docs(monit): document datasource query tools on the invoke entry

en/developer/cli.mdx

@@ -462,31 +462,28 @@ flashduty session export <session_id> --include-subagents > session.ndjson
 | `--include-subagents` | After each `subagent_dispatch`, recursively inline that subagent's own full event stream |
 
 
-### monit-query — Monitoring datasource queries
+### monit-query — Unified datasource tool invocation
 
-Query monitoring back-end datasources directly, bypassing the alert-rule layer. The `data` subcommand supports 9 datasource types (Prometheus, VictoriaLogs, Loki, MySQL, SLS, Elasticsearch, PostgreSQL, Oracle, ClickHouse). For metric trends and log patterns, use the named tools of `monit datasource-tools-invoke` below.
+`monit-query` executes **a single named tool** against a configured datasource — the unified entry for both query tools (`<type>.query`, covering `prometheus`, `mysql`, `postgres`, `oracle`, `clickhouse`, `elasticsearch`, `loki`, `victorialogs`, `sls`, `tencent_cls`) and diagnostic tools (e.g. `mysql.overview`, `redis_node.slowlog`), bypassing the alert-rule layer. The legacy `monit-query data` subcommand is retired. Get the datasource ID from the `id` field of `monit datasource-list`:
 
 ```bash
-flashduty monit-query data [flags]       # Structured datasource query
+flashduty monit datasource-list --type prometheus --json | jq '.[] | {id, name, type_ident, address}'
+flashduty monit-query <datasource-id> --tool 'prometheus.query' \
+  --params '{"expr":"sum(rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":1789000000000}}'
+flashduty monit-query <datasource-id> --tool 'redis_node.slowlog' --params '{}'
 ```
 
-Common flags for `data`:
-
 | Flag | Description |
 |------|-------------|
-| `--ds-type` | Datasource type (required): `prometheus`, `victorialogs`, `loki`, `mysql`, `sls`, `elasticsearch`, `postgres`, `oracle`, `clickhouse` |
-| `--ds-name` | Datasource name as configured in the console (required) |
-| `--expr` | Query expression (required) |
-| `--delay-seconds` | Look-back offset in seconds for point-in-time queries (default `0`) |
-| `--args KEY=VALUE` | Additional arguments, repeatable (values must be strings). In raw mode (`loki` / `victorialogs`), `<ds-type>.start` and `<ds-type>.end` accept a relative duration (`15m`), `now`, a date/RFC3339 timestamp, or unix seconds/milliseconds; the CLI normalizes them to the unix-seconds form the datasource requires |
-
-`data` returns a stable `query_result.v1` structured result: `format` is always `query_result.v1`, and `result.kind` is one of `frames` (typed table/time-series frames), `records` (schema-flexible records, may contain nested JSON or null), or `samples` (instant samples with complete label sets) — results are no longer flattened into the legacy rows shape.
+| `<datasource-id>` | Datasource ID (positional, required, from `monit datasource-list`, min 1) |
+| `--tool` | Tool name (required), prefixed by the datasource type, e.g. `prometheus.query`, `mysql.overview`, `redis_node.slowlog`; 1–128 chars |
+| `--params` | Tool parameters JSON (may be omitted, meaning `{}`; pass `-` to read a larger payload from standard input; an explicit `null` is invalid) |
 
-`rows` requires `--ds-type`, `--ds-name`, and `--expr` (query expression). Use `--args KEY=VALUE` (repeatable) for parameterized queries. **`rows` is deprecated** — use `monit-query data` instead. In raw mode (`loki` / `victorialogs`), `rows` accepts time-window arguments `--args <ds-type>.start=<t>` and `--args <ds-type>.end=<t>` as a relative duration, `now`, date/RFC3339, or Unix seconds or milliseconds; the CLI normalizes them to the unix-seconds form the datasource requires.
+Query tools return a complete `explore_result.v1` structured result: `format` is always `explore_result.v1`, and `result.kind` is one of `samples` (instant samples with complete label sets), `frames` (typed table/time-series frames), or `logs` (raw logs with `applied_limit` and `has_more`). For the diagnostic tool response shape, see `monit datasource-tools-invoke` below.
 
 ### monit datasource-tools-invoke — Datasource diagnostics
 
-`monit datasource-tools-invoke` executes **one deterministic read-only tool** against a configured datasource — the current path for structured datasource diagnostics (replacing `monit-query diagnose`). Get the datasource ID from the `id` field of `monit datasource-list`:
+`monit datasource-tools-invoke` executes **one deterministic read-only tool** against a configured datasource — the current path for structured datasource diagnostics (replacing `monit-query diagnose`). It is equivalent to the `monit-query` command above, which is the recommended path. Get the datasource ID from the `id` field of `monit datasource-list`:
 
 ```bash
 flashduty monit datasource-list --type redis_node --json | jq '.[] | {id, name, type_ident, address}'
@@ -503,9 +500,9 @@ flashduty monit datasource-tools-invoke <datasource-id> --tool 'redis_node.slowl
 
 Semantics and limits:
 
-- **No tool catalog, no auto-replay, no fallback**: one call runs exactly one named tool; fill parameters according to the datasource tool's contract rather than guessing from the command list. The `mysql.query` / `postgres.query` tools have been removed — free SQL stays under `monit-query data`.
+- **No tool catalog, no auto-replay, no fallback**: one call runs exactly one named tool; fill parameters according to the datasource tool's contract rather than guessing from the command list. Alongside diagnostic tools, the entry also supports `<type>.query` query tools (`prometheus`, `mysql`, `postgres`, `oracle`, `clickhouse`, `elasticsearch`, `loki`, `victorialogs`, `sls`, `tencent_cls`).
 - Requires **all** currently online routable Edge sessions in the cluster to support the v0.71.0 base invoke protocol (individual tools may require a newer implementation); normal datasource queries retain their existing version compatibility.
-- Request body limit 128 KiB; complete success response limit 1 MiB; tool timeout at most 25 seconds.
+- Request body limit 128 KiB; complete success response limit 10 MiB; tool timeout at most 25 seconds.
 - The datasource must have `enabled=true`; `alerting_enabled=false` does not block diagnostics.
 - Response: `data` (tool-specific JSON evidence, preserved without conversion, never null, no legacy diagnose envelope), `tool`, `datasource_id`, optional `summary`, and a `truncated` object (with `reason`; its presence indicates truncation).
 

en/developer/go-sdk.mdx

@@ -186,7 +186,7 @@ Endpoints are grouped by service and hang off the client: the call convention is
 
 `client.Diagnostics.QueryData` runs a synchronous query via `POST /monit/query/data` and returns a stable `query_result.v1` structured result (`result.kind` is one of `frames`, `records`, or `samples`). This API requires monit-edge v0.65.0 or later. For log-pattern and metric-trend analysis, use `client.DataSources.ToolsInvoke` with `prometheus.metric_trends`, `loki.log_patterns`, or `victorialogs.log_patterns`.
 
-`client.DataSources.ToolsInvoke` (`POST /monit/datasource/tools/invoke`, `monit-datasource-tools-invoke`) executes one deterministic tool against a configured datasource: `tool` is a single tool name prefixed by the datasource type (e.g. `mysql.overview`), and `params` is the tool-specific JSON parameters (omitted means `{}`; an explicit `null` is invalid). Free SQL goes through `/monit/query/data`; `mysql.query` and `postgres.query` are unsupported. It requires all currently online routable Edge sessions in the cluster to support the v0.71.0 base invoke protocol (individual tools may require a newer implementation), and there is no tool catalog, no automatic replay, and no fallback to legacy diagnose. The request body limit is 128 KiB, the complete success response limit is 1 MiB, and the tool timeout is at most 25 seconds; the response is a `DatasourceToolResult` (`data` is tool-specific JSON, never null, `summary` is optional, and a `truncated` object with `reason` indicates truncation).
+`client.DataSources.ToolsInvoke` (`POST /monit/datasource/tools/invoke`, `monit-datasource-tools-invoke`) executes one deterministic tool against a configured datasource: `tool` is a single tool name prefixed by the datasource type (e.g. `mysql.overview`), and `params` is the tool-specific JSON parameters (omitted means `{}`; an explicit `null` is invalid). Alongside diagnostic tools, the entry supports `<type>.query` query tools (`prometheus`, `mysql`, `postgres`, `oracle`, `clickhouse`, `elasticsearch`, `loki`, `victorialogs`, `sls`, `tencent_cls`); the `/monit/query/data` entry stays unchanged. It requires all currently online routable Edge sessions in the cluster to support the v0.71.0 base invoke protocol (individual tools may require a newer implementation), and there is no tool catalog, no automatic replay, and no fallback to legacy diagnose. The request body limit is 128 KiB, the complete success response limit is 10 MiB, and the tool timeout is at most 25 seconds; the response is a `DatasourceToolResult` (`data` is tool-specific JSON, never null, `summary` is optional, and a `truncated` object with `reason` indicates truncation).
 
 For `client.DataSources`, the `payload` selects a type-specific configuration block by `type_ident`. Fifteen `type_ident` values are allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, plus the new diagnostic-only types `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, and `kafka` — diagnostic-only types always have `alerting_enabled` false (which does not block non-alerting queries or tools) and reject true. Connection address rules: Redis/MongoDB diagnostic types take a single `host:port` (bracket IPv6), with no URI, userinfo, or query; `kafka` takes 1–32 unique comma-separated `host:port` bootstrap addresses (at most 4096 characters after normalization, and the payload has no broker list); for `mongodb_mongod` / `mongodb_mongos` the configuration block's `auth_source` defaults to `admin`, username and password must be configured together, and client certificates are unsupported; the Redis node configuration's `database` defaults to 0. Sensitive fields such as the diagnostic types' `password` and Kafka's `tls_key` support `${env:NAME}` references: literal values are omitted from responses (only `${env:...}` references are echoed back), omitting the fields on update preserves the stored values, and explicitly sending an empty string clears them.
 

zh/developer/cli.mdx

@@ -462,31 +462,28 @@ flashduty session export <session_id> --include-subagents > session.ndjson
 | `--include-subagents` | 在每条 `subagent_dispatch` 之后递归内联该子智能体自身的完整事件流 |
 
 
-### monit-query — 监控数据源查询
+### monit-query — 监控数据源统一工具调用
 
-直接查询监控后端数据源，无需经过告警规则层。`data` 子命令支持 9 种数据源类型（Prometheus、VictoriaLogs、Loki、MySQL、SLS、Elasticsearch、PostgreSQL、Oracle、ClickHouse）。指标趋势和日志模式分析使用下文的 `monit datasource-tools-invoke` 命名工具。
+`monit-query` 对已配置的数据源执行**单个命名工具**，是查询与诊断的统一入口：查询工具（`<type>.query`，覆盖 `prometheus`、`mysql`、`postgres`、`oracle`、`clickhouse`、`elasticsearch`、`loki`、`victorialogs`、`sls`、`tencent_cls`）与诊断工具（如 `mysql.overview`、`redis_node.slowlog`）都走它，无需经过告警规则层。旧 `monit-query data` 子命令已退役。数据源 ID 从 `monit datasource-list` 的 `id` 字段获取：
 
 ```bash
-flashduty monit-query data [flags]       # 结构化数据源查询
+flashduty monit datasource-list --type prometheus --json | jq '.[] | {id, name, type_ident, address}'
+flashduty monit-query <datasource-id> --tool 'prometheus.query' \
+  --params '{"expr":"sum(rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":1789000000000}}'
+flashduty monit-query <datasource-id> --tool 'redis_node.slowlog' --params '{}'
 ```
 
-`data` 常用参数：
-
 | 参数 | 说明 |
 |------|------|
-| `--ds-type` | 数据源类型（必填）：`prometheus`、`victorialogs`、`loki`、`mysql`、`sls`、`elasticsearch`、`postgres`、`oracle`、`clickhouse` |
-| `--ds-name` | 数据源名称（必填，与控制台配置一致） |
-| `--expr` | 查询表达式（必填） |
-| `--delay-seconds` | 查询时间点的回溯偏移秒数，用于点对点查询（默认 `0`） |
-| `--args KEY=VALUE` | 附加参数，可重复（值须为字符串）。`loki` / `victorialogs` 原始模式下，`<ds-type>.start` 与 `<ds-type>.end` 接受相对时长（`15m`）、`now`、日期/RFC3339 时间戳或 Unix 秒/毫秒，CLI 会统一归一化为数据源要求的 Unix 秒 |
-
-`data` 返回稳定的 `query_result.v1` 结构化结果：`format` 固定为 `query_result.v1`，`result.kind` 为 `frames`（类型化表格/时序帧）、`records`（字段灵活的记录，可含嵌套 JSON 或 null）或 `samples`（带完整标签集的即时样本）三者之一，不再把结果强制压平为旧版行结构。
+| `<datasource-id>` | 数据源 ID（位置参数，必填，来自 `monit datasource-list`，最小 1） |
+| `--tool` | 工具名（必填），以数据源类型为前缀，如 `prometheus.query`、`mysql.overview`、`redis_node.slowlog`；1–128 字符 |
+| `--params` | 工具参数 JSON（可省略，省略即 `{}`；参数较长时传 `-` 从标准输入读取；显式 `null` 不合法） |
 
-`rows` 常用参数：`--ds-type`、`--ds-name`（均必填）、`--expr`（查询表达式，必填）、`--args KEY=VALUE`（可重复）。**`rows` 已弃用**，请改用 `monit-query data`。`rows` 原始模式（`loki` / `victorialogs`）可通过 `--args <ds-type>.start=<t>` 与 `--args <ds-type>.end=<t>` 指定时间窗口，支持相对时长、`now`、日期/RFC3339、Unix 秒或毫秒，CLI 会统一归一化为数据源要求的 Unix 秒。
+查询工具返回完整的 `explore_result.v1` 结构化结果：`format` 固定为 `explore_result.v1`，`result.kind` 为 `samples`（带完整标签集的即时样本）、`frames`（类型化表格/时序帧）或 `logs`（原始日志，含 `applied_limit` 与 `has_more`）三者之一。诊断工具的返回结构见下文 `monit datasource-tools-invoke`。
 
 ### monit datasource-tools-invoke — 数据源诊断工具
 
-`monit datasource-tools-invoke` 对已配置的数据源执行**一次确定性的只读工具调用**，是结构化数据源诊断的现行路径（取代 `monit-query diagnose`）。数据源 ID 从 `monit datasource-list` 的 `id` 字段获取：
+`monit datasource-tools-invoke` 对已配置的数据源执行**一次确定性的只读工具调用**，是结构化数据源诊断的现行路径（取代 `monit-query diagnose`），与上文 `monit-query` 命令等价，`monit-query` 为推荐路径。数据源 ID 从 `monit datasource-list` 的 `id` 字段获取：
 
 ```bash
 flashduty monit datasource-list --type redis_node --json | jq '.[] | {id, name, type_ident, address}'
@@ -503,9 +500,9 @@ flashduty monit datasource-tools-invoke <datasource-id> --tool 'redis_node.slowl
 
 语义与限制：
 
-- **无工具目录、无自动重试、无回退**：一次调用只执行一个命名工具，参数需按各数据源工具约定填写，不要从命令行列表猜测。`mysql.query` / `postgres.query` 工具已移除——自由 SQL 请用 `monit-query data`。
+- **无工具目录、无自动重试、无回退**：一次调用只执行一个命名工具，参数需按各数据源工具约定填写，不要从命令行列表猜测。除诊断工具外，入口还支持 `<type>.query` 查询工具（`prometheus`、`mysql`、`postgres`、`oracle`、`clickhouse`、`elasticsearch`、`loki`、`victorialogs`、`sls`、`tencent_cls`）。
 - 要求所选集群内**全部**当前在线可路由的 Edge 会话支持 v0.71.0 基础调用协议（个别工具可能要求更新的实现）；普通数据源查询不受此版本限制。
-- 请求体 ≤128 KiB；完整成功响应 ≤1 MiB；工具超时 ≤25 秒。
+- 请求体 ≤128 KiB；完整成功响应 ≤10 MiB；工具超时 ≤25 秒。
 - 需要数据源 `enabled=true`；`alerting_enabled=false` 不阻塞诊断。
 - 返回值：`data`（工具特定的 JSON 证据，原样保留、永不为 null，不含旧 diagnose 信封）、`tool`、`datasource_id`、可选 `summary`，以及 `truncated` 对象（含 `reason`，存在即表示结果被截断）。
 

zh/developer/go-sdk.mdx

@@ -186,7 +186,7 @@ client, err := flashduty.NewClient("YOUR_APP_KEY",
 
 `client.Diagnostics.QueryData` 通过 `POST /monit/query/data` 执行同步查询，返回稳定的 `query_result.v1` 结构化结果（`result.kind` 为 `frames` / `records` / `samples` 之一），要求 monit-edge v0.65.0 及以上版本。日志模式和指标趋势分析统一使用 `client.DataSources.ToolsInvoke`，工具名称为 `prometheus.metric_trends`、`loki.log_patterns` 或 `victorialogs.log_patterns`。
 
-`client.DataSources.ToolsInvoke`（`POST /monit/datasource/tools/invoke`，`monit-datasource-tools-invoke`）在某个已配置数据源上执行一个确定性工具：`tool` 名称由数据源类型前缀修饰（如 `mysql.overview`），`params` 为工具专属 JSON 参数（省略视为 `{}`，显式 `null` 非法）；自由 SQL 请走 `/monit/query/data`，`mysql.query` 与 `postgres.query` 不受支持。该接口要求集群中所有在线可路由的 Edge 会话都支持 v0.71.0 基础调用协议（单个工具可能要求更新的实现），无工具目录、无自动重放、也不会回退到旧版 diagnose。请求体上限 128 KiB，完整成功响应上限 1 MiB，单工具超时至多 25 秒；响应为 `DatasourceToolResult`（`data` 为工具专属 JSON、永不为 null，`summary` 可选，出现 `truncated` 时其 `reason` 说明截断原因）。
+`client.DataSources.ToolsInvoke`（`POST /monit/datasource/tools/invoke`，`monit-datasource-tools-invoke`）在某个已配置数据源上执行一个确定性工具：`tool` 名称由数据源类型前缀修饰（如 `mysql.overview`），`params` 为工具专属 JSON 参数（省略视为 `{}`，显式 `null` 非法）；除诊断工具外，入口支持 `<type>.query` 查询工具（`prometheus`、`mysql`、`postgres`、`oracle`、`clickhouse`、`elasticsearch`、`loki`、`victorialogs`、`sls`、`tencent_cls`），`/monit/query/data` 入口保持不变。该接口要求集群中所有在线可路由的 Edge 会话都支持 v0.71.0 基础调用协议（单个工具可能要求更新的实现），无工具目录、无自动重放、也不会回退到旧版 diagnose。请求体上限 128 KiB，完整成功响应上限 10 MiB，单工具超时至多 25 秒；响应为 `DatasourceToolResult`（`data` 为工具专属 JSON、永不为 null，`summary` 可选，出现 `truncated` 时其 `reason` 说明截断原因）。
 
 `client.DataSources` 的 `payload` 按 `type_ident` 选择类型专属配置块。当前允许的 `type_ident` 共 15 种：`prometheus`、`loki`、`mysql`、`oracle`、`postgres`、`clickhouse`、`elasticsearch`、`sls`、`tencent_cls`、`victorialogs`，以及新增的诊断专用类型 `redis_node`、`redis_sentinel`、`mongodb_mongod`、`mongodb_mongos`、`kafka`——诊断专用类型的 `alerting_enabled` 恒为 false（不阻止非告警查询与工具调用），且拒绝传 true。连接地址规则：Redis/MongoDB 诊断类型为单个 `host:port`（IPv6 需加方括号），不接受 URI、userinfo 或 query；`kafka` 为 1–32 个以逗号分隔、互不重复的 `host:port` bootstrap 地址（规范化后至多 4096 字符，`payload` 中不再有 broker 列表）；`mongodb_mongod` / `mongodb_mongos` 的配置块中 `auth_source` 默认为 `admin`，用户名与密码必须成对配置，不支持客户端证书；Redis 节点配置的 `database` 默认为 0。诊断类型的 `password` 与 Kafka 的 `tls_key` 等敏感字段支持 `${env:NAME}` 引用：响应中字面值会被省略（仅当存储值本身就是 `${env:...}` 引用时才回显），更新时省略这些字段即保留原值，显式传空字符串则清除。