@chengxianglibra/dsh-data-analysis 0.1.1 → 0.1.2

package/README.md

@@ -4,25 +4,29 @@
 
 DeepSeek Harness 的 Marivo 集成插件。当前包提供：
 
-- 精确 Marivo 0.5.3 共享 Runtime 与 zero-init per-Workspace binding；
+- 精确 Marivo 0.5.4 共享 Runtime 与 zero-init per-Workspace binding；
 - `marivo_help` 实时公共 Help transport；
+- 会话标题旁的“语义层”对象浏览器：Workspace 分类搜索、只读详情与局部关系图；
 - `marivo_datasource_test` 的 DSH Credentials 收集与显式 connection test；
-- `marivo_datasource_access` 的 30 分钟、最多 64 次 foreground Shell credential lease；
-- `marivo_evidence_sources({ session_id, sources })` 的可移植 Artifact-owned Finding 来源交付；
-- `emit_dataset(BaseFrame, ...)`、`emit_computed(DataFrame, ...)` 与
-  `emit_session_trace(SessionGraph, ...)` 的有界 JavaScript 投影；
-- 随包分发并挂载的 `dsh-data-analysis-report` Skill，以及 `marivo-analysis` 激活后的按需路由。
-
-旧 `marivo_test`、`marivo_report_render`、`ReportDocument`、报告 parser/renderer/publisher、专用报告 Web
-卡片与 replay 入口已删除，不提供 alias。
+- `marivo_python` 的本次执行准入与单次 resolver 凭证注入；
+- 会话标题旁的“数据源与凭证”管理、测试与缺失输入提交后的原调用续接；
+- `marivo_present({ draft_path })` 的一次文件提交、结果卡片、打开与离线 HTML 下载；
+- 唯一插件 Skill `dsh-data-analysis-presentation`，组织图表、表格、报告、看板与可读来源展示；
+- `dsh_data_analysis_presentation.write_dataset(frame, path)` 的 computed typed JSON writer；
+- 内部 Artifact/computed/source-only 数据投影，保存精确来源及 unavailable 状态。
+
+共享 reader、离线 builder、`marivo_present` 和展示 Skill 提供统一的展示交付；
+两个 Marivo Runtime Skill `marivo-analysis`、`marivo-semantic` 继续从当前 Runtime 挂载。
+旧 report-kit、report Skill、经典 JS 与 Evidence 卡协议不再分发。升级说明见
+[0.1.2 发布说明](../../docs/releases/0.1.2.md)。
 
 ## Compatibility
 
 包内 `dshDataAnalysisCompatibility` 是唯一运行时兼容声明：
 
 - DSH distribution 与所有必需 peer 精确使用 `0.1.1-rc.2`；
-- Marivo package spec 精确为 `marivo[duckdb,trino,clickhouse]==0.5.3`；
-- 项目自有 Runtime marker 为 `dsh-data-analysis-runtime/v2`；
+- Runtime 通过 pip 安装已发布的 Marivo 0.5.4；版本约束为 `marivo[duckdb,trino,clickhouse]==0.5.4`；
+- 项目自有 Runtime marker 为 `dsh-data-analysis-runtime/v3`；
 - 子进程策略为 `direct-argv-inherited-env-snapshot-overlay-v2`。
 
 管理员解释器的 `marivo.__version__` 与 package identity 必须精确匹配；不使用 capability/version matrix。
@@ -32,32 +36,57 @@ DeepSeek Harness 的 Marivo 集成插件。当前包提供：
 ```text
 marivo_help({ targets: string[] })
 marivo_datasource_test({ name: string })
-marivo_datasource_access({ name: string })
-marivo_evidence_sources({
-  session_id: string,
-  sources: Array<{ artifact_ref: string, finding_id: string }>
-})
+marivo_python({ code: string, datasources: string[] })
+marivo_present({ draft_path: string, report_id?: string, expected_build_id?: string })
 ```
 
 `marivo_datasource_test` 只拥有缺失 Credentials 的 DSH/Web 闭环和显式连接测试；
-`marivo_datasource_access` 只签发有界 foreground Shell lease，不执行连接测试。`md.inspect(...)`、
+`marivo_python` 在本次调用内等待全部数据源凭证就绪、核验身份并取得 fresh snapshot，再通过 DSH 前台
+执行服务与 Marivo 公开 resolver 启动一次代码。配置齐全时不额外测试；普通 Shell 不获得凭证。
+缺失输入时默认等待 Web 表单，提交测试成功后继续原调用；取消、轮换或 Workspace 变化终止旧准备，
+已启动代码失败不重放。无 Web 场景配置 `credentialInteraction: 'none'`，subagent 同样不等待表单。
+详见[凭证模块](../../docs/modules/datasource-credentials.md)。`md.inspect(...)`、
 Session recovery、Artifact revalidation、Quality、Evidence 读取、Session Graph 与 `to_pandas()` 都直接使用
 Marivo 公共 API，不增加 convenience Tool。
 
-## 报告交付
-
-仅当用户明确请求 HTML/Web 或耐久报告、接受生成提议，或修改已有 bundle 时，Agent 加载
-`dsh-data-analysis-report`；普通长回答或多图表/表格不会自动产出文件。已有分析恢复并 revalidate persisted
-Artifacts，不为报告展示重新执行 `observe`。
-该 Skill 只提供内容组织、布局、样式和检查原则，不包含页面 Starter、通用 chart helper、可视化 DSL 或
-HTML Checker。配套 assets 提供 `ReportData` 读取、精简 Artifact 摘要和 Session DAG；Python report-kit
-分别通过 `emit_dataset`、`emit_computed`、`emit_session_trace` 发射 Artifact、pandas DataFrame 与 Graph
-快照；Artifact 与 Graph emitter 默认 `reader`，明确审计请求才使用 `audit`。多 Session 的独立 Graph 集中展示，
-Frame preview 只按精确 Session 与 Artifact identity 关联。Agent 自由生成
-`<workspace>/<new-report-directory>/index.html` 与可选相对资源。Native/both 的
-最终入口使用顶层 DSH `write` / `edit`，并以精确 Markdown 行内路径交付，让 DSH Web 复用 Produced Files
-提供点击；Code-only 在 `run_code` 内使用同一 Tool，但嵌套 mutation 只保证精确路径。插件不创建报告对象、
-digest、不可变发布、历史字节 replay 或 share link。
+## 语义层对象浏览器
+
+点击 DSH 会话标题旁的“语义层”，默认查看该会话所属 Workspace，也可在面板内显式切换 Workspace。
+可按业务域和类型筛选，搜索名称、引用与业务定义，
+复制对象引用、查看定义位置，并在对象关系中逐层浏览。桌面采用三栏布局，窄屏支持列表与详情切换。
+
+页面不要求 live Agent，只读取 Marivo Catalog 元数据，不执行 `observe`、数据预览或连接测试。
+打开和手动刷新重新加载；读取失败时明确标注上次成功内容。数据源连接配置、凭证值与原始源码不展示。
+使用及验收边界见[模块说明](../../docs/modules/semantic-browser.md)。
+
+“数据源与凭证”位于同一会话标题旁，打开时同样使用该会话所属 Workspace，面板内保留 Workspace 选择。
+两个入口随 Harness 的会话标题显示，无会话或空会话时不显示，侧栏底部不保留入口。
+
+## 分析与展示
+
+普通事实问答使用文字。图表、表格、报告、看板和可读来源展示加载 `dsh-data-analysis-presentation`，
+按 Skill 编写 Workspace 相对 Draft，再调用 `marivo_present`。已有 Artifact 或 computed 数据无需先激活
+`marivo-analysis`；需要新分析或语义编写时，按需加载对应 Runtime Skill 与 live Help。
+Skill 只指导内容组织、声明来源和交付，不承担分析计算或来源有效性判断；布局由 reader 自适应。
+完整流程见[展示 Skill](../../docs/modules/presentation-skill.md)。
+
+Python helper 的可选 `labels={列名: 展示名}` 设置中文表头、图例和 tooltip，字段绑定仍使用原列名。
+Python helper 只接受 pandas DataFrame，写入 `schemaVersion: 1` 的 typed JSON；int64/Decimal 保留精确字符串，
+null 保留缺失含义，datetime 必须带时区。它不保存来源或转换代码；来源在展示 Draft 中声明。
+固定 projection 从同一 bound Workspace 恢复 persisted Artifact 和可选 Finding，不自动 observe、revalidate 或读取凭据。
+直接 Artifact dataset 缺必要数据会失败，computed 和 source-only 可以保留 unavailable 来源。
+
+共享 reader 展示 Markdown、metric、18 类 chart、table 和 source，保留精确值、单位、截断与 unavailable 来源。chart 支持 bar/line 变体与当前页面的字段、图形及过滤探索；统计量由分析阶段准备，探索不改写保存快照。
+`marivo_present` 读取 Workspace 相对 Draft 路径，生成不可变新 build 的 JSON/自包含 HTML。
+默认创建新 Report；修改已有报告时成对传入 `report_id` 与本次修改所基于的 `expected_build_id`，以完整 Draft 更新同一 Report。
+版本冲突时读取当前保存内容并合并需保留的编辑，不强行覆盖，也不回退新建。
+原卡片通过 reportId 打开最近保存结果；阅读器可编辑标题、正文、指标标签、图表和表格配置，以及移动／删除 cell（允许删空），支持撤销／重做和保存／取消。
+保存生成同报告的新 build，保留底层数据、来源和代码，不运行 Agent 或 Python。
+全部 18 种 chart 与同 dataset 的表格和数据预览共享临时筛选；筛选不重算指标、不标记编辑修改、不进入保存、下载或打印。
+文档、receipt 与 delivery 使用 schema v2，Draft 和 typed dataset 保持 v1；旧报告不读取、不迁移，旧文件保留。文本始终包含两份文件的位置、digest 和字节数，headless 也能取得交付物。
+展开来源仅使用保存的快照；文件变化、缺失或 Workspace 归属变化会明确失败。
+实现与验收见[展示数据投影](../../docs/modules/presentation-projection.md)、[展示 reader](../../docs/modules/presentation-reader.md)、
+[展示交付](../../docs/modules/presentation-delivery.md)。
 
 ## 验证
 
@@ -67,6 +96,26 @@ npm run build
 npm run verify:plugin-package
 ```
 
-当前架构与验收边界见仓库根目录的[总体架构](../../docs/architecture.md)、
-[插件能力优化设计](../../docs/plan/plugin-capability-optimization-design.md)和
-[v2 验收记录](../../docs/acceptance/plugin-capability-optimization-v2.md)。
+当前架构与验收边界见仓库根目录的[总体架构](../../docs/architecture.md)和
+[展示交付](../../docs/modules/presentation-delivery.md)。
+
+## 语义对象引用
+
+在 Web 输入框输入 `@` 选择当前 Workspace 的 Marivo 对象；多词检索使用 `@"monthly revenue"`。
+选中后显示完整 `kind:path`，提交只携带精确 ref。最近七个自然日热度保存在 DSH profile；候选缓存为 30 秒。
+对象有效性由执行时 Marivo Catalog 验证，删除对象不会被相似对象自动替换。
+
+
+## 草稿静态预检
+
+在 Workspace 根目录运行 `dsh-data-analysis-presentation-lint analysis/presentation.draft.json`，
+或通过 `--project-root PATH` 显式指定 Workspace。CLI 复用 present 的草稿与 TypedDataset 校验及文件边界，
+检查草稿结构和引用的 computed JSON；不启动 Runtime、不执行分析、不生成报告文件。
+输出 JSON 的 `ok` 仅表示这些静态检查通过；`deferredChecks` 列出仍由 `marivo_present` 完成的
+Artifact 可用性与数据、codeRefs、投影后文档与渲染检查。退出码为 0（通过）、1（校验失败）、2（参数错误）。
+草稿结构通过后逐份检查 computed 文件，每份保留首个错误，修正后可再次预检。
+
+int64 单元格必须是精确整数字符串，例如 `"42"`；JSON number `42` 也不接受。
+诊断保留 JSON pointer，并显示 `column query_count type=int64`、原因与修复建议。
+超过 JS 安全整数范围的 number 可能已舍入，不能转成字符串来恢复精度；应从原始精确数据重写，
+或使用绑定 Runtime 中的 `write_dataset`。预检通过不等于成功交付，仍需 present 的成功 receipt。

package/lib/bin/environment.js

@@ -7,7 +7,7 @@ import { environmentPayload } from "../environment/summary.js";
 function usage() {
     return `Usage: dsh-data-analysis-env [--project-root PATH] [--python PATH] [--runtime-root PATH] [--uv PATH]
 
-Ensures the shared pinned Marivo and report-kit Runtime, initializes the minimal
+Ensures the shared pinned Marivo and presentation-kit Runtime, initializes the minimal
 Workspace layout, and checks the exact interpreter, import identities, and doctor
 admission used by the DSH plugin. The JSON output contains no credentials or raw
 doctor details.

package/lib/bin/presentation-lint.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import process from 'node:process';
+import { lintPresentationDraft } from "../presentation/lint.js";
+const usage = 'Usage: dsh-data-analysis-presentation-lint DRAFT_PATH [--project-root PATH]\n';
+const args = process.argv.slice(2);
+if (args.length === 1 && (args[0] === '--help' || args[0] === '-h')) {
+    process.stdout.write(usage);
+}
+else if ((args.length !== 1 && args.length !== 3) ||
+    !args[0] ||
+    args[0].startsWith('-') ||
+    (args.length === 3 && (args[1] !== '--project-root' || !args[2]))) {
+    process.stderr.write(usage);
+    process.exitCode = 2;
+}
+else {
+    const result = await lintPresentationDraft(path.resolve(args[2] ?? process.cwd()), args[0]);
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    process.exitCode = result.ok ? 0 : 1;
+}

package/lib/bridges.js

@@ -1,11 +1,11 @@
 import { MarivoDatasourceBridge } from "./datasource/bridge.js";
 import { MarivoHelpBridge } from "./disclosure/bridge.js";
-import { MarivoEvidenceBridge } from "./evidence/bridge.js";
+import { MarivoPresentationProjection } from "./presentation/projection/index.js";
 /** Compose domain adapters without adding domain methods back to the Environment. */
 export function createMarivoBridgeSet(environment) {
     return Object.freeze({
         help: new MarivoHelpBridge(environment),
         datasource: new MarivoDatasourceBridge(environment),
-        evidence: new MarivoEvidenceBridge(environment),
+        presentation: new MarivoPresentationProjection(environment),
     });
 }

package/lib/client/credentials/create-datasource.js

@@ -0,0 +1,67 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// @ts-nocheck -- JSX is bundled by the plugin client build.
+import { useEffect, useState } from 'react';
+export function CreateDatasource({ model, workspaceId, close }) {
+    const [schema, setSchema] = useState(null);
+    const [backend, setBackend] = useState('');
+    const [values, setValues] = useState({});
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState('');
+    useEffect(() => {
+        const controller = new AbortController();
+        model
+            .authoring(workspaceId, controller.signal)
+            .then((value) => {
+            if (controller.signal.aborted)
+                return;
+            setSchema(value);
+            setBackend(value.backends[0]?.name ?? '');
+        })
+            .catch((error) => {
+            if (!controller.signal.aborted)
+                setError(error.message);
+        });
+        return () => controller.abort();
+    }, [model, workspaceId]);
+    const fields = schema?.backends.find((item) => item.name === backend)?.fields ?? [];
+    async function submit(event) {
+        event.preventDefault();
+        if (busy)
+            return;
+        setError('');
+        const input = {};
+        try {
+            for (const field of fields) {
+                const value = values[field.name];
+                if (value === undefined || value === '')
+                    continue;
+                input[field.name] = field.type === 'string' ? value : JSON.parse(value);
+            }
+        }
+        catch {
+            setError('请检查数字、布尔值或 JSON 字段的格式。');
+            return;
+        }
+        setBusy(true);
+        try {
+            await model.createDatasource(workspaceId, schema, { backend, fields: input });
+            close();
+        }
+        catch (error) {
+            setError(error.message);
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    return (_jsxs("form", { className: "mc-form", "aria-label": "\u65B0\u589E\u6570\u636E\u6E90", onSubmit: submit, children: [_jsxs("div", { className: "mc-form-body", children: [_jsx("div", { className: "mc-detail-heading", children: _jsx("h3", { children: "\u65B0\u589E\u6570\u636E\u6E90" }) }), error && (_jsx("p", { role: "alert", className: "mc-result", "data-tone": "error", children: error })), !schema && !error && _jsx("p", { role: "status", children: "\u6B63\u5728\u8BFB\u53D6\u6570\u636E\u6E90\u914D\u7F6E\u5B57\u6BB5\u2026" }), schema && (_jsxs("fieldset", { className: "mc-field", disabled: busy, children: [_jsxs("label", { className: "mc-secret-input", children: ["\u5F15\u64CE", _jsx("select", { "aria-label": "\u5F15\u64CE", value: backend, onChange: (event) => {
+                                            setBackend(event.target.value);
+                                            setValues({});
+                                            setError('');
+                                        }, children: schema.backends.map((item) => (_jsx("option", { value: item.name, children: item.name }, item.name))) })] }), fields.map((field) => (_jsxs("label", { className: "mc-secret-input", htmlFor: `mc-create-${field.name}`, children: [_jsxs("span", { className: "mc-input-heading", children: [_jsxs("span", { className: "mc-input-name", children: [field.name, field.name.endsWith('_env') ? '（凭证引用名）' : '', field.required ? ' *' : ''] }), (field.description || field.name.endsWith('_env')) && (_jsxs("span", { className: "mc-input-description", children: [field.description, field.name.endsWith('_env') &&
+                                                        ' 填写引用名，如 MY_DB_PASSWORD；仅使用字母、数字和下划线，不能以数字开头。实际用户名或密码请在创建后的“新增凭证”中填写。'] }))] }), field.type === 'boolean' ? (_jsxs("select", { id: `mc-create-${field.name}`, "aria-label": field.name, value: values[field.name] ?? '', onChange: (event) => setValues({ ...values, [field.name]: event.target.value }), children: [_jsxs("option", { value: "", children: ["\u9ED8\u8BA4", field.default == null ? '' : ` (${field.default})`] }), _jsx("option", { value: "true", children: "true" }), _jsx("option", { value: "false", children: "false" })] })) : (_jsx("input", { id: `mc-create-${field.name}`, "aria-label": field.name, required: field.required, autoComplete: "off", type: field.type === 'number' ? 'number' : 'text', placeholder: field.default == null
+                                            ? field.type === 'json'
+                                                ? 'JSON'
+                                                : ''
+                                            : String(field.default), value: values[field.name] ?? '', onChange: (event) => setValues({ ...values, [field.name]: event.target.value }) }))] }, field.name)))] }))] }), _jsxs("div", { className: "mc-form-footer", children: [_jsx("button", { className: "mc-primary", type: "submit", disabled: !backend || busy, children: busy ? '正在新增…' : '确认新增数据源' }), _jsx("button", { type: "button", onClick: close, disabled: busy, children: "\u53D6\u6D88" })] })] }));
+}

package/lib/client/credentials/install.js

@@ -0,0 +1,191 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useRef, useState, useSyncExternalStore } from 'react';
+import { WorkspaceHeaderAction } from "../workspace-header-action.js";
+import { CreateDatasource } from "./create-datasource.js";
+import { CredentialClientModel, credentialMessage } from "./model.js";
+import { credentialStyles } from "./styles.js";
+const statusLabels = {
+    'awaiting-input': '等待填写',
+    executing: '正在保存或验证',
+    'awaiting-decision': '连接验证失败，等待处理',
+    succeeded: '验证完成，原调用继续',
+    'handed-off': '已交给助手排查',
+    'call-ended': '原调用已结束',
+    'context-changed': '上下文已变化',
+};
+function Icon({ name, size = 18 }) {
+    return (_jsxs("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.6", strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": "true", children: [name === 'database' && (_jsxs(_Fragment, { children: [_jsx("ellipse", { cx: "12", cy: "5", rx: "8", ry: "3" }), _jsx("path", { d: "M4 5v14c0 4 16 4 16 0V5M4 12c0 4 16 4 16 0" })] })), name === 'lock' && (_jsxs(_Fragment, { children: [_jsx("rect", { x: "4", y: "10", width: "16", height: "11", rx: "2" }), _jsx("path", { d: "M8 10V7a4 4 0 0 1 8 0v3m-4 5v2" })] })), name === 'close' && _jsx("path", { d: "m6 6 12 12M6 18 18 6" }), name === 'refresh' && (_jsx("path", { d: "M20 7v5h-5M4 17v-5h5M6.1 6a8 8 0 0 1 13.4 3M4.5 15a8 8 0 0 0 13.4 3" })), name === 'check' && _jsx("path", { d: "m5 12 4 4L19 6" }), name === 'info' && (_jsxs(_Fragment, { children: [_jsx("circle", { cx: "12", cy: "12", r: "9" }), _jsx("path", { d: "M12 11v6m0-10v.01" })] }))] }));
+}
+function TestResult({ result, stale = false }) {
+    if (!result)
+        return null;
+    return (_jsxs("div", { className: "mc-result", "data-tone": stale ? 'stale' : result.ok ? 'success' : 'error', role: "status", children: [_jsxs("div", { className: "mc-result-title", children: [_jsx(Icon, { name: stale || !result.ok ? 'info' : 'check', size: 16 }), stale ? '配置已变化，请重新测试' : result.ok ? '连接测试成功' : '连接测试失败'] }), !result.ok && !stale && (_jsxs(_Fragment, { children: [_jsx("p", { children: result.failure?.message }), result.repair?.action && _jsx("p", { children: result.repair.action }), result.failure?.code && (_jsxs("details", { children: [_jsx("summary", { children: "\u67E5\u770B\u9519\u8BEF\u4EE3\u7801" }), _jsx("pre", { children: result.failure.code })] }))] }))] }));
+}
+function OperationOutcome({ entry }) {
+    if (!entry)
+        return null;
+    const operation = entry.operation;
+    const errors = operation?.errors ?? [];
+    const unsuccessful = entry.error ||
+        operation?.status === 'cancelled' ||
+        operation?.status === 'failed' ||
+        operation?.result?.ok === false;
+    if (!unsuccessful && operation?.action !== 'delete')
+        return null;
+    return (_jsxs("div", { className: "mc-operation-note", "data-error": Boolean(entry.error || errors.length), role: "status", children: [entry.error && _jsx("p", { children: entry.error }), operation?.status === 'cancelled' && _jsx("p", { children: "\u672C\u6B21\u64CD\u4F5C\u5DF2\u53D6\u6D88\u3002" }), operation?.status === 'succeeded' && operation.action === 'delete' && (_jsx("p", { children: "\u5DF2\u5220\u9664\u4FDD\u5B58\u503C\uFF0C\u5F53\u524D\u914D\u7F6E\u72B6\u6001\u5DF2\u66F4\u65B0\u3002" })), errors.length > 0 && _jsx("p", { children: errors.map(credentialMessage).join(' ') }), operation?.status === 'failed' && errors.length === 0 && !operation.result && (_jsx("p", { children: "\u64CD\u4F5C\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5\u3002" })), unsuccessful && operation?.saved.length > 0 && _jsxs("p", { children: ["\u5DF2\u4FDD\u5B58\uFF1A", operation.saved.join('、'), "\u3002"] })] }));
+}
+function DatasourceProperties({ context }) {
+    const properties = Object.entries(context.properties ?? {});
+    return (_jsxs("section", { className: "mc-properties", "aria-label": "\u6570\u636E\u6E90\u5C5E\u6027", children: [_jsx("h4", { className: "mc-section-heading", children: "\u6570\u636E\u6E90\u5C5E\u6027" }), _jsxs("dl", { className: "mc-property-list", children: [_jsxs("div", { className: "mc-property", children: [_jsx("dt", { children: "\u5F15\u64CE" }), _jsx("dd", { children: context.backend || '未提供' })] }), properties.map(([field, value]) => (_jsxs("div", { className: "mc-property", children: [_jsx("dt", { children: field }), _jsx("dd", { children: value !== null && typeof value === 'object' ? (_jsx("section", { className: "mc-property-json", tabIndex: 0, "aria-label": `${field} 配置值`, children: _jsx("pre", { children: JSON.stringify(value, null, 2) }) })) : (_jsx("span", { children: typeof value === 'string' && value !== '' ? value : JSON.stringify(value) })) })] }, field)))] })] }));
+}
+function CredentialForm({ context, request, state, model, workspaceId }) {
+    const [values, setValues] = useState({});
+    const [editing, setEditing] = useState({});
+    const [deleting, setDeleting] = useState('');
+    const busy = request?.status === 'executing' ||
+        state.operations.some((entry) => entry.handle.scope === context.token);
+    const ended = request?.endedAt !== undefined;
+    const configured = context.refs.filter((ref) => context.credentials[ref]?.configured).length;
+    const ready = configured === context.refs.length;
+    const outcome = state.outcomes[context.token];
+    const latestTest = !outcome?.overviewUpdated && outcome?.operation?.result
+        ? { result: outcome.operation.result, at: outcome.operation.endedAt, stale: false }
+        : context.lastTest;
+    const latestResult = request?.failure ?? latestTest?.result;
+    // biome-ignore lint/correctness/useExhaustiveDependencies: Identity or credential revision changes must discard unsubmitted secrets.
+    useEffect(() => {
+        setValues({});
+        setEditing({});
+        setDeleting('');
+    }, [context.token, context.version]);
+    const saveReference = (ref) => {
+        const changes = { [ref]: values[ref] };
+        setValues({ ...values, [ref]: '' });
+        setEditing({ ...editing, [ref]: false });
+        void model.start(context, 'save', changes);
+    };
+    const submit = () => {
+        const changes = Object.fromEntries(Object.entries(values).filter(([, value]) => value !== ''));
+        setValues({});
+        setEditing({});
+        void model.start(context, request ? 'submit' : 'update', changes);
+    };
+    return (_jsxs("section", { className: "mc-form", "aria-label": `${context.name} 凭证配置`, children: [_jsxs("div", { className: "mc-form-body", children: [_jsxs("div", { className: "mc-detail-heading", children: [_jsxs("div", { children: [_jsx("p", { className: "mc-eyebrow", children: "\u6570\u636E\u6E90\u914D\u7F6E" }), _jsx("h3", { children: context.name })] }), _jsxs("span", { className: "mc-badge", "data-ready": ready, children: [ready && _jsx(Icon, { name: "check", size: 13 }), context.refs.length === 0
+                                        ? '无需凭证'
+                                        : ready
+                                            ? '凭证已配齐'
+                                            : `${configured} / ${context.refs.length} 项已配置`] })] }), request && (_jsxs("div", { className: "mc-request-status", role: "status", children: [_jsx("strong", { children: statusLabels[request.status] }), !ended && _jsx("p", { children: "\u9A8C\u8BC1\u6210\u529F\u540E\u7EE7\u7EED\u5F53\u524D\u4EFB\u52A1\u3002" }), (request.status === 'call-ended' || request.status === 'context-changed') && (_jsx("p", { children: "\u8BF7\u91CD\u65B0\u53D1\u8D77\u4EFB\u52A1\u3002" }))] })), _jsx(DatasourceProperties, { context: context }), _jsx("h4", { className: "mc-section-heading", children: "\u51ED\u8BC1" }), context.refs.length === 0 && (_jsx("p", { className: "mc-note", children: "\u8BE5\u6570\u636E\u6E90\u6CA1\u6709\u51ED\u8BC1\u5F15\u7528\uFF0C\u53EF\u76F4\u63A5\u6D4B\u8BD5\u8FDE\u63A5\u3002" })), context.refs.length > 0 && (_jsx("div", { className: "mc-fields", children: context.refs.map((ref) => {
+                            const info = context.credentials[ref];
+                            const shared = state.datasources
+                                .filter((item) => item.refs.includes(ref))
+                                .map((item) => item.name);
+                            return (_jsxs("fieldset", { className: "mc-field", disabled: busy || ended, "aria-label": ref, children: [_jsxs("div", { className: "mc-field-header", children: [_jsxs("div", { className: "mc-field-title", children: [_jsx("h4", { children: ref }), _jsxs("p", { children: ["\u5B57\u6BB5\uFF1A", Object.entries(context.fields)
+                                                                .filter(([, value]) => value === ref)
+                                                                .map(([field]) => field)
+                                                                .join('、'), ' ', "\u00B7 \u6765\u6E90\uFF1A", info?.source ?? '无', !info?.writable && ' · 来源只读'] })] }), _jsxs("div", { className: "mc-field-actions", children: [_jsx("span", { className: "mc-badge", "data-ready": Boolean(info?.configured), children: info?.configured ? '已配置' : '未配置' }), info?.writable && info.configured && !editing[ref] && (_jsx("button", { type: "button", onClick: () => setEditing({ ...editing, [ref]: true }), children: "\u66F4\u6362" })), info?.writable && info.configured && editing[ref] && (_jsx("button", { type: "button", onClick: () => {
+                                                            setValues({ ...values, [ref]: '' });
+                                                            setEditing({ ...editing, [ref]: false });
+                                                        }, children: "\u53D6\u6D88\u66F4\u6362" })), info?.writable && !request && info.configured && (_jsx("button", { className: "mc-quiet", type: "button", onClick: () => setDeleting(ref), children: "\u5220\u9664\u5DF2\u4FDD\u5B58\u503C" }))] })] }), info?.writable && (!info.configured || editing[ref]) && (_jsxs("label", { className: "mc-secret-input", children: ["\u65B0\u503C", _jsx("input", { type: "password", autoComplete: "new-password", placeholder: "\u8F93\u5165\u51ED\u8BC1\u503C", value: values[ref] ?? '', onChange: (event) => setValues({ ...values, [ref]: event.target.value }) }), !request && (_jsx("button", { type: "button", className: "mc-primary", disabled: !values[ref], onClick: () => saveReference(ref), children: info.configured ? '确认更换' : '新增凭证' }))] })), shared.length > 1 && (_jsxs("p", { className: "mc-field-note", children: ["\u4E0E ", shared.filter((name) => name !== context.name).join('、'), " \u5171\u4EAB\u6B64\u5F15\u7528"] })), deleting === ref && (_jsxs("div", { className: "mc-confirm", children: [_jsxs("p", { children: ["\u786E\u8BA4\u5220\u9664 ", ref, " \u7684\u5DF2\u4FDD\u5B58\u503C\uFF1F"] }), _jsx("button", { className: "mc-danger", type: "button", onClick: () => {
+                                                    setDeleting('');
+                                                    void model.start(context, 'delete', {}, ref);
+                                                }, children: "\u786E\u8BA4\u5220\u9664\u5DF2\u4FDD\u5B58\u503C" }), _jsx("button", { type: "button", onClick: () => setDeleting(''), children: "\u4FDD\u7559" })] }))] }, ref));
+                        }) })), _jsxs("div", { className: "mc-test", children: [_jsxs("div", { className: "mc-test-heading", children: [_jsx("h4", { children: "\u8FDE\u63A5\u72B6\u6001" }), latestTest?.at !== undefined && (_jsxs("time", { dateTime: new Date(latestTest.at).toISOString(), children: ["\u4E0A\u6B21\u6D4B\u8BD5\uFF1A", new Date(latestTest.at).toLocaleString()] }))] }), latestResult ? (_jsx(TestResult, { result: latestResult, stale: !request?.failure && latestTest?.stale })) : (_jsx("p", { className: "mc-empty-test", children: "\u5C1A\u672A\u6D4B\u8BD5\u8FDE\u63A5\u3002" })), _jsx(OperationOutcome, { entry: outcome })] })] }), !ended && (_jsxs("div", { className: "mc-form-footer", children: [request && (_jsx("button", { className: "mc-primary", type: "button", disabled: busy, onClick: submit, children: "\u63D0\u4EA4\u51ED\u8BC1\u5E76\u7EE7\u7EED" })), _jsx("button", { type: "button", disabled: busy, onClick: () => void model.start(context, request ? 'submit' : 'test'), children: request ? '使用已有配置验证并继续' : '测试连接' }), request?.failure && (_jsx("button", { type: "button", disabled: busy, onClick: () => void model.start(context, 'diagnose'), children: "\u4EA4\u7ED9\u52A9\u624B\u6392\u67E5" })), request ? (_jsx("button", { className: "mc-quiet mc-cancel", type: "button", onClick: () => void model.cancelRequest(request.id), children: "\u53D6\u6D88\u672C\u8F6E" })) : (busy && (_jsx("button", { className: "mc-quiet mc-cancel", type: "button", onClick: () => void model.cancelOperation(context.token), children: "\u53D6\u6D88\u64CD\u4F5C" })))] })), ended && (_jsxs("div", { className: "mc-form-footer", children: [_jsx("button", { type: "button", onClick: () => model.show(workspaceId), children: "\u8FD4\u56DE\u6570\u636E\u6E90\u7BA1\u7406" }), _jsx("button", { className: "mc-quiet", type: "button", onClick: () => model.close(), children: "\u5B8C\u6210" })] }))] }));
+}
+function CredentialPanel({ model, workspaces }) {
+    const state = useSyncExternalStore(model.subscribe, model.getSnapshot);
+    const dialog = useRef(null);
+    const columns = useRef(null);
+    const main = useRef(null);
+    const [creating, setCreating] = useState(false);
+    // biome-ignore lint/correctness/useExhaustiveDependencies: Switching context discards the creation form.
+    useEffect(() => setCreating(false), [state.open, state.workspaceId, state.requestId]);
+    useEffect(() => {
+        if (state.open)
+            dialog.current?.showModal();
+        else
+            dialog.current?.close();
+    }, [state.open]);
+    const request = state.requests.find((item) => item.id === state.requestId);
+    const pending = state.requests.filter((item) => item.endedAt === undefined && item.sessionId === state.sessionId);
+    const context = request?.context ?? state.datasources.find((item) => item.token === state.selected);
+    // biome-ignore lint/correctness/useExhaustiveDependencies: A different detail or creation page starts at the top of its content.
+    useEffect(() => {
+        if (main.current)
+            main.current.scrollTop = 0;
+        if (columns.current)
+            columns.current.scrollTop = 0;
+    }, [creating, context?.token]);
+    const workspaceId = request
+        ? (workspaces.find((item) => item.sessionIds.includes(request.sessionId))?.workspaceId ?? '')
+        : state.workspaceId;
+    const datasources = request ? [request.context] : state.datasources;
+    const operations = state.operations.filter((entry) => entry.workspaceId === workspaceId);
+    const activeOperation = operations.find((entry) => entry.handle.id === state.handle?.id)?.operation;
+    if (!state.open)
+        return null;
+    return (_jsxs("dialog", { ref: dialog, className: "mc-dialog", onCancel: (event) => {
+            event.preventDefault();
+            model.close();
+        }, "aria-labelledby": "marivo-credentials-title", children: [_jsx("style", { children: credentialStyles }), _jsxs("div", { className: "mc-shell", children: [_jsxs("header", { className: "mc-header", children: [_jsx("div", { className: "mc-header-mark", children: _jsx(Icon, { name: "lock", size: 22 }) }), _jsxs("div", { className: "mc-header-copy", children: [_jsx("h2", { id: "marivo-credentials-title", children: "\u6570\u636E\u6E90\u4E0E\u51ED\u8BC1" }), _jsx("p", { children: "\u914D\u7F6E\u8BBF\u95EE\u51ED\u8BC1\uFF0C\u6D4B\u8BD5\u6570\u636E\u6E90\u8FDE\u63A5\u3002" })] }), _jsx("button", { className: "mc-close", type: "button", "aria-label": "\u6536\u8D77", title: "\u6536\u8D77", onClick: () => model.close(), children: _jsx(Icon, { name: "close", size: 20 }) })] }), pending.length > 0 && (_jsxs("div", { className: "mc-requests", children: [_jsx("span", { children: "\u672C\u4F1A\u8BDD\u5F85\u529E" }), pending.map((item) => (_jsxs("button", { type: "button", onClick: () => model.openRequest(item.id), children: [item.context.name, " \u00B7 ", statusLabels[item.status]] }, item.id))), request && (_jsx("button", { className: "mc-quiet", type: "button", onClick: () => model.show(workspaceId), children: "\u6570\u636E\u6E90\u7BA1\u7406" }))] })), _jsxs("div", { className: "mc-columns", ref: columns, children: [_jsxs("aside", { className: "mc-nav", "aria-label": "\u6570\u636E\u6E90\u5BFC\u822A", children: [!request && (_jsx("button", { type: "button", disabled: !workspaceId || state.loading, onClick: () => setCreating(true), children: "\u65B0\u589E\u6570\u636E\u6E90" })), _jsxs("div", { children: [_jsxs("div", { className: "mc-nav-heading", children: [_jsx("h3", { children: request ? '请求的数据源' : `数据源 · ${datasources.length}` }), _jsx("button", { className: "mc-quiet", type: "button", "aria-label": "\u5237\u65B0\u72B6\u6001", title: "\u5237\u65B0\u72B6\u6001", disabled: state.loading || !workspaceId, onClick: () => void model.selectWorkspace(workspaceId), children: _jsx(Icon, { name: "refresh", size: 16 }) })] }), _jsx("ul", { className: "mc-datasources", children: datasources.map((item) => {
+                                                    const count = item.refs.filter((ref) => item.credentials[ref]?.configured).length;
+                                                    const ready = count === item.refs.length;
+                                                    const running = state.operations.some((entry) => entry.handle.scope === item.token);
+                                                    return (_jsx("li", { children: _jsxs("button", { className: "mc-datasource", type: "button", "aria-label": `选择数据源 ${item.name}`, "aria-pressed": context?.token === item.token, onClick: () => {
+                                                                if (request)
+                                                                    model.openRequest(request.id);
+                                                                else {
+                                                                    setCreating(false);
+                                                                    model.select(item.token);
+                                                                }
+                                                            }, children: [_jsx(Icon, { name: "database" }), _jsxs("span", { className: "mc-datasource-copy", children: [_jsx("span", { className: "mc-datasource-name", children: item.name }), _jsxs("span", { className: "mc-datasource-status", children: [_jsx("span", { className: "mc-dot", "data-ready": ready }), running
+                                                                                    ? '正在处理…'
+                                                                                    : item.refs.length === 0
+                                                                                        ? '无需凭证'
+                                                                                        : ready
+                                                                                            ? '凭证已配齐'
+                                                                                            : `${count} / ${item.refs.length} 项已配置`] })] })] }) }, item.token));
+                                                }) })] })] }), _jsxs("main", { className: "mc-main", ref: main, children: [state.error && (_jsx("p", { role: "alert", className: "mc-alert", children: state.error })), state.loading && (_jsx("p", { className: "mc-loading", role: "status", children: "\u6B63\u5728\u8BFB\u53D6\u6570\u636E\u6E90\u4E0E\u51ED\u8BC1\u72B6\u6001\u2026" })), !creating && !state.loading && !context && !state.error && (_jsxs("div", { className: "mc-empty", children: [_jsx(Icon, { name: "database", size: 32 }), _jsx("h3", { children: !state.workspaceId
+                                                    ? '当前会话未绑定 Workspace'
+                                                    : state.datasources.length === 0
+                                                        ? '暂无数据源'
+                                                        : '选择一个数据源' }), _jsx("p", { children: !state.workspaceId
+                                                    ? '请返回会话后重试。'
+                                                    : state.datasources.length === 0
+                                                        ? '该 Workspace 没有已定义的数据源。'
+                                                        : '查看凭证配置与最近一次连接测试。' })] })), creating && (_jsx(CreateDatasource, { model: model, workspaceId: workspaceId, close: () => setCreating(false) }, workspaceId)), !creating && context && (_jsx(CredentialForm, { context: context, request: request, state: state, model: model, workspaceId: workspaceId }, context.token)), operations.length > 0 && (_jsxs("section", { className: "mc-activity", "aria-label": "\u8FDB\u884C\u4E2D\u7684\u51ED\u8BC1\u64CD\u4F5C", children: [_jsxs("p", { className: "mc-activity-heading", children: ["\u8FDB\u884C\u4E2D \u00B7 ", operations.length] }), _jsx("div", { className: "mc-activity-list", children: operations.map((entry) => (_jsxs("button", { type: "button", "aria-pressed": state.handle?.id === entry.handle.id, onClick: () => model.selectOperation(entry.handle.id), children: [entry.name, " \u00B7 \u5904\u7406\u4E2D"] }, entry.handle.id))) }), activeOperation?.status === 'running' && (_jsxs("div", { className: "mc-progress", children: [_jsxs("p", { children: [state.operations.find((entry) => entry.handle.id === state.handle?.id)?.name, ' ', "\u00B7 ", activeOperation.phase === 'saving' ? '正在保存' : '正在验证连接'] }), _jsx("button", { type: "button", onClick: () => void model.cancelOperation(), children: "\u53D6\u6D88\u6B64\u64CD\u4F5C" }), activeOperation.saved.length > 0 && (_jsxs("p", { children: ["\u5DF2\u4FDD\u5B58\uFF1A", activeOperation.saved.join('、'), "\u3002"] }))] }))] }))] })] })] })] }));
+}
+export function installCredentials(ctx, rpc) {
+    let storage;
+    try {
+        storage = window.sessionStorage;
+    }
+    catch {
+        /* optional query-handle persistence */
+    }
+    const model = new CredentialClientModel(rpc, storage);
+    model.recover();
+    ctx.effect(() => () => model.dispose(), 'dsh-data-analysis: credential client lifecycle');
+    ctx.on('connection/reset', () => model.reset());
+    ctx.slots.inject('conversation.session.header.actions', () => ctx.slots.register({ name: 'conversation.session.header.actions', id: 'marivo-credentials', order: 100 }, function Entry({ sessionId, useWorkspaces }) {
+        const workspaces = useWorkspaces((state) => state.items);
+        const selected = workspaces.find((item) => item.sessionIds.includes(sessionId))?.workspaceId ?? '';
+        return (_jsx(WorkspaceHeaderAction, { label: "\u6570\u636E\u6E90\u4E0E\u51ED\u8BC1", icon: "credentials", disabled: !selected, title: selected ? '数据源与凭证' : '当前会话未绑定工作区，无法打开数据源与凭证', onClick: () => {
+                if (selected)
+                    model.show(selected);
+            } }));
+    }));
+    ctx.slots.inject('conversation.session.header.actions', () => ctx.slots.register({ name: 'conversation.session.header.actions', id: 'marivo-credential-requests', order: 120 }, function Pending({ sessionId }) {
+        const state = useSyncExternalStore(model.subscribe, model.getSnapshot);
+        const request = state.requests.find((item) => item.sessionId === sessionId && item.endedAt === undefined);
+        return request ? (_jsx("button", { className: "mc-pending-entry", type: "button", onClick: () => model.openRequest(request.id), children: "\u7B49\u5F85\u914D\u7F6E\u51ED\u8BC1" })) : null;
+    }));
+    ctx.slots.inject('shell.overlay', () => ctx.slots.register({ name: 'shell.overlay', id: 'marivo-credentials' }, function Overlay({ useSessions, useWorkspaces }) {
+        const sessionId = useSessions((state) => state.current) ?? '';
+        const workspaces = useWorkspaces((state) => state.items);
+        const currentWorkspace = workspaces.find((item) => item.sessionIds.includes(sessionId))?.workspaceId ?? '';
+        useEffect(() => model.session(sessionId), [sessionId]);
+        // biome-ignore lint/correctness/useExhaustiveDependencies: Workspace reassignment must dismiss old content.
+        useEffect(() => model.close(), [currentWorkspace]);
+        return _jsx(CredentialPanel, { model: model, workspaces: workspaces });
+    }));
+}