+     * 从数据库读取指定数据源的最新 Definition 或墓碑。
+     *
+     * @param sourceId Federation SourceId
+     * @return 当前共享状态
+     */
+    @Override
+    public Optional<FederationSourceState> find(SourceId sourceId) {
+        BigInteger recordId = parseRecordId(sourceId);
+        if (recordId == null) {
+            return Optional.empty();
+        }
+        return toState(sourceMapper.selectOneById(recordId));
+    }
+
+    /**
+     * 加载当前数据库上下文中可见的外部数据源快照。
+     *
+     * @return Definition 与墓碑集合
+     */
+    @Override
+    public Collection<FederationSourceState> loadSnapshot() {
+        QueryWrapper query = QueryWrapper.create()
+                .in(DatacenterSource::getSourceType, List.of(
+                        DatacenterSourceType.MYSQL.name(),
+                        DatacenterSourceType.POSTGRESQL.name()))
+                .in(DatacenterSource::getStatus, List.of(
+                        DatacenterSourceStatus.DRAFT.code(),
+                        DatacenterSourceStatus.READY.code(),
+                        DatacenterSourceStatus.DEGRADED.code(),
+                        DatacenterSourceStatus.DISABLED.code(),
+                        DatacenterSourceStatus.DELETED.code()));
+        List<DatacenterSource> sources = sourceMapper.selectListByQuery(query);
+        Map<BigInteger, com.easyagents.federation.sql.source.FederationSourceDefinition> definitions =
+                definitionFactory.createBatch(sources.stream()
+                        .filter(this::isActive)
+                        .toList());
+        return sources.stream()
+                .map(source -> toState(source, definitions.get(source.getId())))
+                .flatMap(Optional::stream)
+                .toList();
+    }
+
+    /**
+     * 注册节点本地变更消费者。
+     *
+     * @param consumer 状态消费者
+     * @return 可关闭订阅
+     */
+    @Override
+    public SourceStateSubscription subscribe(Consumer<FederationSourceState> consumer) {
+        subscribers.add(consumer);
+        return () -> subscribers.remove(consumer);
+    }
+
+    /**
+     * 响应无凭据 Redis 提示，从数据库重读并发布最新状态。
+     *
+     * @param sourceId Federation SourceId
+     */
+    public void refresh(SourceId sourceId) {
+        find(sourceId).ifPresent(state -> subscribers.forEach(consumer -> consumer.accept(state)));
+    }
+
+    /**
+     * 周期性回源数据库，弥补 Redis Pub/Sub 在节点离线或网络抖动时可能丢失的提示。
+     */
+    @Scheduled(fixedDelayString = "${easyflow.datacenter.federation-reconcile-ms:30000}")
+    public void reconcile() {
+        try {
+            loadSnapshot().forEach(state -> subscribers.forEach(consumer -> consumer.accept(state)));
+        } catch (RuntimeException exception) {
+            log.warn("Failed to reconcile datacenter Federation source states", exception);
+        }
+    }
+
+    private Optional<FederationSourceState> toState(DatacenterSource source) {
+        return toState(source, null);
+    }
+
+    private Optional<FederationSourceState> toState(
+            DatacenterSource source,
+            com.easyagents.federation.sql.source.FederationSourceDefinition preloadedDefinition) {
+        if (source == null || source.getId() == null) {
+            return Optional.empty();
+        }
+        DatacenterSourceStatus status = DatacenterSourceStatus.fromCode(source.getStatus());
+        long revision = source.getDefinitionRevision() == null ? 0L : source.getDefinitionRevision();
+        if (status == DatacenterSourceStatus.READY || status == DatacenterSourceStatus.DEGRADED) {
+            if (revision <= 0L) {
+                return Optional.empty();
+            }
+            return Optional.of(ActiveSourceState.of(preloadedDefinition == null
+                    ? definitionFactory.create(source) : preloadedDefinition));
+        }
+        if ((status == DatacenterSourceStatus.DRAFT && revision > 0L)
+                || status == DatacenterSourceStatus.DISABLED
+                || status == DatacenterSourceStatus.DELETED) {
+            return Optional.of(SourceTombstone.of(definitionFactory.sourceId(source), revision));
+        }
+        return Optional.empty();
+    }
+
+    private boolean isActive(DatacenterSource source) {
+        DatacenterSourceStatus status = source == null
+                ? DatacenterSourceStatus.DRAFT
+                : DatacenterSourceStatus.fromCode(source.getStatus());
+        return status == DatacenterSourceStatus.READY || status == DatacenterSourceStatus.DEGRADED;
+    }
+
+    private BigInteger parseRecordId(SourceId sourceId) {
+        if (sourceId == null) {
+            return null;
+        }
+        String value = sourceId.value();
+        int marker = value.lastIndexOf("-source-");
+        if (marker < 0) {
+            return null;
+        }
+        try {
+            return new BigInteger(value.substring(marker + "-source-".length()));
+        } catch (NumberFormatException ignored) {
+            return null;
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterFederationSqlPolicy.java

@@ -0,0 +1,859 @@
+package tech.easyflow.datacenter.federation;
+
+import com.easyagents.federation.sql.api.FederationSqlErrorCode;
+import com.easyagents.federation.sql.api.FederationSqlException;
+import com.easyagents.federation.sql.compile.FederationSqlPolicy;
+import com.easyagents.federation.sql.compile.SqlPolicyContext;
+import com.mybatisflex.core.query.QueryWrapper;
+import java.math.BigInteger;
+import java.util.ArrayDeque;
+import java.util.Collections;
+import java.util.Deque;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.IdentityHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentLinkedQueue;
+import org.apache.calcite.rel.RelNode;
+import org.apache.calcite.rel.RelVisitor;
+import org.apache.calcite.rel.core.TableScan;
+import org.apache.calcite.sql.SqlIdentifier;
+import org.apache.calcite.sql.SqlCall;
+import org.apache.calcite.sql.SqlKind;
+import org.apache.calcite.sql.SqlJoin;
+import org.apache.calcite.sql.SqlNode;
+import org.apache.calcite.sql.SqlNodeList;
+import org.apache.calcite.sql.SqlOrderBy;
+import org.apache.calcite.sql.SqlSelect;
+import org.apache.calcite.sql.SqlWith;
+import org.apache.calcite.sql.SqlWithItem;
+import org.apache.calcite.sql.util.SqlBasicVisitor;
+import org.springframework.stereotype.Component;
+import tech.easyflow.datacenter.entity.DatacenterTable;
+import tech.easyflow.datacenter.entity.DatacenterTableField;
+import tech.easyflow.datacenter.mapper.DatacenterCatalogMapper;
+import tech.easyflow.datacenter.mapper.DatacenterSourceMapper;
+import tech.easyflow.datacenter.mapper.DatacenterTableFieldMapper;
+import tech.easyflow.datacenter.mapper.DatacenterTableMapper;
+import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSensitivityLevel;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
+
+/**
+ * 将 Calcite 解析出的表与字段引用限制在当前数据源的可查询纳管范围内。
+ */
+@Component
+public class DatacenterFederationSqlPolicy implements FederationSqlPolicy {
+
+    private static final int MAX_POLICY_CACHE_ENTRIES = 512;
+
+    private final DatacenterTableMapper tableMapper;
+    private final DatacenterTableFieldMapper tableFieldMapper;
+    private final DatacenterCatalogMapper catalogMapper;
+    private final DatacenterSourceMapper sourceMapper;
+    private final Map<PolicyCacheKey, PolicySnapshot> policyCache = new ConcurrentHashMap<>();
+    private final ConcurrentLinkedQueue<PolicyCacheKey> policyCacheOrder = new ConcurrentLinkedQueue<>();
+
+    /**
+     * 创建业务 SQL Policy。
+     *
+     * @param tableMapper 表 Mapper
+     * @param tableFieldMapper 字段 Mapper
+     * @param catalogMapper 命名空间 Mapper
+     * @param sourceMapper 数据源 Mapper
+     */
+    public DatacenterFederationSqlPolicy(
+            DatacenterTableMapper tableMapper,
+            DatacenterTableFieldMapper tableFieldMapper,
+            DatacenterCatalogMapper catalogMapper,
+            DatacenterSourceMapper sourceMapper) {
+        this.tableMapper = tableMapper;
+        this.tableFieldMapper = tableFieldMapper;
+        this.catalogMapper = catalogMapper;
+        this.sourceMapper = sourceMapper;
+    }
+
+    /**
+     * 返回 Policy 代码版本。
+     *
+     * @return 稳定版本
+     */
+    @Override
+    public String version() {
+        return "xl01-wp1-v6";
+    }
+
+    /**
+     * 拒绝未纳管表、不可查询字段和任何尚未支持脱敏的敏感字段。
+     *
+     * @param context Calcite 策略上下文
+     */
+    @Override
+    public void validate(SqlPolicyContext context) {
+        if (context.request().queryScope().bindings().size() != 1
+                || context.referencedSources().size() != 1
+                || !context.referencedSources().contains(
+                        context.request().sourceId())) {
+            throw validationFailure("当前数据中枢尚未开放跨数据源授权范围");
+        }
+        BigInteger sourceId = parseRecordId(context.request().sourceId().value());
+        requireCurrentScopeRevision(
+                sourceId, context.request().policyVersion());
+        PolicyCacheKey cacheKey = new PolicyCacheKey(sourceId, context.request().policyVersion());
+        PolicySnapshot snapshot = cachedSnapshot(cacheKey);
+        Set<String> referencedNames = referencedTables(context.relRoot().rel);
+        Set<BigInteger> referencedTableIds = new LinkedHashSet<>();
+        for (String referencedName : referencedNames) {
+            Set<BigInteger> tableIds = snapshot.tableIdsByName().get(referencedName);
+            if (tableIds == null || tableIds.isEmpty()) {
+                throw validationFailure("SQL 引用了未纳管表: " + referencedName);
+            }
+            referencedTableIds.addAll(tableIds);
+        }
+        validatePhysicalColumns(context.relRoot().rel, snapshot);
+        validateFields(context, snapshot, referencedTableIds);
+    }
+
+    /**
+     * 直接核对数据库权威范围版本，避免跨节点通知延迟复用旧策略。
+     *
+     * @param sourceId 数据源记录 ID
+     * @param policyVersion 编译请求携带的范围版本
+     */
+    private void requireCurrentScopeRevision(
+            BigInteger sourceId,
+            String policyVersion) {
+        long requestedRevision = parseScopeRevision(policyVersion);
+        DatacenterSource current = sourceMapper.selectOneById(sourceId);
+        if (current == null
+                || DatacenterSourceStatus.fromCode(current.getStatus())
+                != DatacenterSourceStatus.READY
+                || current.getScopeRevision() == null
+                || current.getScopeRevision() != requestedRevision) {
+            throw validationFailure("数据范围已变化，请重新执行查询");
+        }
+    }
+
+    /**
+     * 解析范围策略版本。
+     *
+     * @param policyVersion 策略版本
+     * @return 范围 revision
+     */
+    private long parseScopeRevision(String policyVersion) {
+        if (policyVersion == null || !policyVersion.startsWith("scope-")) {
+            throw validationFailure("数据范围版本无效");
+        }
+        try {
+            return Long.parseLong(policyVersion.substring("scope-".length()));
+        } catch (NumberFormatException exception) {
+            throw validationFailure("数据范围版本无效");
+        }
+    }
+
+    private PolicySnapshot cachedSnapshot(PolicyCacheKey cacheKey) {
+        PolicySnapshot existing = policyCache.get(cacheKey);
+        if (existing != null) {
+            return existing;
+        }
+        PolicySnapshot loaded = loadSnapshot(cacheKey.sourceId());
+        PolicySnapshot raced = policyCache.putIfAbsent(cacheKey, loaded);
+        if (raced != null) {
+            return raced;
+        }
+        policyCacheOrder.add(cacheKey);
+        trimCache();
+        return loaded;
+    }
+
+    private void trimCache() {
+        while (policyCache.size() > MAX_POLICY_CACHE_ENTRIES) {
+            PolicyCacheKey eldest = policyCacheOrder.poll();
+            if (eldest == null) {
+                return;
+            }
+            policyCache.remove(eldest);
+        }
+    }
+
+    private PolicySnapshot loadSnapshot(BigInteger sourceId) {
+        QueryWrapper tableQuery = QueryWrapper.create()
+                .eq(DatacenterTable::getSourceId, sourceId)
+                .eq(DatacenterTable::getQueryable, 1)
+                .eq(DatacenterTable::getMetadataStatus, DatacenterMetadataStatus.ACTIVE.name());
+        List<DatacenterTable> tables = tableMapper.selectListByQuery(tableQuery);
+        if (tables.isEmpty()) {
+            return PolicySnapshot.empty();
+        }
+        Set<BigInteger> catalogIds = new HashSet<>();
+        Set<BigInteger> tableIds = new HashSet<>();
+        for (DatacenterTable table : tables) {
+            tableIds.add(table.getId());
+            if (table.getCatalogId() != null) {
+                catalogIds.add(table.getCatalogId());
+            }
+        }
+        Map<BigInteger, String> logicalSchemas = new HashMap<>();
+        if (!catalogIds.isEmpty()) {
+            QueryWrapper catalogQuery = QueryWrapper.create().in(DatacenterCatalog::getId, catalogIds);
+            for (DatacenterCatalog catalog : catalogMapper.selectListByQuery(catalogQuery)) {
+                logicalSchemas.put(catalog.getId(), catalog.getLogicalSchemaName());
+            }
+        }
+        Map<String, Set<BigInteger>> idsByName = new HashMap<>();
+        Set<String> tableReferenceNames = new HashSet<>();
+        for (DatacenterTable table : tables) {
+            addTableName(idsByName, tableReferenceNames, table.getTableName(), table.getId());
+            addTableName(idsByName, tableReferenceNames, table.getActualTable(), table.getId());
+            String schema = logicalSchemas.get(table.getCatalogId());
+            if (schema != null && !schema.isBlank()) {
+                addTableName(idsByName, tableReferenceNames, schema + "." + table.getTableName(), table.getId());
+                addTableName(idsByName, tableReferenceNames, schema + "." + table.getActualTable(), table.getId());
+            }
+        }
+
+        Map<BigInteger, ColumnPolicy> columnsByTable = new HashMap<>();
+        QueryWrapper fieldQuery = QueryWrapper.create().in(DatacenterTableField::getTableId, tableIds);
+        for (DatacenterTableField field : tableFieldMapper.selectListByQuery(fieldQuery)) {
+            ColumnPolicy columns = columnsByTable.computeIfAbsent(
+                    field.getTableId(), ignored -> ColumnPolicy.mutable());
+            String columnName = sourceColumnName(field);
+            if (columnName != null && !columnName.isBlank()) {
+                columns.knownExact().add(columnName);
+                columns.knownFolded().add(columnName.toUpperCase(Locale.ROOT));
+                if (fieldAllowed(field)) {
+                    columns.allowedExact().add(columnName);
+                    columns.allowedFolded().add(columnName.toUpperCase(Locale.ROOT));
+                }
+            }
+        }
+        Map<String, Set<BigInteger>> immutableNames = new HashMap<>();
+        idsByName.forEach((name, ids) -> immutableNames.put(name, Set.copyOf(ids)));
+        return new PolicySnapshot(
+                Map.copyOf(immutableNames),
+                immutableColumnPolicies(columnsByTable),
+                Set.copyOf(tableReferenceNames));
+    }
+
+    private Map<BigInteger, ColumnPolicy> immutableColumnPolicies(
+            Map<BigInteger, ColumnPolicy> mutablePolicies) {
+        Map<BigInteger, ColumnPolicy> immutable = new HashMap<>();
+        mutablePolicies.forEach((tableId, policy) -> immutable.put(tableId, new ColumnPolicy(
+                Set.copyOf(policy.knownExact()),
+                Set.copyOf(policy.knownFolded()),
+                Set.copyOf(policy.allowedExact()),
+                Set.copyOf(policy.allowedFolded()))));
+        return Map.copyOf(immutable);
+    }
+
+    private void validatePhysicalColumns(RelNode root, PolicySnapshot snapshot) {
+        new RelVisitor() {
+            @Override
+            public void visit(RelNode node, int ordinal, RelNode parent) {
+                if (node instanceof TableScan scan) {
+                    String referencedName = referencedTableName(scan);
+                    Set<BigInteger> tableIds = snapshot.tableIdsByName().get(referencedName);
+                    if (tableIds == null || tableIds.isEmpty()) {
+                        throw validationFailure("SQL 引用了未纳管表: " + referencedName);
+                    }
+                    for (BigInteger tableId : tableIds) {
+                        ColumnPolicy policy = snapshot.columnsByTable().get(tableId);
+                        if (policy == null || policy.knownExact().isEmpty()) {
+                            throw validationFailure("数据表尚未纳管任何字段: " + referencedName);
+                        }
+                        for (String fieldName : scan.getRowType().getFieldNames()) {
+                            if (!policy.knownExact().contains(fieldName)
+                                    && !policy.knownFolded().contains(fieldName.toUpperCase(Locale.ROOT))) {
+                                throw validationFailure("物理表包含尚未纳管的字段: " + fieldName);
+                            }
+                        }
+                    }
+                }
+                super.visit(node, ordinal, parent);
+            }
+        }.go(root);
+    }
+
+    private void validateFields(
+            SqlPolicyContext context,
+        PolicySnapshot snapshot,
+        Set<BigInteger> referencedTableIds) {
+        Deque<AliasContext> scopes = new ArrayDeque<>();
+        Map<String, DerivedRelation> commonTables = collectCommonTables(
+                context.validatedSql(), snapshot, referencedTableIds);
+        context.validatedSql().accept(new SqlBasicVisitor<Void>() {
+            @Override
+            public Void visit(SqlCall call) {
+                AliasContext scope = scopeFor(
+                        call, snapshot, referencedTableIds, commonTables);
+                if (scope == null) {
+                    return super.visit(call);
+                }
+                scopes.push(scope);
+                try {
+                    return super.visit(call);
+                } finally {
+                    scopes.pop();
+                }
+            }
+
+            @Override
+            public Void visit(SqlIdentifier identifier) {
+                if (scopes.isEmpty()) {
+                    return null;
+                }
+                AliasContext aliasContext = scopes.peek();
+                if (aliasContext.syntaxAliases().contains(identifier)
+                        || aliasContext.tableIdentifiers().contains(identifier)
+                        || aliasContext.outputAliasReferences().contains(identifier)) {
+                    return null;
+                }
+                if (identifier.isStar()) {
+                    boolean allAllowed = referencedTableIds.stream()
+                            .map(snapshot.columnsByTable()::get)
+                            .allMatch(policy -> policy != null
+                                    && policy.knownExact().equals(policy.allowedExact()));
+                    if (!allAllowed) {
+                        throw validationFailure("查询范围包含不可查询或敏感字段，请显式选择允许字段");
+                    }
+                    return null;
+                }
+                List<String> names = identifier.names;
+                if (names.isEmpty()) {
+                    return null;
+                }
+                int last = names.size() - 1;
+                String columnName = names.get(last);
+                boolean quoted = identifier.isComponentQuoted(last);
+                if (derivedColumnReference(identifier, aliasContext)) {
+                    return null;
+                }
+                Set<BigInteger> targetTableIds = resolveColumnTables(
+                        identifier, snapshot, referencedTableIds, aliasContext);
+                boolean allowed = !targetTableIds.isEmpty() && targetTableIds.stream()
+                        .allMatch(tableId -> columnAllowed(
+                                snapshot.columnsByTable().get(tableId), columnName, quoted));
+                if (!allowed) {
+                    throw validationFailure("SQL 引用了不可查询或敏感字段: " + columnName);
+                }
+                return null;
+            }
+        });
+    }
+
+    private AliasContext scopeFor(
+            SqlCall call,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds,
+            Map<String, DerivedRelation> commonTables) {
+        if (call instanceof SqlOrderBy orderBy
+                && orderBy.query instanceof SqlSelect select) {
+            return collectAliases(
+                    select, orderBy.orderList, snapshot,
+                    referencedTableIds, commonTables);
+        }
+        if (call instanceof SqlSelect select) {
+            return collectAliases(
+                    select, null, snapshot, referencedTableIds, commonTables);
+        }
+        return null;
+    }
+
+    private boolean derivedColumnReference(
+            SqlIdentifier identifier,
+            AliasContext aliasContext) {
+        List<String> names = identifier.names;
+        int columnIndex = names.size() - 1;
+        String columnKey = identifierKey(
+                names.get(columnIndex),
+                identifier.isComponentQuoted(columnIndex));
+        if (names.size() == 1) {
+            return aliasContext.unqualifiedDerivedColumns().contains(columnKey);
+        }
+        int qualifierIndex = names.size() - 2;
+        String qualifierKey = identifierKey(
+                names.get(qualifierIndex),
+                identifier.isComponentQuoted(qualifierIndex));
+        Set<String> derivedColumns = aliasContext
+                .derivedColumnsByAlias().get(qualifierKey);
+        return derivedColumns != null && derivedColumns.contains(columnKey);
+    }
+
+    private Set<BigInteger> resolveColumnTables(
+            SqlIdentifier identifier,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds,
+            AliasContext aliasContext) {
+        List<String> identifierNames = identifier.names;
+        if (identifierNames.size() >= 2) {
+            int qualifierIndex = identifierNames.size() - 2;
+            String qualifier = identifierNames.get(qualifierIndex);
+            Set<BigInteger> aliased = aliasContext.tableIdsByAlias().get(
+                    identifierKey(qualifier, identifier.isComponentQuoted(qualifierIndex)));
+            if (aliased != null && !aliased.isEmpty()) {
+                return aliased;
+            }
+            Set<BigInteger> qualified = snapshot.tableIdsByName().get(qualifier);
+            if (qualified != null && !qualified.isEmpty()) {
+                Set<BigInteger> referencedQualified = new LinkedHashSet<>(qualified);
+                referencedQualified.retainAll(referencedTableIds);
+                if (!referencedQualified.isEmpty()) {
+                    return referencedQualified;
+                }
+            }
+        }
+        if (referencedTableIds.size() == 1) {
+            return referencedTableIds;
+        }
+        // 无法将别名还原到单表时采用交集语义，避免多表同名列扩大权限。
+        return referencedTableIds;
+    }
+
+    private AliasContext collectAliases(
+            SqlSelect select,
+            SqlNodeList externalOrderList,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds,
+            Map<String, DerivedRelation> commonTables) {
+        Map<String, Set<BigInteger>> tableIdsByAlias = new HashMap<>();
+        Map<String, Set<String>> derivedColumnsByAlias = new HashMap<>();
+        Set<String> outputAliases = new HashSet<>();
+        Set<SqlIdentifier> syntaxAliases = Collections.newSetFromMap(
+                new IdentityHashMap<>());
+        Set<SqlIdentifier> tableIdentifiers = Collections.newSetFromMap(
+                new IdentityHashMap<>());
+        Set<SqlIdentifier> outputAliasReferences = Collections.newSetFromMap(
+                new IdentityHashMap<>());
+        collectOutputAliases(
+                select, outputAliases, syntaxAliases, outputAliasReferences);
+        FromSummary fromSummary = collectFrom(
+                select.getFrom(), snapshot, referencedTableIds,
+                commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                syntaxAliases, tableIdentifiers);
+        markOutputAliasReferences(
+                externalOrderList, outputAliases, outputAliasReferences);
+        return new AliasContext(
+                Map.copyOf(tableIdsByAlias),
+                Map.copyOf(derivedColumnsByAlias),
+                fromSummary.singleDerived()
+                        ? fromSummary.outputColumns() : Set.of(),
+                Set.copyOf(outputAliases),
+                syntaxAliases,
+                tableIdentifiers,
+                outputAliasReferences);
+    }
+
+    private void collectOutputAliases(
+            SqlSelect select,
+            Set<String> outputAliases,
+            Set<SqlIdentifier> syntaxAliases,
+            Set<SqlIdentifier> outputAliasReferences) {
+        if (select.getSelectList() == null) {
+            return;
+        }
+        for (SqlNode item : select.getSelectList()) {
+            if (!(item instanceof SqlCall call)
+                    || call.getKind() != SqlKind.AS
+                    || call.operandCount() < 2
+                    || !(call.operand(1) instanceof SqlIdentifier alias)
+                    || alias.names.isEmpty()) {
+                continue;
+            }
+            int aliasIndex = alias.names.size() - 1;
+            outputAliases.add(identifierKey(
+                    alias.names.get(aliasIndex),
+                    alias.isComponentQuoted(aliasIndex)));
+            syntaxAliases.add(alias);
+        }
+        markOutputAliasReferences(
+                select.getOrderList(), outputAliases, outputAliasReferences);
+        markOutputAliasReferences(
+                select.getGroup(), outputAliases, outputAliasReferences);
+    }
+
+    private void markOutputAliasReferences(
+            SqlNode node,
+            Set<String> outputAliases,
+            Set<SqlIdentifier> outputAliasReferences) {
+        if (node == null) {
+            return;
+        }
+        if (node instanceof SqlNodeList nodes) {
+            for (SqlNode item : nodes) {
+                markOutputAliasReferences(item, outputAliases, outputAliasReferences);
+            }
+            return;
+        }
+        if (node instanceof SqlIdentifier identifier && identifier.names.size() == 1) {
+            if (outputAliases.contains(identifierKey(
+                    identifier.names.get(0), identifier.isComponentQuoted(0)))) {
+                outputAliasReferences.add(identifier);
+            }
+            return;
+        }
+        if (node instanceof SqlCall call
+                && (call.getKind() == SqlKind.DESCENDING
+                || call.getKind() == SqlKind.NULLS_FIRST
+                || call.getKind() == SqlKind.NULLS_LAST)
+                && call.operandCount() > 0) {
+            markOutputAliasReferences(
+                    call.operand(0), outputAliases, outputAliasReferences);
+        }
+    }
+
+    private FromSummary collectFrom(
+            SqlNode from,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds,
+            Map<String, DerivedRelation> commonTables,
+            Map<String, Set<BigInteger>> tableIdsByAlias,
+            Map<String, Set<String>> derivedColumnsByAlias,
+            Set<SqlIdentifier> syntaxAliases,
+            Set<SqlIdentifier> tableIdentifiers) {
+        if (from == null) {
+            return FromSummary.empty();
+        }
+        if (from instanceof SqlIdentifier identifier) {
+            tableIdentifiers.add(identifier);
+            String relationKey = identifierKey(
+                    identifier.names.get(identifier.names.size() - 1),
+                    identifier.isComponentQuoted(identifier.names.size() - 1));
+            DerivedRelation commonTable = commonTables.get(relationKey);
+            if (commonTable != null) {
+                tableIdsByAlias.put(relationKey, commonTable.tableIds());
+                derivedColumnsByAlias.put(
+                        relationKey, commonTable.outputColumns());
+                return new FromSummary(
+                        commonTable.tableIds(), commonTable.outputColumns(), true);
+            }
+            return new FromSummary(
+                    resolveReferencedTableIds(
+                            identifier, snapshot, referencedTableIds),
+                    Set.of(),
+                    false);
+        }
+        if (!(from instanceof SqlCall call)) {
+            return FromSummary.empty();
+        }
+        if (call instanceof SqlSelect nestedSelect) {
+            FromSummary nested = collectFrom(
+                    nestedSelect.getFrom(), snapshot, referencedTableIds,
+                    commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                    syntaxAliases, tableIdentifiers);
+            return new FromSummary(
+                    nested.tableIds(), outputColumnKeys(nestedSelect), true);
+        }
+        if (call instanceof SqlJoin join) {
+            FromSummary left = collectFrom(
+                    join.getLeft(), snapshot, referencedTableIds,
+                    commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                    syntaxAliases, tableIdentifiers);
+            FromSummary right = collectFrom(
+                    join.getRight(), snapshot, referencedTableIds,
+                    commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                    syntaxAliases, tableIdentifiers);
+            Set<BigInteger> tableIds = new LinkedHashSet<>(left.tableIds());
+            tableIds.addAll(right.tableIds());
+            return new FromSummary(Set.copyOf(tableIds), Set.of(), false);
+        }
+        if (call.getKind() == SqlKind.AS && call.operandCount() >= 2) {
+            SqlNode relationNode = call.operand(0);
+            FromSummary relation = collectFrom(
+                    relationNode, snapshot, referencedTableIds,
+                    commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                    syntaxAliases, tableIdentifiers);
+            SqlNode aliasNode = call.operand(1);
+            if (aliasNode instanceof SqlIdentifier alias && !alias.names.isEmpty()) {
+                int aliasIndex = alias.names.size() - 1;
+                String aliasKey = identifierKey(
+                        alias.names.get(aliasIndex),
+                        alias.isComponentQuoted(aliasIndex));
+                syntaxAliases.add(alias);
+                if (!relation.tableIds().isEmpty()) {
+                    tableIdsByAlias.merge(aliasKey, relation.tableIds(), (left, right) -> {
+                        Set<BigInteger> merged = new LinkedHashSet<>(left);
+                        merged.addAll(right);
+                        return Set.copyOf(merged);
+                    });
+                }
+                if (relation.singleDerived()
+                        && !relation.outputColumns().isEmpty()) {
+                    derivedColumnsByAlias.put(
+                            aliasKey, relation.outputColumns());
+                }
+            }
+            return relation;
+        }
+        if (call instanceof SqlOrderBy orderBy) {
+            return collectFrom(
+                    orderBy.query, snapshot, referencedTableIds,
+                    commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                    syntaxAliases, tableIdentifiers);
+        }
+        if (call instanceof SqlWith sqlWith) {
+            return collectFrom(
+                    sqlWith.body, snapshot, referencedTableIds,
+                    commonTables, tableIdsByAlias, derivedColumnsByAlias,
+                    syntaxAliases, tableIdentifiers);
+        }
+        return FromSummary.empty();
+    }
+
+    private Map<String, DerivedRelation> collectCommonTables(
+            SqlNode root,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds) {
+        Map<String, DerivedRelation> commonTables = new HashMap<>();
+        collectCommonTables(
+                root, snapshot, referencedTableIds, commonTables);
+        return Map.copyOf(commonTables);
+    }
+
+    private void collectCommonTables(
+            SqlNode node,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds,
+            Map<String, DerivedRelation> commonTables) {
+        if (node instanceof SqlOrderBy orderBy) {
+            collectCommonTables(
+                    orderBy.query, snapshot, referencedTableIds, commonTables);
+            return;
+        }
+        if (!(node instanceof SqlWith sqlWith)) {
+            return;
+        }
+        for (SqlNode withNode : sqlWith.withList) {
+            if (!(withNode instanceof SqlWithItem withItem)
+                    || withItem.name == null
+                    || withItem.name.names.isEmpty()) {
+                continue;
+            }
+            collectCommonTables(
+                    withItem.query, snapshot, referencedTableIds, commonTables);
+            SqlSelect select = selectBody(withItem.query);
+            if (select == null) {
+                continue;
+            }
+            FromSummary source = collectFrom(
+                    select.getFrom(), snapshot, referencedTableIds,
+                    commonTables, new HashMap<>(), new HashMap<>(),
+                    Collections.newSetFromMap(new IdentityHashMap<>()),
+                    Collections.newSetFromMap(new IdentityHashMap<>()));
+            Set<String> outputColumns = withItem.columnList == null
+                    || withItem.columnList.isEmpty()
+                    ? outputColumnKeys(select)
+                    : identifierKeys(withItem.columnList);
+            int nameIndex = withItem.name.names.size() - 1;
+            commonTables.put(
+                    identifierKey(
+                            withItem.name.names.get(nameIndex),
+                            withItem.name.isComponentQuoted(nameIndex)),
+                    new DerivedRelation(
+                            source.tableIds(), outputColumns));
+        }
+        collectCommonTables(
+                sqlWith.body, snapshot, referencedTableIds, commonTables);
+    }
+
+    private SqlSelect selectBody(SqlNode node) {
+        if (node instanceof SqlSelect select) {
+            return select;
+        }
+        if (node instanceof SqlOrderBy orderBy) {
+            return selectBody(orderBy.query);
+        }
+        if (node instanceof SqlWith sqlWith) {
+            return selectBody(sqlWith.body);
+        }
+        return null;
+    }
+
+    private Set<String> outputColumnKeys(SqlNode query) {
+        SqlSelect select = selectBody(query);
+        if (select == null || select.getSelectList() == null) {
+            return Set.of();
+        }
+        Set<String> outputColumns = new LinkedHashSet<>();
+        for (SqlNode item : select.getSelectList()) {
+            if (item instanceof SqlCall call
+                    && call.getKind() == SqlKind.AS
+                    && call.operandCount() >= 2
+                    && call.operand(1) instanceof SqlIdentifier alias
+                    && !alias.names.isEmpty()) {
+                int index = alias.names.size() - 1;
+                outputColumns.add(identifierKey(
+                        alias.names.get(index),
+                        alias.isComponentQuoted(index)));
+                continue;
+            }
+            if (item instanceof SqlIdentifier identifier
+                    && !identifier.isStar()
+                    && !identifier.names.isEmpty()) {
+                int index = identifier.names.size() - 1;
+                outputColumns.add(identifierKey(
+                        identifier.names.get(index),
+                        identifier.isComponentQuoted(index)));
+            }
+        }
+        return Set.copyOf(outputColumns);
+    }
+
+    private Set<String> identifierKeys(SqlNodeList identifiers) {
+        Set<String> keys = new LinkedHashSet<>();
+        for (SqlNode node : identifiers) {
+            if (node instanceof SqlIdentifier identifier
+                    && !identifier.names.isEmpty()) {
+                int index = identifier.names.size() - 1;
+                keys.add(identifierKey(
+                        identifier.names.get(index),
+                        identifier.isComponentQuoted(index)));
+            }
+        }
+        return Set.copyOf(keys);
+    }
+
+    private Set<BigInteger> resolveReferencedTableIds(
+            SqlIdentifier identifier,
+            PolicySnapshot snapshot,
+            Set<BigInteger> referencedTableIds) {
+        Set<BigInteger> candidates = snapshot.tableIdsByName().get(
+                String.join(".", identifier.names));
+        if (candidates == null || candidates.isEmpty()) {
+            return Set.of();
+        }
+        Set<BigInteger> referenced = new LinkedHashSet<>(candidates);
+        referenced.retainAll(referencedTableIds);
+        return Set.copyOf(referenced);
+    }
+
+    private String identifierKey(String name, boolean quoted) {
+        return quoted ? "Q:" + name : "U:" + name.toUpperCase(Locale.ROOT);
+    }
+
+    private boolean columnAllowed(ColumnPolicy policy, String columnName, boolean quoted) {
+        if (policy == null) {
+            return false;
+        }
+        return quoted
+                ? policy.allowedExact().contains(columnName)
+                : policy.allowedFolded().contains(columnName.toUpperCase(Locale.ROOT));
+    }
+
+    private boolean fieldAllowed(DatacenterTableField field) {
+        return Integer.valueOf(1).equals(field.getQueryable())
+                && DatacenterMetadataStatus.ACTIVE.name().equals(field.getMetadataStatus())
+                && DatacenterSensitivityLevel.PUBLIC.name().equals(field.getSensitivityLevel());
+    }
+
+    private void addTableName(
+            Map<String, Set<BigInteger>> idsByName,
+            Set<String> tableReferenceNames,
+            String name,
+            BigInteger tableId) {
+        if (name == null || name.isBlank()) {
+            return;
+        }
+        idsByName.computeIfAbsent(name, ignored -> new LinkedHashSet<>()).add(tableId);
+        tableReferenceNames.add(name);
+    }
+
+    private Set<String> referencedTables(RelNode root) {
+        Set<String> names = new LinkedHashSet<>();
+        new RelVisitor() {
+            @Override
+            public void visit(RelNode node, int ordinal, RelNode parent) {
+                if (node instanceof TableScan scan) {
+                    names.add(referencedTableName(scan));
+                }
+                super.visit(node, ordinal, parent);
+            }
+        }.go(root);
+        return names;
+    }
+
+    private String referencedTableName(TableScan scan) {
+        List<String> qualified = scan.getTable().getQualifiedName();
+        if (qualified.isEmpty()) {
+            return "";
+        }
+        String table = qualified.get(qualified.size() - 1);
+        return qualified.size() >= 2
+                ? qualified.get(qualified.size() - 2) + "." + table
+                : table;
+    }
+
+    private BigInteger parseRecordId(String sourceId) {
+        int marker = sourceId.lastIndexOf("-source-");
+        if (marker < 0) {
+            throw new FederationSqlException(
+                    FederationSqlErrorCode.INVALID_ARGUMENT,
+                    "invalid data source id");
+        }
+        return new BigInteger(sourceId.substring(marker + "-source-".length()));
+    }
+
+    private String sourceColumnName(DatacenterTableField field) {
+        return field.getSourceColumnName() == null || field.getSourceColumnName().isBlank()
+                ? field.getFieldName() : field.getSourceColumnName();
+    }
+
+    private FederationSqlException validationFailure(String message) {
+        return new FederationSqlException(FederationSqlErrorCode.SQL_VALIDATION_FAILED, message);
+    }
+
+    private record PolicyCacheKey(BigInteger sourceId, String policyVersion) {
+    }
+
+    private record AliasContext(
+            Map<String, Set<BigInteger>> tableIdsByAlias,
+            Map<String, Set<String>> derivedColumnsByAlias,
+            Set<String> unqualifiedDerivedColumns,
+            Set<String> outputAliases,
+            Set<SqlIdentifier> syntaxAliases,
+            Set<SqlIdentifier> tableIdentifiers,
+            Set<SqlIdentifier> outputAliasReferences) {
+    }
+
+    private record DerivedRelation(
+            Set<BigInteger> tableIds,
+            Set<String> outputColumns) {
+    }
+
+    private record FromSummary(
+            Set<BigInteger> tableIds,
+            Set<String> outputColumns,
+            boolean singleDerived) {
+
+        private static FromSummary empty() {
+            return new FromSummary(Set.of(), Set.of(), false);
+        }
+    }
+
+    private record ColumnPolicy(
+            Set<String> knownExact,
+            Set<String> knownFolded,
+            Set<String> allowedExact,
+            Set<String> allowedFolded) {
+
+        private static ColumnPolicy mutable() {
+            return new ColumnPolicy(new HashSet<>(), new HashSet<>(), new HashSet<>(), new HashSet<>());
+        }
+    }
+
+    private record PolicySnapshot(
+            Map<String, Set<BigInteger>> tableIdsByName,
+            Map<BigInteger, ColumnPolicy> columnsByTable,
+            Set<String> tableReferenceNames) {
+
+        private static PolicySnapshot empty() {
+            return new PolicySnapshot(Map.of(), Map.of(), Set.of());
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/federation/DatacenterMetadataIdentity.java

@@ -0,0 +1,174 @@
+package tech.easyflow.datacenter.federation;
+
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+import java.util.List;
+import tech.easyflow.datacenter.entity.DatacenterTableField;
+
+/**
+ * 使用 presence 与长度前缀生成稳定元数据摘要。
+ */
+public final class DatacenterMetadataIdentity {
+
+    private DatacenterMetadataIdentity() {
+    }
+
+    /**
+     * 计算物理命名空间摘要。
+     *
+     * @param catalog 物理 Catalog
+     * @param schema 物理 Schema
+     * @return SHA-256 摘要
+     */
+    public static String namespaceKey(String catalog, String schema) {
+        return digest(List.of(nullable(catalog), nullable(schema)));
+    }
+
+    /**
+     * 计算物理表身份摘要。
+     *
+     * @param sourceId 数据源 ID
+     * @param namespaceKey 命名空间摘要
+     * @param physicalTable 物理表名
+     * @param tableKind 对象类型
+     * @return SHA-256 摘要
+     */
+    public static String tableIdentity(
+            String sourceId,
+            String namespaceKey,
+            String physicalTable,
+            String tableKind) {
+        return digest(List.of(
+                "table-v1",
+                nullable(sourceId),
+                nullable(namespaceKey),
+                nullable(physicalTable),
+                nullable(tableKind)));
+    }
+
+    /**
+     * 计算表结构观测摘要。
+     *
+     * @param tableName 表名
+     * @param tableKind 对象类型
+     * @param fields 按 JDBC 顺序排列的字段
+     * @return SHA-256 摘要
+     */
+    public static String tableFingerprint(
+            String tableName,
+            String tableKind,
+            List<DatacenterTableField> fields) {
+        MessageDigest digest = newDigest();
+        update(digest, "table-metadata-v1");
+        update(digest, nullable(tableName));
+        update(digest, nullable(tableKind));
+        List<DatacenterTableField> safeFields = fields == null ? List.of() : fields;
+        digest.update(ByteBuffer.allocate(Integer.BYTES).putInt(safeFields.size()).array());
+        for (DatacenterTableField field : safeFields) {
+            update(digest, nullable(field.getSourceColumnName()));
+            update(digest, nullable(field.getNativeTypeName()));
+            update(digest, nullable(field.getJdbcTypeCode()));
+            update(digest, nullable(field.getPrecision()));
+            update(digest, nullable(field.getScale()));
+            update(digest, nullable(field.getRequired()));
+        }
+        return HexFormat.of().formatHex(digest.digest());
+    }
+
+    /**
+     * 计算单字段元数据摘要。
+     *
+     * @param field 字段元数据
+     * @return SHA-256 摘要
+     */
+    public static String fieldFingerprint(DatacenterTableField field) {
+        return digest(List.of(
+                "field-v1",
+                nullable(field.getSourceColumnName()),
+                nullable(field.getNativeTypeName()),
+                nullable(field.getJdbcTypeCode()),
+                nullable(field.getPrecision()),
+                nullable(field.getScale()),
+                nullable(field.getRequired())));
+    }
+
+    /**
+     * 复现 V58 的存量表身份回填算法，仅用于首次刷新时识别可安全升级的旧摘要。
+     *
+     * @param sourceId 数据源 ID
+     * @param catalogId 目录 ID
+     * @param physicalTable 物理表名
+     * @param tableKind 表类型
+     * @return V58 SHA-256 摘要
+     */
+    public static String legacyV58TableIdentity(
+            Object sourceId,
+            Object catalogId,
+            String physicalTable,
+            String tableKind) {
+        String source = sourceId == null ? "0" : String.valueOf(sourceId);
+        String catalog = catalogId == null ? "0" : String.valueOf(catalogId);
+        String table = physicalTable == null ? "" : physicalTable;
+        String kind = tableKind == null ? "" : tableKind;
+        return rawDigest("S" + codePointLength(source) + ":" + source
+                + "C" + codePointLength(catalog) + ":" + catalog
+                + "T" + codePointLength(table) + ":" + table
+                + "K" + codePointLength(kind) + ":" + kind);
+    }
+
+    /**
+     * 复现 V58 的存量表结构摘要回填算法。
+     *
+     * @param tableName 表名
+     * @param tableKind 表类型
+     * @return V58 SHA-256 摘要
+     */
+    public static String legacyV58TableFingerprint(String tableName, String tableKind) {
+        String table = tableName == null ? "" : tableName;
+        String kind = tableKind == null ? "" : tableKind;
+        return rawDigest(codePointLength(table) + ":" + table
+                + codePointLength(kind) + ":" + kind);
+    }
+
+    private static int codePointLength(String value) {
+        return value.codePointCount(0, value.length());
+    }
+
+    private static String rawDigest(String value) {
+        MessageDigest digest = newDigest();
+        return HexFormat.of().formatHex(digest.digest(value.getBytes(StandardCharsets.UTF_8)));
+    }
+
+    private static String digest(List<String> values) {
+        MessageDigest digest = newDigest();
+        for (String value : values) {
+            update(digest, value);
+        }
+        return HexFormat.of().formatHex(digest.digest());
+    }
+
+    private static void update(MessageDigest digest, String value) {
+        byte[] bytes = value.getBytes(StandardCharsets.UTF_8);
+        digest.update(ByteBuffer.allocate(Integer.BYTES).putInt(bytes.length).array());
+        digest.update(bytes);
+    }
+
+    private static String nullable(Object value) {
+        if (value == null) {
+            return "N";
+        }
+        String text = String.valueOf(value);
+        return "V" + text.length() + ":" + text;
+    }
+
+    private static MessageDigest newDigest() {
+        try {
+            return MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException exception) {
+            throw new IllegalStateException("SHA-256 is not available", exception);
+        }
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/integration/AssistantDatacenterBridge.java

@@ -1,7 +1,18 @@
 package tech.easyflow.datacenter.integration;
 
+import tech.easyflow.common.entity.LoginAccount;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryRequest;
 
 public interface AssistantDatacenterBridge {
-    AssistantDatacenterResult queryPage(DatacenterQueryRequest request);
+
+    /**
+     * 使用明确执行账号查询数据中枢。
+     *
+     * @param request 查询请求
+     * @param account 执行账号
+     * @return 查询结果
+     */
+    AssistantDatacenterResult queryPage(
+            DatacenterQueryRequest request,
+            LoginAccount account);
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/integration/AssistantDatacenterResult.java

@@ -4,7 +4,7 @@ import com.mybatisflex.core.row.Row;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
 import tech.easyflow.datacenter.meta.entity.DatacenterDatasetVersion;
-import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceView;
 
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -13,7 +13,7 @@ import java.util.Map;
 
 public class AssistantDatacenterResult {
     private List<Row> rows = new ArrayList<>();
-    private DatacenterSource source;
+    private DatacenterSourceView source;
     private DatacenterCatalog catalog;
     private DatacenterTable table;
     private DatacenterDatasetVersion version;
@@ -21,8 +21,8 @@ public class AssistantDatacenterResult {
 
     public List<Row> getRows() { return rows; }
     public void setRows(List<Row> rows) { this.rows = rows; }
-    public DatacenterSource getSource() { return source; }
-    public void setSource(DatacenterSource source) { this.source = source; }
+    public DatacenterSourceView getSource() { return source; }
+    public void setSource(DatacenterSourceView source) { this.source = source; }
     public DatacenterCatalog getCatalog() { return catalog; }
     public void setCatalog(DatacenterCatalog catalog) { this.catalog = catalog; }
     public DatacenterTable getTable() { return table; }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/integration/DefaultAssistantDatacenterBridge.java

@@ -1,6 +1,7 @@
 package tech.easyflow.datacenter.integration;
 
 import org.springframework.stereotype.Component;
+import tech.easyflow.common.entity.LoginAccount;
 import tech.easyflow.datacenter.execution.model.DatacenterQueryRequest;
 import tech.easyflow.datacenter.execution.model.DatacenterSchemaResponse;
 import tech.easyflow.datacenter.execution.service.DatacenterDatasetQueryService;
@@ -17,8 +18,10 @@ public class DefaultAssistantDatacenterBridge implements AssistantDatacenterBrid
     private DatacenterDatasetQueryService queryService;
 
     @Override
-    public AssistantDatacenterResult queryPage(DatacenterQueryRequest request) {
-        var page = queryService.queryPage(request);
+    public AssistantDatacenterResult queryPage(
+            DatacenterQueryRequest request,
+            LoginAccount account) {
+        var page = queryService.queryPage(request, account);
         DatacenterSchemaResponse schema = queryService.getSchema(request.getDatasetRef());
         AssistantDatacenterResult result = new AssistantDatacenterResult();
         result.setRows(page.getRecords());

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/mapper/DatacenterQueryAuditMapper.java

@@ -0,0 +1,10 @@
+package tech.easyflow.datacenter.mapper;
+
+import com.mybatisflex.core.BaseMapper;
+import tech.easyflow.datacenter.audit.DatacenterQueryAudit;
+
+/**
+ * 数据中枢查询审计 Mapper。
+ */
+public interface DatacenterQueryAuditMapper extends BaseMapper<DatacenterQueryAudit> {
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/entity/DatacenterCatalog.java

@@ -31,6 +31,18 @@ public class DatacenterCatalog extends DateEntity implements Serializable {
     private String catalogDesc;
     @Column(comment = "目录类型")
     private String catalogType;
+    @Column(comment = "Calcite 逻辑 Schema")
+    private String logicalSchemaName;
+    @Column(comment = "JDBC 物理 Catalog")
+    private String physicalCatalogName;
+    @Column(comment = "JDBC 物理 Schema")
+    private String physicalSchemaName;
+    @Column(comment = "物理命名空间稳定摘要")
+    private String namespaceKey;
+    @Column(comment = "元数据状态")
+    private String metadataStatus;
+    @Column(comment = "最近发现时间")
+    private Date lastSeenAt;
     @Column(comment = "状态")
     private Integer status;
     @Column(typeHandler = FastjsonTypeHandler.class, comment = "扩展项")
@@ -59,6 +71,18 @@ public class DatacenterCatalog extends DateEntity implements Serializable {
     public void setCatalogDesc(String catalogDesc) { this.catalogDesc = catalogDesc; }
     public String getCatalogType() { return catalogType; }
     public void setCatalogType(String catalogType) { this.catalogType = catalogType; }
+    public String getLogicalSchemaName() { return logicalSchemaName; }
+    public void setLogicalSchemaName(String logicalSchemaName) { this.logicalSchemaName = logicalSchemaName; }
+    public String getPhysicalCatalogName() { return physicalCatalogName; }
+    public void setPhysicalCatalogName(String physicalCatalogName) { this.physicalCatalogName = physicalCatalogName; }
+    public String getPhysicalSchemaName() { return physicalSchemaName; }
+    public void setPhysicalSchemaName(String physicalSchemaName) { this.physicalSchemaName = physicalSchemaName; }
+    public String getNamespaceKey() { return namespaceKey; }
+    public void setNamespaceKey(String namespaceKey) { this.namespaceKey = namespaceKey; }
+    public String getMetadataStatus() { return metadataStatus; }
+    public void setMetadataStatus(String metadataStatus) { this.metadataStatus = metadataStatus; }
+    public Date getLastSeenAt() { return lastSeenAt; }
+    public void setLastSeenAt(Date lastSeenAt) { this.lastSeenAt = lastSeenAt; }
     public Integer getStatus() { return status; }
     public void setStatus(Integer status) { this.status = status; }
     public Map<String, Object> getOptions() { return options; }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/entity/DatacenterSource.java

@@ -1,5 +1,6 @@
 package tech.easyflow.datacenter.meta.entity;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.databind.annotation.JsonSerialize;
 import com.fasterxml.jackson.databind.ser.std.ToStringSerializer;
 import com.mybatisflex.annotation.Column;
@@ -29,6 +30,30 @@ public class DatacenterSource extends DateEntity implements Serializable {
     private String sourceCode;
     @Column(comment = "数据源类型")
     private String sourceType;
+    @Column(comment = "Federation Adapter 标识")
+    private String adapterId;
+    @Column(typeHandler = FastjsonTypeHandler.class, comment = "不含凭据的 Adapter 选项")
+    private Map<String, String> adapterOptionsJson;
+    @Column(comment = "数据源 Definition 版本")
+    private Long definitionRevision;
+    @Column(comment = "Definition SHA-256 校验和")
+    private String definitionChecksum;
+    @Column(comment = "纳管范围版本")
+    private Long scopeRevision;
+    @Column(comment = "Adapter 兼容状态")
+    private String compatibilityStatus;
+    @Column(comment = "数据库产品名称")
+    private String databaseProductName;
+    @Column(comment = "数据库产品版本")
+    private String databaseProductVersion;
+    @Column(comment = "JDBC Driver 名称")
+    private String driverName;
+    @Column(comment = "JDBC Driver 版本")
+    private String driverVersion;
+    @Column(comment = "元数据刷新状态")
+    private String metadataRefreshStatus;
+    @Column(comment = "元数据最近刷新时间")
+    private Date metadataRefreshedAt;
     @Column(comment = "访问模式")
     private String accessMode;
     @Column(comment = "是否内置")
@@ -85,6 +110,30 @@ public class DatacenterSource extends DateEntity implements Serializable {
     public void setSourceCode(String sourceCode) { this.sourceCode = sourceCode; }
     public String getSourceType() { return sourceType; }
     public void setSourceType(String sourceType) { this.sourceType = sourceType; }
+    public String getAdapterId() { return adapterId; }
+    public void setAdapterId(String adapterId) { this.adapterId = adapterId; }
+    public Map<String, String> getAdapterOptionsJson() { return adapterOptionsJson; }
+    public void setAdapterOptionsJson(Map<String, String> adapterOptionsJson) { this.adapterOptionsJson = adapterOptionsJson; }
+    public Long getDefinitionRevision() { return definitionRevision; }
+    public void setDefinitionRevision(Long definitionRevision) { this.definitionRevision = definitionRevision; }
+    public String getDefinitionChecksum() { return definitionChecksum; }
+    public void setDefinitionChecksum(String definitionChecksum) { this.definitionChecksum = definitionChecksum; }
+    public Long getScopeRevision() { return scopeRevision; }
+    public void setScopeRevision(Long scopeRevision) { this.scopeRevision = scopeRevision; }
+    public String getCompatibilityStatus() { return compatibilityStatus; }
+    public void setCompatibilityStatus(String compatibilityStatus) { this.compatibilityStatus = compatibilityStatus; }
+    public String getDatabaseProductName() { return databaseProductName; }
+    public void setDatabaseProductName(String databaseProductName) { this.databaseProductName = databaseProductName; }
+    public String getDatabaseProductVersion() { return databaseProductVersion; }
+    public void setDatabaseProductVersion(String databaseProductVersion) { this.databaseProductVersion = databaseProductVersion; }
+    public String getDriverName() { return driverName; }
+    public void setDriverName(String driverName) { this.driverName = driverName; }
+    public String getDriverVersion() { return driverVersion; }
+    public void setDriverVersion(String driverVersion) { this.driverVersion = driverVersion; }
+    public String getMetadataRefreshStatus() { return metadataRefreshStatus; }
+    public void setMetadataRefreshStatus(String metadataRefreshStatus) { this.metadataRefreshStatus = metadataRefreshStatus; }
+    public Date getMetadataRefreshedAt() { return metadataRefreshedAt; }
+    public void setMetadataRefreshedAt(Date metadataRefreshedAt) { this.metadataRefreshedAt = metadataRefreshedAt; }
     public String getAccessMode() { return accessMode; }
     public void setAccessMode(String accessMode) { this.accessMode = accessMode; }
     public Integer getBuiltinFlag() { return builtinFlag; }
@@ -103,8 +152,10 @@ public class DatacenterSource extends DateEntity implements Serializable {
     public void setSchemaName(String schemaName) { this.schemaName = schemaName; }
     public String getUsername() { return username; }
     public void setUsername(String username) { this.username = username; }
+    @JsonIgnore
     public String getCredentialCipher() { return credentialCipher; }
     public void setCredentialCipher(String credentialCipher) { this.credentialCipher = credentialCipher; }
+    @JsonIgnore
     public Map<String, Object> getConfigJson() { return configJson; }
     public void setConfigJson(Map<String, Object> configJson) { this.configJson = configJson; }
     public Map<String, Object> getCapabilitiesJson() { return capabilitiesJson; }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/enums/DatacenterMetadataStatus.java

@@ -0,0 +1,15 @@
+package tech.easyflow.datacenter.meta.enums;
+
+/**
+ * 数据库对象元数据状态。
+ */
+public enum DatacenterMetadataStatus {
+    /** 当前仍能从目标数据库发现。 */
+    ACTIVE,
+    /** 本次刷新未发现。 */
+    MISSING,
+    /** 结构已变化，等待用户确认。 */
+    CHANGED,
+    /** 已由用户停止纳管。 */
+    RETIRED
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/enums/DatacenterSensitivityLevel.java

@@ -0,0 +1,15 @@
+package tech.easyflow.datacenter.meta.enums;
+
+/**
+ * 数据字段敏感级别。
+ */
+public enum DatacenterSensitivityLevel {
+    /** 可直接用于受控查询。 */
+    PUBLIC,
+    /** 仅限组织内部。 */
+    INTERNAL,
+    /** 需要脱敏后使用。 */
+    SENSITIVE,
+    /** 默认禁止进入查询结果。 */
+    RESTRICTED
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/enums/DatacenterSourceStatus.java

@@ -0,0 +1,56 @@
+package tech.easyflow.datacenter.meta.enums;
+
+import java.util.Arrays;
+
+/**
+ * 数据源持久化生命周期。
+ */
+public enum DatacenterSourceStatus {
+
+    /** 配置已保存，尚未激活。 */
+    DRAFT(0),
+    /** Definition 已发布且节点可查询。 */
+    READY(1),
+    /** 配置仍保留，但当前 Runtime 不可用。 */
+    DEGRADED(2),
+    /** 管理员主动禁用。 */
+    DISABLED(3),
+    /** 删除墓碑，禁止新查询。 */
+    DELETED(4);
+
+    private final int code;
+
+    /**
+     * 创建状态。
+     *
+     * @param code 持久化编码
+     */
+    DatacenterSourceStatus(int code) {
+        this.code = code;
+    }
+
+    /**
+     * 返回持久化编码。
+     *
+     * @return 状态编码
+     */
+    public int code() {
+        return code;
+    }
+
+    /**
+     * 按持久化编码解析状态。
+     *
+     * @param code 状态编码
+     * @return 对应状态；未知编码按草稿处理
+     */
+    public static DatacenterSourceStatus fromCode(Integer code) {
+        if (code == null) {
+            return DRAFT;
+        }
+        return Arrays.stream(values())
+                .filter(status -> status.code == code)
+                .findFirst()
+                .orElse(DRAFT);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterCatalogMeta.java

@@ -14,6 +14,9 @@ public class DatacenterCatalogMeta {
     private String catalogName;
     private String catalogType;
     private String catalogDesc;
+    private String logicalSchemaName;
+    private String physicalCatalogName;
+    private String physicalSchemaName;
 
     @JsonSerialize(using = ToStringSerializer.class)
     public BigInteger getId() { return id; }
@@ -27,4 +30,10 @@ public class DatacenterCatalogMeta {
     public void setCatalogType(String catalogType) { this.catalogType = catalogType; }
     public String getCatalogDesc() { return catalogDesc; }
     public void setCatalogDesc(String catalogDesc) { this.catalogDesc = catalogDesc; }
+    public String getLogicalSchemaName() { return logicalSchemaName; }
+    public void setLogicalSchemaName(String logicalSchemaName) { this.logicalSchemaName = logicalSchemaName; }
+    public String getPhysicalCatalogName() { return physicalCatalogName; }
+    public void setPhysicalCatalogName(String physicalCatalogName) { this.physicalCatalogName = physicalCatalogName; }
+    public String getPhysicalSchemaName() { return physicalSchemaName; }
+    public void setPhysicalSchemaName(String physicalSchemaName) { this.physicalSchemaName = physicalSchemaName; }
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterFieldDescriptionUpdate.java

@@ -2,24 +2,85 @@ package tech.easyflow.datacenter.meta.model;
 
 import java.math.BigInteger;
 
+/**
+ * 字段说明与只读查询治理更新。
+ */
 public class DatacenterFieldDescriptionUpdate {
 
     private BigInteger fieldId;
     private String fieldDesc;
+    private Integer queryable;
+    private String sensitivityLevel;
 
+    /**
+     * 获取字段 ID。
+     *
+     * @return 字段 ID
+     */
     public BigInteger getFieldId() {
         return fieldId;
     }
 
+    /**
+     * 设置字段 ID。
+     *
+     * @param fieldId 字段 ID
+     */
     public void setFieldId(BigInteger fieldId) {
         this.fieldId = fieldId;
     }
 
+    /**
+     * 获取字段说明。
+     *
+     * @return 字段说明
+     */
     public String getFieldDesc() {
         return fieldDesc;
     }
 
+    /**
+     * 设置字段说明。
+     *
+     * @param fieldDesc 字段说明
+     */
     public void setFieldDesc(String fieldDesc) {
         this.fieldDesc = fieldDesc;
     }
+
+    /**
+     * 获取是否允许只读查询。
+     *
+     * @return 1 为允许，0 为禁止，空表示保持原值
+     */
+    public Integer getQueryable() {
+        return queryable;
+    }
+
+    /**
+     * 设置是否允许只读查询。
+     *
+     * @param queryable 1 为允许，0 为禁止，空表示保持原值
+     */
+    public void setQueryable(Integer queryable) {
+        this.queryable = queryable;
+    }
+
+    /**
+     * 获取敏感级别。
+     *
+     * @return 敏感级别，空表示保持原值
+     */
+    public String getSensitivityLevel() {
+        return sensitivityLevel;
+    }
+
+    /**
+     * 设置敏感级别。
+     *
+     * @param sensitivityLevel PUBLIC、INTERNAL、SENSITIVE 或 RESTRICTED
+     */
+    public void setSensitivityLevel(String sensitivityLevel) {
+        this.sensitivityLevel = sensitivityLevel;
+    }
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterManagedMetadataSnapshot.java

@@ -0,0 +1,24 @@
+package tech.easyflow.datacenter.meta.model;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * 一次连接内读取的已纳管表元数据快照。
+ *
+ * @param details 当前仍存在的表详情
+ * @param missingTableNames 当前连接中未发现的表名
+ */
+public record DatacenterManagedMetadataSnapshot(
+        List<DatacenterTableDetailMeta> details,
+        Set<String> missingTableNames) {
+
+    /**
+     * 对返回集合做防御性复制。
+     */
+    public DatacenterManagedMetadataSnapshot {
+        details = List.copyOf(details == null ? List.of() : details);
+        missingTableNames = Set.copyOf(
+                missingTableNames == null ? Set.of() : missingTableNames);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterMetadataPage.java

@@ -0,0 +1,55 @@
+package tech.easyflow.datacenter.meta.model;
+
+import java.util.List;
+
+/**
+ * 有界元数据分页结果。
+ *
+ * @param records 当前页记录
+ * @param pageNumber 页码，从 1 开始
+ * @param pageSize 每页记录上限
+ * @param hasMore 是否还有下一页
+ * @param <T> 元数据类型
+ */
+public record DatacenterMetadataPage<T>(
+        List<T> records,
+        long pageNumber,
+        long pageSize,
+        boolean hasMore) {
+
+    /**
+     * 防御性复制当前页记录。
+     */
+    public DatacenterMetadataPage {
+        records = List.copyOf(records == null ? List.of() : records);
+    }
+
+    /**
+     * 从已加载记录中创建有界分页结果。
+     *
+     * @param records 全部候选记录
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @param <T> 元数据类型
+     * @return 当前页结果
+     */
+    public static <T> DatacenterMetadataPage<T> slice(
+            List<T> records,
+            long pageNumber,
+            long pageSize) {
+        List<T> safeRecords = records == null ? List.of() : records;
+        long safePage = Math.max(1L, pageNumber);
+        long safeSize = Math.max(1L, pageSize);
+        if (safePage - 1L > Long.MAX_VALUE / safeSize) {
+            return new DatacenterMetadataPage<>(List.of(), safePage, safeSize, false);
+        }
+        long offset = (safePage - 1L) * safeSize;
+        if (offset >= safeRecords.size()) {
+            return new DatacenterMetadataPage<>(List.of(), safePage, safeSize, false);
+        }
+        int from = Math.toIntExact(offset);
+        int to = (int) Math.min((long) safeRecords.size(), offset + safeSize);
+        return new DatacenterMetadataPage<>(
+                safeRecords.subList(from, to), safePage, safeSize, to < safeRecords.size());
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSaveDescriptionsRequest.java

@@ -9,6 +9,8 @@ public class DatacenterSaveDescriptionsRequest {
     private BigInteger tableId;
     private String tableDesc;
     private List<DatacenterFieldDescriptionUpdate> fields = new ArrayList<>();
+    private Long fieldPageNumber;
+    private Long fieldPageSize;
 
     public BigInteger getTableId() {
         return tableId;
@@ -33,4 +35,24 @@ public class DatacenterSaveDescriptionsRequest {
     public void setFields(List<DatacenterFieldDescriptionUpdate> fields) {
         this.fields = fields;
     }
+
+    /** @return 保存后返回的字段页码 */
+    public Long getFieldPageNumber() {
+        return fieldPageNumber;
+    }
+
+    /** @param fieldPageNumber 保存后返回的字段页码 */
+    public void setFieldPageNumber(Long fieldPageNumber) {
+        this.fieldPageNumber = fieldPageNumber;
+    }
+
+    /** @return 保存后返回的字段页大小 */
+    public Long getFieldPageSize() {
+        return fieldPageSize;
+    }
+
+    /** @param fieldPageSize 保存后返回的字段页大小 */
+    public void setFieldPageSize(Long fieldPageSize) {
+        this.fieldPageSize = fieldPageSize;
+    }
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceActivateRequest.java

@@ -0,0 +1,26 @@
+package tech.easyflow.datacenter.meta.model;
+
+import java.math.BigInteger;
+import java.util.List;
+
+/**
+ * 激活数据源并纳管选定对象的请求。
+ *
+ * @param sourceId 数据源 ID
+ * @param catalogName 物理 Catalog 或 Schema 名称
+ * @param tableNames 需要纳管的表或视图
+ * @param prewarm 是否立即预热节点本地连接池
+ */
+public record DatacenterSourceActivateRequest(
+        BigInteger sourceId,
+        String catalogName,
+        List<String> tableNames,
+        boolean prewarm) {
+
+    /**
+     * 防御性复制表名。
+     */
+    public DatacenterSourceActivateRequest {
+        tableNames = List.copyOf(tableNames == null ? List.of() : tableNames);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceCandidateCatalogRequest.java

@@ -0,0 +1,16 @@
+package tech.easyflow.datacenter.meta.model;
+
+/**
+ * 未发布候选连接的命名空间分页请求。
+ *
+ * @param definition 候选连接配置
+ * @param keyword 命名空间搜索词
+ * @param pageNumber 页码
+ * @param pageSize 每页大小
+ */
+public record DatacenterSourceCandidateCatalogRequest(
+        DatacenterSourceDraftRequest definition,
+        String keyword,
+        Long pageNumber,
+        Long pageSize) {
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceCandidateMetadataRequest.java

@@ -0,0 +1,18 @@
+package tech.easyflow.datacenter.meta.model;
+
+/**
+ * 活动数据源候选配置的元数据浏览请求。
+ *
+ * @param definition 候选连接配置
+ * @param catalogName 目标 Catalog 或 Schema
+ * @param keyword 表名搜索词
+ * @param pageNumber 页码
+ * @param pageSize 每页大小
+ */
+public record DatacenterSourceCandidateMetadataRequest(
+        DatacenterSourceDraftRequest definition,
+        String catalogName,
+        String keyword,
+        Long pageNumber,
+        Long pageSize) {
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceDraftRequest.java

@@ -0,0 +1,47 @@
+package tech.easyflow.datacenter.meta.model;
+
+import java.math.BigInteger;
+import java.util.Map;
+
+/**
+ * 创建或更新数据源草稿的受控请求。
+ *
+ * @param id 编辑时的数据源 ID
+ * @param sourceName 连接名称
+ * @param sourceCode 租户内业务编码
+ * @param sourceType 数据源类型
+ * @param host 主机地址
+ * @param port 端口
+ * @param databaseName 数据库名
+ * @param schemaName 默认 Schema
+ * @param username 用户名
+ * @param password 本次提交的明文密码；只在请求内存中短暂存在
+ * @param driverClassName JDBC Driver 类名
+ * @param jdbcUrl JDBC URL
+ * @param adapterOptions 不含凭据的 Adapter 选项
+ * @param configJson 不含凭据的连接扩展项
+ */
+public record DatacenterSourceDraftRequest(
+        BigInteger id,
+        String sourceName,
+        String sourceCode,
+        String sourceType,
+        String host,
+        Integer port,
+        String databaseName,
+        String schemaName,
+        String username,
+        String password,
+        String driverClassName,
+        String jdbcUrl,
+        Map<String, String> adapterOptions,
+        Map<String, Object> configJson) {
+
+    /**
+     * 防御性复制可变配置。
+     */
+    public DatacenterSourceDraftRequest {
+        adapterOptions = Map.copyOf(adapterOptions == null ? Map.of() : adapterOptions);
+        configJson = Map.copyOf(configJson == null ? Map.of() : configJson);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceReconfigureRequest.java

@@ -0,0 +1,29 @@
+package tech.easyflow.datacenter.meta.model;
+
+import java.util.List;
+
+/**
+ * 活动数据源原地重配置请求。
+ *
+ * @param definition 候选连接配置
+ * @param catalogName 显式选择的 Catalog 或 Schema
+ * @param tableNames 显式选择的表或视图
+ * @param prewarm 是否在发布后预热
+ * @param expectedDefinitionRevision 调用方读取到的 Definition 版本
+ * @param expectedScopeRevision 调用方读取到的范围版本
+ */
+public record DatacenterSourceReconfigureRequest(
+        DatacenterSourceDraftRequest definition,
+        String catalogName,
+        List<String> tableNames,
+        boolean prewarm,
+        Long expectedDefinitionRevision,
+        Long expectedScopeRevision) {
+
+    /**
+     * 防御性复制表名集合。
+     */
+    public DatacenterSourceReconfigureRequest {
+        tableNames = List.copyOf(tableNames == null ? List.of() : tableNames);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceView.java

@@ -0,0 +1,75 @@
+package tech.easyflow.datacenter.meta.model;
+
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.ser.std.ToStringSerializer;
+import java.math.BigInteger;
+import java.util.Date;
+import java.util.Map;
+
+/**
+ * 不含凭据、密文和内部 Runtime 对象的数据源视图。
+ *
+ * @param id 数据源 ID
+ * @param sourceName 连接名称
+ * @param sourceCode 业务编码
+ * @param sourceType 数据源类型
+ * @param status 生命周期名称
+ * @param builtinFlag 是否内置
+ * @param host 主机
+ * @param port 端口
+ * @param databaseName 数据库名
+ * @param schemaName 默认 Schema
+ * @param username 用户名
+ * @param driverClassName Driver 类名
+ * @param jdbcUrl JDBC URL
+ * @param passwordConfigured 是否已保存密码
+ * @param definitionRevision Definition 版本
+ * @param scopeRevision 纳管范围版本
+ * @param compatibilityStatus 兼容状态
+ * @param databaseProductName 数据库产品
+ * @param databaseProductVersion 数据库版本
+ * @param driverName 实际 Driver 名称
+ * @param driverVersion 实际 Driver 版本
+ * @param lastTestStatus 最近测试状态
+ * @param lastTestMessage 最近测试说明
+ * @param lastTestedAt 最近测试时间
+ * @param metadataRefreshStatus 元数据刷新状态
+ * @param metadataRefreshedAt 元数据刷新时间
+ * @param adapterOptions 不含凭据的 Adapter 选项
+ */
+public record DatacenterSourceView(
+        @JsonSerialize(using = ToStringSerializer.class) BigInteger id,
+        String sourceName,
+        String sourceCode,
+        String sourceType,
+        String status,
+        Integer builtinFlag,
+        String host,
+        Integer port,
+        String databaseName,
+        String schemaName,
+        String username,
+        String driverClassName,
+        String jdbcUrl,
+        boolean passwordConfigured,
+        long definitionRevision,
+        long scopeRevision,
+        String compatibilityStatus,
+        String databaseProductName,
+        String databaseProductVersion,
+        String driverName,
+        String driverVersion,
+        String lastTestStatus,
+        String lastTestMessage,
+        Date lastTestedAt,
+        String metadataRefreshStatus,
+        Date metadataRefreshedAt,
+        Map<String, String> adapterOptions) {
+
+    /**
+     * 防御性复制 Adapter 选项。
+     */
+    public DatacenterSourceView {
+        adapterOptions = Map.copyOf(adapterOptions == null ? Map.of() : adapterOptions);
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterSourceViews.java

@@ -0,0 +1,59 @@
+package tech.easyflow.datacenter.meta.model;
+
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
+
+/**
+ * 将持久化数据源实体转换为安全 API 视图。
+ */
+public final class DatacenterSourceViews {
+
+    private DatacenterSourceViews() {
+    }
+
+    /**
+     * 创建不含凭据与内部对象的数据源视图。
+     *
+     * @param source 持久化数据源实体
+     * @return 安全数据源视图
+     * @throws IllegalArgumentException 数据源为空时抛出
+     */
+    public static DatacenterSourceView from(DatacenterSource source) {
+        if (source == null) {
+            throw new IllegalArgumentException("source must not be null");
+        }
+        return new DatacenterSourceView(
+                source.getId(),
+                source.getSourceName(),
+                source.getSourceCode(),
+                source.getSourceType(),
+                DatacenterSourceStatus.fromCode(source.getStatus()).name(),
+                source.getBuiltinFlag(),
+                source.getHost(),
+                source.getPort(),
+                source.getDatabaseName(),
+                source.getSchemaName(),
+                source.getUsername(),
+                source.getDriverClassName(),
+                source.getJdbcUrl(),
+                source.getCredentialCipher() != null
+                        && !source.getCredentialCipher().isBlank(),
+                value(source.getDefinitionRevision()),
+                Math.max(1L, value(source.getScopeRevision())),
+                source.getCompatibilityStatus(),
+                source.getDatabaseProductName(),
+                source.getDatabaseProductVersion(),
+                source.getDriverName(),
+                source.getDriverVersion(),
+                source.getLastTestStatus(),
+                source.getLastTestMessage(),
+                source.getLastTestedAt(),
+                source.getMetadataRefreshStatus(),
+                source.getMetadataRefreshedAt(),
+                source.getAdapterOptionsJson());
+    }
+
+    private static long value(Long value) {
+        return value == null ? 0L : value;
+    }
+}

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/model/DatacenterTableDetailMeta.java

@@ -6,12 +6,36 @@ import tech.easyflow.datacenter.entity.DatacenterTableField;
 import java.util.ArrayList;
 import java.util.List;
 
+/**
+ * 数据表及其有界字段详情。
+ */
 public class DatacenterTableDetailMeta {
     private DatacenterTable table;
     private List<DatacenterTableField> fields = new ArrayList<>();
+    private long fieldPageNumber = 1L;
+    private long fieldPageSize;
+    private boolean hasMoreFields;
 
+    /** @return 数据表元数据 */
     public DatacenterTable getTable() { return table; }
+    /** @param table 数据表元数据 */
     public void setTable(DatacenterTable table) { this.table = table; }
+    /** @return 当前页字段 */
     public List<DatacenterTableField> getFields() { return fields; }
-    public void setFields(List<DatacenterTableField> fields) { this.fields = fields; }
+    /** @param fields 当前页字段 */
+    public void setFields(List<DatacenterTableField> fields) {
+        this.fields = fields == null ? new ArrayList<>() : new ArrayList<>(fields);
+    }
+    /** @return 字段页码 */
+    public long getFieldPageNumber() { return fieldPageNumber; }
+    /** @param fieldPageNumber 字段页码 */
+    public void setFieldPageNumber(long fieldPageNumber) { this.fieldPageNumber = fieldPageNumber; }
+    /** @return 字段页大小 */
+    public long getFieldPageSize() { return fieldPageSize; }
+    /** @param fieldPageSize 字段页大小 */
+    public void setFieldPageSize(long fieldPageSize) { this.fieldPageSize = fieldPageSize; }
+    /** @return 是否还有字段 */
+    public boolean isHasMoreFields() { return hasMoreFields; }
+    /** @param hasMoreFields 是否还有字段 */
+    public void setHasMoreFields(boolean hasMoreFields) { this.hasMoreFields = hasMoreFields; }
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/service/DatacenterDatasetRegistryService.java

@@ -20,6 +20,21 @@ public interface DatacenterDatasetRegistryService {
 
     DatacenterTable registerTable(DatacenterSource source, DatacenterCatalog catalog, DatacenterTableDetailMeta detail, LoginAccount account);
 
+    /**
+     * 在管理员显式重配置连接时重新绑定物理表身份和字段结构。
+     *
+     * @param source 新数据源 Definition
+     * @param catalog 新物理命名空间
+     * @param detail 新物理表元数据
+     * @param account 操作账号
+     * @return 重绑定后的纳管表
+     */
+    DatacenterTable rebindTable(
+            DatacenterSource source,
+            DatacenterCatalog catalog,
+            DatacenterTableDetailMeta detail,
+            LoginAccount account);
+
     DatacenterTable getTableWithFields(BigInteger tableId);
 
     List<DatacenterTableField> getFields(BigInteger tableId);
@@ -34,5 +49,35 @@ public interface DatacenterDatasetRegistryService {
 
     int removeTables(List<BigInteger> tableIds);
 
+    /**
+     * 刷新一个已纳管表的观测元数据，不自动插入新表或新字段。
+     *
+     * @param source 当前数据源
+     * @param catalog 已纳管命名空间
+     * @param tableId 已纳管表 ID
+     * @param detail 当前 JDBC 元数据
+     * @param account 当前账号
+     * @return 是否收缩或改变了可查询范围
+     */
+    boolean refreshManagedTable(
+            DatacenterSource source,
+            DatacenterCatalog catalog,
+            BigInteger tableId,
+            DatacenterTableDetailMeta detail,
+            LoginAccount account);
+
+    /**
+     * 将本次无法发现的已纳管表标记为缺失。
+     *
+     * @param source 当前数据源
+     * @param tableId 已纳管表 ID
+     * @param account 当前账号
+     * @return 是否收缩或改变了可查询范围
+     */
+    boolean markManagedTableMissing(
+            DatacenterSource source,
+            BigInteger tableId,
+            LoginAccount account);
+
     DatacenterTable saveDescriptions(BigInteger tableId, String tableDesc, List<DatacenterFieldDescriptionUpdate> fields, LoginAccount account);
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/service/DatacenterSourceService.java

@@ -9,24 +9,183 @@ import tech.easyflow.datacenter.meta.entity.DatacenterSource;
 import tech.easyflow.datacenter.meta.model.DatacenterBatchRegisterRequest;
 import tech.easyflow.datacenter.meta.model.DatacenterCatalogMeta;
 import tech.easyflow.datacenter.meta.model.DatacenterTableDetailMeta;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceActivateRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterMetadataPage;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceCandidateMetadataRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceCandidateCatalogRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceDraftRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceReconfigureRequest;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceView;
 
 import java.math.BigInteger;
 import java.util.List;
 
 public interface DatacenterSourceService extends IService<DatacenterSource> {
+    /**
+     * 保存内部 Excel/项目数据源实体，外部 Controller 不应调用。
+     *
+     * @param source 内部数据源实体
+     * @param account 当前账号
+     * @return 保存后的实体
+     */
     DatacenterSource saveSource(DatacenterSource source, LoginAccount account);
 
-    Page<DatacenterSource> pageSources(Long pageNumber, Long pageSize, LoginAccount account);
+    /**
+     * 保存外部 JDBC 数据源草稿。
+     *
+     * @param request 受控草稿请求
+     * @param account 当前账号
+     * @return 安全数据源视图
+     */
+    DatacenterSourceView saveDraft(DatacenterSourceDraftRequest request, LoginAccount account);
 
-    DatacenterConnectionTestResult testConnection(DatacenterSource source, LoginAccount account);
+    /**
+     * 分页返回不含凭据的数据源。
+     *
+     * @param pageNumber 页码
+     * @param pageSize 页大小
+     * @param account 当前账号
+     * @return 安全数据源分页
+     */
+    Page<DatacenterSourceView> pageSources(Long pageNumber, Long pageSize, LoginAccount account);
+
+    /**
+     * 探测已保存草稿并记录数据库/Driver 指纹。
+     *
+     * @param sourceId 数据源 ID
+     * @param account 当前账号
+     * @return 连接探测结果
+     */
+    DatacenterConnectionTestResult probe(BigInteger sourceId, LoginAccount account);
+
+    /**
+     * 激活数据源、纳管选择对象并发布 Definition。
+     *
+     * @param request 激活请求
+     * @param account 当前账号
+     * @return READY 数据源视图
+     */
+    DatacenterSourceView activate(DatacenterSourceActivateRequest request, LoginAccount account);
+
+    /**
+     * 使用活动数据源的候选配置执行无状态连接探测。
+     *
+     * @param request 候选连接配置
+     * @param account 当前账号
+     * @return 连接探测结果
+     */
+    DatacenterConnectionTestResult probeCandidate(
+            DatacenterSourceDraftRequest request,
+            LoginAccount account);
+
+    /**
+     * 浏览活动数据源候选配置可访问的命名空间。
+     *
+     * @param request 候选连接配置
+     * @param account 当前账号
+     * @return 命名空间列表
+     */
+    List<DatacenterCatalogMeta> listCandidateCatalogs(
+            DatacenterSourceDraftRequest request,
+            LoginAccount account);
+
+    /**
+     * 分页浏览活动数据源候选配置可访问的命名空间。
+     *
+     * @param request 候选配置与分页条件
+     * @param account 当前账号
+     * @return 有界命名空间列表
+     */
+    DatacenterMetadataPage<DatacenterCatalogMeta> listCandidateCatalogsPage(
+            DatacenterSourceCandidateCatalogRequest request,
+            LoginAccount account);
+
+    /**
+     * 分页浏览活动数据源候选配置可访问的表。
+     *
+     * @param request 候选配置与分页条件
+     * @param account 当前账号
+     * @return 有界表列表
+     */
+    DatacenterMetadataPage<DatacenterTable> listCandidateTables(
+            DatacenterSourceCandidateMetadataRequest request,
+            LoginAccount account);
+
+    /**
+     * 原地发布活动数据源的新连接配置和显式纳管范围。
+     *
+     * @param request 重配置请求
+     * @param account 当前账号
+     * @return 发布后的安全视图
+     */
+    DatacenterSourceView reconfigure(
+            DatacenterSourceReconfigureRequest request,
+            LoginAccount account);
 
     List<DatacenterCatalogMeta> listCatalogs(BigInteger sourceId, LoginAccount account);
 
-    List<DatacenterTable> listTables(BigInteger sourceId, String catalogName, LoginAccount account);
+    /**
+     * 分页浏览当前数据源的命名空间。
+     *
+     * @param sourceId 数据源 ID
+     * @param keyword 名称搜索词
+     * @param pageNumber 页码
+     * @param pageSize 每页大小
+     * @param account 当前账号
+     * @return 有界命名空间列表
+     */
+    DatacenterMetadataPage<DatacenterCatalogMeta> listCatalogsPage(
+            BigInteger sourceId,
+            String keyword,
+            Long pageNumber,
+            Long pageSize,
+            LoginAccount account);
 
-    DatacenterTableDetailMeta getTableDetail(BigInteger sourceId, String catalogName, String tableName, boolean register, LoginAccount account);
+    DatacenterMetadataPage<DatacenterTable> listTables(
+            BigInteger sourceId,
+            String catalogName,
+            String keyword,
+            Long pageNumber,
+            Long pageSize,
+            LoginAccount account);
+
+    DatacenterTableDetailMeta getTableDetail(
+            BigInteger sourceId,
+            String catalogName,
+            String tableName,
+            boolean register,
+            Long fieldPageNumber,
+            Long fieldPageSize,
+            LoginAccount account);
 
     List<DatacenterTable> batchRegisterTables(DatacenterBatchRegisterRequest request, LoginAccount account);
 
     void removeSource(BigInteger sourceId, LoginAccount account);
+
+    /**
+     * 停用活动数据源并发布墓碑。
+     *
+     * @param sourceId 数据源 ID
+     * @param account 当前账号
+     * @return 停用后的安全视图
+     */
+    DatacenterSourceView disable(BigInteger sourceId, LoginAccount account);
+
+    /**
+     * 重新探测、预热并启用已停用数据源。
+     *
+     * @param sourceId 数据源 ID
+     * @param account 当前账号
+     * @return 启用后的安全视图
+     */
+    DatacenterSourceView enable(BigInteger sourceId, LoginAccount account);
+
+    /**
+     * 刷新已纳管对象的 JDBC 元数据观测状态。
+     *
+     * @param sourceId 数据源 ID
+     * @param account 当前账号
+     * @return 刷新后的安全视图
+     */
+    DatacenterSourceView refreshMetadata(BigInteger sourceId, LoginAccount account);
 }

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/service/impl/DatacenterDatasetRegistryServiceImpl.java

@@ -9,6 +9,8 @@ import tech.easyflow.datacenter.adapter.DbHandleManager;
 import tech.easyflow.datacenter.entity.DatacenterTable;
 import tech.easyflow.datacenter.entity.DatacenterTableField;
 import tech.easyflow.datacenter.execution.model.DatasetRef;
+import tech.easyflow.datacenter.federation.DatacenterMetadataIdentity;
+import tech.easyflow.datacenter.federation.DatacenterFederationChangeNotifier;
 import tech.easyflow.datacenter.mapper.DatacenterCatalogMapper;
 import tech.easyflow.datacenter.mapper.DatacenterDatasetVersionMapper;
 import tech.easyflow.datacenter.mapper.DatacenterDerivedTableMapper;
@@ -20,6 +22,9 @@ import tech.easyflow.datacenter.meta.entity.DatacenterCatalog;
 import tech.easyflow.datacenter.meta.entity.DatacenterSource;
 import tech.easyflow.datacenter.meta.model.DatacenterFieldDescriptionUpdate;
 import tech.easyflow.datacenter.meta.enums.DatacenterSourceType;
+import tech.easyflow.datacenter.meta.enums.DatacenterMetadataStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSensitivityLevel;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
 import tech.easyflow.datacenter.meta.service.DatacenterDatasetRegistryService;
 import tech.easyflow.datacenter.meta.service.DatacenterMetaConstants;
 import tech.easyflow.datacenter.meta.model.DatacenterTableDetailMeta;
@@ -30,7 +35,11 @@ import java.math.BigInteger;
 import java.util.Date;
 import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 @Service
 public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRegistryService {
@@ -51,6 +60,8 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
     private DatacenterImportJobMapper importJobMapper;
     @Resource
     private DbHandleManager dbHandleManager;
+    @Resource
+    private DatacenterFederationChangeNotifier federationChangeNotifier;
 
     @Override
     public DatacenterSource ensureBuiltinSource(DatacenterSourceType sourceType, LoginAccount account) {
@@ -67,7 +78,11 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
         source.setDeptId(deptId);
         source.setSourceType(sourceType.name());
         source.setBuiltinFlag(1);
-        source.setStatus(0);
+        source.setStatus(DatacenterSourceStatus.READY.code());
+        source.setDefinitionRevision(1L);
+        source.setScopeRevision(1L);
+        source.setMetadataRefreshStatus("SUCCESS");
+        source.setMetadataRefreshedAt(new Date());
         source.setCreated(new Date());
         source.setModified(new Date());
         source.setCreatedBy(account == null ? BigInteger.ZERO : account.getId());
@@ -92,6 +107,12 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
         wrapper.eq(DatacenterCatalog::getCatalogName, catalogName);
         DatacenterCatalog catalog = catalogMapper.selectOneByQuery(wrapper);
         if (catalog != null) {
+            boolean changed = applyCatalogIdentity(catalog, source, catalogName);
+            if (changed) {
+                catalog.setModified(new Date());
+                catalog.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+                catalogMapper.update(catalog);
+            }
             return catalog;
         }
         catalog = new DatacenterCatalog();
@@ -105,6 +126,7 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
         catalog.setCatalogName(catalogName);
         catalog.setCatalogDesc(catalogName);
         catalog.setCatalogType("DATABASE");
+        applyCatalogIdentity(catalog, source, catalogName);
         catalog.setStatus(0);
         catalog.setCreated(new Date());
         catalog.setModified(new Date());
@@ -116,13 +138,43 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
 
     @Override
     public DatacenterTable registerTable(DatacenterSource source, DatacenterCatalog catalog, DatacenterTableDetailMeta detail, LoginAccount account) {
+        return registerTable(source, catalog, detail, account, false);
+    }
+
+    /**
+     * 显式重配置时允许在同一稳定表记录上确认新的物理身份，并重建字段治理基线。
+     */
+    @Override
+    public DatacenterTable rebindTable(
+            DatacenterSource source,
+            DatacenterCatalog catalog,
+            DatacenterTableDetailMeta detail,
+            LoginAccount account) {
+        return registerTable(source, catalog, detail, account, true);
+    }
+
+    private DatacenterTable registerTable(
+            DatacenterSource source,
+            DatacenterCatalog catalog,
+            DatacenterTableDetailMeta detail,
+            LoginAccount account,
+            boolean allowExplicitRebind) {
         DatacenterTable table = detail.getTable();
         applyTableDefaults(table, source, detail);
+        table.setPhysicalIdentityKey(DatacenterMetadataIdentity.tableIdentity(
+                source.getId().toString(),
+                catalog.getNamespaceKey(),
+                table.getActualTable(),
+                table.getTableKind()));
+        table.setMetadataFingerprint(DatacenterMetadataIdentity.tableFingerprint(
+                table.getTableName(), table.getTableKind(), detail.getFields()));
         QueryWrapper wrapper = QueryWrapper.create();
         wrapper.eq(DatacenterTable::getSourceId, source.getId());
         wrapper.eq(DatacenterTable::getCatalogId, catalog.getId());
         wrapper.eq(DatacenterTable::getTableName, table.getTableName());
         DatacenterTable existing = tableMapper.selectOneByQuery(wrapper);
+        List<DatacenterTableField> persistedFields = existing == null
+                ? List.of() : getFields(existing.getId());
         Date now = new Date();
         if (existing == null) {
             table.setSourceId(source.getId());
@@ -136,6 +188,39 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
             table.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
             tableMapper.insert(table);
         } else {
+            boolean identityChanged = hasText(existing.getPhysicalIdentityKey())
+                    && !existing.getPhysicalIdentityKey().equals(table.getPhysicalIdentityKey())
+                    && !existing.getPhysicalIdentityKey().equals(
+                    DatacenterMetadataIdentity.legacyV58TableIdentity(
+                            existing.getSourceId(), existing.getCatalogId(),
+                            existing.getActualTable(), existing.getTableKind()));
+            if (identityChanged && !allowExplicitRebind) {
+                throw new BusinessException("物理表身份已变化，请移除原绑定后重新接入: " + table.getTableName());
+            }
+            boolean structureChanged = false;
+            if (hasText(existing.getMetadataFingerprint())
+                    && !existing.getMetadataFingerprint().equals(table.getMetadataFingerprint())) {
+                boolean legacyFingerprint = existing.getMetadataFingerprint().equals(
+                        DatacenterMetadataIdentity.legacyV58TableFingerprint(
+                                existing.getTableName(), existing.getTableKind()));
+                if (!legacyFingerprint
+                        || !legacyStructureMatches(
+                        persistedFields, detail.getFields())) {
+                    structureChanged = true;
+                }
+            }
+            if (structureChanged && !allowExplicitRebind) {
+                throw new BusinessException(
+                        "表结构已变化，请移除原绑定后重新接入: " + table.getTableName());
+            }
+            boolean resetGovernance = allowExplicitRebind
+                    && (identityChanged || structureChanged);
+            if (resetGovernance) {
+                tableFieldMapper.deleteByQuery(QueryWrapper.create()
+                        .eq(DatacenterTableField::getTableId, existing.getId()));
+                persistedFields = List.of();
+                existing.setQueryable(table.getQueryable());
+            }
             if (!hasText(existing.getTableDesc())) {
                 existing.setTableDesc(normalizeDescription(table.getTableDesc()));
             }
@@ -145,30 +230,61 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
             existing.setAccessMode(table.getAccessMode());
             existing.setVersioningEnabled(table.getVersioningEnabled());
             existing.setCapabilitiesJson(table.getCapabilitiesJson());
+            existing.setPhysicalIdentityKey(table.getPhysicalIdentityKey());
+            existing.setMetadataFingerprint(table.getMetadataFingerprint());
+            existing.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+            existing.setLastSeenAt(now);
+            // 查询开关属于治理配置，元数据刷新不得覆盖人工决策。
+            existing.setTimeSemantics(table.getTimeSemantics());
+            existing.setMetadataRevision((existing.getMetadataRevision() == null
+                    ? 0L : existing.getMetadataRevision()) + 1L);
             existing.setModified(now);
             existing.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
             tableMapper.update(existing);
             table = existing;
         }
-        Map<String, DatacenterTableField> existingFieldMap = getFields(table.getId()).stream()
-                .collect(LinkedHashMap::new, (map, field) -> map.put(field.getFieldName(), field), Map::putAll);
-        QueryWrapper deleteWrapper = QueryWrapper.create();
-        deleteWrapper.eq(DatacenterTableField::getTableId, table.getId());
-        tableFieldMapper.deleteByQuery(deleteWrapper);
+        Map<String, DatacenterTableField> existingFieldMap = persistedFields.stream()
+                .collect(LinkedHashMap::new,
+                        (map, field) -> map.put(sourceColumnName(field), field),
+                        Map::putAll);
         for (DatacenterTableField field : detail.getFields()) {
-            DatacenterTableField existingField = existingFieldMap.get(field.getFieldName());
+            applyFieldDefaults(field);
+            DatacenterTableField existingField = existingFieldMap.remove(sourceColumnName(field));
             if (existingField != null && hasText(existingField.getFieldDesc())) {
                 field.setFieldDesc(existingField.getFieldDesc());
             } else {
                 field.setFieldDesc(normalizeDescription(field.getFieldDesc()));
             }
-            field.setId(null);
             field.setTableId(table.getId());
-            field.setCreated(now);
             field.setModified(now);
-            field.setCreatedBy(account == null ? BigInteger.ZERO : account.getId());
             field.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+            if (existingField == null) {
+                field.setId(null);
+                field.setCreated(now);
+                field.setCreatedBy(account == null ? BigInteger.ZERO : account.getId());
                 tableFieldMapper.insert(field);
+            } else {
+                field.setId(existingField.getId());
+                field.setCreated(existingField.getCreated());
+                field.setCreatedBy(existingField.getCreatedBy());
+                if (existingField.getSensitivityLevel() != null) {
+                    field.setSensitivityLevel(existingField.getSensitivityLevel());
+                    field.setMaskingStrategy(existingField.getMaskingStrategy());
+                }
+                // 元数据刷新只更新物理事实，保留字段级治理设置。
+                field.setQueryable(existingField.getQueryable());
+                field.setSortable(existingField.getSortable());
+                tableFieldMapper.update(field);
+            }
+        }
+        for (DatacenterTableField missing : existingFieldMap.values()) {
+            missing.setMetadataStatus(DatacenterMetadataStatus.MISSING.name());
+            missing.setQueryable(0);
+            missing.setSortable(0);
+            missing.setWritable(0);
+            missing.setModified(now);
+            missing.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+            tableFieldMapper.update(missing);
         }
         table.setFields(getFields(table.getId()));
         return table;
@@ -196,19 +312,71 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
                 fieldUpdateMap.put(field.getFieldId(), field);
             }
         }
+        boolean policyChanged = false;
         for (DatacenterTableField field : table.getFields()) {
             DatacenterFieldDescriptionUpdate update = fieldUpdateMap.get(field.getId());
             if (update == null) {
                 continue;
             }
             field.setFieldDesc(normalizeDescription(update.getFieldDesc()));
+            Integer queryable = normalizedQueryable(update.getQueryable(), field.getQueryable());
+            String sensitivityLevel = normalizedSensitivityLevel(
+                    update.getSensitivityLevel(), field.getSensitivityLevel());
+            if (!DatacenterSensitivityLevel.PUBLIC.name().equals(sensitivityLevel)
+                    && Integer.valueOf(1).equals(queryable)) {
+                throw new BusinessException("敏感字段暂不支持直接查询，请关闭可查询后保存");
+            }
+            policyChanged |= !Objects.equals(field.getQueryable(), queryable)
+                    || !Objects.equals(field.getSensitivityLevel(), sensitivityLevel);
+            field.setQueryable(queryable);
+            field.setSensitivityLevel(sensitivityLevel);
             field.setModified(now);
             field.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
             tableFieldMapper.update(field);
         }
+        if (policyChanged) {
+            incrementExternalScopeRevisions(List.of(table));
+        }
         return getTableWithFields(tableId);
     }
 
+    /**
+     * 校验并归一化字段查询开关。
+     *
+     * @param requested 请求值
+     * @param existing 当前值
+     * @return 归一化后的 0 或 1
+     */
+    private Integer normalizedQueryable(Integer requested, Integer existing) {
+        if (requested == null) {
+            return existing == null ? 0 : existing;
+        }
+        if (requested != 0 && requested != 1) {
+            throw new BusinessException("queryable 只能为 0 或 1");
+        }
+        return requested;
+    }
+
+    /**
+     * 校验并归一化字段敏感级别。
+     *
+     * @param requested 请求值
+     * @param existing 当前值
+     * @return 有效枚举名称
+     */
+    private String normalizedSensitivityLevel(String requested, String existing) {
+        if (requested == null || requested.isBlank()) {
+            return existing == null || existing.isBlank()
+                    ? DatacenterSensitivityLevel.PUBLIC.name() : existing;
+        }
+        try {
+            return DatacenterSensitivityLevel.valueOf(
+                    requested.trim().toUpperCase(Locale.ROOT)).name();
+        } catch (IllegalArgumentException exception) {
+            throw new BusinessException("不支持的字段敏感级别: " + requested);
+        }
+    }
+
     @Override
     public DatacenterTable getTableWithFields(BigInteger tableId) {
         DatacenterTable table = tableMapper.selectOneById(tableId);
@@ -223,7 +391,7 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
     public List<DatacenterTableField> getFields(BigInteger tableId) {
         QueryWrapper wrapper = QueryWrapper.create();
         wrapper.eq(DatacenterTableField::getTableId, tableId);
-        wrapper.orderBy("id");
+        wrapper.orderBy("ordinal_position asc, id asc");
         return tableFieldMapper.selectListByQuery(wrapper);
     }
 
@@ -231,6 +399,7 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
     public DatasetRef resolveDatasetRef(BigInteger tableId) {
         DatacenterTable table = getTableWithFields(tableId);
         DatasetRef ref = new DatasetRef();
+        ref.setTenantId(table.getTenantId());
         ref.setTableId(tableId);
         ref.setSourceId(table.getSourceId());
         ref.setCatalogId(table.getCatalogId());
@@ -266,6 +435,7 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
         if (catalogId != null) {
             wrapper.eq(DatacenterTable::getCatalogId, catalogId);
         }
+        wrapper.eq(DatacenterTable::getMetadataStatus, DatacenterMetadataStatus.ACTIVE.name());
         wrapper.orderBy("created desc");
         return tableMapper.selectListByQuery(wrapper);
     }
@@ -280,31 +450,231 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
         QueryWrapper physicalTableWrapper = QueryWrapper.create();
         physicalTableWrapper.in(DatacenterTable::getId, ids);
         List<DatacenterTable> tables = tableMapper.selectListByQuery(physicalTableWrapper);
+        List<BigInteger> authorizedIds = tables.stream()
+                .map(DatacenterTable::getId)
+                .distinct()
+                .toList();
+        if (authorizedIds.size() != ids.size()) {
+            throw new BusinessException("部分数据表不存在或无权删除");
+        }
         tables.forEach(this::deletePhysicalTableIfNecessary);
 
         QueryWrapper fieldWrapper = QueryWrapper.create();
-        fieldWrapper.in(DatacenterTableField::getTableId, ids);
+        fieldWrapper.in(DatacenterTableField::getTableId, authorizedIds);
         tableFieldMapper.deleteByQuery(fieldWrapper);
 
         QueryWrapper versionWrapper = QueryWrapper.create();
-        versionWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterDatasetVersion::getTableId, ids);
+        versionWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterDatasetVersion::getTableId, authorizedIds);
         datasetVersionMapper.deleteByQuery(versionWrapper);
 
         QueryWrapper importJobWrapper = QueryWrapper.create();
-        importJobWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterImportJob::getTableId, ids);
+        importJobWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterImportJob::getTableId, authorizedIds);
         importJobMapper.deleteByQuery(importJobWrapper);
 
         QueryWrapper upstreamWrapper = QueryWrapper.create();
-        upstreamWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterDerivedTable::getSourceTableId, ids);
+        upstreamWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterDerivedTable::getSourceTableId, authorizedIds);
         derivedTableMapper.deleteByQuery(upstreamWrapper);
 
         QueryWrapper downstreamWrapper = QueryWrapper.create();
-        downstreamWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterDerivedTable::getDerivedTableId, ids);
+        downstreamWrapper.in(tech.easyflow.datacenter.meta.entity.DatacenterDerivedTable::getDerivedTableId, authorizedIds);
         derivedTableMapper.deleteByQuery(downstreamWrapper);
 
         QueryWrapper tableWrapper = QueryWrapper.create();
-        tableWrapper.in(DatacenterTable::getId, ids);
-        return tableMapper.deleteByQuery(tableWrapper);
+        tableWrapper.in(DatacenterTable::getId, authorizedIds);
+        int removed = tableMapper.deleteByQuery(tableWrapper);
+        incrementExternalScopeRevisions(tables);
+        return removed;
+    }
+
+    /**
+     * 刷新已纳管表的物理观测值；身份、结构或历史状态存在歧义时立即收缩权限。
+     */
+    @Override
+    @Transactional(rollbackFor = Exception.class)
+    public boolean refreshManagedTable(
+            DatacenterSource source,
+            DatacenterCatalog catalog,
+            BigInteger tableId,
+            DatacenterTableDetailMeta detail,
+            LoginAccount account) {
+        DatacenterTable existing = tableMapper.selectOneById(tableId);
+        if (existing == null
+                || !Objects.equals(existing.getSourceId(), source.getId())
+                || !Objects.equals(existing.getCatalogId(), catalog.getId())) {
+            throw new BusinessException("已纳管数据表不存在或不属于当前连接");
+        }
+        DatacenterTable discovered = detail == null ? null : detail.getTable();
+        if (discovered == null) {
+            throw new BusinessException("未返回数据表元数据: " + existing.getTableName());
+        }
+        applyTableDefaults(discovered, source, detail);
+        String discoveredIdentity = DatacenterMetadataIdentity.tableIdentity(
+                source.getId().toString(),
+                catalog.getNamespaceKey(),
+                discovered.getActualTable(),
+                discovered.getTableKind());
+        String discoveredFingerprint = DatacenterMetadataIdentity.tableFingerprint(
+                discovered.getTableName(), discovered.getTableKind(), detail.getFields());
+        List<DatacenterTableField> persistedFields = getFields(existing.getId());
+        boolean identityMatches = Objects.equals(
+                existing.getPhysicalIdentityKey(), discoveredIdentity)
+                || Objects.equals(
+                existing.getPhysicalIdentityKey(),
+                DatacenterMetadataIdentity.legacyV58TableIdentity(
+                        existing.getSourceId(), existing.getCatalogId(),
+                        existing.getActualTable(), existing.getTableKind()));
+        boolean legacyCompatible = Objects.equals(
+                existing.getMetadataFingerprint(),
+                DatacenterMetadataIdentity.legacyV58TableFingerprint(
+                        existing.getTableName(), existing.getTableKind()))
+                && legacyStructureMatches(persistedFields, detail.getFields());
+        boolean fingerprintMatches = Objects.equals(
+                existing.getMetadataFingerprint(), discoveredFingerprint)
+                || legacyCompatible;
+        boolean ambiguous = !DatacenterMetadataStatus.ACTIVE.name().equals(existing.getMetadataStatus())
+                || !identityMatches
+                || !fingerprintMatches;
+        if (ambiguous) {
+            return markTableUnavailable(
+                    existing, DatacenterMetadataStatus.CHANGED, true, account);
+        }
+
+        Date now = new Date();
+        existing.setActualTable(discovered.getActualTable());
+        existing.setTableKind(discovered.getTableKind());
+        existing.setPhysicalIdentityKey(discoveredIdentity);
+        existing.setMetadataFingerprint(discoveredFingerprint);
+        existing.setLastSeenAt(now);
+        existing.setMetadataRevision((existing.getMetadataRevision() == null
+                ? 0L : existing.getMetadataRevision()) + 1L);
+        existing.setModified(now);
+        existing.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+        tableMapper.update(existing);
+
+        Map<String, DatacenterTableField> discoveredFields = detail.getFields().stream()
+                .collect(Collectors.toMap(
+                        this::sourceColumnName,
+                        field -> field,
+                        (first, ignored) -> first,
+                        LinkedHashMap::new));
+        for (DatacenterTableField persisted : persistedFields) {
+            DatacenterTableField observed = discoveredFields.get(sourceColumnName(persisted));
+            if (observed == null
+                    || (!legacyCompatible && !Objects.equals(
+                    persisted.getMetadataFingerprint(),
+                    DatacenterMetadataIdentity.fieldFingerprint(observed)))) {
+                // 表 fingerprint 相同的前提下不应进入该分支；保留 fail-closed 防线。
+                return markTableUnavailable(
+                        existing, DatacenterMetadataStatus.CHANGED, true, account);
+            }
+            persisted.setOrdinalPosition(observed.getOrdinalPosition());
+            persisted.setJdbcType(observed.getJdbcType());
+            persisted.setJdbcTypeCode(observed.getJdbcTypeCode());
+            persisted.setNativeTypeName(observed.getNativeTypeName());
+            persisted.setPrecision(observed.getPrecision());
+            persisted.setScale(observed.getScale());
+            persisted.setRequired(observed.getRequired());
+            persisted.setIndexed(observed.getIndexed());
+            persisted.setMetadataFingerprint(
+                    DatacenterMetadataIdentity.fieldFingerprint(observed));
+            persisted.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+            persisted.setLastSeenAt(now);
+            persisted.setModified(now);
+            persisted.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+            tableFieldMapper.update(persisted);
+        }
+        return false;
+    }
+
+    /**
+     * 标记未发现的已纳管表，并关闭其全部查询入口。
+     */
+    @Override
+    @Transactional(rollbackFor = Exception.class)
+    public boolean markManagedTableMissing(
+            DatacenterSource source,
+            BigInteger tableId,
+            LoginAccount account) {
+        DatacenterTable existing = tableMapper.selectOneById(tableId);
+        if (existing == null || !Objects.equals(existing.getSourceId(), source.getId())) {
+            throw new BusinessException("已纳管数据表不存在或不属于当前连接");
+        }
+        return markTableUnavailable(
+                existing, DatacenterMetadataStatus.MISSING, false, account);
+    }
+
+    private boolean markTableUnavailable(
+            DatacenterTable table,
+            DatacenterMetadataStatus status,
+            boolean seen,
+            LoginAccount account) {
+        boolean changed = !status.name().equals(table.getMetadataStatus())
+                || !Integer.valueOf(0).equals(table.getQueryable());
+        Date now = new Date();
+        table.setMetadataStatus(status.name());
+        table.setQueryable(0);
+        if (seen) {
+            table.setLastSeenAt(now);
+        }
+        table.setModified(now);
+        table.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+        tableMapper.update(table);
+        for (DatacenterTableField field : getFields(table.getId())) {
+            changed |= !status.name().equals(field.getMetadataStatus())
+                    || !Integer.valueOf(0).equals(field.getQueryable());
+            field.setMetadataStatus(status.name());
+            field.setQueryable(0);
+            field.setSortable(0);
+            field.setWritable(0);
+            if (seen) {
+                field.setLastSeenAt(now);
+            }
+            field.setModified(now);
+            field.setModifiedBy(account == null ? BigInteger.ZERO : account.getId());
+            tableFieldMapper.update(field);
+        }
+        return changed;
+    }
+
+    /**
+     * 删除外部纳管表后以 CAS 推进策略版本，并在提交后通知其他节点。
+     *
+     * @param removedTables 本事务删除的纳管表
+     */
+    private void incrementExternalScopeRevisions(List<DatacenterTable> removedTables) {
+        Set<BigInteger> sourceIds = removedTables.stream()
+                .map(DatacenterTable::getSourceId)
+                .filter(java.util.Objects::nonNull)
+                .collect(Collectors.toSet());
+        for (BigInteger sourceId : sourceIds) {
+            DatacenterSource source = sourceMapper.selectOneById(sourceId);
+            if (source == null || (!DatacenterSourceType.MYSQL.name().equals(source.getSourceType())
+                    && !DatacenterSourceType.POSTGRESQL.name().equals(source.getSourceType()))) {
+                continue;
+            }
+            long previous = source.getScopeRevision() == null ? 0L : source.getScopeRevision();
+            long definitionRevision = source.getDefinitionRevision() == null
+                    ? 0L : source.getDefinitionRevision();
+            DatacenterSource patch = new DatacenterSource();
+            patch.setId(source.getId());
+            patch.setScopeRevision(Math.max(1L, previous) + 1L);
+            patch.setModified(new Date());
+            QueryWrapper guard = QueryWrapper.create()
+                    .eq(DatacenterSource::getId, source.getId())
+                    .eq(DatacenterSource::getTenantId, source.getTenantId())
+                    .eq(DatacenterSource::getDefinitionRevision, definitionRevision)
+                    .eq(DatacenterSource::getScopeRevision, previous)
+                    .ne(DatacenterSource::getStatus,
+                            DatacenterSourceStatus.DELETED.code());
+            if (sourceMapper.updateByQuery(patch, guard) != 1) {
+                throw new BusinessException("数据范围已被其他请求更新，请刷新后重试");
+            }
+            DatacenterSource updated = sourceMapper.selectOneById(source.getId());
+            if (updated == null) {
+                throw new BusinessException("数据连接已被删除");
+            }
+            federationChangeNotifier.publishAfterCommit(updated);
+        }
     }
 
     private void deletePhysicalTableIfNecessary(DatacenterTable table) {
@@ -360,12 +730,130 @@ public class DatacenterDatasetRegistryServiceImpl implements DatacenterDatasetRe
         if ((table.getActualTable() == null || table.getActualTable().isBlank()) && table.getTableName() != null) {
             table.setActualTable(table.getTableName());
         }
+        if (table.getQueryable() == null) {
+            table.setQueryable(1);
+        }
+        if (table.getMetadataStatus() == null) {
+            table.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+        }
+        if (table.getLastSeenAt() == null) {
+            table.setLastSeenAt(new Date());
+        }
+        if (table.getTimeSemantics() == null) {
+            table.setTimeSemantics("NONE");
+        }
+        if (table.getMetadataRevision() == null) {
+            table.setMetadataRevision(1L);
+        }
         table.setTableDesc(normalizeDescription(table.getTableDesc()));
         if (detail.getFields() == null) {
             detail.setFields(List.of());
         }
     }
 
+    private boolean applyCatalogIdentity(
+            DatacenterCatalog catalog,
+            DatacenterSource source,
+            String catalogName) {
+        boolean mysql = DatacenterSourceType.MYSQL.name().equals(source.getSourceType())
+                || DatacenterSourceType.PROJECT_MYSQL.name().equals(source.getSourceType());
+        String physicalCatalog = mysql ? catalogName : source.getDatabaseName();
+        String physicalSchema = mysql ? null : catalogName;
+        String logicalSchema = catalogName;
+        String namespaceKey = DatacenterMetadataIdentity.namespaceKey(physicalCatalog, physicalSchema);
+        boolean changed = !java.util.Objects.equals(catalog.getLogicalSchemaName(), logicalSchema)
+                || !java.util.Objects.equals(catalog.getPhysicalCatalogName(), physicalCatalog)
+                || !java.util.Objects.equals(catalog.getPhysicalSchemaName(), physicalSchema)
+                || !java.util.Objects.equals(catalog.getNamespaceKey(), namespaceKey)
+                || !DatacenterMetadataStatus.ACTIVE.name().equals(catalog.getMetadataStatus());
+        catalog.setLogicalSchemaName(logicalSchema);
+        catalog.setPhysicalCatalogName(physicalCatalog);
+        catalog.setPhysicalSchemaName(physicalSchema);
+        catalog.setNamespaceKey(namespaceKey);
+        catalog.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+        catalog.setLastSeenAt(new Date());
+        return changed;
+    }
+
+    private void applyFieldDefaults(DatacenterTableField field) {
+        if (!hasText(field.getSourceColumnName())) {
+            field.setSourceColumnName(field.getFieldName());
+        }
+        if (field.getNativeTypeName() == null) {
+            field.setNativeTypeName(field.getJdbcType());
+        }
+        field.setMetadataStatus(DatacenterMetadataStatus.ACTIVE.name());
+        field.setLastSeenAt(new Date());
+        if (field.getSensitivityLevel() == null) {
+            field.setSensitivityLevel(DatacenterSensitivityLevel.PUBLIC.name());
+        }
+        field.setMetadataFingerprint(DatacenterMetadataIdentity.fieldFingerprint(field));
+    }
+
+    /**
+     * 使用 V58 已持久化的旧字段信息校验首次元数据升级。
+     *
+     * <p>V58 新增的 JDBC 编码和顺序列没有回填，因此这些空值只表示未知；
+     * 字段名称、旧 JDBC 类型、精度、小数位和必填属性仍必须保持一致。</p>
+     *
+     * @param persistedFields V58 存量字段
+     * @param discoveredFields 当前 JDBC 发现字段
+     * @return 已知旧结构是否与当前结构一致
+     */
+    private boolean legacyStructureMatches(
+            List<DatacenterTableField> persistedFields,
+            List<DatacenterTableField> discoveredFields) {
+        List<DatacenterTableField> safePersisted = persistedFields == null
+                ? List.of() : persistedFields;
+        List<DatacenterTableField> safeDiscovered = discoveredFields == null
+                ? List.of() : discoveredFields;
+        if (safePersisted.size() != safeDiscovered.size()) {
+            return false;
+        }
+        Map<String, DatacenterTableField> discoveredByName = safeDiscovered.stream()
+                .collect(Collectors.toMap(
+                        this::sourceColumnName,
+                        field -> field,
+                        (first, ignored) -> first,
+                        LinkedHashMap::new));
+        if (discoveredByName.size() != safeDiscovered.size()) {
+            return false;
+        }
+        for (DatacenterTableField persisted : safePersisted) {
+            DatacenterTableField discovered = discoveredByName.get(
+                    sourceColumnName(persisted));
+            if (discovered == null
+                    || !sameWhenKnown(persisted.getFieldType(), discovered.getFieldType())
+                    || !sameWhenKnown(persisted.getJdbcType(), discovered.getJdbcType())
+                    || !sameWhenKnown(persisted.getNativeTypeName(), discovered.getNativeTypeName())
+                    || !sameWhenKnown(persisted.getJdbcTypeCode(), discovered.getJdbcTypeCode())
+                    || !sameWhenKnown(persisted.getPrecision(), discovered.getPrecision())
+                    || !sameWhenKnown(persisted.getScale(), discovered.getScale())
+                    || !sameWhenKnown(persisted.getRequired(), discovered.getRequired())) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * 比较旧元数据中的已知值，空值按 V58 未回填处理。
+     *
+     * @param persisted 旧值
+     * @param discovered 当前值
+     * @return 旧值为空或两者相等时返回 true
+     */
+    private boolean sameWhenKnown(Object persisted, Object discovered) {
+        return persisted == null
+                || java.util.Objects.equals(persisted, discovered);
+    }
+
+    private String sourceColumnName(DatacenterTableField field) {
+        return hasText(field.getSourceColumnName())
+                ? field.getSourceColumnName()
+                : field.getFieldName();
+    }
+
     private String normalizeDescription(String description) {
         if (description == null) {
             return "";

easyflow-modules/easyflow-module-datacenter/src/main/java/tech/easyflow/datacenter/meta/service/impl/DatacenterSourceCandidateService.java

@@ -0,0 +1,361 @@
+package tech.easyflow.datacenter.meta.service.impl;
+
+import com.easyagents.federation.sql.api.FederationSqlException;
+import com.easyagents.federation.sql.source.RuntimeFingerprint;
+import com.easyagents.federation.sql.source.SourceProbeResult;
+import java.math.BigInteger;
+import java.util.Date;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Service;
+import tech.easyflow.common.entity.LoginAccount;
+import tech.easyflow.common.web.exceptions.BusinessException;
+import tech.easyflow.datacenter.execution.model.DatacenterConnectionTestResult;
+import tech.easyflow.datacenter.federation.DatacenterFederationRuntime;
+import tech.easyflow.datacenter.meta.entity.DatacenterSource;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceStatus;
+import tech.easyflow.datacenter.meta.enums.DatacenterSourceType;
+import tech.easyflow.datacenter.meta.model.DatacenterSourceDraftRequest;
+import tech.easyflow.datacenter.meta.support.DatacenterSourceConnectionDefaults;
+import tech.easyflow.datacenter.security.DatacenterCredentialCipher;
+
+/**
+ * 构造并探测未发布的数据源候选配置，确保凭据和连接默认值只在一个边界内处理。
+ */
+@Service
+public class DatacenterSourceCandidateService {
+
+    private static final Logger LOGGER =
+            LoggerFactory.getLogger(DatacenterSourceCandidateService.class);
+
+    private final DatacenterCredentialCipher credentialCipher;
+    private final DatacenterSourceConnectionDefaults connectionDefaults;
+    private final DatacenterFederationRuntime federationRuntime;
+
+    /**
+     * 创建候选配置服务。
+     *
+     * @param credentialCipher 凭据加密器
+     * @param connectionDefaults JDBC 默认配置
+     * @param federationRuntime Federation Runtime
+     */
+    public DatacenterSourceCandidateService(
+            DatacenterCredentialCipher credentialCipher,
+            DatacenterSourceConnectionDefaults connectionDefaults,
+            DatacenterFederationRuntime federationRuntime) {
+        this.credentialCipher = credentialCipher;
+        this.connectionDefaults = connectionDefaults;
+        this.federationRuntime = federationRuntime;
+    }
+
+    /**
+     * 构造仅可探测、不可查询的持久化草稿。
+     *
+     * @param request 草稿请求
+     * @param existing 当前草稿；新建时为空
+     * @param account 当前账号
+     * @return 已归一化草稿
+     */
+    public DatacenterSource buildDraft(
+            DatacenterSourceDraftRequest request,
+            DatacenterSource existing,
+            LoginAccount account) {
+        validateDefinition(request);
+        requireEditableDraft(existing, request.sourceType());
+        DatacenterSource source = existing == null
+                ? new DatacenterSource() : copy(existing);
+        source.setSourceName(request.sourceName().trim());
+        source.setSourceCode(trimToNull(request.sourceCode()));
+        source.setSourceType(request.sourceType());
+        source.setAccessMode("READ_ONLY");
+        source.setBuiltinFlag(0);
+        source.setAdapterId("jdbc");
+        source.setAdapterOptionsJson(Map.of());
+        source.setHost(request.host().trim());
+        source.setPort(request.port());
+        source.setDatabaseName(request.databaseName().trim());
+        source.setSchemaName(trimToNull(request.schemaName()));
+        source.setUsername(request.username().trim());
+        source.setDriverClassName(
+                connectionDefaults.defaultDriverClassName(request.sourceType()));
+        source.setJdbcUrl(null);
+        source.setConfigJson(Map.of());
+        applyCredential(source, existing, trimToNull(request.password()));
+        connectionDefaults.normalize(source);
+        requireCredential(source);
+        source.setDefinitionRevision(existing == null
+                ? 1L : value(existing.getDefinitionRevision()) + 1L);
+        source.setScopeRevision(Math.max(1L, value(source.getScopeRevision())));
+        source.setDefinitionChecksum(null);
+        source.setCompatibilityStatus(null);
+        source.setMetadataRefreshStatus("PENDING");
+        source.setStatus(DatacenterSourceStatus.DRAFT.code());
+        source.setCapabilitiesJson(Map.of(
+                "capabilities", List.of(
+                        "TEST_CONNECTION", "BROWSE_METADATA", "READ_QUERY")));
+        if (source.getTenantId() == null && account != null) {
+            source.setTenantId(account.getTenantId());
+            source.setDeptId(account.getDeptId());
+        }
+        return source;
+    }
+
+    /**
+     * 构造活动连接的下一 revision 候选配置。
+     *
+     * @param current 当前已发布配置
+     * @param request 新连接定义
+     * @return 未发布候选配置
+     */
+    public DatacenterSource buildReconfigurationCandidate(
+            DatacenterSource current,
+            DatacenterSourceDraftRequest request) {
+        validateDefinition(request);
+        DatacenterSourceStatus status = DatacenterSourceStatus.fromCode(current.getStatus());
+        if (status != DatacenterSourceStatus.READY
+                && status != DatacenterSourceStatus.DEGRADED) {
+            throw new BusinessException("只有已激活连接可以使用候选配置");
+        }
+        if (!java.util.Objects.equals(current.getSourceType(), request.sourceType())) {
+            throw new BusinessException("数据连接类型创建后不可修改");
+        }
+        DatacenterSource candidate = copy(current);
+        candidate.setSourceName(request.sourceName().trim());
+        String requestedCode = trimToNull(request.sourceCode());
+        candidate.setSourceCode(requestedCode == null
+                ? current.getSourceCode() : requestedCode);
+        candidate.setAccessMode("READ_ONLY");
+        candidate.setBuiltinFlag(0);
+        candidate.setAdapterId("jdbc");
+        candidate.setAdapterOptionsJson(Map.of());
+        candidate.setHost(request.host().trim());
+        candidate.setPort(request.port());
+        candidate.setDatabaseName(request.databaseName().trim());
+        candidate.setSchemaName(trimToNull(request.schemaName()));
+        candidate.setUsername(request.username().trim());
+        candidate.setDriverClassName(
+                connectionDefaults.defaultDriverClassName(request.sourceType()));
+        candidate.setJdbcUrl(null);
+        candidate.setConfigJson(Map.of());
+        applyCredential(candidate, current, trimToNull(request.password()));
+        connectionDefaults.normalize(candidate);
+        requireCredential(candidate);
+        candidate.setDefinitionRevision(value(current.getDefinitionRevision()) + 1L);
+        candidate.setScopeRevision(current.getScopeRevision());
+        candidate.setDefinitionChecksum(null);
+        candidate.setStatus(DatacenterSourceStatus.DRAFT.code());
+        candidate.setLastTestStatus(null);
+        candidate.setLastTestMessage(null);
+        candidate.setLastTestedAt(null);
+        return candidate;
+    }
+
+    /**
+     * 使用短生命周期候选上下文探测连接，并将数据库指纹写回候选实体。
+     *
+     * @param candidate 候选配置
+     * @return 安全探测结果
+     */
+    public DatacenterConnectionTestResult probe(DatacenterSource candidate) {
+        Date testedAt = new Date();
+        DatacenterConnectionTestResult result = new DatacenterConnectionTestResult();
+        try {
+            DatacenterSourceStatus status = DatacenterSourceStatus.fromCode(
+                    candidate.getStatus());
+            SourceProbeResult probe = status == DatacenterSourceStatus.READY
+                    || status == DatacenterSourceStatus.DEGRADED
+                    ? federationRuntime.probe(candidate)
+                    : federationRuntime.probeCandidate(candidate);
+            RuntimeFingerprint fingerprint = probe.fingerprint();
+            result.setSuccess(probe.supported());
+            result.setErrorCode(probe.supported() ? null : "ADAPTER_UNSUPPORTED");
+            result.setMessage(bounded(probe.diagnostic()));
+            result.setCapabilities(List.of(
+                    "TEST_CONNECTION", "BROWSE_METADATA", "READ_QUERY"));
+            result.setDetails(safeProbeDetails(candidate, fingerprint));
+            candidate.setLastTestStatus(probe.supported() ? "SUCCESS" : "FAILED");
+            candidate.setLastTestMessage(result.getMessage());
+            candidate.setCompatibilityStatus(
+                    probe.supported() ? "CODE_SUPPORTED_UNVERIFIED" : "UNSUPPORTED");
+            applyFingerprint(candidate, fingerprint);
+        } catch (FederationSqlException exception) {
+            LOGGER.warn("候选数据源探测失败，sourceId={}, code={}",
+                    candidate.getId(), exception.errorCode(), exception);
+            result.setSuccess(false);
+            result.setErrorCode(exception.errorCode().name());
+            result.setMessage(bounded(exception.getMessage()));
+            candidate.setLastTestStatus("FAILED");
+            candidate.setLastTestMessage(result.getMessage());
+        } catch (RuntimeException exception) {
+            LOGGER.error("候选数据源探测发生未预期错误，sourceId={}",
+                    candidate.getId(), exception);
+            result.setSuccess(false);
+            result.setErrorCode("CONNECTION_FAILED");
+            result.setMessage("无法连接到数据库，请检查地址、账号和网络");
+            candidate.setLastTestStatus("FAILED");
+            candidate.setLastTestMessage(result.getMessage());
+        }
+        candidate.setLastTestedAt(testedAt);
+        return result;
+    }
+
+    /**
+     * 加密新密码，空密码则保留已有密文。
+     *
+     * @param target 目标实体
+     * @param existing 当前实体
+     * @param password 可选明文密码
+     */
+    public void applyCredential(
+            DatacenterSource target,
+            DatacenterSource existing,
+            String password) {
+        if (password != null) {
+            target.setCredentialCipher(credentialCipher.encrypt(password));
+            return;
+        }
+        if ((target.getCredentialCipher() == null
+                || target.getCredentialCipher().isBlank()) && existing != null) {
+            target.setCredentialCipher(existing.getCredentialCipher());
+        }
+    }
+
+    /**
+     * 从旧兼容配置中读取待加密密码。
+     *
+     * @param configJson 兼容配置
+     * @return 归一化密码；不存在时为空
+     */
+    public String extractPassword(Map<String, Object> configJson) {
+        if (configJson == null || configJson.get("password") == null) {
+            return null;
+        }
+        return trimToNull(String.valueOf(configJson.get("password")));
+    }
+
+    /**
+     * 复制数据源快照，避免候选探测修改权威实体。
+     *
+     * @param source 原实体
+     * @return 独立副本
+     */
+    public DatacenterSource copy(DatacenterSource source) {
+        DatacenterSource copy = new DatacenterSource();
+        copy.setId(source.getId());
+        copy.setTenantId(source.getTenantId());
+        copy.setDeptId(source.getDeptId());
+        copy.setCreated(source.getCreated());
+        copy.setCreatedBy(source.getCreatedBy());
+        copy.setSourceName(source.getSourceName());
+        copy.setSourceCode(source.getSourceCode());
+        copy.setSourceType(source.getSourceType());
+        copy.setAdapterId(source.getAdapterId());
+        copy.setAdapterOptionsJson(source.getAdapterOptionsJson());
+        copy.setDefinitionRevision(source.getDefinitionRevision());
+        copy.setDefinitionChecksum(source.getDefinitionChecksum());
+        copy.setScopeRevision(source.getScopeRevision());
+        copy.setAccessMode(source.getAccessMode());
+        copy.setBuiltinFlag(source.getBuiltinFlag());
+        copy.setCredentialCipher(source.getCredentialCipher());
+        copy.setDriverClassName(source.getDriverClassName());
+        copy.setJdbcUrl(source.getJdbcUrl());
+        copy.setHost(source.getHost());
+        copy.setPort(source.getPort());
+        copy.setDatabaseName(source.getDatabaseName());
+        copy.setSchemaName(source.getSchemaName());
+        copy.setUsername(source.getUsername());
+        copy.setConfigJson(source.getConfigJson());
+        copy.setCapabilitiesJson(source.getCapabilitiesJson());
+        copy.setOptions(source.getOptions());
+        copy.setStatus(source.getStatus());
+        copy.setCompatibilityStatus(source.getCompatibilityStatus());
+        copy.setDatabaseProductName(source.getDatabaseProductName());
+        copy.setDatabaseProductVersion(source.getDatabaseProductVersion());
+        copy.setDriverName(source.getDriverName());
+        copy.setDriverVersion(source.getDriverVersion());
+        copy.setMetadataRefreshStatus(source.getMetadataRefreshStatus());
+        copy.setMetadataRefreshedAt(source.getMetadataRefreshedAt());
+        copy.setLastTestStatus(source.getLastTestStatus());
+        copy.setLastTestMessage(source.getLastTestMessage());
+        copy.setLastTestedAt(source.getLastTestedAt());
+        return copy;
+    }
+
+    private void validateDefinition(DatacenterSourceDraftRequest request) {
+        if (request == null || request.sourceName() == null
+                || request.sourceName().isBlank()) {
+            throw new BusinessException("请输入连接名称");
+        }
+        if (!DatacenterSourceType.MYSQL.name().equals(request.sourceType())
+                && !DatacenterSourceType.POSTGRESQL.name().equals(request.sourceType())) {
+            throw new BusinessException("当前批次仅支持 MySQL 和 PostgreSQL");
+        }
+        if (request.host() == null || request.host().isBlank()
+                || request.databaseName() == null || request.databaseName().isBlank()
+                || request.username() == null || request.username().isBlank()) {
+            throw new BusinessException("请完整填写主机、数据库和用户名");
+        }
+    }
+
+    private void requireEditableDraft(
+            DatacenterSource existing,
+            String requestedSourceType) {
+        if (existing == null) {
+            return;
+        }
+        if (DatacenterSourceStatus.fromCode(existing.getStatus())
+                != DatacenterSourceStatus.DRAFT) {
+            throw new BusinessException("已激活连接不可直接修改，请使用重配置");
+        }
+        if (!java.util.Objects.equals(existing.getSourceType(), requestedSourceType)) {
+            throw new BusinessException("数据连接类型创建后不可修改");
+        }
+    }
+
+    private void requireCredential(DatacenterSource source) {
+        if (source.getCredentialCipher() == null
+                || source.getCredentialCipher().isBlank()) {
+            throw new BusinessException("请输入数据库密码");
+        }
+    }
+
+    private Map<String, Object> safeProbeDetails(
+            DatacenterSource source,
+            RuntimeFingerprint fingerprint) {
+        Map<String, Object> details = new LinkedHashMap<>();
+        details.put("databaseProductName", fingerprint.databaseProduct());
+        details.put("databaseProductVersion", fingerprint.databaseVersion());
+        details.put("driverName", fingerprint.driverName());
+        details.put("driverVersion", fingerprint.driverVersion());
+        details.put("effectiveDriverClassName", source.getDriverClassName());
+        details.put("effectivePort", source.getPort());
+        return java.util.Collections.unmodifiableMap(details);
+    }
+
+    private void applyFingerprint(
+            DatacenterSource source,
+            RuntimeFingerprint fingerprint) {
+        source.setDatabaseProductName(fingerprint.databaseProduct());
+        source.setDatabaseProductVersion(fingerprint.databaseVersion());
+        source.setDriverName(fingerprint.driverName());
+        source.setDriverVersion(fingerprint.driverVersion());
+    }
+
+    private String trimToNull(String value) {
+        return value == null || value.isBlank() ? null : value.trim();
+    }
+
+    private long value(Long sourceValue) {
+        return sourceValue == null ? 0L : sourceValue;
+    }
+
+    private String bounded(String value) {
+        if (value == null) {
+            return null;
+        }
+        return value.length() <= 500 ? value : value.substring(0, 500);
+    }
+}