[adm 4] Restore external API connection and discovery

.changeset/calm-external-apis.md

@@ -0,0 +1,5 @@
+---
+'@ankhorage/studio': minor
+---
+
+Rebuild external API authoring with trusted OpenAPI discovery, GraphQL introspection, manual REST fallback, canonical manifest persistence, operation visibility, and credential-safe endpoint testing.

README.md

@@ -3,7 +3,7 @@
 
 # @ankhorage/studio
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v0.11.11](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v0.11.12](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Standalone Studio authoring package for Ankhorage apps.
 

docs/external-api-authoring.md

@@ -0,0 +1,25 @@
+# External API authoring
+
+`/ankh/apis` connects existing services into the canonical manifest `dataSources` registry. Studio does not own OpenAPI parsing, GraphQL introspection, REST normalization, or endpoint execution; those capabilities come from `@ankhorage/data-sources`.
+
+## Trusted host boundary
+
+The browser submits only authoring intent and provider-neutral credential references. The local Studio host performs discovery and operation tests through a constrained HTTP transport with timeouts, response-size limits, redirect rejection, and cloud metadata target blocking. Trusted secret values are resolved only inside the host and are removed from browser-readable operation diagnostics.
+
+## Persistence
+
+Successful OpenAPI discovery, GraphQL introspection, and manual REST creation upsert the resulting `DataSourceConfig` directly into the editable Studio manifest. Reusing a normalized source ID updates that source. There is no secondary API catalog or unsaved API model.
+
+## Authoring flows
+
+- **Auto discovery** probes direct and conventional OpenAPI document locations before trying GraphQL introspection at the supplied URL.
+- **OpenAPI** uses only the canonical discovery/import flow.
+- **GraphQL** executes the canonical introspection request and normalizes discovered operations.
+- **Manual REST** provides an explicit fallback when no schema document exists.
+- **Operation testing** uses the canonical data-source test runner. Browser responses omit request headers and bodies and redact query values.
+
+Package-neutral source-ID normalization and registry upsert helpers are exported through `@ankhorage/studio/externalApiAuthoring`.
+
+## Validation boundary
+
+Changes to this flow must validate the package model and trusted host behavior, the Studio web workspace, the generated app web administration surface, and the published package contents. External provider availability is injected or mocked in deterministic tests; real credentials never belong in repository or browser test fixtures.

package.json

@@ -179,6 +179,10 @@
     "./host": {
       "types": "./dist/host/index.d.ts",
       "import": "./dist/host/index.js"
+    },
+    "./externalApiAuthoring": {
+      "types": "./dist/externalApiAuthoring.d.ts",
+      "import": "./dist/externalApiAuthoring.js"
     }
   },
   "ankh": {
@@ -194,7 +198,9 @@
       "studio.secrets.list",
       "studio.secrets.create",
       "studio.secrets.replace",
-      "studio.secrets.remove"
+      "studio.secrets.remove",
+      "studio.data-sources.connect",
+      "studio.data-sources.test"
     ]
   },
   "scripts": {
@@ -234,6 +240,7 @@
   "dependencies": {
     "@ankhorage/color-theory": "^0.0.8",
     "@ankhorage/contracts": "^4.0.1",
+    "@ankhorage/data-sources": "^0.6.0",
     "@ankhorage/expo-runtime": "^0.0.11",
     "@ankhorage/infra": "^1.1.0",
     "@ankhorage/orchestrator": "^0.2.4",